KR20140020337A - Method for authentication using user apparatus, digital system, and authentication system thereof - Google Patents

Abstract

A method for self-authentication using a user device, a digital system and an authentication system therefor are provided. A method for self-authentication using a user device according to an embodiment of the present invention includes: a step that a digital system performs communication with a predetermined user device for self-authentication; and a step that the digital system transmits a confirmation signal which includes at least one between terminal identification information of the digital system or device identification information of the user device which is received through the communication to an authentication system. An authentication process which authenticates at least one between the terminal identification information or the device identification information which are included in the transmitted confirmation signal is performed by the authentication system, and an authentication request outputted to the authentication system or a service system which is connected to the authentication system is as successful only if the authentication confirmation process is processed.

Description

Identity authentication method using a user device, digital system and authentication system for the same {Method for authentication using user apparatus, digital system, and authentication system}

The present invention relates to a user authentication method using a user device, a digital system and an authentication system therefor, and more particularly, a user who wants to use various services (eg, financial transactions such as login, payment or transfer, certificate issuance, etc.). The present invention relates to an authentication method having a simple and very excellent security using a user device and a digital system (for example, a mobile terminal) and a system therefor when it is necessary to perform identity authentication (or user authentication).

Conventional techniques related to identity authentication (or user authentication) have traditionally been identity authentication using usernames and passwords. However, such a conventional authentication method has a problem that it is difficult to perform a normal authentication function when an ID and a password are leaked. To complement this, various authentication schemes have appeared.

For example, there are authentication of the mobile phone itself, authentication by a user using an authorized certificate, authentication using an OTP, authentication of an i-PIN (Internet Personal Identification Number), or authentication using a credit card.

Authorized certificate authentication is an authentication protocol with a relatively high security level, but it is not easy to carry the authorized certificate stably and there are disadvantages such as complicated authentication process. In addition, the public certificate has also recently been leaked in large quantities, thus posing a problem of safety.

i-PIN uses a virtual identification number used on the Internet to perform self-authentication. In this case, the new identification number is not only required for the user to know in advance. There is a limitation that it is difficult to perform a normal authentication function.

In addition, the mobile phone identity authentication is a method of authenticating the occupation of the mobile phone using the authentication number, there is a problem that is vulnerable to smishing.

Also, since all of these conventional technologies are a method of inputting a password (certificate password, I-PIN password) or an authentication number, if a password or an authentication number is exposed to another person, the authentication of the user is inevitable. There is a high risk of exposure to hacking.

In addition, in the case of authentication using the OTP, the user can authenticate only when the user has the OTP client (OTP token). Also, the user is required to generate the OTP through the OTP client, There is a presence.

Accordingly, a technical idea that can provide a highly secure personal authentication protocol while maintaining convenience compared with conventional authentication technologies is required along with a payment protocol.

In addition, online crime becomes more intelligent and frequent as online financial transactions become more active, so the need for 2-channel authentication is increasing. Technological thinking is required to enable users to easily perform authentication while enabling 2-channel authentication.

In addition, there is a case where a user allows a predetermined service to another person as necessary, and in this case, the authentication request and the authentication act to be performed by a legitimate user to be authenticated may be separated, so that the user may easily There is a need for a technical idea that allows the use of services without exposing information.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide a digital system and a user device which are highly likely to be carried by a user.

In addition, it is possible to separate the authentication device (i.e., the digital system and the user device), which is a tool necessary for authentication, from the device that performs the authentication request, so that two-channel identity authentication, remote identity authentication, or a valid user for a third party can be performed. It is to provide a technical idea that makes it easy to perform identity authentication to allow a service.

In addition, the digital system implements a technical idea that can provide a higher security by implementing a communication (for example, short-range wireless communication) with the user device, that is, the communication between the authentication tool to transmit the confirmation signal required for authentication. To provide.

In addition, even when a user device, which is an authentication tool for identity authentication, uses a payment card, payment financial information (eg, card number, expiration date, CVC, etc.) may not be distributed on the network, so that information leakage may be caused by an attack. Even if it occurs, it provides a technical idea of a self-authentication method that can provide high security by reducing the risk of leaking payment financial information by an attacker.

The present invention also provides a technical idea that allows a digital system and / or a user device to be used for an authentication operation to be predetermined and perform authentication of the user only through the digital system and / or the user device.

In addition, the authentication is successful only if the digital system to be used for the authentication and the user device paired with the digital system are set in advance, and communication (for example, contact or contactless) is performed between the paired devices. It is to provide a technical idea that can provide a significant security synergy effect.

Technical concept related to identity verification in the present invention can be applied to payment authentication as it is. In general, payment is authenticated at the stage before payment, and in particular, when a payment card is used as a user device according to the technical idea of the present invention, it is natural that the authentication through payment card may be applied as payment verification. something to do.

In accordance with another aspect of the present invention, there is provided a user authentication method using a user device, the digital system performing communication with a predetermined user device for authentication, and when the communication is performed, the digital Transmitting, by the authentication system, a confirmation signal to the authentication system, the system including at least one of terminal identification information of the digital system or device identification information of the user device received through the communication. An authentication confirmation procedure is performed in which at least one of the terminal identification information or the device identification information included in the confirmation signal is authenticated, and the authentication confirmation procedure is successful, and a service connected to the authentication system or the authentication system from a predetermined data processing apparatus. Successful authentication request output to the system It can be characterized.

In addition, the user authentication method using the user device, the authentication action request information output by the authentication system receiving the authentication request including the identification information of the digital system output from the data processing device is the data processing device or The method may further include displaying the digital system. When the authentication activity request information is displayed, the digital system may perform the communication with the user device.

In addition, the user authentication method using the user device, the digital system further comprises the step of receiving the authentication action request information output from the data processing device receiving the identification information of the digital system, the authentication action request information When the digital system is received, the digital system can perform the communication with the user device.

The user device may be a payment IC card, and the user device identification information included in the confirmation signal may be identification information of the user device irrelevant to payment financial information of the payment IC card. Can be.

The authentication method using the user device may further include determining, by the digital system, whether the user device is a preset pair so as to correspond to the digital system, and as a result, the user device must be a preset pair. The confirmation signal may be transmitted to the authentication system.

The user authentication method using the user device may include requesting, by the digital system or the authentication system, user authentication information corresponding to the user device to a user of the digital system, and user authentication information input in response to the request. The digital system or the data processing device further comprises the step of transmitting to the authentication system, characterized in that the authentication confirmation procedure is successful only if the user authentication information is further authenticated by the authentication system.

The digital system may not include payment financial information of the user device, wherein the user device is a payment IC card.

In accordance with another aspect of the present invention, there is provided a user authentication method using a user device, wherein the first authentication output by a data processing device receives identification information of a digital system of a second user by a first user. The digital system receives the second authentication act request information corresponding to the second authentication request outputted by the authentication system that receives the action request information by the digital system or receives the second authentication request by the data processing apparatus. Receiving, when the digital system communicates with a predetermined user device, and when the communication is performed, terminal identification information of the digital system or device identification of the user device received through the communication. Transmitting a confirmation signal including at least one of the information to the authentication system; And, by the authentication system, an authentication verification procedure in which at least one of the terminal identification information or the device identification information included in the transmitted confirmation signal is authenticated is performed, and the authentication verification procedure is successful. It may be characterized in that the first authentication request or the second authentication request corresponding to the information is successfully processed.

In the authentication method using a user device according to an embodiment of the present invention for solving the technical problem, when the digital system communicates with a predetermined user device, the authentication system is a confirmation signal from the digital system-the confirmation signal is Receiving at least one of terminal identification information of the digital system or device identification information of the user device acquired by the digital system through the communication, wherein the authentication system is based on the received confirmation signal. Performing an authentication verification procedure for authenticating at least one of the terminal identification information or the device identification information; and if the authentication verification procedure is successful, the authentication system connects a predetermined data processing device to the authentication system or the authentication system. Successfully process the authentication request output to the service system. It can include.

