KR20120096158A - Method for user authentication - Google Patents

Abstract

PURPOSE: A user authentication method is provided to perform the login authentication of a user by using identity information which is not related to user personal information in an application service object. CONSTITUTION: A user inputs personal identity information(S101). The user accesses an application service object(S102). The application service object calls an authentication module(S103). The authentication module asks a user a login request(S104). The user inputs user identification information into the authentication module(S105). The authentication module transmits a received telephone number and a citizen-number to the authentication service object(S106). The authentication service object provides a virtual ID to the authentication module(S107). The authentication module transfers the virtual ID to the application service object(S108). The application service object provides the service to the user(S109). The authentication service object transmits a message to the user(S110). The user transmits an approval state about the message to the authentication service object(S111). The authentication service object transfers the user personal information to the application service object(S112). The application service object provides a service to the user(S113).

Description

User Authentication Method {METHOD FOR USER AUTHENTICATION}

The disclosed technique relates to a user authentication method.

The initial technology for logging in to web services or applications that only the registered user should access and use is to register at the time of registration or to enter the ID and password promised between the user and the service provider. It was to determine whether it is the same as the one registered in advance at the service provider side, but since the user's ID and password may be exposed by hacking techniques such as Keylog or Sniffing, There was a concern that the login authentication method that was relied on would lower security.

One-time passwords may be used to make login authentication more reliable, but a hardware method using a terminal for generating a one-time password or a method using a virtual machine (VM) for a communication terminal or a text message of a mobile phone may be used. have.

The hardware method is expensive due to the purchase of an additional terminal, and there are limitations due to battery life. In addition, the virtual machine method of the communication terminal has a problem that there is a model that can not be mounted in the virtual machine depending on the communication terminal and there are restrictions that may be affected by the environment, such as the regulation of the mobile communication company. The method of using a text message on a mobile phone is to pass a random number to the user and authenticate the login only if the passed random number is entered correctly at the login stage. There is a problem of high cost because it is necessary to send a text message.

In the prior art, HTTP, a web protocol, is a stateless protocol that does not store previous state due to the simplicity of the protocol. This makes it impossible for the HTTP protocol itself to maintain the user's previous state. The cookie was created to solve this problem. The cookie is an object for maintaining the state of a web page and has been used as a kind of token exchanged between processes. In addition, when the visitor first accesses the website using the visitor terminal, the web server of the website sends the unique authentication information in a cookie to the browser so as not to perform a separate authentication in the page movement of the visitor. Subsequent connections are authenticated by cookies coming and going between the web server and the browser. That is, the cookie stored in the accessor's terminal eliminates the need for the visitor to enter their ID and password each time they visit the webpage. However, such cookie information is stored in the plain text form on the visitor's terminal, making it possible to access another person's session by modifying the variable value of the cookie, and possibly extracting other person's cookie information by malicious code. There is also a security problem.

The technical problem to be achieved by the disclosed technology is to store the user's personal information in the authentication service object, and to provide a virtual ID not related to the user's personal information to the service server when using the service to prevent the user's personal information exposure To provide a way.

A first aspect of the disclosed technology to achieve the technical problem, (a) when a user accesses an application service object, the application service object calling the authentication module; (b) the authentication module receiving personal unique information from a user and providing the authentication service object to an authentication service object; (c) the authentication service object providing the authentication module with a virtual ID corresponding to the personal unique information; (d) the authentication module providing the virtual ID to the application service object; And (e) the application service object providing a service to the user.

A second aspect of the disclosed technology to achieve the technical problem, the authentication module is called from an application service object; Receiving, by the authentication module, personally unique information from a user; Providing, by the authentication module, the personally unique information to an authentication service object; Receiving, by the authentication module, a virtual ID corresponding to the personal unique information from an authentication service object; And the authentication module provides the virtual ID to the application service object.

Embodiments of the disclosed technology can have the effect of including the following advantages. However, the embodiments of the disclosed technology are not meant to include all of them, and thus the scope of the disclosed technology should not be understood as being limited thereto.

According to an embodiment of the present invention, the user authentication method according to the embodiment may protect the user's personal information by performing login authentication of the user by using identification information irrelevant to the user's personal information on the application service object. There is an advantage. In addition, when the application service object requires the personal information of the user in providing the service, the application service object has an advantage of allowing the user to be aware of what information is used by using the user's approval. In addition, the application service object has an advantage of preventing the server management from leaking user information arbitrarily by using an encryption API. In addition, since the user subscribes to only one authentication service object and the authentication service object performs user authentication on a plurality of application service objects, the user does not have to proceed with the registration procedure for each service.

