KR20090114818A - Managing System and Method of Identity Information - Google Patents

Abstract

PURPOSE: An ID management system and method is provided to integrated-manage the personal information of all users online without separately building the personal information by SP(Service Provider). CONSTITUTION: An SP manager(107) collects, stores, and manages the SP related information. A user manager(109) issues an ID and password to a legal user who connects through the user terminal. The user manager receives the personal information and stores the received personal information. An authenticating unit(111) confirms whether the user who requests a join is legal or not. A card issuing unit(115) offers the online card list. When the user selects the online card, the online card is issued.

Description

Managing system and method of identity information

The present invention relates to an identity information management system and method, and more particularly to an identity management system and method for securely managing personal information necessary for personal identification online.

Unlike the offline world, the online world can guarantee anonymity for users who want to use the content. Instead, this anonymity can cause a number of social problems. In order to solve this problem, service providers on the Internet collect personal information from users who want to use the service to manage as a member.

In addition, online service providers are increasing the rate of attracting customers by providing differentiated services to users who subscribe as members and using them to generate advertising revenue. Therefore, users should register as a member of the online service provider in order to use a higher quality service, and for this purpose, their personal information should be disclosed to the service provider.

By the way, such personal information includes almost all the personal information of the individual such as the user's real name, social security number, ID, password, address, phone number, email address. Therefore, if the service provider abuses such personal information or if the personal information management device of the service server is hacked, the personal information is indiscriminately leaked, causing mental and financial damage to the user.

In addition, since the online service is operated by the membership system, the user has the disadvantage of having to register as a member and anxiety due to membership even when a user wants to read a simple post.

Accordingly, in order to protect such personal information, a single sign-on (SSO) scheme has been introduced to integrate and manage personal information of a related service provider site (family site). In the SSO method, personal information management and authentication for multiple service providers are performed on one server. When a user performs a membership registration process on a specific server, the service provided by the site registered as a family on the server is separately provided. Can be used without registering.

Similarly, services for integrated management and authentication of personal information, such as Open ID and Cardspace, in a specific server are spreading. In addition, the server that integrates and manages personal information strengthens the security policy for personal information so that users can provide their own information without anxiety.

However, the current personal information integrated management server must collect the information of each site registered as itself and the family, the user information to be registered as a member to each site, and manage such that the security of such information is maintained, There is a problem that a lot of costs are required to build, manage, maintain, and maintain the database.

In addition, since there are also a plurality of integrated personal information management server that manages a plurality of sites as a family, in order to use a service of a site that is not registered in the same family, a user may add his or her personal information to another integrated personal information management server. You can't get rid of the discomfort and anxiety you have to provide.

In addition, with the development of information technology, as security technology for personal information is developed, hacking technology for this is also being developed. Therefore, each integrated management server should immediately reflect the security technology and the hacking technology and its anti-hacking technology, which is reflected in the security policy, technology, personnel, capital, etc. are required for this.

The present invention has been made to solve the above problems and disadvantages, there is a technical problem to provide an ID management system and method that can prevent all personal information is abused by integrated management of online personal information.

Another technical problem of the present invention is to issue a plurality of online cards according to the type of service to be used and to select an appropriate online card according to the type of service to be used when registering a user to the ID management system, thereby allowing the user to select a service. It is to provide an ID management system and method that can differentiate and provide personal information.

Another technical problem of the present invention is that a plurality of ID management systems are linked to a task based on authorized authentication, even if a user who wants to use the online service provides personal information only to any one ID management system, only by a simple procedure. It is to reduce the inconvenience of the user by allowing the user to register or log in to the SP server connected to the ID management system.