In addition, the user authentication method using the user device, the authentication system receiving the authentication request including the identification information of the digital system from the data processing device, and the authentication system in response to the digital system Or transmitting the authentication activity request information to the data processing device, and after transmitting the authentication activity request information, the authentication system performs the authentication confirmation procedure only when the confirmation signal is received from the digital system. It may be characterized by.

The authentication method using the user device may include: authenticating whether a pair is established by determining whether the digital system and the user device are pairs set to correspond to the authentication system in advance by the authentication system. It further includes, and whether the pair is authenticated can be determined that the authentication confirmation procedure was successful.

In accordance with another aspect of the present invention, there is provided a user authentication method using a user device, wherein an authentication request output from a data processing device that receives identification information of a digital system of a second user by a first user is authenticated. Receiving the system, transmitting, by the authentication system, authentication activity request information corresponding to the received authentication request to the digital system; and when the digital system and a predetermined user device communicate with each other, the authentication system Receiving an acknowledgment signal from a digital system, wherein the acknowledgment signal includes at least one of terminal identification information of the digital system or device identification information of the user device acquired by the digital system through the communication; The terminal identification tablet based on the received confirmation signal Or when performing an authentication procedure to authenticate the at least one of the device identification information, and the authentication procedure is successful, and the authentication system may include the step of processing the authentication request succeeds.

The user authentication method using the user device may be recorded on a computer readable recording medium recording a program.

Digital system for performing the user authentication using the user device according to an embodiment of the present invention for achieving the above technical problem, in the digital system, a communication module for performing communication with the authentication system, a user authentication of a predetermined authentication request In order to communicate with the user device through the user device communication module and the user device communication module for communicating with the user device for the confirmation, the confirmation signal-the confirmation signal is the terminal identification information of the digital system or through the communication A control module for transmitting at least one of the obtained device identification information of the user device to an authentication system, wherein, by the authentication system, the terminal identification information or the device identification included in the transmitted confirmation signal An authentication confirmation procedure is performed in which at least one of the information is authenticated. When the procedure is successful, the authentication request output from the predetermined data processing apparatus to the authentication system or the service system connected to the authentication system may be successfully processed.

The control module may not include payment financial information of the user device, wherein the user device is a payment IC card.

The digital system for performing the user authentication using the user device according to an embodiment of the present invention for achieving the technical problem is output by the data processing device received the identification information of the digital system of the second user by the first user Communication for receiving received first authentication activity request information or second authentication activity request information corresponding to the second authentication request outputted by the authentication system that has received the second authentication request by the data processing apparatus. Module, a user device communication module for communicating with a predetermined user device, and when the communication is performed, a confirmation signal-the confirmation signal is terminal identification information of the digital system or device identification of the user device obtained through the communication. And a control module for transmitting at least one of the information to the authentication system. On the basis of the confirmation signal, if the authentication confirmation procedure for authenticating at least one of the terminal identification information or the device identification information by the authentication system is successful, a first authentication request or the first authentication request corresponding to the first authentication action request information. 2 may be characterized in that the authentication request is successfully processed.

In the authentication system according to an embodiment of the present invention for achieving the technical problem, when the digital system communicates with a predetermined user device, the confirmation signal output by the digital system-the confirmation signal is a terminal of the digital system A communication unit for receiving at least one of identification information or device identification information of the user device obtained through the communication; authentication based on the confirmation signal including the received terminal identification information or the device identification information; The authentication unit for performing the verification process, and if the authentication verification procedure is authenticated to authenticate at least one of the terminal identification information or the device identification information, a predetermined data processing device is sent to the authentication system or a service system connected to the authentication system. It includes a control unit for success processing the output authentication request. That may be characterized.

An authentication system according to an embodiment of the present invention for achieving the technical problem, receives the authentication request output from the data processing apparatus received the identification information of the digital system of the second user by the first user, the authentication request And transmits authentication request information corresponding to the digital system, and when the digital system and the predetermined user device communicate with each other, a confirmation signal-the confirmation signal is obtained through terminal identification information of the digital system or the communication. A communication unit for receiving at least one of device identification information of a user device from the digital system, and authenticating at least one of the terminal identification information or the device identification information based on the confirmation signal received by the communication unit. An authentication unit for performing an authentication verification procedure, and the authentication unit If it succeeds, the authentication process may be a control unit for successful processing the certificate request.

According to the technical idea of the present invention, there is an effect of providing high security and simplicity by performing self-authentication by using two independent objects of a digital system and a user device, both of which are highly likely to be carried by a user and are familiar.

In addition, the authentication request and the authentication activity can be separated (that is, the device or requester performing the authentication request and the authentication tool or actor required for authentication are set separately), so that the security can be easily performed and the two-channel authentication can be performed at a remote location. There is an effect that the right user can perform the authentication of, or the authentication of a third party.

In addition, the user device (e.g. IC card, traffic card, electronic identity card, etc.) and the digital system that the user usually carries so that the authentication can be successful only if communication is performed, there is no need to carry the authentication tool separately There is an effect that can increase the security while maintaining the convenience of.

In addition, since the digital system to be used for identity authentication can be set in advance and specified, the digital system to be used for identity authentication has the effect of being robust against attacks such as smishing or man in middle attack, and other digital systems. There is an effect that can actively block online crime through.

In addition, since a user device paired with the digital system can be set in advance, the two devices are paired with each other even if they do not have all the paired devices (that is, even if they have a registered digital system and the user device). If the device is not set), it is possible to bring about a significant increase in security by disabling normal authentication.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 shows schematic systems for implementing a user authentication method using a user device according to an embodiment of the present invention.
2 shows a schematic configuration of a digital system according to an embodiment of the present invention.
3 shows a schematic configuration of an authentication system according to an embodiment of the present invention.
Figure 4 shows a schematic data flow of a user authentication method using a user device according to an embodiment of the present invention.
5 is a schematic data flow diagram of a user authentication method using a user device according to another embodiment of the present invention.
6 is a schematic data flow of a user authentication method using a user device according to another embodiment of the present invention.
7 is a diagram illustrating a process of performing an authentication confirmation procedure by an authentication system according to an embodiment of the present invention.
8 is a diagram for describing a process of transmitting a confirmation signal by a digital system according to one embodiment of the present invention.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component. Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

1 shows schematic systems for implementing a user authentication method using a user device according to an embodiment of the present invention.

Referring to FIG. 1, a digital system 100, an authentication system 200, and a user device 300 may be provided to implement a user authentication method using a user device according to an embodiment of the present invention. Depending on the implementation, a predetermined data processing apparatus 400 may be further provided. Further, a service system 500 connected to the authentication system 200 and capable of providing a predetermined service to the digital system 100 and / or the data processing apparatus 400 may be further provided.

The digital system 100 can implement the technical idea of the present invention while transmitting and receiving necessary information through the wired / wireless network with the authentication system 200. In addition, the digital system 100 may obtain information (eg, device identification information) necessary for the technical idea of the present invention from the user device 300 by communicating with the user device 300.

The digital system 100 may perform contact or non-contact communication with the user device 300. For example, the user device 300 may be implemented as a smart card, an IC card, or a transportation card capable of performing contact or non-contact communication with the digital system 100. In particular, the user device 300 may be a payment IC card (credit card, check card, etc.).

According to another embodiment, the user device 300 has its own identification information as the device owned by the user, and any type of device capable of communicating with the digital system 100 is possible. For example, the user device 300 may be a device capable of proving an identity (e.g., an electronic identification card), a communicable OTP device, or a user's mobile phone separate from the digital system 100.

Hereinafter, for convenience of description, the user device 300 will be described as a payment IC card, but the scope of the present invention is not limited thereto. In addition, the digital system 100 and the user device 300 will be described mainly for performing short-range wireless communication (eg, NFC communication or Bluetooth), but the scope of the present invention is not limited thereto.

