KR20150034970A - Apparatus and method for user authentication - Google Patents

Abstract

The present invention relates to an apparatus and a method for user authentication. The user authentication apparatus which is combined with a service server and authenticates a user comprises: an identification information processing unit for transmitting, to a first user terminal, server identification information and session generation information or transmitting image code information based on the server identification information or the session generation information when the service server receives a service request signal from the first user terminal, wherein the first user terminal displays an image code in a display unit based on the received server identification information and the received session generation information, or the received image code information; and an authentication unit for receiving authentication object information from a second user terminal obtaining the server identification information and the session generation information by scanning the image code displayed in the display unit of the first user terminal, and authenticating a user based on the received authentication object information.

Description

[0001] APPARATUS AND METHOD FOR USER AUTHENTICATION [0002]

The present invention relates to a user authentication apparatus and method, and more particularly, to a user authentication apparatus and method capable of enhancing security while maintaining convenience.

Recently, hacking cases over the Internet are increasing rapidly. Especially, with the popularization of smart phones, not only hacking using conventional computers but also hacking cases using smart phones are increasing rapidly.

The hacking method has been evolving in recent years, so that malicious code such as a pharming method may be infected in advance and a user may access the legitimate website even if the user accesses the illegal site. Also, as personal information such as large portal sites is leaked, there are also cases in which an illegal user accesses the relevant site by browsing personal information or uploading an advertisement spam post by acquiring an ID / password using the information.

As a technique for blocking such an illegal login, for example, a technique disclosed in Korean Patent Laid-Open Publication No. 10-2012-0037330 (published on April 19, 2012) is known.

According to this, the first image object is generated by receiving the user identification information, and the first image object is transmitted to the user terminal while receiving the second image object. A method of performing authentication in comparison with a first image object is disclosed.

In this method, an image object is photographed using a mobile terminal, which is a separate terminal, so that it is possible to prevent unauthorized access using only a computer. However, the user must first input login information and compare image codes There is still a limit in that authentication must be performed.

Korean Patent Publication No. 10-2012-0037330 (published on April 19, 2012)

SUMMARY OF THE INVENTION The present invention has been made in view of the above-mentioned circumstances, and it is an object of the present invention to provide an image forming apparatus and a method thereof, in which user authentication can be performed only by photographing an image code without inputting authentication target information such as an ID or a password, And an object of the present invention is to provide a user authentication apparatus and method capable of increasing the convenience of users.

In addition, the present invention allows a server to display server identification information in an image code on a user terminal based on a public key certificate issued by a certification authority including server identification information such as a domain address of the server, The terminal identification information of the terminal is photographed by the terminal and the server identification information is compared with the server identification information of the public key certificate stored in a separate user terminal so that the user can easily determine whether the server is a legitimate server It is another object to provide an authentication apparatus and method.

According to an aspect of the present invention, there is provided a user authentication apparatus for performing user authentication in combination with a service server, the apparatus comprising: a first user terminal for receiving a service request signal from a first user terminal; An identification information processing unit for transmitting the server identification information and the session creation information or transmitting the image code information based on the server identification information and the session creation information, wherein the first user terminal transmits the received server identification information and the session creation information or the reception Displaying an image code on a display unit based on one image code information; Receiving image authentication information from a second user terminal that has obtained the server identification information and the session creation information by scanning the image code displayed on the display unit of the first user terminal and performs user authentication based on the received authentication subject information And a user authentication unit configured to authenticate the user.

Here, the server identification information is preferably included in a public key certificate previously uniquely assigned to the service server from the certification authority.

When the first user terminal receives the server identification information and the session creation information, the first user terminal generates and displays the image code on the display unit based on the server identification information and the session creation information, and when receiving the image code information, Can be configured to be displayed.

In addition, the authentication object information may include at least one of a user identifier and a password.

Further, the authentication object information may be stored in advance in the second user terminal or may be acquired by input from the user.

If the public key certificate corresponding to the server identification information obtained by scanning the image code displayed on the display unit of the first user terminal is not stored in the second user terminal, A corresponding public key certificate may be obtained from the certificate authority.

Also, the second user terminal may obtain the public key information from the public key certificate.