1 is a flowchart illustrating an authentication step of a user authentication method according to an exemplary embodiment.

The description of the disclosed technique is merely an example for structural or functional explanation and the scope of the disclosed technology should not be construed as being limited by the embodiments described in the text. That is, the embodiments may be variously modified and may have various forms, and thus the scope of the disclosed technology should be understood to include equivalents capable of realizing the technical idea.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms 'first', 'second', etc. are used to distinguish one component from another component and the scope of rights should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "include" or "have" refer to features, numbers, steps, operations, components, parts, or parts thereof described. It is to be understood that the combination is intended to be present, but not to exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

Each step may occur differently from the stated order unless the context clearly dictates the specific order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the disclosed technology belongs, unless otherwise defined. Terms defined in commonly used dictionaries should be interpreted to be consistent with meaning in the context of the relevant art and can not be construed as having ideal or overly formal meaning unless expressly defined in the present application.

1 is a flowchart illustrating a user authentication method according to an exemplary embodiment.

Referring to FIG. 1, in operation S101, a user 110 joins an authentication service object 130, inputs personally unique information of a user, and information of a user required for a service provided by an application service object 140. Enter. In this case, the personal unique information is information for identifying a subscriber who has subscribed to the authentication service object 130 and includes a phone number or a social security number. According to the embodiment, the telephone number can be used as the ID and the social security number can be used as the PW. Information of the user required for the service may include a name, address, gender, age, payment account or e-mail address. According to the embodiment, when the service provided by the application service object 140 is a mail order service, information such as payment account information, address, name, etc. of the user is required for payment and delivery of goods.

Meanwhile, according to an embodiment, the user 110 may be a web browser running on a PC, a dedicated browser capable of accessing the web on a mobile device, or a dedicated application designed to access the application service and use the service. have.

In operation S102, the user 110 accesses the application service object 140. The application service object 140 is an object that provides a service to the user 110, and corresponds to a mobile service object that provides a service to a web server or a mobile device that provides a web page to the user. On the other hand, the application service object 140 provides a variety of services according to the embodiment, such as online shopping, photo printing, traffic information.

In operation S103, the application service object 140 calls the authentication module 120. The authentication module 120 provides a login interface to the user 110 to receive login information from the user. At this time, in step S101, the telephone number and social security number entered when the user subscribes to the authentication service object 130 is used as login information. The user 110 logs in with the authentication service object 130 using the telephone number as the ID and the social security number as the PW.

The authentication module 120 may be installed and driven as an application programming interface (API) on the application service object 140. According to another embodiment, when the user 110 accesses the application service object 140 in step S102, the user 110 may be driven by receiving the authentication module installation file and executing the authentication module 120. According to another embodiment, when the user 110 is a dedicated browser or a dedicated application running on a mobile device accessing the application service object 140, the user 110 may include an authentication module 120.

In step S104, the authentication module 120 requests the user 110 to log in.

In operation S105, the user 110 inputs user identification information to the authentication module 120. At this time, since the user 110 enters the phone number and the resident number in the login request window, the user needs to call the authentication module 120 through a separate operation or access the authentication module 120 through a separate method. There is no.

In step S106, when receiving the telephone number and the resident number, the authentication module 120 transmits the received telephone number and the resident number to the authentication service object 130. The authentication service object 130 recognizes a phone number and a social security number to identify an individual subscribed to the authentication service object 130.

When the authentication service object 130 identifies the subscribed individual, the authentication service object 130 generates a virtual ID. According to an embodiment, the virtual ID may be generated when the user 110 subscribes to the authentication service object 130. A virtual ID is an ID made up of letters or numbers that have nothing to do with an individual's information.

In operation S107, the authentication service object 130 generates a virtual ID and provides it to the authentication module 120.

Subsequently, the authentication module 120 transmits the virtual ID to the application service object 140 (S108). The application service object 140 recognizes the virtual ID as personal identification information and performs a user login. According to an embodiment, the login may be performed by API interworking between the authentication module 120 and the application service object 140.

In operation S109, the application service object 140 provides a service to the user 110. When the personal information of the user is needed in the service providing process, the application service object 140 requests the authentication service object 130 for the necessary personal information. The application service object 140 transmits the virtual ID to the authentication service object 130 to request necessary user personal information. The authentication service object 130 requests the user's approval without directly providing the requested user personal information to the application service object 140.

In operation S110, the authentication service object 130 transmits a message indicating that the user's personal information is provided to the application service object 140, including an information use approval request message, to the user 110. According to an embodiment, the message is transmitted to the terminal interface 110 through the authentication module 120.

