KR20110005608A - System and method for managing otp using location information, otp device and recording medium - Google Patents

Abstract

PURPOSE: A system and a method for managing an OTP(One Time Password) using location information, an OTP device and a recording medium are provided to prevent a malicious use of a stolen OTP device by authenticating an OTP based on the location of the OTP device which generates an OTP. CONSTITUTION: An information reception unit(225) receives an OTP(One Time Password), and the OTP is generated based on OTP generation information including the location information of the OTP device as a seed value. A location confirmation unit(230) confirms the location information of the OTP device which generates the OTP. An information configuration unit(240) configures the OTP generation information including the confirmed OTP device location information as a seed value. An OTP authenticator(235) authenticates the validity of the received OTP by comparing the OTP generated based on the OTP generation information with the received OTP.

Description

System and Method for Managing OTP using Location Information, OTP Device and Recording Medium}

1 is a diagram illustrating a functional configuration of an OTP device having a function of generating an OTP using location information according to an embodiment of the present invention.

2 is a diagram illustrating an OTP system configuration according to an embodiment of the present invention.

3 is a diagram illustrating an OTP medium registration process according to an embodiment of the present invention.

4 is a diagram illustrating an OTP generation process according to an embodiment of the present invention.

5 is a diagram illustrating an OTP authentication process according to an embodiment of the present invention.

<Description of main parts of drawing>

100: OTP device 105: control unit

110: screen output unit 115: key input unit

120: positioning position 125: battery

130: memory unit 135: authentication unit

140: information confirmation unit 145: information configuration unit

150: OTP generating unit 155: OTP output unit

According to the present invention, when generating an OTP in an OTP device having a positioning function, the OTP is generated using the OTP device position information obtained through the positioning function in the OTP device as a seed value of the OTP, and the OTP is authenticated. When the OTP is authenticated by the server, the method provides a method and system for authenticating the OTP using the identified OTP device location information as the same seed value after identifying the location of the OTP device that generated the OTP.

With the development of information and communication technology, non-face-to-face transactions using telecommunication networks are activated, non-face-to-face transaction providers must verify that users connected through telecommunication networks are valid traders and prepare for any incidents that may occur.

In the non-face-to-face transaction as described above, the most common method of authenticating a user connected through a communication network is used to authenticate using ID / PW. It is used to identify the trader rather than being used.

As a non-face-to-face transaction authentication method that is more advanced than the ID / PW method, an authentication method using an official certificate is used, and a medium (for example, a computer) on which the official certificate is recorded is hacked, When processing a non-face-to-face transaction through the installed terminal, the official certificate also has a problem that does not provide a reliable degree of face-to-face transaction authentication.

One time password (OTP) is used as a method for solving the problems of the above-mentioned public certificate. The OTP exchanges / shares one or more fixed seed values and fixed seed values dynamically determined at the time of generating the password, and then the fixed seed identified / determined at the point of non-face authentication by each trading party. By assigning a value and a dynamic seed value to a predetermined code generation algorithm (eg, a hash function) to generate an OTP that can be used once, and exchanging and authenticating the generated OTP, even if the OTP is exposed, the same OTP can be reused. Since it is not possible, it is used as a safer authentication means for hacking than other authentication means.

An object of the present invention for solving the above problems, when generating the OTP in the OTP device having a positioning function, the OTP device position information obtained through the positioning function in the OTP device as a seed value of the OTP Generate the OTP, and when the OTP is authenticated by the server that authenticates the OTP, confirms the location of the OTP device that generated the OTP, and uses the identified OTP device location information as the same seed value. To authenticate.

The method for operating an OTP using location information according to the present invention comprises the steps of: acquiring OTP device location information corresponding to the OTP device location by positioning the location of the OTP device when the OTP is generated by the OTP device; Configuring OTP generation information including the OTP device location information as a seed value, and generating and outputting OTP using one or more fixed seed values included in the OTP generation information and a dynamic seed value dynamically determined. It is characterized by comprising.

In a method for operating an OTP using location information according to the present invention, receiving an OTP generated through OTP generation information including OTP device location information as a seed value, and confirming location information of the OTP device generating the OTP. And configuring OTP generation information including the identified OTP device location information as a seed value, generating OTP 'through the OTP generation information, and comparing the received OTP with the generated OTP'. (Or verifying operation) to authenticate the received OTP validity.

The OTP operation method using location information according to the present invention is characterized in that it further comprises the step of hashing and processing the OTP device location information to the seed value data structure of the OTP generation information.

In the OTP operation method using the location information according to the present invention, the step of confirming the location information of the OTP device generating the OTP, when the OTP is input and transmitted through the user terminal, the communication address of the user terminal Providing information to a telecommunication company server to which the user terminal is connected to confirm the address of the user terminal as the OTP device location information, or a user terminal to which the OTP is input is managed by a terminal management authority, a terminal- Merchant terminal; Or, if the financial terminal-, characterized in that the user terminal information provided to the terminal management authority to confirm the user terminal location to be confirmed by the OTP device location information.

In an OTP operation method using location information according to the present invention, the OTP device location information includes a coordinate value including a longitude value and a latitude value at which the OTP device is located, or an address at which the OTP device is located. And a location value including any one of information, landmark information, and a location code.

In the OTP operation method using the location information according to the present invention, the OTP device location information, characterized in that it is included as a dynamic seed value of the OTP generation information dynamically determined according to the OTP device location.

In the OTP operation method using the location information according to the present invention, the OTP generation information is a combination of the terminal-side OTP generation information and the OTP device location information including a parameter for determining at least one fixed seed value and a dynamic seed value Characterized in that the configuration.