The authentication object information received by the authentication performing unit may be encrypted and transmitted from the second user terminal based on the public key information.

The second user terminal compares the server identification information acquired by scanning the image code displayed on the display unit of the first user terminal with the server identification information included in the public key certificate, It may be configured to authenticate that the service server is a legitimate server.

Also, the authentication performing unit may transmit the user authentication result information together with the first user terminal and the second user terminal.

Also, the authentication performing unit may transmit the user authentication result information to the second user terminal, and if the approval signal is received from the second user terminal, the authentication performing unit may transmit the service page of the user authentication completed state to the first user terminal .

According to another aspect of the present invention, there is provided a method of authenticating a user in a user authentication apparatus coupled with a service server, the method comprising: when a service server receives a service request signal from a first user terminal, A first step of transmitting generation information or image code information based on the server identification information and the session generation information, wherein the first user terminal transmits the generated server identification information and session creation information or the received image code information Displaying an image code on a display unit based on the image code; A second step of receiving authentication object information from a second user terminal that has acquired server identification information and session creation information by scanning an image code displayed on a display unit of the first user terminal; And a third step of performing user authentication based on the received authentication object information.

According to another aspect of the present invention, there is provided a method for authenticating a user in a user authentication apparatus coupled with a service server, the method comprising: receiving a service request signal from a first user terminal, To a terminal; A second step of the first user terminal generating a key pair for providing a cryptographic key exchange protocol and generating an image code including a public key, wherein the first user terminal displays the image code on a display unit box-; A third step of the second user terminal scanning the image code to obtain the public key of the first user terminal and transmitting the encrypted authentication information based on the obtained public key to the first user terminal; A fourth step of the first user terminal decrypting the encrypted authentication target information received from the second user terminal and transmitting the decrypted encrypted authentication target information to the service server; And a fifth step of performing the user authentication based on the authentication object information received from the first user terminal by the service server.

According to the present invention, user authentication can be performed only by photographing an image code without having to input authentication target information such as an ID and a password separately from the user terminal, thereby enhancing the convenience of the user while maintaining security A user authentication apparatus and method can be provided.

In addition, the present invention allows a server to display server identification information in an image code on a user terminal based on a public key certificate issued by a certification authority including server identification information such as a domain address of the server, A user who is able to easily determine whether the server to which the user is connected is a legitimate server by obtaining the server identification information and comparing the obtained server identification information with server identification information of a public key certificate stored in a separate user terminal An authentication apparatus and method can be provided.

1 is a diagram illustrating a connection relationship between a service server providing a service in combination with a user authentication apparatus and a user authentication apparatus according to the present invention, a user terminal, and a certification authority.
2 is a diagram showing an internal configuration of the user authentication apparatus 10 according to the present invention.
3 is a flowchart illustrating an embodiment of a user authentication method according to the present invention.
4 is a flowchart illustrating a user authentication method according to another embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 illustrates the overall connection relationship between a service server 100 providing a service in combination with a user authentication apparatus 10 and a user authentication apparatus 10 according to the present invention, user terminals 200 and 300, and a certification authority 400 FIG.

Referring to FIG. 1, a user authentication apparatus 10 according to the present invention is included in a service server 100, and a service server 100 is connected to a first user terminal 200, a second user terminal 300 and the certification authority 400. [

The service server 100 may be a conventional web server providing a web service to a user terminal via a network, for example, as a server for providing a service to a user through a network. In some cases, the service server 100 does not perform user authentication but simply provides a service. However, in many cases, the user authentication is performed by receiving login information such as an ID and a password from a user. Is combined with the service server 100 to perform a user authentication process as described below.

That is, the service server 100 according to the present invention receives and stores a public key certificate including server identification information uniquely assigned to each service server 100 from the certification authority 400, and the first user terminal 200 The user authentication apparatus 10 transmits server identification information and session generation information to the first user terminal 200 or transmits image identification information based on the server identification information and the session creation information do.

When the first user terminal 200 displays the image code on the display unit based on the server identification information and the session creation information or the image code information, the second user terminal 300 scans the image code and displays the server identification information and the session creation information . Next, when the second user terminal 300 transmits authentication object information such as an ID and a password to the service server 100, the user authentication apparatus 10 performs user authentication based on the received authentication object information do.

