KR20110040265A - A method for authenticating a user - Google Patents

Abstract

PURPOSE: A method for authenticating a user is provided to effectively dealing with a shoulder surfing attach by inputting a set comprised of several elements including a password character. CONSTITUTION: A one-time session key set and a password set are provided to a user(S100). The password set includes password characters corresponding to the session key set elements with a ratio of 1:N(N>1). A password subset is inputted(S200). N characters of the password characters are matched with the specific session key of the session key set. A user is authenticated(S300).

Description

A METHOD FOR AUTHENTICATING A USER

The present invention relates to a user authentication method, and more particularly, to a user authentication method in which a user inputs a set of several elements including a password character instead of directly inputting a password character, surfing attack, and the like.

In the modern society in which information and communication technology has been developed, a personal identification number (PIN, password, user authentication (personal identification number), etc.) is used for access control to devices such as a computer, a KIOSK terminal, a bank terminal Number) and user authentication method by password. In this method, a password or a personal identification number (user authentication number) stored in a device such as a computer is compared with a value input by a user, and a determination is made as to whether or not the user is coincident or not.

The personal identification number (user identification number) usually consists of 4 digits. Numbers in the range of 0000 to 9999 are available and have a number of 10,000 cases. Depending on the device, a number associated with a sequential number or personal information such as 1111 may be restricted when used as a personal identification number (user identification number), and the number may be less than 10,000. The user authentication method using the personal identification number (user authentication number) can obtain the access authority to the apparatus when the personal identification number (user authentication number) is known, There is no ambiguity about. In addition, there is no need for additional management or maintenance costs because additional cost is not required because authentication is attempted through the terminal depending on the user's memory without the need for an additional device.

However, this method has a problem in safety because the attacker can easily find out the personal identification number only by peeping over the shoulder when the user enters the personal identification number (user authentication number). In order to solve this problem, there has been proposed a method of indirectly inputting a personal identification number (user authentication number) through matching between a symbol and a number, which is known only to a user without directly inputting a personal identification number (user authentication number) Is recorded on a small camcorder or the like, especially when the same user is recorded many times, there is still a serious problem in the stability thereof.

The present invention proposes a method for solving the above-mentioned problems of existing methods, in which a user inputs a set composed of a plurality of elements including a password character instead of directly inputting a password character, And it is an object of the present invention to provide a user authentication method capable of responding to an attack such as a peek attack more effectively.

According to an aspect of the present invention,

(1) providing a one-time session key set to be used for indirectly inputting a user authentication password and password characters arranged to correspond to the session key set elements at a ratio of 1: N (N >

(2) receiving N password characters from a user by matching N characters of the password characters with a specific session key in the session key set; And

(3) performing authentication of the user by checking whether the user authentication password character of the user is included among the N password characters inputted.

Preferably,

(N + 1) -th row, the session key set and the password strings of the generated (N + 1) -th row are provided to the user in step (1)

In step (2), the session key set 1 row is fixed, the user can move the password character array N row, or the password character string N row is fixed, So that the N password characters can be matched with the specific session key.

More preferably, in step (1), the password character array N is generated by matching the row of the password character array with respect to one row of the session key set, It is possible to display a plurality of times by repeating one key set.

Preferably, when the user authentication password is composed of L characters, the steps (1) to (3) may be repeatedly performed for each of the L characters in order.

According to the user authentication method of the present invention, by allowing a user to input a set composed of several elements including a password character instead of directly inputting a password character, a user can more effectively cope with an attack such as a peeking attack using a recordable device .

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the embodiment of the present invention, the password may include a common alphabetic character, a number, or a special symbol. However, in the following description, 'password' refers to a personal identification number (PIN) And the like.

1 is a diagram illustrating a configuration of a user authentication method according to an embodiment of the present invention. 1, a user authentication method according to an exemplary embodiment of the present invention includes a session key set and a password character array providing step S100, a password character set inputting step S200, and a user authentication performing step S300 .

In step S100, the one-time session key set to be indirectly used for inputting the password and the password characters are arbitrarily arranged to correspond to the session key set at a ratio of 1: N (N > Here, "indirectly inputting a password" means that, instead of directly inputting a password such as '1234' as in the existing user inputting method, it is possible to match '1234' to a specific session key only known to the user This means that the input is indirectly by the method. Also, the 'one-time' session key set means that the session key set is randomly generated whenever the session key set and the password character array are generated. The fact that the session key set and password characters are mapped in a ratio of 1: N means that if the session key set is composed of 10 elements, the password character array is composed of 10xN elements. For example, if N is 3, the number of elements in the password character array is 30 for a session key set composed of 10 elements. Since N is greater than 1, the total number of elements in the password character array is larger than the total number of elements in the session key set.

In step S200, a set of N characters from the password character array is matched with a specific session key in the session key set, thereby receiving a password character set composed of N characters from the user. In the present invention, instead of directly matching a specific password character with a specific session key in a 1: 1 manner, a password subset including a specific password character is matched with a specific session key. That is, the password character set {1, a, k} including '1' is matched with the password character, for example, '1', not the specific session key of the session key set. Of course, although the number of elements of the password character set to be matched with the specific session key is not limited to N, N is preferred in order to facilitate implementation of the invention using the symmetric structure.