The digital system 100 may perform near field communication with the user device 300. To this end, the user may tag the digital system 100 and the user device 300. In this specification, tagging refers to the case where the digital system 100 and the user device 300 are located within a certain distance (for example, 10 cm or less when the NFC communication is used) in order to carry out contactless communication such as RFID communication and NFC communication. Or the like). The user can perform tagging by bringing the digital system 100 or the user device 300 into a predetermined distance to the user device 300 or the digital system 100. [

If the user device 300 is a payment card, the user device 300 may be a financial transaction means. The user device 300 may include a predetermined communication device (e.g., an RF antenna, an RF tag, and the like) to perform tagging communication with the digital system 100. [ In addition, the user device 300 may further include a storage device in which information necessary for realizing the technical idea of the present invention can be stored. For example, the user device 300 may be implemented as an IC card having an IC chip or various types of smart cards. When the user device 300 is a payment IC card, the authentication request according to the spirit of the present invention may be a payment request. That is, when authentication is successful according to the technical idea of the present invention, the service system 500 connected to the authentication system 200 or the authentication system 500 by wire or wireless network makes payment using the user device 300 as a payment means. (I.e. services).

Of course, the user device 300 may be an apparatus that can not independently perform financial transactions as described above. Even if the user device 300 is not a financial transaction device, according to the technical idea of the present invention, a user device 300 (e.g., an ID, a mobile phone separate from the digital system 100) Etc.) can be used to easily perform authentication of the user. For example, since the user can easily perform the identity authentication only by the tagging operation of the digital system 100 and the user device 300, the user can input the ID / password, select the authorized certificate, As compared with the conventional complicated authentication process, it is possible to perform the self-authentication with high security, which is much simpler.

In addition, when performing short-range wireless communication through tagging, the user device (for example, an electronic ID card or a payment card, etc. 300) does not need to be taken out of a pocket or a wallet.

Of course, other personal authentication methods (eg, personal authentication using a public certificate) may be further performed before or after the personal authentication according to the technical idea of the present invention for higher security. Higher security can of course be provided when such a dual authentication protocol is performed.

According to the technical idea of the present invention, the authentication request may be output from the digital system 100 or the data processing device 400 to the authentication system 200 or the service system 500. In addition, in order for the authentication request to be successfully processed, that is, to be successfully authenticated, a confirmation signal according to the technical concept of the present invention may be transmitted to the authentication system 200.

In addition, the confirmation signal may be output from the digital system 100 to the authentication system 200 only when the user performs a predetermined authentication action to allow the authentication request. The authentication may be, for example, an act of allowing the digital system 100 and the user device 300 to communicate. As a result, a user may allow (or successfully authenticate) a predetermined authentication request by performing an action of communicating his digital system 100 and his user device 300. Therefore, the authentication tool necessary for allowing the user to allow the authentication request may be the digital system 100 and the user device 300.

Meanwhile, the digital system 100 and the user device 300 to be possessed by the user for authentication may be specified in advance. This specification may be performed by the authentication system 200 previously storing identification information of the digital system 100 and the user device 300 to be used for authentication.

In addition, the confirmation signal includes identification information of the digital system 100, that is, terminal identification information or identification information of the user device 300 that performs communication (eg, near field communication) with the digital system 100. Identification information may be included.

To this end, the digital system 100 may obtain device identification information of the user device 300 through the communication (eg, near field communication).

For example, the user device 300 may be a payment IC card. In this case, the device identification information may be a UID (Unique Identification Number) of the payment IC card that can be obtained from the user device 300. It may be the same fixed device identification information.

That is, when the user device 300 is a payment IC card, the device identification information is payment financial information, that is, financial information necessary for payment (eg, card number, expiration date, CVC code, etc.) may be information capable of identifying the user device 300. In this case, since the settlement financial information may not be distributed to the digital system 100 or the authentication system 200, the security can be enhanced.

Of course, if the authentication request is a payment request, payment financial information may be included. However, even in the case of a payment request, it is easy for an average expert in the technical field of the present invention that a payment system (not shown, the authentication system 200 may be an internal system of the payment system or may be connected to the payment system while being externally present). If the digital system 100 and / or the user device 300 corresponding to the payment financial information and the payment financial information is registered in advance, the payment financial information may not be distributed. It can be effective.

Meanwhile, although the digital system 100 is illustrated as a mobile phone in FIG. 1, the digital system 100 can communicate with the authentication system 200 through a wired / wireless network, and communicate with the user device 300 through a predetermined communication (for example, near field communication). It can be defined as including a data processing device of any type that can be communicated through). For example, the digital system 100 may be a data processing device, such as a tablet, a music player, or the like, which is easy for the user to carry around. Of course, the digital system 100 is preferably capable of communicating with the authentication system 200 and / or the data processing apparatus 400 via a network.

In addition, the digital system 100 may include its identification information, that is, terminal identification information, in the confirmation signal and transmit the identification information to the authentication system 200 in order to implement the technical idea of the present invention.

The terminal identification information is identification information (eg, identification information of USIM, IMSI, IMEI, MAC) of hardware of the digital system 100 (eg, hardware (eg, USIM, network device, etc.) included in the digital system 100). Address, etc.). When the terminal identification information is included, the authentication system 200 may determine that the authentication confirmation procedure is successful only when the terminal identification information is registered in advance. Therefore, if the confirmation signal is not received through the digital system 100, which is a terminal registered in advance, even if the confirmation signal is transmitted to the authentication system 200 by a predetermined device, the authentication confirmation procedure may not be successful. Therefore, there is an effect that a predetermined service may not be provided to the user (the device which made the authentication request). That is, it is possible to designate a digital system, thereby blocking unauthorized service requests through other terminals. In addition, since authentication confirmation (payment authentication) can be performed only through the designated digital system, there is an effect of preventing smishing or man-in-the-middle attack.

The confirmation signal may be defined as including a series of information or signals including information necessary for the authentication procedure performed by the authentication system 200. [ The acknowledgment signal does not necessarily mean one data set (or contiguous packet data), but may be information or signals separated in time or physically. That is, the digital system 100 may output the confirmation signal to the authentication system 200 a plurality of times.

In any case, according to the spirit of the present invention, the digital system 100 may include the terminal identification information and / or the device identification information in the confirmation signal and transmit it to the authentication system 200, and the terminal included in the confirmation signal. Identification information and / or device identification information may be authenticated by the authentication system 200.

In order for the authentication system 200 to authenticate the terminal identification information and / or the device identification information, the digital system 100 and / or the user that can be used for authentication in advance for each user in the authentication system 200. The identification information of the device 300 may be registered (stored).

In addition, the digital system 100 may transmit the confirmation signal to the authentication system 200 only when the digital system 100 and the user device 300 communicate. Therefore, even if the digital system 100 is attacked by hacking, the confirmation signal may not be transmitted to the authentication system 200 unless the user device 300 is possessed by the user. Authentication will not succeed.

In addition, the confirmation signal may be output only when the digital system 100 communicates with the user device 300 set as a pair (pair) in advance with the digital system 100. To this end, identification information of the user device 300 that forms a pair with the digital system 100 may be registered in advance in the digital system 100. Of course, information about the digital system 100 paired with the user device 300 may be registered in advance.

Then, the authentication system 200 may perform an authentication confirmation procedure for authenticating the terminal identification information and / or the device identification information included in the confirmation signal.

The authentication confirmation procedure includes an identification information authentication procedure for authenticating the terminal identification information and / or the device identification information. Whereby the legitimacy of the digital system 100 and / or the user device 300 can be authenticated.

The authentication confirmation procedure may be a procedure for authenticating the included identification information when only one of the terminal identification information and the device identification information is included in the confirmation signal. The authentication confirmation procedure may be a procedure for authenticating both pieces of identification information when both the terminal identification information and the device identification information are included in the confirmation signal. Therefore, even if a user possessing the digital system 100 does not possess the user device 300 registered in the authentication system 200 in advance, or even if the user possesses the user device 300. If you do not have a digital system 100 registered in advance in 200, there is an effect that the authentication is not successful.

The procedure for authenticating the device identification information according to an embodiment may be performed by the digital system 100. [ Alternatively, the procedure of authenticating the terminal identification information may be performed by the user device 300. That is, the digital system 100 may store identification information of the user device 300 that may be used for authentication in advance in the digital system 100, or may be used for the authentication in advance in the user device 300. ) May be stored, and the digital system 100 or the user device 300 determines whether the device that communicates with the device is a pre-registered device by the authentication system 200. There is a similar effect to the identification information and / or the terminal identification information is authenticated. However, since the digital system 100 and / or the user device 300 may have a greater risk of forgery than the authentication system 200, for security, the device identification information and / or Alternatively, it may be desirable for the terminal identification information to be authenticated.