In FIG. 1, the first user terminal 200 is a terminal that is connected to the service server 100 to receive a service. The first user terminal 200 includes a network connection unit and a display unit as a conventional device known in the art such as a computer, a smart phone, and the like. When the first user terminal 200 accesses the service server 100 and requests a service, the first user terminal 200 receives the server identification information and the session creation information from the user authentication apparatus 10, or receives the server identification information and the image creation information And displays an image code based thereon on a display unit (not shown). Here, the image code is preferably a two-dimensional bar code such as a QR code.

The second user terminal 200 scans the image code displayed on the display unit of the first user terminal 200 to obtain the server identification information and the session creation information, encrypts the authentication target information of the user, To the user authentication apparatus 10 to be combined. To this end, the second user terminal 200 comprises photographing means (not shown) such as a camera capable of scanning image codes and network connection means.

In the present invention, the first user terminal 200 is preferably a computer, and the second user terminal 300 is a mobile communication terminal such as a smart phone having a camera.

Upon receiving the authentication object information from the second user terminal 300, the user authentication device 10 performs a user authentication process based on the received authentication object information. When the authentication is successful, the authentication is completed. For example, in the case of the web service, the web page of the state in which the authentication is completed, that is, the login is completed is transmitted to the first user terminal 100, And the web service according to the request of the web service.

Meanwhile, the certification authority 400 performs a function of uniquely assigning a public key certificate including the server identification information to each of the service servers 100. In response to a request from the service server 100, each of the service servers 100 And transmits the public key certificate to the service server 100 and stores the public key certificate. The service server 100 also stores a public key certificate including server identification information. Here, the public key certificate refers to data issued by the certification authority 400 to certify that a specific public key is associated with a specific user (service server), as is known in the art. The public key certificate itself is not a direct object of the present invention, and the present invention can use any public key certificate of any kind known in the art, so a detailed description thereof will be omitted. The public key certificate may also include other necessary information to authenticate that the service server is a legitimate server.

2 is a diagram showing an internal configuration of the user authentication apparatus 10 according to the present invention.

Referring to FIG. 2, the user authentication apparatus 10 includes an identification information processing unit 11 and an authentication performing unit 12.

When the service server 100 receives the service request signal from the first user terminal 200, the identification information processing unit 11 transmits the server identification information and the session creation information to the first user terminal 200, And transmits the image code information based on the information and the session creation information. As described above, the first user terminal 200 displays the image code on the display unit based on the server identification information and the session creation information or the image code information.

As described above, the server identification information is preferably a domain address, for example, as identification information included in a public key certificate uniquely assigned to each service server 100 in the certification authority 400. The session creation information refers to additional information for performing a key exchange protocol and a session ID, which is identification information given to a session formed for performing a service between the service server 100 and the first user terminal 200 Since this is known from the prior art, detailed description is omitted. The session creation information includes a function for allowing the service server 100 to check which session the authentication target information is for when the second user terminal 300 transmits authentication target information to the service server 100, And performs a function of providing additional information for performing the key exchange protocol.

The identification information processing unit 11 can transmit the server identification information and the session creation information to the first user terminal 200. In this case, based on the server identification information and the session creation information received by the first user terminal 200 For example, an image code of a two-dimensional barcode such as a QR code is generated and displayed on the display unit.

On the other hand, when the identification information processing unit 11 transmits the image code information based on the server identification information and the session creation information, the first user terminal 200 displays the image code corresponding to the received image code information on the display unit do.

The authentication performing unit 12 scans the image code displayed on the display unit of the first user terminal 200 and receives the authentication object information from the second user terminal 300 that has obtained the server identification information and the session creation information, And performs the user authentication based on the received authentication object information.

Here, the authentication object information may be, for example, a user identifier (ID) and a password as information to be compared at the time of performing authentication in the service server 100, for example. Of course, this information may be cryptographically generated identification information based on random number information for identifying other users.