In step S300, the user authentication is performed by checking whether or not the actual password character of the user is included in the input N number of password character sets. In the present invention, since a password character set including a specific password character is input instead of receiving a specific password character, instead of confirming whether or not the password character input from the user matches the user authentication password, The user authentication procedure is performed by checking whether or not the user authentication password character is included in the password character set.

According to an embodiment, in step S100, the password character array N may be generated by matching N rows of the session key set with respect to one row, and the generated session key set and password character array of the generated N + 1 row may be provided to the user. In this case, in step S200, the N password character sets may be matched with the specific session key by allowing the user to move the N character row of the password character array while fixing one row of the session key set. Alternatively, it is possible to configure the password character array N to be fixed and to move one row of the session key set. Of course, it is possible to generate a plurality of times by repeatedly displaying one row of the session key set so as to correspond to each row constituting the password character array of N rows, by generating N rows of the password character array for one row of the session key set. This is to allow the user to easily identify the matching of the elements of the session key set with the specific elements of the password character array. In this case, in step S200, the session key sets repeatedly displayed a plurality of times are all fixed, the user moves the password character array N rows or the password character array N row is fixed, .

Most of the passwords are composed of two or more characters (or numbers). In this case, steps S100, S200, and S300 must be repeated as many times as the number of characters constituting the password. Generally, if the password consists of L characters, steps S100, S200, and S300 are repeated for each of the L characters in order.

2 is a block diagram of a user authentication apparatus for implementing a user authentication method according to an embodiment of the present invention. 2, the user authentication apparatus according to an exemplary embodiment of the present invention may include an input module 210, a storage module 220, a calculation module 230, and a display module 240 have.

The input module 210 is a module for receiving information from a user through a keyboard, a mouse, a touch screen, a keypad, an RFID, a smart card, biometrics (fingerprint, iris, voice, face) The user inputs his or her own ID through the input module 210. The input module 210 transmits the input ID to the operation module 230. If the input user ID is valid, The user authentication password is input through the authentication method, and the user's access is accepted. 3 is a block diagram illustrating a configuration of an input module of a user authentication apparatus according to an embodiment of the present invention. 3, the input module of the user authentication apparatus according to an exemplary embodiment of the present invention may be implemented with an input module using a touch screen method (FIG. 3A) and an input module using a button (FIG. 3B) In addition, various input methods can be adopted according to the system environment, such as a finger mouse for a smart phone, a touch pad for a notebook, and an input method using a G-sensor.

The storage module 220 stores a user's ID and a corresponding user authentication password. The operation module 230 searches the ID list stored in the storage module 220 for the ID received from the input module 210 to determine whether the user ID is a valid user ID. If the ID is a valid ID, The password input through the module 210 is compared with the password stored in the storage module 220, and the access is accepted when they match. If the ID is not valid, it indicates that the ID is invalid in the display module 240. In addition, symbols are arranged according to the value input from the input module 210, and transmitted to the display module 240. The display module 240 may display a character array used for a password input and symbols to be used as a session key in a two-dimensional array, and may provide a user with a usage message or a guidance message such as an error message. The input module 210 and the display module 240 may be implemented as an integrated unit.

4 is a diagram illustrating an example of a password input screen that can be displayed in the display module in the user authentication method according to the embodiment of the present invention. As shown in Fig. 4, the password input screen may be constituted by a session key set of one row and a password character array of N rows corresponding thereto. A set of session keys in a row may consist of, for example, M symbols, each symbol representing a one-time session key to be used to indirectly input a password. Here, the symbol that can be used as the session key includes not only the graphic image, but also any means that the user can easily distinguish, such as letters, special symbols, and colors. The password character array of N lines starting from the second line can be any symbols that can be used in the password, such as numerals, letters, or special symbols. The number of characters that can be input by the user, that is, a password, is N × M, N and M can be changed according to the system environment, and N is a number greater than or equal to 2. N is set to 2 or more, by allowing the user to sequentially input sets containing password characters instead of password characters, so that a plurality of times of shoulder surfing attack (peeking or camera recording) This is to provide stronger security than the authentication method. Additional information such as color or pattern can be provided for each row so that users can easily distinguish each row when entering password characters. In addition, the position of the session key set is not limited to the first row as shown in FIG. 4, but may be located in the middle or last row of the matrix, and the same symbol may be repeatedly displayed (See FIG. 6). In the password input screen shown in Fig. 4, one of the password constituent characters can be input by one operation for the (N + 1) xM matrix, and if it is repeated L times, an L-letter password can be input .

5 and 6, a detailed operation process in the user authentication method proposed by the present invention will be described below.