The authentication procedure performed by the authentication system 200 may further include a pair authentication procedure for authenticating whether the digital system 100 and the user device 300 are a pair. That is, the digital system 100 and the user device 300 may be paired in advance. Only when the two devices forming the pair perform the communication, the authentication system 200 determines that authentication is successful . As such, the authentication confirmation procedure may be successful only when the two devices used in the authentication action (that is, the communication between the digital system 100 and the user device 300) for confirming the authentication request by the user are paired. In this case, if the digital system 100 and the user device 300 are both registered by the authentication system 200, even if they are not paired with each other, the authentication confirmation process may not be successfully processed, It is possible to have a synergistic effect. Whether the two devices used in the authentication operation (digital system 100 and user device 300) are a pair may be authenticated by the authentication system 200, but may also be authenticated by the digital system 100 . That is, the confirmation signal can be transmitted only when the digital system 100 communicates with the user device 300 that is set to be paired with the digital system 100 in advance. To this end, the digital system 100 may have previously stored information (e.g., device identification information) about the user device 300 that is paired with the digital system 100 in advance.

The authentication request may be transmitted to the authentication system 200 before the confirmation signal is transmitted to the authentication system 200. For example, the authentication request may be an authentication request transmitted from the predetermined data processing apparatus 400 to the authentication system 200. The data processing apparatus 400 is a device separate from the digital system 100 used by the user of the digital system 100 and is connected to the authentication system 200 to request authentication of a PC, a notebook computer, a tablet, Mobile terminal, set-top box, IPTV, and the like. For example, a user may input identification information (e.g., a telephone number) of his or her digital system 100 through the data processing apparatus 400 to perform an authentication request.

Further, the data processing apparatus 400 may be implemented in various embodiments according to the types of services provided after the authentication according to the technical idea of the present invention succeeds. For example, if the service is a payment service, the data processing device 400 may be an agent terminal requesting payment for settlement. If the service is a service for opening a door, the data processing device 400 may be a device installed at a door. Various embodiments of the data processing apparatus 400 may be possible depending on the type of service.

According to an embodiment, the data processing apparatus 400 or the digital system 100 may make an authentication request to a predetermined service system 500. The service system 500 may transmit a predetermined service (for example, a request for authentication) to the authentication requesting device (for example, the data processing device 400 or the digital system 100) upon successful authentication of the user according to the technical idea of the present invention. Login, financial transaction, confirmation of specific information, issuance of a certificate, purchase of goods or services, payment, opening and closing of a door, etc.). A user may access the service system 500 through the data processing apparatus 400 or the digital system 100 and the service system 500 may be connected to the service system 500 in order to perform the service provided by the service system 500. [ And may request the data processing apparatus 400 or the digital system 100 to authenticate the user. In this case, the service system 500 allows the data processing apparatus 400 or the digital system 100 to access the authentication system 200 (for example, a web page or a UI provided by the authentication system 200) The data processing apparatus 400 or the digital system 100 may be controlled to receive the authentication from the authentication system 200 through the data processing apparatus 400 or the digital system 100 have. The data processing apparatus 400 or the digital system 100 may transmit the authentication request to the authentication system 200 by inputting information necessary for the authentication request (for example, identification information of the digital system 100) As shown in FIG.

Of course, in some implementations, the service system 500 may receive an authentication request from the data processing apparatus 400 or the digital system 100 and send the received authentication request to the authentication system 200 . That is, the service system 500 may mediate the authentication process according to the technical idea of the present invention. Accordingly, the data processing apparatus 400 or the digital system 100 transmitting predetermined information or signals to the authentication system 200 is transmitted to the authentication system 200 through the service system 500. It can be interpreted as including the case. Of course, even when the authentication system 200 transmits predetermined information or signals to the data processing apparatus 400 or the digital system 100, the authentication system 200 may include the case of being transmitted through the service system 500 . ≪ / RTI >

Although the authentication system 200 and the service system 500 are implemented as separate physical devices in FIG. 1, the authentication system 200 may be included in the service system 500 . In other words, since the predetermined software that implements the function of the authentication system 200 is installed in the service system 500, the authentication according to the technical idea of the present invention may be performed.

According to one embodiment, the authentication of the user according to the technical idea of the present invention may be performed for settlement. In this case, the data processing apparatus 400 may be a predetermined merchant terminal (a POS device installed in a store, a mobile merchant terminal, or the like). In this case, the user or the merchant can transmit the authentication request to the authentication system 200 by inputting identification information (e.g., telephone number) of the digital system 100 of the user to the merchant terminal. In some cases, the user may notify identification information of his or her digital system 100 to a merchant site to perform payment at a remote site. Then, the merchant may transmit the authentication request to the authentication system 200 by inputting the identification information using the data processing apparatus 400, that is, a computer used at the merchant, or an affiliate terminal. If the authentication is successful by the authentication system 200, the payment requested by the data processing apparatus 400 may be finally approved. At this time, the service system 500 may be a predetermined card company system (or a financial institution system that performs card settlement). In addition, the authentication request and payment request do not necessarily need to be performed separately. That is, the authentication request according to the embodiment of the present invention may be performed simultaneously with a predetermined service request (for example, payment, etc.). In this case, identification information of the digital system 100 for the authentication request Of course. Such an example will be described in detail later with reference to FIGS. 4 and 5. FIG.

According to another embodiment, the authentication request may be output by the digital system 100 and transmitted to the authentication system 200 together with the acknowledgment signal or separately from the acknowledgment signal. Such an example will be described with reference to FIG.

When the authentication request is received and an acknowledgment signal is received from the digital system 100, the authentication system 200 performs an authentication check procedure as described above based on the received acknowledgment signal. If the authentication is successful, Can successfully process the authentication of the data processing apparatus 400 or the digital system 100. That is, the received authentication request can be successfully processed. The service system 500 may then provide the data processing device 400 or a predetermined service requested by the digital system 100. Needless to say, another authentication of the user (for example, authentication using the authorized certificate, etc.) may be required after the authentication of the user according to the technical idea of the present invention succeeds.

In addition, the authentication procedure may further include authenticating user authentication information (e.g., PIN) of the user device 300. For example, when the user device 300 is a payment IC card, a password (i.e., a PIN number) set by the user may be preset in the user device 300. The user authentication information of the user device 300 may also be registered in the authentication system 200 in advance. Then, the authentication system 200 receives the user authentication information from the digital system 100 or the data processing apparatus 400, and if the received user authentication information corresponds to previously registered information, To be successful. Of course, the authentication of the user authentication information may be performed by the digital system 100 that communicates with the user device 300. In this case, the user authentication information of the user device 300 may be registered in the digital system 100 in advance.

The authentication system 200 includes all systems participating in receiving an authentication request, communicating with the digital system 100 and / or the data processing apparatus 400, or in deciding whether to grant an authentication request Can be defined as meaning. Of course, the authentication system 200 does not mean only one physical device, but may be a system that is organically coupled to a plurality of devices or systems to implement the technical idea of the present invention. For example, the authentication system 200 may receive the authentication request directly from the digital system 100 or the data processing apparatus 400, or may receive the authentication request via the service system 500 as described above have.

For example, in the case of a payment service, the authentication system 200 can directly transmit a settlement request (the settlement request is an authentication request) from the data processing apparatus 400, for example, a user's computer, an affiliate store terminal Or may receive a payment request (authentication request) via the service system (e.g., web server 500 that provides an online marketplace). In this case, the authentication system 200 may be a credit card company system that can settle the settlement request (authentication request) using the previously registered credit card information (the credit card company system in the present invention is not only an independent card company system, (Which means to include all financial institution systems (not shown) that perform card settlement). In some embodiments, the authentication system 200 may further include a VAN system or a PG company system connected to the card company system through a network to mediate a payment process.