When the service server 100 is required to perform a login service, the authentication object information may be login information input by the user for login. The authentication object information may be stored in the second user terminal 300 in advance for each service server 100. The user terminal 300 may receive the authentication object information from the user through an input means such as a keypad of the second user terminal 300. [

On the other hand, if the second user terminal 300 does not store the public key certificate corresponding to the server identification information obtained by scanning the image code displayed on the display unit of the first user terminal 100 in the second user terminal 300 The second user terminal 300 may acquire a public key certificate corresponding to the server identification information from the certification authority 400. [ To this end, the second user terminal 300 may access the certification authority 400 to transmit the identification information of the corresponding service server and receive the corresponding public key certificate. The public key certificate here also includes public key information together with the server identification information and information necessary for authentication of the other server as described above.

Meanwhile, the second user terminal 300 transmits the server identification information obtained by scanning the image code displayed on the display unit of the first user terminal 200, the public key certificate stored in advance, or the public key certificate obtained from the certification authority 400 It is preferable that authentication of the service server is performed by comparing the server identification information included in the certificate. The second user terminal 300 may provide the authentication result of the service server 100 through the display unit so that the second user terminal 300 can recognize the user when the user accesses the illegal site by way of, . For example, if the server identification information to be compared is different, the display unit of the second user terminal 300 indicates to the user that the authentication has been denied, and the subsequent process is suspended. This means that any one of the server identification information is not the valid server identification information of the service server 100. For example, if the first user terminal 200 is not a legitimate service server 100 but a service server 100). ≪ / RTI >

The second user terminal 300 transmits authentication target information to the authentication performing unit 12 of the user authentication apparatus 10 when the second user terminal 300 is a mobile communication terminal such as a smart phone, And may be transmitted through a communication network. Alternatively, the second user terminal 300 may transmit the authentication object information through the first user terminal 200.

Also, it is preferable that the second user terminal 300 transmits the authentication object information to the service server 100 according to the policy of the service server 100, and it may be transmitted through a key exchange protocol or a user authentication protocol . For this purpose, the service server 100 may be configured to transmit the public key to the first user terminal 200 together with the server identification information and the session creation information.

When the second user terminal 300 receives the authentication object information from the second user terminal 300, the authentication performing unit 12 stores the second authentication information in response to the service server 100, And encrypts the authentication subject information with the public key stored in the public key certificate obtained by the authentication. When the encrypted authentication object information is received, the authentication performing unit 12 decrypts the information.

Also, the second user terminal 300 and the authentication performing unit 12 generate a key by performing a key sharing process or a key exchanging process by a key sharing protocol based on a public key, So as to encrypt and transmit the encrypted authentication target information. This process is known from the prior art and is not a direct object of the present invention, so a detailed description thereof will be omitted.

Meanwhile, the authentication performing unit 12 performs user authentication by comparing authentication target information received from the second user terminal 300 with authentication information of a user stored in advance on the service server 100 side. As described above, the authentication object information may be, for example, a user identifier (ID) and a password, and may be cryptographically generated identification information based on random number information for identifying other users in addition to such information. The authentication performing unit 12 compares the authentication object information with previously stored authentication information, determines whether the user is a legitimate user, and performs user authentication.

The authentication performing unit 12 may simultaneously transmit the user authentication result information to the first user terminal 200 and the second user terminal 300. [ This is to prevent authentication of a fraudulent user using either the first user terminal 200 or the second user terminal 300 so that the user can visually confirm the same at the same time.

The authentication performing unit 12 first transmits the user authentication result information to the second user terminal 300 and receives an approval signal from the second user terminal 300 to confirm that the corresponding result information is recognized And may transmit the service page in a state in which the authentication is completed to the first user terminal 200. That is, the second user terminal 300 is provided with an information for notifying that the authentication is successful, and at the same time provides an interface through which the user can select the approval, and if the user selects and approves the authentication, And transmit the service page in a state in which the authentication is completed to the first user terminal 200.

FIG. 3 is a flowchart illustrating an embodiment of a method for authenticating a user according to the present invention with the configuration described with reference to FIGS. 1 and 2. FIG. It should be noted that FIG. 3 shows a case where the user authentication apparatus 10 is included in the service server 100 for convenience of explanation.

Referring to FIG. 3, the service server 100 obtains a public key certificate including unique server identification information from the certification authority 400 and stores it (S100).