In the OTP operation method using the location information according to the present invention, the OTP generation information is a combination of server-side OTP generation information and the OTP device location information including a parameter for determining at least one fixed seed value and a dynamic seed value Characterized in that the configuration.

On the other hand, it includes a computer-readable recording medium, characterized in that for recording a program for executing the OTP operation method using the above-described location information.

On the other hand, the OTP device according to the present invention, when generating the OTP in the OTP (One Time Password) device, the location positioning unit for obtaining the OTP device location information corresponding to the location of the OTP device by positioning the location of the OTP device, and the OTP An information constituting unit for generating OTP generation information including device location information as a seed value and an OTP generating unit for generating an OTP using one or more fixed seed values included in the OTP generation information and a dynamic seed value dynamically determined. It is characterized by comprising.

On the other hand, the OTP operation system using the location information according to the present invention, the information receiving means for receiving the OTP generated through the OTP generation information including the OTP device location information as the seed value, and the OTP device that generated the OTP Location information means for confirming location information, information structuring means for constructing OTP generation information including the identified OTP device location information as a seed value, and OTP 'through the OTP generation information, and generating the OTP'; And OTP authentication means for authenticating the received OTP validity by comparing (or verifying) the generated OTP '.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to a user's or operator's intention or custom. Therefore, the definition should be made based on the contents throughout the present invention.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

1 is a diagram illustrating a functional configuration of an OTP apparatus 100 having a function of generating an OTP using location information according to an embodiment of the present invention.

In more detail, FIG. 1 is a functional configuration for generating an OTP (One Time Password) of N (N> = 2) digits using the OTP device 100 location information in the OTP device 100 having a positioning function. As shown in the drawings, a person having ordinary knowledge in the technical field to which the present invention pertains may have a function of generating an OTP using the location information of the OTP device 100 by referring to and / or modifying the drawing 1. The method may be inferred, and the present invention includes all the inferred implementation methods, and the technical features are not limited to the implementation method shown in FIG.

Referring to FIG. 1, the OTP device 100 includes a control unit 105 for controlling a component in the OTP device 100, a screen output unit 110 corresponding to a liquid crystal display (LCD), and a keypad. Key input unit 115 corresponding to the memory unit, a memory unit 130 corresponding to the nonvolatile memory, and a battery 125 for supplying power, and the position of the OTP device 100 is measured. In order to the OTP device 100 is characterized in that it comprises a position location unit 120 for configuring the OTP device 100 location information including a coordinate value (or location value) corresponding to the location.

The controller 105 includes a processor and an execution memory including a CPU / MPU in hardware, and a bus for inputting and outputting a program routine or program data for providing a function specific to the OTP device 100 from a memory device. (BUS) and an electronic circuit (or integrated circuit) provided for this, characterized in that it is loaded into the execution memory from the memory unit 130 or a memory device (or chipset) by software to a specific function A general term of a program routine or program data that is computed through the processor to perform the program (hence, program code recorded on the recording medium of the OTP device 100 to generate an OTP using the OTP device 100 location information. A configuration part is illustrated and described as being provided in the control unit 105 for convenience. Program routines provided basically include an operating system routine (not shown) and one or more system management routines (eg, power management routine, channel (forward / reverse) management routine, handoff routine, etc. not shown). In addition, various functional configurations to be implemented in the OTP apparatus 100 by the controller 105 are implemented.

The screen output unit 110 is a function configuration unit for checking the operation mode operation and the operation state corresponding to the operation mode of the OTP device 100, one or more including an LCD provided in the OTP device 100 And at least one key data input through the key input unit 115 in conjunction with the control unit 105 or the OTP. The apparatus 100 may output a menu screen, a function processing screen, and a function processing result screen corresponding to one or more functions (or programs) included in the apparatus 100.

According to the exemplary embodiment of the present invention, the screen output unit 110 preferably performs a function of a screen output means for outputting a menu screen, a function processing screen, and a function processing result screen corresponding to the function for generating the OTP. .

The key input unit 115 includes a key input device including one or more key buttons including a number key, a character key, or a function key, and the key input device. And at least one key input signal generated by clicking (or entering) the key button in the key input device.

According to an embodiment of the present invention, the key input unit 115 preferably performs a function of key input means for inputting one or more key data corresponding to the function of generating the OTP.

The memory unit 130 is a general term for a nonvolatile memory corresponding to a storage medium storing one or more information (or data) in the OTP device 100 and a recording medium for recording program codes corresponding to one or more program routines. And a read only memory (ROM) corresponding to the read only memory, a flash memory (FM), an electrically erasable and programmable read only memory (EEPROM), and the like. .

According to the embodiment of the present invention, the memory unit 130 may encrypt and store the terminal-side OTP generation information for generating the O (N> = 2) digits in the OTP device 100. In some implementations, the terminal-side OTP generation information may be omitted. However, when the terminal-side OTP generation information is stored in the memory unit 130, it is preferable that the terminal-side OTP generation information is encrypted and stored in the memory unit 130.

The terminal-side OTP generation information may include one or more parameters for determining a fixed seed value dynamic seed value for generating an OTP having N (N> = 2) digits, and the fixed seed value. The dynamic seed value determined by the and parameters is substituted into a preset OTP generation algorithm and OTP generation method to generate N-digit OTP.

For example, if the OTP is generated in a time-synchronized manner, the terminal-side OTP generation information may be a parameter for determining one or more fixed seed values and dynamic seed values to substitute for the time-synchronized OTP generation algorithm. , A synchronization time setting value for determining a synchronization time corresponding to the dynamic seed value of the time-synchronization method OTP.