Hereinafter, the process of authenticating the user according to the technical idea of the present invention will be described in more detail. Hereinafter, for convenience of description, the digital system 100 is implemented as a mobile phone, and the identification information of the digital system 100 is described as an example of a mobile phone number of the mobile phone. The scope of the right is not limited thereto.

2 shows a schematic configuration of a digital system according to an embodiment of the present invention.

Referring to FIG. 2, the digital system 100 includes a control module 110, a user device communication module 120, and a communication module 130.

Herein, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, each of the above configurations may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and may be a code physically connected to one another or a specific type of hardware May be easily deduced to the average expert in the field of the present invention. Thus, each of the above configurations refers to a combination of hardware and software that performs the functions defined herein, and does not mean a specific physical configuration.

The control module 110 provides functions and / or resources of other components (eg, the user device communication module 120, and / or the communication module 130, etc.) included in the digital system 100. Can be controlled.

The user equipment communication module 120 may communicate with the user equipment 300. [ The communication may be contact or non-contact communication as described above. According to an example, the communication may be a contactless short range wireless communication (eg, NFC communication, Bluetooth, etc.). In the case where the communication is the NFC communication, the user may allow the authentication to be approved simply by tagging the digital system 100 and the user device 300, thereby increasing convenience of the user. Even if it is in a wallet or pocket, NFC communication can be performed without taking out the user device 300, so that convenience of authentication can be enhanced. The user equipment communication module 120 may be implemented by, for example, an NFC chip or a module provided in the digital system 100. In addition, it is a matter of course that the embodiment of the user equipment communication module 120 may be varied according to the embodiment of the communication performed by the digital system 100 and the user equipment 300.

The control module 110 may generate or transmit an acknowledgment signal according to the technical idea of the present invention. To this end, the control module 110 may control the communication module 130, of course.

The communication module 130 may communicate with the authentication system 200. And may perform communication with the data processing apparatus 400 according to an embodiment.

The control module 110 may communicate with the user device 300 through the user device communication module 120.

Then, the control module 110 may include the device identification information received from the user device 300 in the confirmation signal. In addition, the control module 110 may extract the terminal identification information of the digital system 100 to include in the confirmation signal. In addition, a confirmation signal may be transmitted to the authentication system 200 through the communication module 130.

In addition, the control module 110 may include a predetermined authentication request in the confirmation signal or output the authentication request separately from the confirmation signal. Alternatively, the confirmation signal may include an authentication signal indicating an authentication result using the user authentication information. It should be understood that the acknowledgment signal is not limited to one information or a continuously transmitted signal, and the acknowledgment signal may be transmitted to the authentication system 200 discontinuously in a plurality of times according to an embodiment.

The authentication system 200 may then perform an authentication procedure based on the acknowledgment signal. In addition, if the authentication confirmation procedure is successful, the authentication system 200 may process that the authentication of the identity is successful for the received authentication request (or a device that outputs the authentication request). For example, if the authentication confirmation process is successful, the authentication system 200 may transmit an authentication result indicating that the authentication of the user is successful to the data processing apparatus 400, the digital system 100, and / or the service system 500 Lt; / RTI >

According to an exemplary embodiment, payment financial information of the user device (eg, payment card, 300) may be further included as device identification information in the confirmation signal. That is, in this case, the user device 300 may be a payment card (ie, an IC card). When payment financial information is included in the confirmation signal as the device identification information, the authentication system 200 may authenticate the user device 300 based on the payment financial information. However, if the confirmation signal includes payment financial information, there is a risk that payment financial information may be leaked, and the leaked payment financial information may be misused. Accordingly, when the confirmation signal further includes payment financial information of the user device, the authentication system 200 determines whether the digital system 100 is a pre-registered terminal based on the terminal identification information. It may be desirable to strengthen. Of course, as described above, the device identification information may be selected as identification information of the user device 300 irrelevant to the payment financial information.

Meanwhile, the communication module 130 may receive predetermined authentication act request information from the authentication system 200 or from the data processing apparatus 400. The authentication action request information may include information for requesting a user to perform an authentication operation, that is, to communicate the digital system 100 and the user device 300. [ Of course, only the signal indicating that the authentication request has been performed in the data processing apparatus 400 or the digital system 100 may be included in the authentication action request information.

The authentication action request information may be displayed on a display device (not shown) included in the digital system 100. The user may perform the requested authentication by communicating the digital system 100 and the user device 300 after confirming and confirming the authentication action request information.

The communication module 130 may receive the authentication activity request information from the authentication system 200 or may receive the authentication activity request information from the data processing apparatus 400. Such an example will be described later with reference to Figs.

Meanwhile, the control module 110 may determine whether the user device 300 is a device forming a pair with the digital system 100. And transmit the confirmation signal to the authentication system 200 only when the user device 300 is a device forming a pair with the digital system 100. [ Of course, the procedure for authenticating such a pair may be performed by the authentication system 200 as described above.

In addition, the control module 110 requests predetermined user authentication information (eg, PIN) before or after performing communication with the user device 300, and the user authentication information is stored in the user device 300 (eg, The confirmation signal may be transmitted only when corresponding to the authentication information (for example, PIN information) of the payment IC card.

If user authentication using the user authentication information is not performed, the digital system 100 may not transmit the confirmation signal to the authentication system 200. For example, the digital system 100 may receive the user authentication information in advance before communicating with the user device 300. Or may receive the user authentication information from the user after the communication is performed. If the user authentication information does not correspond to the information set in the user device 300 in advance, the confirmation signal may not be transmitted. According to an embodiment, the user authentication using the user authentication information may be performed by the digital system 100 after the confirmation signal is transmitted. In this case, the digital system 100 may further transmit a predetermined authentication signal indicating the result of user authentication using the user authentication information to the authentication system 200 after transmitting the confirmation signal. Then, the authentication system 200 receiving the authentication signal may finally determine the success or failure of the authentication confirmation procedure.

Or the digital system 100 transmits the user authentication information received from the user to the authentication system 200 and determines whether the user authentication information corresponds to the user device 300 by the authentication system 200 .

3 shows a schematic configuration of an authentication system according to an embodiment of the present invention.

3, an authentication system 200 according to an exemplary embodiment of the present invention includes a control unit 210, a communication unit 220, and an authentication unit 230. The authentication system 200 may further include a DB 240.

The configuration of the control unit 210, the communication unit 220, the authentication unit 230, and the DB 240 included in the authentication system 200 includes hardware for performing the technical idea of the present invention, And the functional and structural combination of the software. For example, each of the above configurations may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and may be a code physically connected to one another or a specific type of hardware May be easily deduced to the average expert in the field of the present invention. Thus, each of the above configurations refers to a combination of hardware and software that performs the functions defined herein, and does not mean a specific physical configuration.

Also, the authentication system 200 does not mean any physical device. That is, an average expert in the technical field of the present invention can easily deduce that the authentication system 200 can be implemented by organically combining different physical devices through a network.

The authentication system 200 may be included in the service system 500 or may be implemented in a system separate from the service system 500. In addition, the operating system of the authentication system 200 and the service system 500 may be the same or different.

The control unit 331 can control functions and / or resources of other components included in the authentication system 200 (e.g., the communication unit 220, the authentication unit 230, and the DB 240) .

The communication unit 220 may perform communication with the digital system 100. In particular, the communication unit 220 may receive an acknowledgment signal from the digital system 100.

The authenticator 230 may perform an authentication confirmation procedure based on the confirmation signal. The confirmation signal may include the device identification information and / or the terminal identification information. The authentication confirmation procedure may include an authentication procedure for authenticating the device identification information and / or the terminal identification information. In addition, at least one of two devices used by the user in the authentication operation, that is, authentication of whether the digital system 100 and the user device 300 are paired, and / or authentication of user authentication information set in the user device 300. One may optionally further include as described above.

If the authentication confirmation procedure is successful by the authentication unit 230, the control unit 210 may successfully process the authentication request received after the authentication request or the confirmation signal that has already been received. The control unit 210 may send a signal indicating the authentication result to the service system 500 for success processing.