An ID management system according to an embodiment of the present invention for achieving the above technical problem is an ID management system connected to a plurality of service provider servers (SP servers) and a plurality of user terminals through a communication network, the identifier of the SP server An SP management unit for collecting, storing, and managing SP related information including a service type; A user manager for issuing IDs and passwords to legitimate users connected through the user terminal and receiving and storing personal information; An authentication unit which checks whether the user who requested membership through the user terminal or the SP server is legal and performs a login procedure if legal; A card issuing unit for providing a list of online cards that can be issued to a user who has requested membership through the user terminal and issuing an online card as the user selects the online card; And an authentication token generator for generating an authentication token as the login procedure is completed by the authentication unit, wherein the authentication unit asks an authorized certification authority for the legality of membership of the user. It includes an accredited certification support certification unit that authenticates users according to the legality information provided by the certification authority.

On the other hand, the ID management method according to an embodiment of the present invention is an ID management method in an ID management system connected to a plurality of user terminals via a communication network, comprising: a first step of connecting to a user terminal; A second step of authenticating whether a user connected through the user terminal is legitimate; A third step of requesting the electronic signature information of the user provided in the second step to an authorized certification authority to authenticate the legitimacy of the user's membership or login; A fourth step of transmitting to the user terminal a list of online cards that can be issued if the user is a legitimate user as a result of the checking of the third step; A fifth step of receiving and storing personal information from the user terminal as the user selects at least one online card; And a sixth step of transmitting online card issuance information to the user terminal.

In addition, the ID management method according to another embodiment of the present invention is an ID management method in an ID management system that is connected to a plurality of service provider servers (SP servers) and a plurality of user terminals through a communication network. As the user who receives the online card accesses the SP server through the user terminal to request a login and submits the online card, the first ID management system receives an online card type and a login processing request message selected by the user from the SP server. Receiving a first step; A second step of the first ID management system accessing the user terminal requesting the login and performing authentication; A third step of allowing the first ID management system to transmit authentication information of the user to the second ID management system to perform public authentication; And a fourth step of transmitting the authentication token transmitted from the second ID management system to the SP server when authentication is successful as a result of the checking of the third step.

According to the present invention, it is possible to integrate and manage the personal information of all users circulated online, so that the service provider does not separately build, manage and maintain personal information, thereby minimizing the cost.

In addition, by issuing a plurality of online cards for each type of service to the user, and having the user present different online cards according to the type of service that the user wants to use, it is possible to prevent unnecessary personal information from being leaked.

In addition, even if a user provides personal information to only one ID management system, there is an advantage that the user can easily register or log in to an SP server connected to another ID management system.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining the connection relationship between the ID management system according to the present invention, a communication network and an authorized certification authority. In this case, the ID management system is two, and accordingly, there are two communication network and service provider (SP) server groups. For example, the connection relationship between the ID management system and the communication network and service provider server group more than illustrated is shown. The present invention can also be applied.

As shown, according to an embodiment of the present invention, the first ID management system 10 includes a first SP server group 30 and a user terminal 40 including a plurality of SP servers via the communication network 20. Connected with. Similarly, the second ID management system 50 is also connected to the second SP server group 60 and the user terminal 40 including the plurality of SP servers via the communication network 20. At this time, the first ID management system 10 and the second ID management system 50 are connected to the authorized certification authority 70, respectively.

Each ID management system 10 and 50 stores and manages IDs of SP servers in each SP server group 30 and 60, and authenticates a user by connecting to a user terminal 40 at the request of each SP server. In this case, only a legitimate user can register. At this time, whether or not the validity of the membership registration for each user, depending on the result of the legality authentication obtained by each ID management system (10, 50) to the authorized certification authority 70, if the user's legality is confirmed, At least one online card is issued to the user according to the type of service to be used.

In the present invention, the online card refers to an intangible card configured by differentiating a user's personal information list to be presented to the SP server according to the type of content provided by each SP server. For example, the online card may include a shopping mall card, a point earning card, and the like. Each online card includes card issuer information and authentication information from an accredited certification authority 70.

The user provides his or her personal information to any one ID management system, that is, the first ID management system 10 or the second ID management system 50, and issues an issue for each type of service that the user wishes to use later. Choose your preferred online card.