In operation S111, the user 110 checks whether the message is approved and transmits it to the authentication service object 130. The authentication service object 130 confirms the approval of the user 110 and transfers the requested personal information of the user to the application service object 140 (S112).

In operation S113, the application service object 140 provides a service to a user by using the received user personal information. According to an embodiment, the application service object 140 may use an API that provides a service by encrypting user's personal information. Therefore, even an administrator who manages the application service object 140 can prevent access to the user's personal information arbitrarily.

Meanwhile, information / message transmission between the user 110, the authentication module 120, the authentication service object 130, and the application service object 140 in steps S102 to S113 may be transmitted using an encrypted protocol. According to an embodiment, information exchange between the authentication service object 130 and the application service object 140 may be performed through API interworking.

In the above user authentication method, the authentication service object 130 may perform user authentication by providing the virtual ID to the application service object 140 provided from different operators. According to an embodiment of the user authentication method, the first operator managing the authentication service object 130 performs a user authentication step through a service alliance with a plurality of providers of the second and third. do. The first operator provides the API of the authentication module 120 to the operators of the second and third. In the second and third business, the authentication module 120 may be mounted on the application service object 140 of the company, or the authentication module 120 may be called when the user 110 accesses the application service object 140. Make sure

The user authentication method according to the above-described embodiment has an advantage of protecting the user's personal information by performing login authentication of the user by using the identification information irrelevant to the user's personal information to the application service object 140. . In addition, when the application service object 140 requires the user's personal information in providing the service, the application service object 140 may be used with the user's approval to alert the user of what information is used. In addition, the application service object 140 has an advantage that server management can be prevented from leaking user information arbitrarily by using an encryption API.

In addition, since the user subscribes to only one authentication service object and the authentication service object performs user authentication on a plurality of application service objects, the user does not have to proceed with the registration procedure for each service.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) .

The computer readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

The disclosed method and apparatus have been described with reference to the embodiments illustrated in the drawings for ease of understanding, but these are merely exemplary, and various modifications and equivalent other embodiments are possible to those skilled in the art. Will understand. Therefore, the true technical protection scope of the disclosed technology should be defined by the appended claims.

110: user
120: authentication module
130: authentication service object
140: application service object

Claims (15)

(a) when the user accesses an application service object, the application service object calling an authentication module;
(b) the authentication module receiving personal unique information from a user and providing the authentication service object to an authentication service object;
(c) the authentication service object providing the authentication module with a virtual ID corresponding to the personal unique information;
(d) the authentication module providing the virtual ID to the application service object; And
(e) the application service object comprising providing a service to the user. The method of claim 1,
Between (d) and (e), if the application service object needs information about the user in providing the service,
Request information about the user corresponding to the virtual ID to the authentication service object, and the authentication service object receives approval of the user from using the information on the user, and sends information about the user to the application service object. User authentication method comprising the steps of providing The method of claim 1,
and before step (a), the user subscribes to the authentication service object, inputs the personal unique information of the user, and inputs information required for the service. The method of claim 1,
The personally unique information includes a phone number or social security number. The method of claim 1,
The authentication module is a user authentication method located on the terminal of the user or on the application service object. 6. The method of claim 5,
The user terminal comprises a PC or a mobile device. 6. The method of claim 5,
The application service object includes a web server providing a service on a web, a mobile server providing a service to a mobile device, or an application running on the user terminal. The method of claim 1,
And the authentication service object provides the virtual ID to an application service object provided from different service providers. Calling an authentication module from an application service object;
Receiving, by the authentication module, personally unique information from a user;
Providing, by the authentication module, the personally unique information to an authentication service object;
Receiving, by the authentication module, a virtual ID corresponding to the personal unique information from an authentication service object; And
And the authentication module provides the virtual ID to the application service object. The method of claim 9,
After the authentication module provides the virtual ID to the application service object,
The authentication service object is requested for information about the user corresponding to the virtual ID, receives the user's permission to use the information, and provides information about the user to the application service object to provide a service to the user. The user authentication method further comprising the step of. The method of claim 9,
Prior to the invoking step, the user subscribes to the authentication service object, inputs the personal unique information of the user, and inputs information required for the service. The method of claim 9,
The personally unique information includes a phone number or social security number. The method of claim 9,
The authentication module is a user authentication method located on the terminal of the user or on the application service object. The method of claim 13,
The application service object includes a web server providing a service on a web, a mobile server providing a service to a mobile device, or an application running on the user terminal. The method of claim 9,
And the authentication service object provides the virtual ID to an application service object provided from different service providers.

Images