Or, if the OTP is generated in a challenge-response manner, the terminal-side OTP generation information may be a parameter for determining one or more fixed seed values and dynamic seed values to be substituted into the challenge-response OTP generation algorithm. A random number generation value for generating a challenge-response random number, or random number reception information for receiving a random number).

The location positioning unit 120 measures the location of the OTP device 100, and provides the OTP device 100 location information including coordinate values (or location values) corresponding to the location of the OTP device 100. It is characterized by the configuration.

According to an exemplary embodiment of the present invention, the positioning unit 120 reads a satellite signal received from a GPS (Global Positioning System) satellite to position the position of the OTP device 100, and the GPS-based coordinate value It is preferable to configure the OTP device 100 location information including the (or location value).

Here, the coordinate value of the OTP device 100, the position of the OTP device 100 on the GPS position coordinate system with respect to the position of the OTP device 100 to be measured using the GPS, it is preferably made to include a longitude value and a latitude value. Do.

The location value of the OTP device 100 is address information indicating the location of the OTP device 100 to be positioned using the GPS as an address on an administrative area, a land located within a predetermined short distance to the location of the OTP device 100. The location information of the OTP apparatus 100 may be determined according to landmark information including a landmark name (eg, “Seoul City Hall”) or a landmark code (eg, a code value assigned to the Seoul City Hall) and a preset location code. If the position code to be displayed (for example, the OTP device 100 coordinate values are included in a rectangular region including (longitude 1, latitude 1) and (longitude 2, latitude 2) on the GPS position coordinate system, the OTP device (100) a code value assigned to a coordinate value).

According to an embodiment of the present invention, in order to configure the location value of the OTP device 100, the memory unit 130 matches the address information (for example, the latitude value (or coordinate area) on the GPS location coordinate system) with the latitude value. Store information, home address information, company address information, merchant address information), landmark information, location code (eg, home location code, company location code, merchant location code).

Referring to FIG. 1, when the user's password (or personal identification number) is stored in the memory unit 130, the OTP device 100 receives the user's password (or personal identification number) through a key input. And an authentication unit 135 for authenticating the input password (or personal identification number) to authenticate the validity of generating the OTP through the OTP device 100 location information. The authentication unit 135 can be omitted.

Referring to FIG. 1, the OTP device 100 configures information for configuring OTP generation information including the OTP device 100 location information as a seed value for generating an O (N> = 2) digit OTP. The unit 145 and the at least one fixed seed value and the dynamic seed value for generating the N-digit OTP are identified / determined from the configured OTP generation information, and the at least one fixed seed value and the dynamic seed value are determined. And an OTP generation unit 150 for generating OTPs by substituting a predetermined OTP generation algorithm. When the terminal-side OTP generation information is stored in the memory unit 130, the OTP generation unit 150 is stored in the memory unit 130. And an information confirming unit 140 for confirming terminal-side OTP generation information, wherein the information configuring unit 145 combines the terminal-side OTP generation information and the OTP device 100 location information. (N> = 2) digits It characterized in that configuring the OTP generation information for generating the OTP.

When the validity of generating the OTP through the OTP device 100 location information is authenticated by the authentication unit 135, the information configuration unit 145 obtains the OTP device 100 obtained through the location positioning unit 120. ) Checking the location information, and if the location information of the OTP device 100 does not match the data structure for generating the N-digit OTP, the obtained OTP device 100 location information is converted into the N-digit OTP. And converting it into a data structure for generation. If the OTP device 100 obtained through the location positioning unit 120 has a data structure for generating the N-digit OTP, or the OTP device obtained through the location positioning unit 120 ( 100) When the data structure of the location information can be generated as it is and the N-digit OTP can be generated, the data structure of the location information of the OTP device 100 may not be changed, and the present invention is not limited thereto.

According to an embodiment of the present invention, the location information of the OTP device 100 is hashed through a hash function that hashes a series of text / binary data into a data structure of seed values constituting the OTP generation information, so that the N It is preferable to convert to a data structure for generating digit OTP.

The information configuration unit 145 configures OTP generation information for generating N-digit OTP by including the OTP device 100 location information as a dynamic seed value for generating the N-digit OTP. .

According to an embodiment of the present invention, the information configuration unit 145 generates the N-digit OTP by including the unique information of the OTP device 100 stored in the memory unit 130 as the fixed seed value of the OTP generation information. It is preferable to configure the OTP generation information for this purpose.

If the N-digit OTP is a time-synchronized OTP, the information configuring unit 145 determines a time value (or a time value for a specific time interval) checked from a timer provided in the OTP device 100. The OTP generation information for generating the N-digit OTP may be configured by including the determined time value as the dynamic seed value of the OTP generation information.

Alternatively, if the N-digit OTP is a challenge-sync OTP, the information configuring unit 145 generates a predetermined random value and transmits / exchanges with a server, or receives / exchanges a random number generated by the server. After that, it is preferable to configure the OTP generation information for generating the N-digit OTP by including the random number value as the dynamic seed value of the OTP generation information.

If the terminal-side OTP generation information is stored in the memory unit 130, the information checking unit 140 confirms the terminal-side OTP generation information from the memory unit 130, and the information configuration unit 145 determines the information. After processing the OTP device 100 location information as the dynamic seed value for generating the N-digit OTP, the N-digit OTP is obtained by combining the checked terminal-side OTP generation information and the OTP device 100 location information. It is preferable to configure OTP generation information for generation.

