KR20150124931A - Secure user two factor authentication method from Personal infomation leaking and smishing - Google Patents

Abstract

The present invention relates to a double user authentication method which uses subscriber information (IMSI, ICCID) being a unique identification number stored in a USIM and an OTP or a user-set password to authenticate a user twice to prevent the damage caused by hacking, smishing, and pharming. The method includes: a first step of registering an ID and a password in a service server; a second step of enabling a mobile communication company server to check the validity of a user when an authentication server receives the mobile phone number of a user in an authentication service subscription step to store unique information for the user authentication in a database; a third step of enabling the service server to receive the mobile phone number and transmit the number to the authentication server when the user requests the authentication log-in in an authentication service usage step; a fourth step of activating an authentication app in the corresponding user′s mobile phone when the user is an authentication service subscriber to extract the unique information thereof when the authentication server receives the mobile phone number of the user; a fifth step of receiving the ID and password of the user by the authentication app in order to enable the authentication app to transmit the information with the unique information to the authentication server; a sixth step of enabling the authentication server to compare the received unique information with the stored unique information or with the unique information of a mobile communication company to conduct a first authentication operation; a seventh step of enabling the service server to receive the first authentication result, ID, and password from the authentication server in order to compare the received information with the ID and password registered therein; and an eighth step of enabling the service server to provide a service to the corresponding user according to the authentication result.

Description

[0001] The present invention relates to a user authentication method for preventing personal information leakage and smashing,

The present invention relates to a technique for securely authenticating a user on a network, and more particularly, to a technique for securely authenticating a user on a network, including a subscriber information (IMSI, ICCID), a unique identification number stored in a universal subscriber identity module (USIM) The user is authenticated by using one password, and the OTP is transmitted to the mobile phone at the time of using the micropayment or authentication service, and the current user authentication process inputted by the PC is changed to transmit the OTP to the PC and input the OTP to the smartphone (USIM) that can prevent damage caused by hacking, smashing, pharming, etc. by allowing a user to input an app password into a smartphone.

Generally, a universal subscriber identity module (USIM) is an application for WCDMA network connection and subscriber authentication, and is mounted and operated on a UICC (Universal Integrated Circuit Card), which is a smart card for communication. The USIM application stores important information such as subscriber information (IMSI, ICCID), network information, and authentication information, and personal supplementary service information such as a text message, e-mail, and phone book. Herein, the subscriber information, which is unique identification information, is composed of an International Mobile Subscriber Identification (IMSI) and an Integrated Circuit Card Identifier (ICC-ID) of 19 or 20 digits. The USIM application shares a secret key K with an authentication center (AuC) for WCDMA subscriber authentication and performs a predetermined authentication procedure to provide confidentiality and integrity of the wireless network service.

On the other hand, the security on the network is divided into two stages of intrusion prevention and intrusion detection. Intrusion prevention is at the forefront of network security, including authentication, authorization, and access control. In the case of an externally connected network, an intrusion from the outside is inevitable. If an intruder breaks the intrusion prevention method and then enters the network, intruder detection must be performed to detect an intruder.

One of the most popular methods of intrusion prevention is User Authentication, which prevents users from accessing the network if they can not provide enough data to prove themselves. To prevent the intrusion of the network based on user authentication, the user authentication method should be designed for the network environment and the security weak points at the whole network level should be removed.

When using site login, personal authentication, micropayment, credit card payment, money transfer, etc. on the network, the user's ID and password are authenticated or the OTP (One Time Password) is transmitted to the mobile phone A method of authenticating by inputting this, and a method of using an authorized certificate.

In recent years, as IT technology has developed, malicious attack techniques such as hacking, smsing, and pharming have been diversified, making existing authentication methods ineffective. In addition, risk of exposure of important personal information due to lack of management of financial institutions . For example, ID and PWD are hacked and stolen, so items, mileage are taken away, OTP SMS is intercepted in the middle and used for micropayment fraud, The damage is occurring, and the anxiety of users is increasing. In particular, most users are storing their IDs and passwords in a smartphone memory in the form of cookies in order to use automatic login on their smartphones, thus increasing the risk of hacking.

Particularly, there is a method of transmitting an OTP to a user's mobile phone and inputting the OTP to a PC when using the site authentication and the micropayment on the network, and a small amount of OTP transmission SMS There is a lot of damage to payment fraud, and the anxiety of the users is increasing. In order to prevent such smashing, payment service operators are strengthening their efforts to prevent users from installing malicious apps.

In addition, to prevent hacking, smashing, pharming, etc., each financial institution, site operator, and payment service operator require users to use additional authentication means in addition to the existing authentication means, or to make the number of digits or character combinations complicated The inconvenience of users is increasing.

Patent Document 1: Japanese Patent Application Laid-Open No. 10-2012-10602 (entitled " User Authentication Processing Method Enhanced Security Through Mobile Communication System and Mobile Communication Terminal Used Therefor)

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the above-mentioned problems, and an object of the present invention is to provide a method and system for authenticating a user by using a unique subscriber information (ICC-ID) and an OTP or a password stored in a USIM (USIM) that enables secure and convenient login, personal authentication, micropayment, credit card payment, and fund transfer on the network by changing the OTP transmission and input process.