On the other hand, each ID management system (10, 50), the user terminal 40, if received from the SP server in the connected SP server group (30, 60), the online card type and the user authentication request message selected by the user, respectively Connect with and perform the authentication process and check if the selected online card is issued to the user.

If a card is issued, an authentication token is generated and transmitted to the SP server. At this time, the authentication token includes a list of personal information of the user, and the personal information becomes personal information allowed to be disclosed for each online card selected by the user.

Each SP server verifies the ID management system 10, 50 using the authentication token received from each ID management system 10, 50, and extracts personal information from the authentication token. Then, the service is provided to the user based on the extracted personal information.

When a user who is issued an ID from another ID management system to the SP server requests login, the SP server requests an online ID verification of the user to the connected ID management system. Thereafter, the ID management system evaluates whether the user's login is legitimate using the authentication information and issuing authority information authenticated from the authorized certification authority 70 through the user's online card, and generates an authentication token according to the result. Send to server At this time, the ID management system may request the personal information of the user from the issuing authority by using the issuer information of the online card, and provide the authentication token delivered to the SP server accordingly. The SP server provided with the authentication token extracts personal information from the authentication token and provides a service to the user.

As described above, in the present invention, when a user joins the first ID management system 10 or the second ID management system 50 as a member, at least one online card specialized according to the type of service is issued. As the user requests a login and selects an online card to use a service of a specific SP server, the SP server requests the card type and login processing selected by the ID management system. The ID management system performs user authentication, checks whether a card type received from the SP server is issued to the user, and if so, generates an authentication token and transmits it to the SP server.

When a user requests membership registration and login to an ID management system not registered as a member, the ID management system authenticates the validity of the user's membership and login using the user's online card. At this time, the ID management system receives the necessary user's personal information from the other ID management system through the authentication token using the card issuer information collected through the online card, and transmits it to the SP server. Accordingly, the SP server can trust a user who has not previously registered, and can provide a service to a user without collecting unnecessary personal information. In other words, the user can provide his or her personal information to only one ID management system, and authenticate the legality of his / her membership and login to another ID management system by using the authentication information of the online card issued at this time. Whenever a member joins the SP server, it is possible to reduce the inconvenience of providing personal information.

That is, according to the present invention, there is no direct agreement relationship between the first ID management system 10 and the second ID management system 50. However, each ID management system can trust the user by using the authentication information included in the online card presented by the user. At this time, any one ID management system may exchange necessary personal information with another ID management system by using the issuer information included in the online card. As a result, the plurality of ID management systems can form a trust relationship with each other, based on the reliability of the authorized certification authority 70, thereby creating an effect such as making a direct business agreement relationship.

FIG. 2 is a detailed configuration diagram of the first ID management system shown in FIG. 1, and since the first ID management system and the second ID management system have the same configuration, the second ID management will be described as a description of the first ID management system. It is shown to replace the description of the system.

As shown, the first ID management system 10 according to the present invention is a control module 101 for controlling the overall operation, the communication module 103 for communicating with the SP server and the user terminal 40 through the communication network 20 ), A storage unit 105 for storing applications and related data for operating the system, an SP management unit 107, a user management unit 109, an authentication unit 111, an authorized authentication support authentication unit 113, a card issuing unit ( 115) and an authentication token generator 117.

In addition, the first ID management system 10 may further include at least one of the security policy setting unit 119, the security processing unit 121, and the message generating unit 123.

A detailed description of each component is as follows.

First, the SP management unit 107 collects information related to the SP on the wired / wireless Internet to perform member management, member authentication, etc. through the first ID management system 10, and stores and manages the information in the storage unit 105. Here, the SP related information may include an SP identifier, a service type provided, an access permission standard, and the like.

The user manager 109 issues an ID and a password to a legitimate user connected through the user terminal 40, receives a user name, a social security number, an address, a phone number, and stores the personal information in the storage 105.