When the OTP generation information including the OTP device 100 location information as the dynamic seed value for generating the N-digit OTP is configured by the information configuration unit 145, the OTP generation unit 150 is configured. Identify at least one fixed seed value included in the OTP generation information, determine at least one dynamic seed value through the parameter included in the OTP generation information, and set the at least one fixed seed value and the dynamic seed value It is characterized by generating an OTP having N (N> = 2) digits by substituting the OTP generating algorithm. Here, the number of digits of the N for the OTP may be fixed or may be changed dynamically every time the OTP is generated, and thus the present invention is not limited thereto.

Referring to FIG. 1, when the N-digit OTP is generated through the OTP generating unit 150, the OTP device 100 outputs the generated OTP through the screen output unit 110. And a short range communication unit (not shown) in the OTP apparatus 100, the OTP output unit 155 may generate the generated OTP through the short range communication unit. It is possible to output to the terminal (or device) located near the OTP device 100.

When the OTP is generated, the OTP output unit 155 outputs the generated OTP in a predetermined area on the screen of the OTP device 100 in cooperation with the screen output unit 110.

According to the exemplary embodiment of the present invention, the OTP output unit 155 outputs an OTP output screen on the screen of the OTP device 100 in association with the screen output unit 110 and generates the OTP output screen. It is preferable to output the OTP.

According to another exemplary embodiment of the present invention, the OTP output unit 155 outputs (or allocates) an OTP output area to a screen area currently output on the screen of the OTP device 100 in association with the screen output unit 110. It is preferable to output the generated OTP to the OTP output region.

If the OTP apparatus 100 is provided with short range communication means (eg, Bluetooth, infrared communication, RFID communication, RF communication, etc.), the OTP output unit 155 generates the short range communication means through the short range communication means. It is possible to output the OTP to the terminal (or device) located in close proximity to the OTP device 100.

2 is a diagram illustrating a configuration of an OTP system according to an embodiment of the present invention.

In more detail, FIG. 2 illustrates an OTP system configuration for authenticating N-digit OTPs generated using the OTP device 200 location information in the OTP device 200 having the positioning function. Those skilled in the art may refer to and / or modify this drawing 2 to implement various methods of constructing the OTP system (for example, some components may be omitted, subdivided, or combined). Although it can be inferred, the present invention includes all the implementation methods inferred, and the technical features are not limited only to the implementation method shown in FIG.

Referring to FIG. 2, the OTP system includes an OTP authentication request server for requesting OTP authentication to an OTP device 200 having the functional configuration shown in FIG. 1 and a user possessing the OTP device 200 ( 210 and the OTP medium information corresponding to the OTP device 200 registered as the OTP medium and the server-side OTP generation information in association with the functional configuration as shown in FIG. 1 and then stored in the storage medium 250. When the OTP device 200 is used as an OTP medium, an OTP operating system for receiving and authenticating an N-digit OTP generated by the OTP device 200 by using the OTP device 200 location information. According to the intention of the skilled person, a separate OTP server 215 for authenticating the user terminal 205 used by the user having the OTP device 200 and the N-digit OTP generated by the OTP device 200. It further comprises.

According to the present invention, the OTP operating system, each means constituting the OTP operating system is implemented in the form of one integrated server, or each means (or a combination of two or more means) constituting the OTP operating system The server system is implemented in the form of each server, or some of the means for configuring the OTP operating system is implemented in the form of a server, and some of the OTP server 215, one of the OTP authentication request server 210 Implemented in the form of components of the above server, or each means constituting the OTP operating system is distributed and implemented in the form of components of one or more servers of the OTP server 215, OTP authentication request server 210 All are possible, and it is apparent that the present invention is not limited by the manner in which the OTP operating system is implemented, the type of server, the location and the number of implementations. Bayida leave.

The OTP device 200 is a device registered as an OTP medium for generating an N-digit OTP using the OTP device 200 location information among the OTP devices 200 having the position location function. After the OTP generation request through the OTP generation request, or the OTP generation validity authentication by the OTP generation request according to a preset menu selection, OTP generation information including the location information of the OTP device 200 is configured to generate an N-digit OTP, It is characterized by outputting.

The OTP authentication request server 210 is a generic term for servers requesting to authenticate a user, payment, and financial transaction through an OTP generated by the OTP device 200. The OTP authentication request server 210 generates an OTP generated by the OTP device 200. Web server processing user authentication through, OTP generated by the OTP device 200 through a shopping mall server or content providing server or home shopping server to process the payment authentication, through the OTP generated by the OTP device 200 It comprises one or more banking server for authenticating a financial transaction, the present invention is not limited by the type of OTP authentication request server 210 and OTP authentication request method.

The user terminal 205 is a generic term for a communication terminal in which a user having the OTP device 200 connects to the OTP authentication request server 210 through a communication network, and includes key input means, screen output means, and data communication means. It consists of all kinds of terminal devices including, preferably a PC, a computer terminal including a laptop, a wireless communication terminal connected to a wireless communication network (for example, OTP device 200, portable Internet terminal, etc.), two-way communication It includes a digital TV, IP-TV, a home appliance terminal connected to a home network, and the like.

The OTP server 215 receives an N-digit OTP generated by the OTP device 200 through a communication network, generates an OTP 'matching with the OTP, and compares (or verifies) the OTP and the OTP'. As a generic term for a server for processing the OTP authentication, the function of authenticating the OTP in the OTP server 215 may be provided in the OTP operating system, and the present invention is not limited thereto.