FIG. 5 is a diagram illustrating a process of inputting a user authentication password composed of four characters (L = 4) according to the user authentication method proposed in the present invention. Although the touch input method is described in the embodiment shown in FIG. 5, the input method is not limited to this, and other input methods that can rotate the array may be operated in the same manner. In the embodiment shown in FIG. 5, the case where the user authentication password is a combination of letters and numbers (a to z, 0 to 9) is shown. However, in a case where the password is composed of letters only or numbers It can be done in a similar way. 5, the four-digit user authentication password 'inha' is set to a value of 4 when the number of rows (N) of the password character array is 4 and the number of elements (M) of the row of the session key set and password character array is 9 This is the process of being authenticated. First, the user authentication system randomly generates a password character array corresponding to a session key set (top row 1) composed of nine elements and a session key set at a ratio of 1: 4, and provides the password character string to a user (FIG. The user rotates the element array of the session key set using the input module to move the session key (♥) selected by the user to be positioned in the same column as the first character (= i) of the user authentication password (FIG. The user presses an input button to inform the user authentication system of his session key (FIG. 5C). Next, the session key set is rotated such that the second character ('n') of the user authentication pass word is located in the same column as the session key (♥) (FIG. 5D). When the second character 'n' of the user authentication password is located in the same column as the session key (♥) through the process shown in FIG. 5D, the second character of the user authentication password is input using the input button, (Fig. 5E). 5D to 5E, when the input of the next characters ('h' and 'a') of the user authentication password is completed, the user authentication is completed (FIG. 5H).

In the example shown in FIG. 5, the user determines his / her session key in the first step, but the present invention is not limited in this way. In another embodiment, the authentication system uses the session key set among the session key set elements It is possible to skip the step of determining the user's session key by arbitrarily determining it and then presenting it in the same column as the first character of the user password and starting it. In this case, the first character of the password is used only to notify the user of the session key, and the user does not perform any further input related to the first character of the password. For example, if the screen presented to the user is as shown in FIG. 5A, the user is assigned a session key as a symbol of the column in which the first character 'i' of the password is located. However, for the second and subsequent characters of the password, the password character array is provided for each character, the user moves and inputs the array, and the user authentication process is performed in the same manner. By doing so, it is possible to prevent a bias phenomenon in which a specific session key is selected more frequently than other session keys in accordance with the user's taste in selecting the session key.

FIG. 6 shows another example of a user authentication password input screen for applying the user authentication method proposed in the present invention, in which the same session key set is placed between two sets of password character strings, So that the correspondence between the string sets can be more easily confirmed. In the case of the start button, when the user authentication process is started, the input button is changed to an enter button and displayed. .

As described above, according to the user authentication method proposed by the present invention, by allowing the user to sequentially input sets including password characters in place of password configuration characters, It can cope effectively.

The present invention may be embodied in many other specific forms without departing from the spirit or essential characteristics and scope of the invention.

1 is a diagram showing a configuration of a user authentication method according to an embodiment of the present invention;

2 is a block diagram illustrating a configuration of a user authentication apparatus for implementing a user authentication method according to an embodiment of the present invention.

3 is a diagram illustrating a configuration of an input module of a user authentication apparatus according to an embodiment of the present invention.

4 is a diagram illustrating an example of a user authentication password input screen that can be displayed in the display module in the user authentication method according to the embodiment of the present invention.

5 is a diagram illustrating a process of inputting a four-digit user authentication password composed of a combination of letters and numbers according to the user authentication method proposed in the present invention.

FIG. 6 is a view showing a case where an identical session key set is placed between two rows of password character arrays, as an input screen for applying the user authentication method proposed in the present invention; FIG.

Description of the Related Art

S100: Providing session key set and password character array

S200: Password character set input step

S300: User authentication step

210: input module

220: Storage module

230: Operation module

240: Display module

Claims (5)

A user authentication method for authenticating a user, (1) a one-time session key set used for indirectly inputting a user authentication password, and password characters arranged in N rows arbitrarily so as to correspond to the session key set elements at a ratio of 1: N (N >step; (2) receiving N password characters from a user by matching N characters of the password characters with a specific session key in the session key set; And (3) performing authentication of the user by checking whether the user's authentication password character of the user is included in the input N password characters The user authentication method comprising: The method according to claim 1, In step (1), the password character array is generated by matching the password character array to one row of the session key set so as to be N rows, and the session key set and the password word character array of the generated N + 1 row are provided to the user , In step (2), the session key set 1 row is fixed, the user can move the password character array N row, or the password character string N row is fixed, So as to match N password characters in the password character array with the specific session key. 3. The method of claim 2, The method of claim 1, wherein, in step (1), the session key set is generated by matching the password character array to one row of the session key set to be N rows, And a plurality of rows are displayed repeatedly. The method according to claim 1, Wherein when the user authentication password is composed of L characters, the steps (1) to (3) are repeatedly performed for each of the L characters in order. The method according to claim 1, When the user authentication password is composed of L characters, only the step (1) is performed for the first password character so that the user recognizes a randomly set session key, and L-1 password characters Wherein the steps (1) to (3) are repeatedly performed in order for each user.

Images