As described above, the DB 240 may previously store device identification information of the user device 300 and terminal identification information of the digital system 100 according to the spirit of the present invention. In addition, pairing information on the pair formation of the digital system 100 and the user device 300, that is, which digital system 100 and which user device 300 are formed as a pair, may be stored in advance. have. In addition, user authentication information of the user device 300 may be further stored.

The communication unit 220 may receive an authentication request from the data processing apparatus 400 or the digital system 100. Needless to say, the authentication request may include identification information (e.g., telephone number) of the digital system 100. Then, the control unit 210 may transmit authentication action request information to the digital system 100 or the data processing apparatus 400 through the communication unit 220. [ The user can confirm the authentication action request information and communicate the digital system 100 and the user device 300. [ Then, the communication unit 220 can receive an acknowledgment signal output from the digital system 100.

Then, the authentication unit 230 may perform the authentication procedure.

The authentication unit 230 determines whether the terminal identification information and / or the device identification information included in the confirmation signal corresponds to the information registered in advance in the DB 240, and when the determination result corresponds, the authentication confirmation procedure is successful. You can judge.

The authentication unit 230 determines whether the digital system 100 and the user device 300 form a pair with each other based on information previously registered in the DB 240, The digital system 100 and the user device 300 form a pair to determine that the authentication confirmation procedure is successful.

When the user authentication information (for example, the PIN information of the payment card, etc.) of the user device 300 is received from the digital system 100, the authentication unit 230 transmits the user authentication information to the DB 240) to determine that the authentication check procedure is successful. Or may determine whether the authentication procedure is successful based on the authentication signal received from the digital system 100. [

FIG. 4 shows a schematic data flow of a user authentication method using a user apparatus according to an embodiment of the present invention.

4 illustrates an example in which an authentication request is made via the digital system 100. Referring to FIG. 4, the digital system 100 may send a predetermined authentication request to the authentication system 200 (S100 ). Then, the authentication request is received through the communication unit 220 of the authentication system 200, the control unit 210 may transmit the authentication activity request information to the communication module 130 of the digital system 100 (S110). ).

After the user confirms the authentication activity request information, the user may communicate the digital system 100 with the user device 300 (S120). Through the communication, the digital system 100 may obtain identification information of the user device 300 (S130). In addition, the digital system 100 may extract terminal identification information of the digital system 100 (S140).

Then, the digital system 100 may include at least one of the device identification information or the terminal identification information in the confirmation signal, and transmit it to the authentication system 200 (S150).

At this time, according to an embodiment of the present disclosure, even when the user device 300 is a payment card, the control module 110 of the digital system 100 may not include payment financial information of the payment card in the confirmation signal. It may be. That is, the payment financial information can be enhanced by not circulating through the network.

Then, the authentication system 200 can perform an authentication procedure based on the confirmation signal (S160). If the authentication verification process is successful, the authentication system 200 may transmit the authentication result, that is, the authentication of the user, to the digital system 100 (S170). Of course, if the digital system 100 accesses a predetermined service system 500 and then transmits the authentication request to the authentication system 200, the authentication system 200 transmits the authentication result to the service system 500 500).

Of course, the authentication system 200 may further determine whether the authentication confirmation procedure is successful based on whether the digital system 100 and the user device 300 form a pair as described above. .

FIG. 5 shows a schematic data flow of an authentication method using a user apparatus according to another embodiment of the present invention.

FIG. 5 illustrates an example in which a payment request is performed by a predetermined data processing apparatus 400. Referring to FIG. 5, the data processing apparatus 400 inputs an identification request of the digital system 100. It may be transmitted to the authentication system 200 (S200).

The data processing apparatus 400 may be a computer or the like used by the user of the digital system 100. [ For example, the user can request an authentication online (S200) through a computer or the like, and in response, the authentication system 200 can transmit authentication action request information to the computer (S210-1). The user may confirm authentication request information displayed on the computer and perform an authentication check action for communicating the digital system 100 and the user device 300 (S220). According to an embodiment, the authentication system 200 may transmit authentication action request information to the digital system 100 (S210). In response, the user may perform the authentication check operation (S220).

According to another embodiment, the data processing apparatus 400 may be an affiliate terminal. That is, the user may want to perform settlement. In this case, the authentication request may be a payment request. The user may notify the affiliated store's identification information of the digital system 100 at an offline store or may directly input the identification information. Alternatively, at a remote location, the user may request the merchant to perform a payment (authentication) request for a predetermined payment through telephone, messaging, or e-mail. Then, an authentication (payment) request may be transmitted to the authentication system 200 by inputting the identification information of the digital system 100 to the merchant terminal (S200). At this time, the authentication action request information may also be transmitted to the merchant terminal and / or the digital system 100 (S200, S200-1). In response to this, the user may communicate the authentication operation, that is, the digital system 100 and the user device 300 (S220).

Then, the digital system 100 may obtain device identification information from the user device 300 (S230). In addition, the digital system 100 may extract terminal identification information (S240).

Then, the digital system 100 may transmit a confirmation signal including the terminal identification information and / or the device identification information to the authentication system 200 (S250). Of course, the device identification information may include settlement financial information of the settlement card. In order to increase the security, the settlement financial information may be transmitted to the user system 300 even if the digital system 100 obtains the confirmation signal .

Then, the authentication system 200 may perform an authentication procedure based on the confirmation signal (S260). Then, the authentication result may be transmitted to the digital system 100 (S270). Or may be transmitted to the data processing apparatus 400 (S270-1). Of course, the authentication result may be transmitted to the service system 500.

Meanwhile, the authentication request according to the embodiment of the present invention may be performed by a person other than the user of the digital system 100. For example, an authentication requester other than the user (that is, a person who performs authentication confirmation) such as a family member, a relative or an acquaintance of the user inputs the identification information of the user to the data processing apparatus 400, (200).

For example, if an authentication requester who is an acquaintance of a user needs to log in to a user's web account, outputs a certificate on behalf of the user, or needs a third party's payment, a predetermined service may be provided from the service system 500. There may be cases. In this case, in the past, there was a risk of informing the authentication requester of information (eg, login information, public certificate password, etc.) for authentication. However, according to the technical concept of the present invention, the authentication request and the authentication action may be made in a spatially separated state, and the authentication requestor does not necessarily have to perform the authentication confirmation action, so that the effect of not having to inform others of the information for authentication is required. have.

Also, in the case of a payment service, when the authentication requester faces the identification information of the user or remotely notifies the affiliation shop side, the affiliate shop sends an authentication request (that is, a payment request ) To the authentication system (200). Of course, in this case, the information on the authentication requester may be further included (eg, the telephone number, name, etc. of the payment requester), and the information on the payment requester may also be included in the authentication action request information.

In this case, the authentication system 200 may transmit the authentication action request information to the digital system 100 of the user, and the authentication action as described above may be performed by the user. Then, if an authentication confirmation procedure is performed by the authentication system 200 and the authentication confirmation procedure is successful, the authentication (payment) result can be transmitted to the data processing apparatus 400 and the digital system 100.

According to another embodiment, an authentication requester other than a user inputs identification information of the digital system 100 to the data processing apparatus (eg, a computer, a mobile terminal of the authentication requester, etc.) 400, or the authentication requester enters into an affiliated store. When notifying the user's identification information, the affiliated store may input the identification information of the digital system 100 to the data processing device (eg, the affiliated store terminal 400). Then, the data processing apparatus 400 may transmit authentication action request information (that is, payment related information including payment details, etc.) to the digital system 100. Of course, for this purpose, predetermined software for implementing the technical idea of the present invention may be installed in the data processing apparatus 400 and / or the digital system 100.

The authentication action request information may include information on the merchant, payment details, and / or information on the payment requester. Then, when the user checks the authentication activity request information and wants to make a payment for a payment request corresponding to the authentication activity request information, the user may perform the authentication verification as described above. The digital system 100 may then send an acknowledgment signal as described above to the authentication system 200. In this case, the confirmation signal may further include information necessary for a payment request (eg, information on an affiliated store, payment details, etc.) as well as the terminal identification information and / or device identification information. That is, the confirmation signal may further include an authentication (settlement) request to be transmitted to the authentication system 200. Of course, the authentication (payment) request may be transmitted to the authentication system 200 separately from the confirmation signal.