Referring to FIG. 2, the OTP operating system registers the OTP device 200 having the position location function as an OTP medium for generating an N-digit OTP using the OTP device 200 location information. And OTP medium registration means 220 for constructing server-side OTP generation information for generating OTP 'for authenticating N-digit OTP generated by OTP device 200 and storing it in storage medium 250. The OTP device 200 registered as the OTP medium is provided with terminal-side OTP generation information matching the server-side OTP generation information.

When the preset OTP registration terminal provides the unique information of the OTP device 200 to be registered as the OTP medium and the customer information of the customer who uses the OTP device 200, the OTP medium registration means 220 generates the OTP device 200. OTP medium information including the unique information and customer information is configured and stored in the storage medium (250).

Here, the OTP registration terminal is a generic term for a terminal device that requests the OTP device 200 to be registered as an OTP medium, and includes a user terminal 205 and an OTP registration authority (eg, a national authority, an OTP authentication request) used by the user. At least one terminal (eg, national agency terminal, OTP authentication request server 210 operating institution terminal, card company terminal, financial company terminal, securities company terminal, etc.) provided in the server 210 operating institution, card company, financial company, securities company, etc.). It is done by

The unique information of the OTP device 200 included in the OTP medium information includes device identification information (or unique information) given to the OTP device 200 provided to the customer (user) among the plurality of OTP devices 200. It is preferable to make.

The customer information may include a social security number corresponding to the nominee (or user) of the OTP apparatus 200 to be used as the OTP medium, and according to the intention of the person skilled in the art, the name, address, contact information of the nominee (or user). It is preferable to further include personal information such as.

If the financial transaction is included in the object of authentication using the OTP apparatus 200 as an OTP medium, the customer information further includes financial information (eg, an account number, a bank, etc.) of the customer corresponding to the customer information. It is preferable.

Alternatively, when a card transaction is included in the object of authentication using the OTP device 200 as an OTP medium, the customer information further includes card information of the customer corresponding to the customer information (eg, a card number, a card company, etc.). It is desirable to.

According to the intention of a person skilled in the art and the field of using the OTP device 200 as an OTP medium, the customer information may be a variety of information (e.g., a user who authenticates using the OTP device 200 as an OTP medium). In the case of including the authentication, it is possible to further include customer account information, etc. for the game, whereby the present invention is not limited.

When the OTP medium information is received, the OTP medium registration unit 220 authenticates the N-digit OTP generated by the OTP device 200 using the location information of the OTP device 200 based on the OTP medium information. Server-side OTP generation information is generated (or assigned).

Here, the server-side OTP generation information is maintained on the OTP operating system, one for generating an N-digit OTP 'to be compared (or verified operation) with the N-digit OTP generated by the OTP device 200. It is preferable that the fixed seed value and the parameters for determining the dynamic seed value are included.

When the OTP device 200 location information is used as the dynamic seed value for generating the N-digit OTP in the OTP device 200, the server-side OTP generation information may include the OTP device 200 location information. It is preferable to include the OTP device 200 position information setting information for determining the dynamic seed value generating the N-digit OTP '. According to the embodiment of the present invention, the OTP device 200 location information setting information may be implemented in the form of program code constituting the location checking means 230 of the OTP operating system, in which case the server-side OTP generation information The OTP device 200 location information setting information is omitted.

According to the embodiment of the present invention, the OTP device 200 location information setting information is the same as the dynamic seed value determined through the OTP device 200 location information obtained by the actual location positioning of the OTP device 200. It is preferable to include information for identifying the OTP device 200 location information for determining the dynamic seed value. Here, the OTP device 200 location information setting function as described above is a program code constituting the positioning means 230 for confirming the OTP device 200 location information with reference to the OTP device 200 location information setting information. Or a program code constituting the location checking means 230 may implement both the OTP device 200 location information setting information configuration and the OTP device 200 location information checking function in the form of a program code. Do.

When the user terminal 205 inputs and transmits an N-digit OTP, the OTP device 200 location information setting information is based on the information of the user terminal 205 transmitted by inputting the N-digit OTP. (200) It is preferable to include the information to set to confirm the location information, the location information setting function of the OTP device 200 as described above is preferably implemented in the program code constituting the positioning means 230. .

For example, when the user terminal 205 is a terminal device connected to a communication network, the OTP device 200 location information setting information may be provided with a communication company (eg, an Internet service provider) that provides a communication network to the user terminal 205. In order to determine the dynamic seed value by confirming the OTP device 200 location information including a location value corresponding to any one of address information, landmark information, and location code corresponding to the IP address of the user terminal 205. It is preferable that the information is included.

Alternatively, when the user terminal 205 is a terminal device managed by a specific terminal management institution, such as an affiliated store terminal or a financial terminal, the OTP device 200 location information setting information is linked to the terminal management institution. Information for determining the dynamic seed value by determining the OTP device 200 location information including a location value corresponding to any one of address information, landmark information, and location code corresponding to the terminal information corresponding to 205. It is preferable to comprise.

According to the exemplary embodiment of the present invention, the server-side OTP generation information may include a fixed seed value generated based on unique information and / or customer information of the OTP device 200 included in the OTP medium information. The generated fixed seed value is preferably included in the terminal-side OTP generation information to be provided to the OTP device 200.

If the N-digit OTP is generated by the time-synchronization scheme, the server-side OTP generation information includes synchronization time setting information for determining a synchronization time corresponding to the dynamic seed value of the time-synchronization scheme OTP. It is preferable.