In this state, when a connection is made through the Web, for example, from the first user terminal 200 and a web service request signal is thus received (S110), the user authentication apparatus 10 transmits the server identification information And session creation information (S120). Such server identification information and session creation information may be transmitted together with an initial web page to correspond to the service request signal.

The first user terminal 200 receives the server identification information and the session creation information, generates an image code corresponding thereto, and displays the generated image code on the display unit (S130). At this time, it is preferable that the image code is a two-dimensional barcode such as the QR code as described above, and the image code is preferably included in the initial web page for the web service request signal.

In this state, the user operates the second user terminal 300 to scan the image code displayed on the display unit of the first user terminal 200 using the camera provided in the second user terminal 300, The server identification information and the session creation information are extracted and obtained (S140, S150).

Next, the second user terminal 300 checks whether the public key certificate corresponding to the obtained server identification information is stored. If the public key certificate is not stored, the second user terminal 300 transmits the public key certificate corresponding to the server identification information to the certification authority 400 And receives it (S160).

The second user terminal 300 compares the server identification information extracted from the scanned image code with the server identification information included in the public key certificate stored or stored in the certification authority 400, (S170). If the authentication fails, it is provided to the user through the display unit of the second user terminal 300 that the authentication has failed and the subsequent process is stopped. In this case, the second user terminal 300 verifies the availability of the public key certificate, and based on the server identification information stored in the public key certificate, the user, that is, the service server 100 connected to the first user terminal 200 It is preferable to provide information on the user through the display unit of the second user terminal 300 so that the user can determine whether or not the user has accessed the intended server.

When authentication of the service server 100 is successful, the second user terminal 300 checks whether the authentication object information, for example, the ID and the password stored beforehand corresponding to the service server 100 corresponding to the server identification information exists If it is not stored, the user inputs the ID and the password through the display unit to obtain the authentication object information such as the ID and the password (S180). If the authentication object information is stored in advance, the step S180 may be omitted.

Next, the second user terminal 300 transmits the authentication object information to the user authentication apparatus 10 of the service server 100 corresponding to the extracted server identification information (S190). At this time, it is preferable to also transmit the session creation information.

It is preferable that the authentication object information is encrypted and transmitted based on the public key information included in the public key certificate acquired from the certification authority 400 or stored in advance as described above. That is, it is preferable that encrypted authentication object information is transmitted and received between the second user terminal 300 and the user authentication apparatus 10 of the service server 100 by a key sharing protocol or a key exchange algorithm based on the public key.

The user authentication apparatus 10 of the service server 100 decrypts authentication target information received from the second user terminal 300 and compares the authentication target information with previously stored authentication information to perform user authentication corresponding to the session creation information (S200).

Next, the user authentication apparatus 10 transmits the user authentication result to the first and second user terminals (S210). If the authentication is successful, the service page of the authentication completed state, for example, the web page in which the login is completed, is transmitted to the first user terminal 200 (S220) so that the web service can be continuously performed. The user authentication result may be simultaneously transmitted to the first and second user terminals as described above. Alternatively, the first user terminal 300 may transmit the authentication result to the first user terminal 200 when the authentication result is received from the second user terminal 300.

FIG. 4 is a flowchart illustrating a method of authenticating a user according to another embodiment of the present invention. FIG. 4 illustrates a case where a public key certificate is not issued in the service server 100 in advance.

Referring to FIG. 4, the first user terminal 200 accesses the service server 100 and transmits a service request signal (S300). In response, the service server 100 transmits an initial service response page to the first user To the terminal 200 (S310).

The first user terminal 200 generates a key pair for providing a cryptographic key exchange protocol, generates an image code including the public key, and displays the generated image code through the display unit at step S320.

The second user terminal 300 scans the image code displayed on the display unit of the first user terminal 200 and acquires the public key information of the first user terminal 200 from the scanned image code at steps S330 and S340.

Next, the second user terminal 300 acquires the authentication object information in the same manner as described in step S180 of FIG. 3 (S350), and based on the public key obtained in the step S340, (S360), and transmits the encrypted authentication object information to the first user terminal 200 (S370).