The authentication system 200 may then perform an authentication procedure based on the acknowledgment signal. The authentication system 200 can transmit the authentication result to the data processing apparatus 400 and / or the digital system 100. [0050] FIG. Of course, in the case of payment, if the authentication confirmation procedure is successful, the authentication request can be successfully processed and the service, that is, payment can be performed. Then, the authentication system 200 or the service system 500 may determine whether the payment is approved and transmit the payment result to the data processing apparatus 400 and / or the digital system 100.

As a result, according to the technical idea of the present invention, it is possible to provide a solution with high security, which is very easy to perform authentication on behalf of a third party authentication requestor.

In addition, according to the present invention as shown in Figs. 4 and 5, only the identification information of the digital system 100 is required for the authentication request, so that the authentication request is easy, and the user has his or her digital system for authentication. It is only necessary to communicate (eg, tag) the 100 with its user device 300. As described above, the security may be very high, although the ease of authentication request and the convenience of authentication and verification are provided. In addition, as shown in Figs. 4 and 5, the user can easily determine whether to allow the authentication request even in the two-channel authentication due to the ease of authentication request and the convenience of payment (authentication) action, For example, login information, authentication certificate password, etc.) can be safely performed without the authentication verification.

FIG. 6 shows a schematic data flow of an authentication method using a user apparatus according to another embodiment of the present invention.

6, when the user notifies or inputs the identification information of his / her digital system 100, the data processing apparatus 400 receives the identification information (S300) To the digital system 100 (S310). To this end, of course, predetermined data may be installed in the data processing apparatus 400 and / or the digital system 100 to implement the technical idea of the present invention.

For example, when the user notifies the identification information of his / her digital system 100 or inputs the payment information to his / her mobile terminal 400 without providing a payment card to the store, the data processing apparatus 400 may transmit the identification information (S300) and transmits the authentication action request information corresponding to the authentication to the digital system 100 (S310). The user may then wirelessly communicate the digital system 100 with the user device 300 in a seat or in a car and perform authentication and payment simply. In this case, not only the user device 300, that is, the card does not need to be transferred to the affiliated party, but payment financial information of the user device 300 may not be transmitted to the affiliated party.

According to an embodiment, the data processing apparatus 400 and the digital system 100 may perform short-range wireless communication. In this case, the authentication activity request information may be transmitted to the digital system 100 by short-range wireless communication between the data processing apparatus 400 and the digital system 100. At this time, the identification information of the digital system 100 may not need to be input to the data processing apparatus 400.

For example, when the technical idea of the present invention is applied to a payment service, when a settlement amount is input to a data processing apparatus (for example, an affiliate terminal 400), the user inputs the digital system 100 to the data processing apparatus 400 It is possible to perform short-range wireless communication. Then, authentication activity request information including payment details (eg, merchant identification information, etc.) including the payment amount may be transmitted to the digital system 100. The user can then remotely communicate the digital system 100 with his / her user device (e.g., the payment IC card 300). With this two short-distance wireless communication, the user can easily make a payment. In this case, the identification information of the digital system 100 of the user is not required to be notified to the merchant, and the settlement financial information of the user device 300 may not be transmitted to the merchant.

As such, when the authentication act request information is transmitted to the digital system 100, the authentication act request information may include information necessary for an authentication request (payment request), and when an authentication act is performed by a user (S320), Terminal identification information and / or device identification information and the authentication request (payment request) may be included in the confirmation signal by the digital system 100 and transmitted to the authentication system 200 (S330, S340, S350). ). Of course, the authentication request (payment request) may be transmitted separately from the acknowledgment signal. That is, the authentication request (payment request) may be output to the authentication system 200 separately before or after the confirmation signal is output to the authentication system 200.

Then, the authentication system 200 can perform an authentication procedure based on the confirmation signal (S360). If the authentication confirmation procedure is successful, the authentication result may be transmitted to the digital system 100 (S380-1). Of course, the data processing apparatus 400 may also be transmitted (S380). Or to a given service system 500.

7 is a diagram illustrating a process of performing an authentication confirmation procedure by an authentication system according to an embodiment of the present invention.

Referring to FIG. 7, a series of processes in which an authentication confirmation procedure is performed by the authentication unit 230 of the authentication system 200 is performed. The authentication unit 230 includes confirmation of terminal identification information and / or device identification information. A signal may be obtained (S410). Then, the authentication unit 230 may check the terminal identification information and / or the device identification information registered in the DB 240 (S411). In operation S412, identification information authentication for determining whether the acquired terminal identification information and / or device identification information and the information checked from the DB 240 correspond to each other may be performed (S412). If the authentication of the authentication tool is successful, it may be determined that the authentication verification procedure is successful (S440). If the authentication fails, it may be determined that the authentication verification procedure has failed (S430).

Although the authentication unit 230 may perform only authentication of such an authentication tool, as shown in FIG. 7, the authentication unit 230 may further selectively perform at least one of authentication of a pair. And if the authentication of the pair is more successful, it can be determined that the authentication confirmation procedure succeeded (S440), if the authentication of the pair failure may be determined that the authentication confirmation procedure failed (S430).

In addition, although Fig. 7 illustrates a case where authentication of the authentication tool and authentication of pairing are performed sequentially, the order of the authentication may be changed as much as of course.

When the authentication unit 230 further performs pair authentication (S420), the authentication unit 230 may provide pair setting information registered in advance in the DB 240, that is, information about a digital system and a user device forming a pair. In operation S420, pair authentication may be performed to confirm whether the digital system 100 and the user device 300 used in the payment confirmation action are a pair. If the pair authentication is successful, it may be determined that the entire authentication verification procedure is successful (S440). Of course, if the pair authentication fails, the authentication unit 230 may determine that the entire authentication confirmation procedure has failed (S430).

8 is a diagram for describing a process of transmitting a confirmation signal by a digital system according to one embodiment of the present invention.

Referring to FIG. 8, a user may input user authentication information (eg, PIN of a payment card) of the user device 300 through a predetermined application installed in the digital system 100 to perform an authentication confirmation action. There is (S500). In operation S510, the digital system 100 may communicate with the user device 300. In operation S520, the digital system 100 may receive device identification information of the user device 300 through the communication.

The digital system 100 may perform user authentication to determine whether the user authentication information input from the user through communication with the user device 300 corresponds to the information set in the user device 300 (S530). If the user authentication succeeds, the digital system 100 may transmit a confirmation signal to the authentication system 200 (S550). Of course, if user authentication fails (S530), the digital system 100 may terminate the process (S560). According to an implementation example, the digital system 100 may perform pair authentication (S540). When the pair authentication is more successful, the digital system 100 may transmit a confirmation signal (S550).

In order for the digital system 100 to perform pair authentication, the device identification information of the user device 300 forming a pair with the digital system 100 may be registered in the digital system 100 in advance. In some embodiments, identification information or terminal identification information of the digital system 100 that forms a pair with the user device 300 may be stored in the storage device of the user device 300. In this case, the digital system 100 may perform pair authentication by checking the information stored in the storage device.

In any case, when the digital system 100 and the user device 300 are not a pairing device, the digital system 100 does not transmit the confirmation signal to the authentication system 200 but performs the process. It may end (S560).

8 illustrates an example in which user authentication is performed before pair authentication, of course, pair authentication may be performed first.

In addition, in FIG. 8, input of user authentication information (eg, PIN) of the user device 300 may be performed at any time after a confirmation signal is transmitted to the authentication system 200 and before the authentication confirmation procedure is terminated. That is, after the digital system 100 transmits the confirmation signal to the authentication system 200, the digital system 100 may receive user authentication information of the user device 300 from the user and authenticate the user. In this case, the digital system 100 may further transmit a predetermined authentication signal indicating the result of user authentication to the authentication system 200. Then, the control unit 210 included in the authentication system 200 may determine the success or failure of the authentication confirmation process after confirming the authentication signal.