The authenticator 111 authenticates whether the user is a legitimate user when the user connected through the user terminal 40 intends to register as a member or when the SP server 30 requests a login service of a specific user. In addition, if it is determined that the user is a legitimate user for the login service request of the SP server 30, a login procedure for the user is performed. To this end, the authentication unit 111 may use any one of a variety of authentication methods, such as an authorized certificate authentication method, mobile phone SMS authentication method.

When the authentication unit 111 needs to proceed with the authentication process by adopting the public certificate authentication method, that is, a user who has received an online card from the second ID management system 50 joins the first ID management system 10 and If you want to log in, the authentication unit 111 provides the authentication information of the online card to the authentication authentication support authentication unit 113 provided separately, to authenticate the legality of the user registration and login. In addition, when a user who does not have an online card wants to register and log in to the first ID management system 10, the authorized authentication support authenticator 113 uses the communication module 103 to connect the user to the authorized certification authority 70. Requests whether or not the legality in membership registration, and performs the function of authenticating whether the user is a legitimate user according to the legality information of the user provided by the authorized certification authority (70).

The card issuing unit 115 provides a list of online cards that can be issued to a user who wants to register as a member, and requests to select at least one online card. In addition, when a user selects an online card, an online card is issued for each user, and the card issuing information is included in personal information and stored in the storage unit 105.

The authentication token generating unit 117, as the authentication unit 111 performs a login procedure in response to a request of a specific SP server, the type of online card received from the SP server (type of online card selected by the user at the login request). With reference to, to generate the authentication token using the personal information provided for the online card issuance.

Accordingly, the SP server verifies the first ID management system 10 using the authentication token received from the first ID management system 10 and extracts personal information from the authentication token.

In addition, when a user who has received an online card from the first ID management system 10 requests login to the second ID management system 50 or an SP server connected thereto, the second ID management system 50 issues an issuing authority. After tracking the user ID to the first ID management system 10, after the user authentication of the authentication unit 111 is completed, the authentication token generator 117 generates an authentication token through the communication module 103 It transmits to the 2nd ID management system 50. FIG.

In order to perform such an operation, the first ID management system 10 stores the verification application in the storage unit 105 and transmits the verification application to each SP server 30 managed by the SP manager 107. It is desirable to verify the authentication token. In addition, the verification application can be upgraded, and the verification application must be transmitted to the SP server 30 every time it is upgraded.

Meanwhile, the security policy setting unit 119 manages a security policy including access permission criteria and post disclosure criteria for each SP managed by the SP management unit 107 and according to the type of online card selected by the user at login. It is determined whether the connection to the SP is possible.

In addition, the security processing unit 121 encrypts the personal information stored in the storage unit 105 so that the first ID management system 10 can be secured from an external attack.

Then, the message generator 123 generates a message for the result of membership registration, authentication, and login processing, and transmits the message to the user terminal 40 so that the user can check the processing result requested by the user.

As described above, the first ID management system 10 of the present invention allows the user to select at least one online card upon membership registration, so that the user can change the type of personal information to be disclosed for each service type. In addition, when requesting a login to a specific SP server, by selecting any one of the pre-registered online card, so that the SP server can use only the personal information disclosed by the user. In addition, when a user who is issued an ID from the second ID management system 50 requests membership registration and login, the user authenticates whether the user registration and login is legitimate using the user's authorized authentication information provided through the online card. do. In this case, the first ID management system 10 requests the user's personal information to the second ID management system 50 using the card issuer information provided through the online card.

On the other hand, the first ID management system 10 is connected to the authorized certification authority 70 for a new user's membership request or login request, requesting the authentication of the user information to the authorized certification authority 70, the legitimacy certified Provide membership services to users.

Accordingly, the user does not need to register personal information on each SP server, and when using the service, the personal information can be differentiated and disclosed according to the type of service to be used, thereby relieving anxiety about leakage and abuse of personal information. . In addition, since the user can subscribe to a plurality of SP servers connected to other ID management systems using the ID issued from one ID management system, the inconvenience of having to provide personal information every time the membership is reduced.