Or when the N-digit OTP is generated in a challenge-response manner, the server-side OTP generation information generates a random number corresponding to the dynamic seed value of the challenge-response OTP or generates a random number to receive the random number. It is preferable to include a value.

When the server-side OTP generation information is generated (or assigned), the OTP medium registration unit 220 configures the terminal-side OTP generation information that matches the server-side OTP generation information, and generates the terminal-side OTP. The information is provided in the memory unit of the OTP apparatus 200.

The OTP medium registration unit 220 stores the OTP device 200 using the OTP device 200 location information by storing the OTP medium information and the server-side OTP generation information in a storage medium 250. Register as an OTP medium generating N-digit OTP.

Referring to FIG. 2, the OTP operating system receives an N-digit OTP generated by the OTP device 200 using location information of the OTP device 200 through a communication network, and generates the OTP. Information receiving means (225) for confirming OTP medium information corresponding to (200), information checking means (245) for confirming server-side OTP generation information associated with the OTP medium information from the storage medium (250), Positioning means 230 for confirming the position information of the OTP device 200 which generated the N-digit OTP, and the server-side OTP generation information and the OTP device 200 position information are combined to generate an N-digit OTP '. Information structuring means 240 constituting OTP generation information for generating an N-digit OTP 'through the OTP generation information, and comparing (or verifying) the N-digit OTP and OTP' to receive the received information. OTP authentication means 235 for authenticating whether the OTP is valid The information receiving means 225, the information checking means 245 and the OTP authentication means 235 can be implemented in a separate OTP server 215, the present invention can be inferred all It is clearly understood that this is done including the method of implementation.

When the OTP device 200 generates the N-digit OTP and the OTP is input and transmitted through the OTP input interface displayed on the user terminal 205, the information receiving means 225 transmits the OTP through the communication network. Characterized in that receiving the OTP from the user terminal 205, in this case, the user terminal 205 further transmits OTP medium information including one or more of the unique information or customer information of the OTP device 200, The information receiving means 225 preferably receives the OTP medium information from the user terminal 205.

According to the embodiment of the present invention, when the OTP is encrypted and transmitted, the information receiving means 225 decrypts the OTP according to a predetermined decryption scheme.

When the OTP is received, the information checking means 245 confirms server-side OTP generation information associated with the OTP medium information from the storage medium 250.

The positioning means 230 is characterized in that the OTP device 200 confirms the location information of the OTP device 200 used to generate the N-digit OTP.

According to the exemplary embodiment of the present invention, the location checking means 230 confirms the location information of the OTP device 200 by using the user terminal 205 information which inputs and transmits the N-digit OTP.

For example, when the user terminal 205 is a terminal device connected to a communication network, the positioning unit 230 confirms the IP address of the user terminal 205 and provides a communication network to the user terminal 205. It is preferable to check the OTP device 200 location information including a location value corresponding to any one of address information, landmark information, and location code corresponding to the IP address in association with a communication company (for example, an Internet service provider). Do.

Alternatively, when the user terminal 205 is a terminal device managed by a specific terminal management institution such as a merchant terminal or a financial terminal, the location checking means 230 confirms terminal information corresponding to the user terminal 205. In addition, it is preferable to check the location information of the OTP device 200 including a location value corresponding to any one of address information, landmark information, and location code corresponding to the terminal information in association with the terminal management authority.

When the server-side OTP generation information and the OTP device 200 location information are confirmed, the information structuring unit 240 combines the server-side OTP generation information and the OTP device 200 location information to form N-digit OTP '. Configure OTP generation information for generation.

When OTP generation information for generating the N-digit OTP 'is configured, the OTP authentication means 235 confirms one or more fixed seed values for generating the OTP' from the OTP generation information, and generates the OTP generation information. One or more dynamic seed values are determined through the parameters included in the parameter, and the one or more fixed seed values and the dynamic seed values are substituted into a predetermined OTP generation algorithm to generate N digits of OTP '.

When the N-digit OTP 'is generated, the OTP authentication means 235 authenticates the OTP validity by comparing (or verifying) the received N-digit OTP' with the generated OTP '.

If the result of the comparison matches (or matches) the OTP and the OTP ', or a predicted result is obtained through a verification operation, the OTP authentication means 235 treats the OTP validity as being authenticated, and the OTP. The validity authentication result is provided to one or more OTP authentication result receiving means of the OTP authentication request server 210, the user terminal 205, and the OTP device 200 that require the OTP authentication result.

On the other hand, if the comparison results do not match (or match) the OTP and the OTP ', or if a predicted result is not obtained through the verification operation, the OTP authentication means 235 treats the OTP validity as not being authenticated. The OTP validity authentication result is provided to one or more OTP authentication result receiving means of the OTP authentication request server 210, the user terminal 205, and the OTP device 200 that require the OTP authentication result.

3 is a diagram illustrating an OTP medium registration process according to an embodiment of the present invention.

In more detail, FIG. 3 illustrates a process of registering a user's OTP device 200 as an OTP medium on the OTP system shown in FIG. 2, and a person having ordinary knowledge in the art to which the present invention pertains, Although various implementation methods (e.g., some steps may be omitted or reordered) may be inferred from the OTP medium registration process by referring to and / or modifying the drawing 3, the present invention may infer all of the inferences. It is made, including the implementation method, the technical features are not limited only to the implementation method shown in FIG.

In the following Figure 3, the OTP operating system shown in Figure 2 is referred to as "server" for convenience.