The first user terminal 200 decrypts the encrypted authentication object information received from the second user terminal 300 in step S380 and transmits the decrypted authentication object information to the service server 100 in step S390. The service server 100 performs user authentication based on the authentication object information received from the first user terminal 100 and transmits the result to the first and second user terminals 200 and 300 (S400, S410, S420). The steps (S400) to (S420) are the same as the steps (S200) to (S220) of FIG. 3, and the detailed description will be omitted.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments.

For example, in the step S120 of FIG. 3, although the server identification information and the session creation information are transmitted to the first user terminal 200, instead of the server identification information and the session creation information, Information may be transmitted. In this case, the first user terminal 200 omits the process of generating the image code separately and displays the image code corresponding to the received image code information on the display unit.

1 to 3, the user authentication apparatus 10 is included in the service server 100, but it is needless to say that the user authentication apparatus 10 may be implemented as a separate server.

10 ... User authentication device
100 ... service server
200 ... first user terminal
300 ... second user terminal
400 ... Certification Body

Claims (13)

A user authentication apparatus for performing user authentication by combining with a service server,
An identification information processor for transmitting the server identification information and the session creation information to the first user terminal or the image code information based on the server identification information and the session creation information when the service server receives the service request signal from the first user terminal, Wherein the first user terminal displays an image code on the display unit based on the received server identification information, the session creation information, or the received image code information;
Receiving image authentication information from a second user terminal that has obtained the server identification information and the session creation information by scanning the image code displayed on the display unit of the first user terminal and performs user authentication based on the received authentication subject information Authentication-
.
The method according to claim 1,
Wherein the server identification information is contained in a public key certificate uniquely assigned to the service server from an authentication authority in advance.
The method according to claim 1,
Upon receiving the server identification information and the session creation information, the first user terminal generates an image code based on the server identification information and the session creation information, displays the image code on the display unit, and displays the corresponding image code on the display unit And the user authentication device.
The method according to claim 1,
Wherein the authentication object information includes at least one of a user identifier and a password.
The method according to claim 1,
Wherein the authentication object information is previously stored in the second user terminal or acquired by input from the user.
The method according to claim 1,
When the second user terminal does not store the public key certificate corresponding to the server identification information obtained by scanning the image code displayed on the display unit of the first user terminal, And obtains the public key certificate from the certification authority.
The method according to claim 6,
Wherein the second user terminal obtains public key information from the public key certificate.
8. The method of claim 7,
Wherein the authentication object information received by the authentication performing unit is encrypted and transmitted from the second user terminal based on the public key information.
The method according to claim 6,
The second user terminal compares the server identification information acquired by scanning the image code displayed on the display unit of the first user terminal with the server identification information included in the public key certificate, Is authentic. ≪ RTI ID = 0.0 > 31. < / RTI >
The method according to claim 1,
Wherein the authentication performing unit transmits user authentication result information together with the first user terminal and the second user terminal.
The method according to claim 1,
Wherein the authentication performing unit transmits the user authentication result information to the second user terminal and transmits the service page in the user authentication completed state to the first user terminal when the approval signal is received from the second user terminal. Device.
A method for authenticating a user in a user authentication apparatus coupled with a service server,
A first step of transmitting the server identification information and the session creation information to the first user terminal or the image code information based on the server identification information and the session creation information when the service server receives the service request signal from the first user terminal And the first user terminal displays the image code on the display unit based on the received server identification information and the session creation information or the received image code information;
A second step of receiving authentication object information from a second user terminal that has acquired server identification information and session creation information by scanning an image code displayed on a display unit of the first user terminal; And
A third step of performing user authentication based on the received authentication object information
And a user authentication method.
A method for authenticating a user in a user authentication apparatus coupled with a service server,
A service server receiving a service request signal from a first user terminal and providing a corresponding service response page to a first user terminal;
A second step of the first user terminal generating a key pair for providing a cryptographic key exchange protocol and generating an image code including a public key, wherein the first user terminal displays the image code on a display unit box-;
A third step of the second user terminal scanning the image code to obtain the public key of the first user terminal and transmitting the encrypted authentication information based on the obtained public key to the first user terminal;
A fourth step of the first user terminal decrypting the encrypted authentication target information received from the second user terminal and transmitting the decrypted encrypted authentication target information to the service server; And
A fifth step of performing a user authentication based on the authentication object information received from the first user terminal by the service server
And a user authentication method.

Images