3 is a flowchart illustrating an example of a service subscription method in the ID management method according to the present invention, and is a flowchart illustrating a procedure in which a user subscribes to the ID management system as a member.

For membership, the user may directly access the first ID management system 10 or access through the SP server. In the present embodiment, a case of accessing through the SP server will be described as an example.

After the user connects to the SP server in the first SP server group 30 through the terminal 40 (S101), as a request for membership to the SP server (S103), the SP server is connected to the first ID management system ( 10, the connection is switched (S105) so that the first ID management system 10 and the user terminal 40 are connected (S107).

Thereafter, the authentication unit 111 of the first ID management system 10 performs authentication in order to confirm whether the user connected through the user terminal 40 is a legitimate user (S109). In this case, various authentication methods, such as a public certificate authentication method and a mobile phone SMS authentication method, may be used. In this embodiment using the public certificate authentication method, the first ID management system 10 must verify the electronic signature of the user through the public authentication support authentication unit 113 (S111). Thereafter, the authorized authentication support authentication unit 113 of the first ID management system 10 performs a procedure of requesting a certificate containing the electronic signature information of the user to the authorized certification authority 70 for authentication. The authorized certification authority 70 authenticates the certificate transmitted from the first ID management system 10 and transmits the certificate to the first ID management system 10 again.

As a result of performing the authentication procedure up to step S113, if it is confirmed that the user is a legitimate user, the card issuing unit 115 of the first ID management system 10 provides a list of cards that can be issued to the user to select a card to be issued. As the user selects a card (S115), the user manager 109 receives personal information including a user name, social security number, address, telephone number, online card information, etc. from the user terminal 40 (S117).

The card selection and personal information receiving process may be performed for each type of card that the user wishes to issue, or integrated. The card type and personal information may be stored in the storage unit 105 and the user may be registered as a member. (S119).

In addition, in step S119 of registering the user as a member, a security policy for each service type may be set as necessary, and the security policy is also stored in the storage unit 105 together with the personal information.

Thereafter, the card issuing unit 115 generates an online card selected by the user (S121). At this time, the issuing authority information must be written in the online card to be provided to the user. Thereafter, the card issuing unit 115 issues an online card to the user and transmits the processing result to the user terminal (S123). At this time, it is desirable to guide together the identifier of the issued card, the type of available SP server, the benefit of using the card.

By such a process, a user who registers as a member of the first ID management system 10 and issues a card not only uses services of all the SP servers managed by the ID management system 10, but also separates personal information. It is possible to simply join the second ID management system 50 without providing a procedure.

Hereinafter, the login and service procedures of the first ID management system 10 will be described.

4 is a flowchart illustrating an example of a login method in the ID management method according to the present invention, in which a user who receives an ID from the second ID management system 50 logs in to the first ID management system 10. Indicates.

First, as the user accesses the SP server through the terminal 40 (S201) and attempts to log in (S203), the SP server presents the list of online cards available at his site to the user terminal 40, At least one is selected (S205).

In addition, it is preferable that the SP server transmits the type of security level and personal information required for its site to the user terminal 40 so that the user can refer to it (S207).

As the user selects and submits the online card (S209), the SP server transmits the card type selected by the user to the first ID management system 10 and requests login processing (S211).

The authentication unit 111 of the first ID management system 10 connects to the user terminal 40 and performs authentication (S213). Here, step S213 may be made of a first authentication procedure using a public certificate or a mobile phone SMS authentication method and a second authentication procedure using an ID and a password.

Typically, when the user requests to log in to the first ID management system 10, the authorized authentication support authentication unit 113 of the first ID management system 10 requests a certificate verification from the authorized certification authority 70 and We will then generate an authentication token and pass it to the SP server. However, in this embodiment where a user who has received an online card from the second ID management system 50 requests login to the first ID management system 10, the first ID management system 10 is the second ID management system. The authentication information is forwarded to 50 (S215), and the second ID management system 50 requests the certificate authority 70 to confirm the certificate (S217).