Referring to FIG. 3, when an OTP registration terminal accesses a server through a communication network and requests an OTP device 200 corresponding to the OTP medium (300), the server transmits the customer information and the user to the OTP registration terminal. An OTP medium registration interface for inputting / registering OTP medium information including unique information of the OTP device 200 corresponding to the OTP device 200 of the device (300), and correspondingly, the OTP registration terminal registers the OTP medium. The OTP medium information including the unique information and the customer information is input and configured through the interface and transmitted to the server (310).

The server receives OTP medium information including unique information and customer information of the OTP device 200 from the OTP registration terminal, and the OTP device 200 location information in the OTP device 200 based on the OTP medium information. Generates (or allocates) server-side OTP generation information for authenticating N-digit OTPs generated by using (315), and stores the OTP medium information and server-side OTP generation information in association with the storage medium 250. (320).

Thereafter, the server includes the terminal-side OTP generation information matching the server-side OTP generation information, and provides the user with an OTP device 200 for generating an N-digit OTP using the OTP device 200 location information. It is processed to be (325).

4 is a diagram illustrating an OTP generation process according to an embodiment of the present invention.

In more detail, FIG. 4 illustrates a process of generating an N-digit OTP using the OTP device 200 location information in the OTP device 200 shown in FIG. 1, and specifically, the OTP device 200. FIG. 2 is a diagram illustrating an implementation method of not transmitting the OTP device 200 location information to the OTP operating system shown in FIG. 2.

Those skilled in the art to which the present invention pertains may refer to and / or modify this drawing 4 to implement various methods for the OTP generation process (for example, some steps may be omitted or the order may be changed). Although it can be inferred, the present invention includes all the implementation methods inferred, and the technical features are not limited only to the implementation method shown in FIG.

In the following Figure 4, the OTP operating system shown in Figure 2 is referred to as "server" for convenience.

Referring to FIG. 4, the OTP apparatus 200 requests a dedicated key button for requesting to generate an N-digit OTP through a key input means, or requests to generate the N-digit OTP through a preset menu selection. If requested, the user authentication request for generating an N-digit OTP using the OTP device 200 location information is requested (400), and the user authentication is processed through a password (or personal identification number) (405).

If the user authentication is not processed (410), the OTP device 200 outputs user authentication error information (415), and ends the OTP generation process.

On the other hand, if the user authentication is processed (410), the OTP device 200 obtains the OTP device 200 position information through the position location function of the OTP device 200 (420).

If the OTP device 200 location information is acquired through the OTP device 200 location positioning function (425), the OTP device 200 uses the OTP of the N-digit number as the location information of the OTP device 200. Including the dynamic seed value for generation, OTP generation information for generating an N-digit OTP is configured (430).

According to an embodiment of the present invention, the OTP device 200 confirms terminal-side OTP generation information from the memory unit, and the OTP device 200 uses the N-digit OTP as the location information of the OTP device 200. After processing with the dynamic seed value for generation, it is preferable to configure the OTP generation information for generating the N-digit OTP by combining the identified terminal-side OTP generation information and the OTP device 200 location information.

If the N-digit OTP is a time-synchronized OTP, the OTP device 200 determines a time value (or a time value for a specific time interval) checked from a timer provided in the OTP device 200. It is preferable to configure the OTP generation information for generating the N-digit OTP by including the determined time value as the dynamic seed value of the OTP generation information.

Alternatively, if the N-digit OTP is a challenge-sync OTP, the OTP device 200 generates a predetermined random value and transmits / exchanges with a server, or receives / exchanges a random number generated by the server. After that, it is preferable to configure the OTP generation information for generating the N-digit OTP by including the random number value as the dynamic seed value of the OTP generation information.

If OTP generation information including the OTP device 200 location information as a dynamic seed value is configured (435), the OTP device 200 checks one or more fixed seed values included in the configured OTP generation information, Determine one or more dynamic seed values through the parameters included in the OTP generation information, and generate and output N-digit OTPs by substituting the identified / determined fixed seed values and dynamic seed values into a preset OTP generation algorithm. (440).

5 is a diagram illustrating an OTP authentication process according to an embodiment of the present invention.

In more detail, FIG. 5 shows N (N> = 2) generated by the OTP apparatus 200 shown in FIG. 1 through the process shown in FIG. 4 through a communication network in the OTP operating system shown in FIG. Receiving an OTP of digits, generating an N-digit OTP 'matching the OTP, and comparing (or verifying) the received N-digit OTP's and authenticating OTP validity, Those skilled in the art to which the present invention pertains may refer to and / or modify this drawing 5 to implement various methods for the OTP authentication process (for example, some steps may be omitted or the order may be changed). Although it can be inferred, the present invention includes all the implementation methods inferred, and the technical features are not limited only to the implementation method shown in FIG.

Hereinafter, the OTP operating system shown in FIG. 2 in FIG. 5 is referred to as a "server" for convenience.

Referring to FIG. 5, after the N-digit OTP is generated / output by the OTP device 200 shown in FIG. 1 through the process shown in FIG. 4, the server is the user terminal shown in FIG. Receiving the N-digit OTP input through the OTP input interface output to the (205) and confirms the OTP medium information (500), server-side OTP generation information associated with the OTP medium information from the storage medium 250 After checking (505), the server checks the location information of the OTP device 200 that determines the dynamic seed value to generate the N-digit OTP '(510).

According to the embodiment of the present invention, the server checks the location information of the OTP device 200 by using the user terminal 205 information transmitted by inputting and transmitting the N-digit OTP.