According to an embodiment, the digital system 100 transmits user authentication information to the authentication system 200, and the authentication of the user authentication information may be performed by the authentication system 200. In this case, the digital system 100 may transmit the user authentication information to the authentication system 200 at any point before the payment request is approved by the authentication system 200. For example, the user authentication information may be included in the confirmation signal, and the user authentication information may be transmitted to the authentication system 200 at any time before or after the transmission of the confirmation signal. Then, the authentication unit 230 included in the authentication system 200 can perform the user authentication using the user authentication information of the user device 300 stored in the DB 240. And, if the user authentication is successful, it may be determined that the authentication confirmation process is finally succeeded.

The user authentication method using the user device according to an embodiment of the present invention may be performed for the purpose of the user authentication itself, but may be performed before providing various services requested by the user. In this case, of course, the authentication request in the present specification may be a service request for requesting the service.

The authentication method using the user apparatus according to the embodiment of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, an optical data storage device, and the like in the form of a carrier wave (for example, . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (18)

The digital system performing communication with a predetermined user device for authenticating the user; And
And when the communication is performed, transmitting, by the digital system, a confirmation signal including at least one of terminal identification information of the digital system or device identification information of the user device received through the communication to the authentication system.
By the authentication system,
An authentication confirmation procedure for authenticating at least one of the terminal identification information or the device identification information included in the transmitted confirmation signal is performed.
And the authentication request outputted from a predetermined data processing device to the authentication system or a service system connected to the authentication system only when the authentication confirmation procedure is successful.
The method of claim 1, wherein the user authentication method using the user device,
And displaying, on the data processing apparatus or the digital system, the authentication act request information output by the authentication system receiving the authentication request including the identification information of the digital system output from the data processing apparatus.
And when the authentication action request information is displayed, the digital system performs user communication with the user device.
The method of claim 1, wherein the user authentication method using the user device,
And receiving, by the digital system, authentication activity request information output from the data processing apparatus receiving the identification information of the digital system.
And the digital system performs the communication with the user device when the authentication activity request information is received.
The method of claim 1, wherein the user device,
It is an IC card for payment.
The user device identification information included in the confirmation signal,
And identification information of the user device irrelevant to payment financial information of the payment IC card.
The method of claim 1, wherein the user authentication method using the user device,
Determining, by the digital system, whether the user device is a pair preset to correspond to the digital system,
The user authentication method using the user device, characterized in that for transmitting the confirmation signal to the authentication system only when the user device is a predetermined pair as a result of the determination.
The method of claim 1, wherein the user authentication method using the user device,
Requesting, by the digital system or the authentication system, user authentication information corresponding to the user device to a user of the digital system; And
Transmitting the user authentication information input in response to the request to the authentication system by the digital system or the data processing apparatus,
The user authentication method using the user device, characterized in that the authentication confirmation procedure is successful only if the user authentication information is further authenticated by the authentication system.
The digital system according to claim 1,
And the user device, wherein the user device is a payment IC card, does not include payment financial information in the confirmation signal.
The digital system receives the first authentication act request information output by the data processing apparatus that has received the identification information of the digital system of the second user by the first user, or transmits the second authentication request by the data processing apparatus. Receiving, by the digital system, second authentication activity request information corresponding to the second authentication request outputted by the authentication system;
The digital system communicating with a predetermined user device; And
And when the communication is performed, transmitting, by the digital system, a confirmation signal including at least one of terminal identification information of the digital system or device identification information of the user device received through the communication to the authentication system.
By the authentication system,
An authentication confirmation procedure for authenticating at least one of the terminal identification information or the device identification information included in the transmitted confirmation signal is performed.
When the authentication confirmation procedure is successful, the first authentication request or the second authentication request corresponding to the first authentication action request information is successfully processed.
When the digital system communicates with a predetermined user device, the authentication system confirms the confirmation signal from the digital system. Receiving at least one of the identification information;
Performing, by the authentication system, an authentication confirmation procedure for authenticating at least one of the terminal identification information and the device identification information based on the received confirmation signal; And
And if the authentication confirmation procedure succeeds, the authentication system successively processing an authentication request outputted from a predetermined data processing apparatus to the authentication system or a service system connected to the authentication system.
The method of claim 9, wherein the user authentication method using the user device,
Receiving, by the authentication system, the authentication request including identification information of the digital system from the data processing apparatus; And
Transmitting, by the authentication system, authentication activity request information to the digital system or the data processing device in response to the reception;
And after the confirmation signal is received from the digital system, the authentication system performs the authentication confirmation procedure after transmitting the authentication activity request information.
The method of claim 9, wherein the user authentication method using the user device,
And authenticating, by the authentication system, whether or not the pair is established by determining whether the digital system and the user device which have transmitted the confirmation signal are pairs set to correspond to each other in advance in the authentication system.
The user authentication method using the user device that determines that the pair authentication is successful only if the authentication confirmation procedure.
Receiving, by the authentication system, an authentication request output from the data processing apparatus that has received the identification information of the digital system of the second user by the first user;
Transmitting, by the authentication system, authentication activity request information corresponding to the received authentication request to the digital system;
When communication is performed between the digital system and a predetermined user device, the authentication system confirms the confirmation signal from the digital system. The confirmation signal is obtained by the digital system through the terminal identification information of the digital system or the communication. Receiving at least one of device identification of the device;
Performing, by the authentication system, an authentication confirmation procedure for authenticating at least one of the terminal identification information and the device identification information based on the received confirmation signal; And
And if the authentication confirmation procedure is successful, the authentication system successfully processing the authentication request.
A computer-readable recording medium having recorded thereon a program for performing the method according to any one of claims 1 to 12.
In a digital system,
Communication module for performing communication with the authentication system;
A user device communication module for communicating with a user device for authentication of a predetermined authentication request; And
When communication with the user device is performed through the user device communication module, a confirmation signal-the confirmation signal includes at least one of terminal identification information of the digital system or device identification information of the user device obtained through the communication. A control module for transmitting-to the authentication system,
By the authentication system, an authentication confirmation procedure is performed in which at least one of the terminal identification information or the device identification information included in the transmitted confirmation signal is authenticated, and the authentication confirmation procedure is successful. And an authentication request outputted to an authentication system or a service system connected to the authentication system.
The method of claim 14, wherein the control module,
And the user device, wherein the user device is a payment IC card, does not include payment financial information in the confirmation signal.
The authentication system receiving the first authentication act request information output by the data processing apparatus that has received the identification information of the digital system of the second user by the first user, or receiving the second authentication request by the data processing apparatus. A communication module for receiving second authentication action request information corresponding to the second authentication request output by the second authentication request;
A user device communication module for communicating with a predetermined user device;
And when the communication is performed, a confirmation signal, wherein the confirmation signal includes at least one of terminal identification information of the digital system or device identification information of the user device obtained through the communication. Module,
If an authentication confirmation procedure for authenticating at least one of the terminal identification information or the device identification information by the authentication system based on the transmitted confirmation signal is successful, a first authentication request corresponding to the first authentication action request information or And the second authentication request is successfully processed.
In the authentication system,
When the digital system communicates with a predetermined user device, a confirmation signal output by the digital system-the confirmation signal is at least one of terminal identification information of the digital system or device identification information of the user device obtained through the communication. A communication unit for receiving one;
An authentication unit for performing an authentication confirmation procedure based on the confirmation signal including the received terminal identification information or the device identification information; And
A control unit for successfully processing an authentication request outputted from a predetermined data processing apparatus to the authentication system or a service system connected to the authentication system when an authentication confirmation procedure for authenticating at least one of the terminal identification information or the device identification information is successful; Authentication system comprising a.
In the authentication system,
Receives an authentication request outputted from a data processing apparatus that receives identification information of a digital system of a second user by a first user, transmits authentication activity request information corresponding to the authentication request to the digital system, and transmits the digital system. And a confirmation signal, when the predetermined user device communicates, from the digital system, wherein the confirmation signal includes at least one of terminal identification information of the digital system or device identification information of the user device obtained through the communication. A communication unit for receiving;
An authentication unit for performing an authentication confirmation procedure for authenticating at least one of the terminal identification information and the device identification information based on the confirmation signal received by the communication unit; And
And a controller for successfully processing the authentication request if the authentication confirmation procedure is successful by the authentication unit.

Images