If the authentication is successful as a result of step S217, the authentication token generating unit of the second ID management system 50 generates an authentication token including previously stored personal information (S219), and the first ID management system 10 In step S221). The first ID management system 10 delivers the received authentication token back to the SP server (S223). At this time, it is preferable that the authentication token generator 117 of the first ID management system 10 transmits the authentication token by performing an electronic signature.

Thereafter, the SP server verifies the reliability of the first ID management system 10 using the authentication token, that is, the reliability of the electronic signature performed on the authentication token and the integrity of the information included in the authentication token (S225). Through this verification process, it is possible to check whether the first ID management system 10 that has transmitted the authentication token is a trusted institution and whether personal information included in the authentication token is forged / modulated.

Subsequently, the SP server 30 extracts personal information included in the authentication token (S227), and provides a service based on the extracted personal information, that is, according to the type of online card selected by the user in step S209 (S229). ).

As described above, in the present invention, the first and second ID management systems 10 and 50 manage the users who want to use the service of the SP server and the SP server as members. In addition, at least one online card is issued according to the online service type when the user registers, and when the user wants to use the service of the SP server, the online card is issued.

As such, even if a user provides his / her personal information to only one ID management system among a plurality of ID management systems and receives a single online card, each ID management system forms a business connection based on a public certificate. The SP server connected to the ID management system can be logged in without any complicated procedures. Therefore, the user can solve the inconvenience of providing personal information and issuing ID every time the user connects to the new SP server, and each SP server can greatly reduce the cost for managing personal information.

Those skilled in the art to which the present invention described above belongs will understand that the present invention can be implemented in other specific forms without changing the technical spirit or essential features. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

There are countless websites online, each offering similar or different services.

When Internet users want to acquire information or conduct e-commerce, they must provide their personal information to each website. When applying the present invention, the Internet user provides his or her own information only to the ID management system, and the service to be used later. If you get an appropriate card according to the type, you can use various services without providing personal information for each website.

Moreover, even if a user provides personal information to only one ID management system among a plurality of ID management systems, the user can easily register to the SP server connected to another ID management system, thereby reducing the inconvenience of user registration. Each SP server can more easily attract members and attract customers.

In addition, each website can minimize the cost of collecting and managing customer information, thereby providing a higher quality service.

1 is a view for explaining the connection relationship between the ID management system according to the present invention and a communication network and an accredited certification authority,

FIG. 2 is a detailed configuration diagram of the first ID management system shown in FIG. 1;

3 is a flowchart illustrating an example of a service subscription method among ID management methods according to the present invention;

4 is a flowchart illustrating an example of a login method among ID management methods according to the present invention.

<Description of the symbols for the main parts of the drawings>

10: first ID management system 20: communication network

30: first service provider server group

40: user terminal 50: second ID management system

60: second service provider server group

70: accredited certification authority

Claims (20)