For example, when the user terminal 205 is a terminal device connected to a communication network, the server checks an IP address of the user terminal 205 and provides a communication network (eg, providing a communication network to the user terminal 205). It is preferable to check the OTP device 200 location information including a location value corresponding to any one of address information, landmark information, and location code corresponding to the IP address.

Alternatively, when the user terminal 205 is a terminal device managed by a specific terminal management institution such as a merchant terminal or a financial terminal, the server checks terminal information corresponding to the user terminal 205 and manages the terminal. It is preferable to check the location information of the OTP device 200 including a location value corresponding to any one of address information, landmark information, and location code corresponding to the terminal information in association with an organization.

If the server-side OTP generation information and the unique information of the OTP device 200 are confirmed (515), the server combines (or associates) the OTP device 200 location information with the server-side OTP generation information to form the OTP device ( In step 520, the OTP generation information including the location information as the dynamic seed value is confirmed / configured.

According to an embodiment of the present invention, if the server-side OTP generation information includes the OTP device 200 location information as a dynamic seed value, the server generates the server-side OTP generation information as the N-digit OTP '. It is preferable to confirm with the OTP generation information.

Thereafter, the server checks one or more fixed seed values for generating the N-digit OTP 'from the OTP generation information, and determines one or more dynamic seed values through parameters included in the OTP generation information. In operation 525, one or more fixed seed values and dynamic seed values are substituted into a predetermined OTP generation algorithm.

If the N-digit OTP 'is generated (530), the server compares (or verifies) the received N-digit OTP' to verify the OTP validity (535).

According to the exemplary embodiment of the present invention, if the result of the comparison between the OTP and the OTP 'is matched (or matched) or a pre-predicted result is obtained through a verification operation, the server verifies the validity of the OTP. Treat it as done.

If the OTP validity is not confirmed (540), the server receives the OTP authentication result corresponding to the OTP validity error preset OTP authentication result receiving means (for example, OTP authentication request server 210, user terminal 205, OTP) (Including one or more of the device 200).

On the other hand, if the OTP validity is confirmed (540), the server receives the OTP authentication result corresponding to the OTP validity check means (for example, OTP authentication request server 210, user terminal 205, OTP device) (Including one or more of 200) (550).

According to the present invention, when generating an OTP in an OTP device having a positioning function, the OTP is generated using the OTP device position information obtained through the positioning function in the OTP device as a seed value of the OTP, and the OTP When the OTP is authenticated by the server that authenticates the OTP, after confirming the location of the OTP device that generated the OTP, the OTP device is authenticated by using the identified OTP device location information as the same seed value. It has the advantage of being stolen / deprived from being used maliciously by a third party in any place, and of eliminating the two-factor authentication limit for OTP.

Claims (11)

When creating an OTP on an One Time Password (OTP) device, Positioning the location of the OTP device to obtain OTP device location information corresponding to the location of the OTP device; Configuring OTP generation information including the OTP device location information as a seed value; And And generating and outputting an OTP using at least one fixed seed value included in the OTP generation information and a dynamic seed value dynamically determined. Receiving OTP generated through OTP generation information including OTP device location information as a seed value; Confirming location information of the OTP device generating the OTP; Configuring OTP generation information including the identified OTP device location information as a seed value; Generating OTP 'through the OTP generation information, and comparing (or verifying) the received OTP with the generated OTP' and authenticating the received OTP validity; OTP operation method using. The method according to claim 1 or 2, And processing the OTP device location information by hashing and processing the OTP device location information into a seed value data structure of the OTP generation information. The method of claim 2, wherein the checking of the location information of the OTP device that generated the OTP comprises: When the OTP is input and transmitted through the user terminal, the communication address information of the user terminal is provided to the communication company server connected to the user terminal to confirm the address of the user terminal as the OTP device location information, or When the user terminal to which the OTP is input is a terminal-merchant terminal or a financial terminal, which is managed by a terminal management institution, the user terminal information that is confirmed by providing the user terminal information to the terminal management institution is determined by the OTP device location information. OTP operation method using the location information, characterized in that for checking with. The method of claim 1 or 2, wherein the OTP device location information, A coordinate value including a longitude value and a latitude value at which the OTP device is located, or The OTP operation method using the location information, characterized in that it comprises a location value including any one of the address information, the landmark (Landmark), the location code where the OTP device is located. The method of claim 1 or 2, wherein the OTP device location information, The OTP operation method using location information, characterized in that it is included as a dynamic seed value of the OTP generation information dynamically determined according to the OTP device location. The method of claim 1, wherein the OTP generation information, And a terminal side OTP generation information including at least one fixed seed value and a parameter for determining a dynamic seed value and the OTP device location information. The method of claim 2, wherein the OTP generation information, And a server side OTP generation information including at least one fixed seed value and a parameter for determining a dynamic seed value and the OTP device location information. A computer-readable recording medium having recorded thereon a program for executing the method of claim 1. When creating an OTP on an One Time Password (OTP) device, A location positioning unit for positioning the location of an OTP device to obtain OTP device location information corresponding to the location of the OTP device; An information constructing unit for constructing OTP generation information including the OTP device location information as a seed value; And And an OTP generator for generating an OTP using at least one fixed seed value included in the OTP generation information and a dynamic seed value dynamically determined. Information receiving means for receiving an OTP generated through OTP generation information including OTP device location information as a seed value; Location checking means for confirming location information of the OTP device that generated the OTP; Information constructing means for constructing OTP generation information including the identified OTP device position information as a seed value; And OTP authentication means for generating OTP 'through the OTP generation information, and compares (or verifies) the received OTP and the generated OTP' to authenticate the received OTP validity. OTP operation system using location information.

Images