An ID management system connected with a plurality of service provider servers (SP servers) and a plurality of user terminals through a communication network, An SP management unit for collecting, storing, and managing SP related information including an identifier of the SP server and a type of a service provided; A user manager for issuing IDs and passwords to legitimate users connected through the user terminal and receiving and storing personal information; An authentication unit which checks whether the user who requested membership through the user terminal or the SP server is legal and performs a login procedure if legal; A card issuing unit for providing a list of online cards that can be issued to a user who has requested membership through the user terminal and issuing an online card as the user selects the online card; And An authentication token generating unit generating an authentication token as a login procedure is completed by the authentication unit; Including; The authentication unit comprises an authentication management support authentication unit for requesting whether the user in the legality of membership registration to the authorized certification authority, and authenticates the user according to the legality information provided by the authorized certification authority . The method of claim 1, The authentication token generating unit may extract the personal information of the user by referring to the online card information included in the login processing request message of the SP server, and generate the authentication token including the personal information of the user who performed the login procedure. ID management system, characterized in that. The method of claim 2, The authentication token generator, when it is confirmed that the issuer of the online card is the ID management system, transmits the authentication token to the SP server. When it is confirmed that the issuer of the online card is another ID management system, the authentication token corresponds to the authentication token. ID management system characterized by transmitting to the ID management system. The method of claim 1, The ID management system, characterized in that for transmitting the authentication token verification application to the SP server. The method of claim 1, The authentication unit, identity management system, characterized in that for verifying whether the user is legitimate by the authentication method, the mobile phone SMS authentication method. The method of claim 1, When the user who receives an online card from an ID management system other than the ID management system requests membership registration or login, the authorized authentication support authentication unit receives the authentication information from the corresponding ID management system and registers or logs in the user. ID management system, characterized in that to authenticate the legality of the. The method of claim 1, The online card includes an individual personal information list according to the type of service provided by the SP server, and includes identification information and issuer information. The method of claim 1, The ID management system, ID management system, characterized in that further comprising a security policy setting unit for managing a security policy including the access permission criteria for each SP server. The method of claim 1, The ID management system further comprises a security processing unit for encrypting and storing the personal information. The method of claim 1, The ID management system further comprises a message generator for generating a service processing result message and transmitting the same to the user terminal. An ID management method in an ID management system connected to a plurality of user terminals through a communication network, A first step of connecting with a user terminal; A second step of authenticating whether a user connected through the user terminal is legitimate; A third step of requesting the electronic signature information of the user provided in the second step to an authorized certification authority to authenticate the legitimacy of the user's membership or login; A fourth step of transmitting to the user terminal a list of online cards that can be issued if the user is a legitimate user as a result of the checking of the third step; A fifth step of receiving and storing personal information from the user terminal as the user selects at least one online card; And A sixth step of transmitting online card issuance information to the user terminal; Identity management method comprising a. The method of claim 11, The fifth step is a step of receiving different personal information for each type of online card selected in the fourth step. The method of claim 11, The ID management system is connected to a plurality of SP servers through the communication network, The first step is a step in which the SP server is connected to the ID management system as the user terminal accesses the SP server and requests membership, the ID management system and the user terminal are connected. ID management method, characterized in that. The method of claim 11, The second step is an ID management method, characterized in that the authentication step using the authentication certificate or the authentication step using the mobile phone SMS. The method of claim 11, In the third step, when a user who has received an online card from an ID management system other than the ID management system requests membership registration or login, the user receives the authentication information from the ID management system to receive the user's membership or login. ID management method characterized in that the step of authenticating whether or not legitimacy. The method of claim 11, And between the fifth step and the sixth step, receiving and storing a security policy from the user terminal. An ID management method in a first ID management system connected to a plurality of service provider servers (SP servers) and a plurality of user terminals via a communication network, As the user who receives the online card from the second ID management system accesses the SP server through the user terminal, requests login and submits the online card, the first ID management system selects the online card selected by the user from the SP server. And a first step of receiving a login processing request message; A second step of the first ID management system accessing the user terminal requesting the login and performing authentication; A third step of allowing the first ID management system to transmit authentication information of the user to the second ID management system to perform public authentication; And A fourth step of transmitting an authentication token transmitted from the second ID management system to the SP server when authentication is successful as a result of the checking of the third step; Identity management method comprising a. The method of claim 17, The online card includes a list of different personal information according to the type of service provided by the SP server, and includes authorized authentication information and issuer information. The authentication token, ID management method characterized in that it comprises a personal information according to the online card type. The method of claim 17, The third step may include a step 3-1 of authenticating whether a user connected through the user terminal is legitimate; And A third step of authenticating whether the user is a registered user by receiving an ID and a password from the user terminal when the verification result of step 3-1 is a legitimate user; ID management method comprising a. The method of claim 17, The fourth step, the ID management method, characterized in that for performing the electronic signature to the authentication token.

Images