According to an aspect of the present invention, there is provided a method for registering an ID and a password in a service server, A second step of confirming whether the authenticated user is a valid user in the mobile communication company server when the authentication server receives the mobile phone number of the user in the authentication service subscription step and storing unique information (ICCID) for user authentication in its own database; A third step of receiving the mobile phone number from the service server and transmitting the mobile phone number to the authentication server when the user requests authentication login in the authentication service use step; A fourth step of confirming whether the authentication server is an authentication service subscriber when the authentication server receives the mobile phone number of the user and activating an authentication app of the user mobile phone to extract unique information (ICCID) if it is an authentication service subscriber; A fifth step of the authentication app receiving the user's ID and password and transmitting the same to the authentication server together with unique information (ICCID); A sixth step of the authentication server comparing the received unique information (ICCID) with stored unique information (ICCID) or unique information (ICCID) stored in the mobile communication company server to perform primary authentication; A seventh step of the service server receiving the primary authentication result and the ID and the password from the authentication server and comparing the ID and the password with the self-registered ID and password to perform secondary authentication; And an eighth step of the service server providing a service to the user according to the authentication result.

The user authentication method according to the present invention authenticates the user using the OTP or the password stored in the USIM or the service server, and performs the second authentication using the subscriber specific information (ICC ID, IMSI) of the USIM to double-authenticate the user. The service can be used. In particular, since the present invention can store the password in the USIM of the mobile terminal and authenticate the same using the same, it is safe from the hacking of the PC or the smartphone, and the subscriber information (ICC ID) Of the mobile phone and transmits the OTP to the PC instead of the mobile phone and inputting the application password instead of the OTP or the smart phone, thereby preventing the sms from being smuggled by the installation of malicious apps. In addition, the subscriber information can be read only by a trusted carrier authorized by the mobile communication company, so that it is possible to prevent the pharming due to the up / modulation of the application (App).

Since the present invention is double-authenticated by using the password and the subscriber information, even if the personal information such as the ID and the password is leaked, it is possible to prevent the damage due to leakage of personal information because the subscriber information is not known, It is possible to prevent hacking damage due to indiscriminate use of cookies, and it is safe from keyboard hacking and the like because the authentication means storage and media are separated in the PC.

In addition, since the user is required to input only the password at the time of authentication, and the subscriber information authentication is performed without the user knowing it, the procedure can be simplified rather than the authentication method that has been performed, It is possible to prevent inconvenience caused by

FIG. 1 is a schematic diagram showing an overall network configuration of a user authentication system using a USIM according to the present invention.
FIG. 2 is a flowchart illustrating a procedure for a user to input and store a password directly in a USIM in the first embodiment of the present invention. FIG.
3 is a flowchart illustrating a procedure for storing a password in a USIM through a mobile communication network in the first embodiment of the present invention.
FIG. 4 is a flowchart illustrating a procedure for authenticating a user using a USIM according to the first embodiment of the present invention; FIG.
5 is a flowchart illustrating a procedure for subscribing to an authentication service according to a second embodiment of the present invention;
6 is a flowchart showing a procedure for using an authentication service according to a second embodiment of the present invention;
FIG. 7 is a flowchart illustrating a procedure of applying an authentication service to a micropayment according to a third embodiment of the present invention;
8 is a flowchart showing an authentication procedure using a password instead of OTP in a micropayment according to a third embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. The following examples are merely illustrative of the present invention and are not intended to limit the scope of the present invention.

1 is a network configuration diagram of a user authentication system using a USIM according to the present invention.

1, a user authentication system 100 according to the present invention includes a user's cellular phone 112 equipped with a USIM for storing a user's password and unique information, a service server A service server 120 for providing a service to a user, a user information such as a mobile phone number, unique information (ICCID), and the like, (ICCID) and mediates user authentication; a mobile communication company server (hereinafter referred to as " user ") that authenticates whether the user is a legitimate user who can use the user authentication method and transmits user information to the authentication server 140, a payment server 150, a wired / wireless Internet 102 and a mobile communication network 104 for connecting the respective entities. In the exemplary embodiment of the present invention, the user terminal 110 has been described as an example of a user terminal. However, various types of wired / wireless terminals that can access the Internet, such as a smart phone, a tablet PC,

Referring to FIG. 1, the Internet 102 refers to a network of networks conforming to the TCP / IP communication protocol for connecting a computer network scattered around the world via wire / wireless, as is well known. The mobile communication network 104 is composed of a base station (BS) and a base station controller (BSC), and is a comprehensive communication network including an access network of CDMA, WCDMA as well as LTE, LTE-A and a mobile communication system to be implemented in the future.

The user PC 110 is a personal computer that can access the Internet. The USIM included in the user cell phone 112 is a card-like module that can be used in a mobile phone. The USIM is used for authentication, charging, UICC (Universal Integrated Circuit Card), which is a smart card for communication, which stores personal information so as to provide various services. Various information including unique subscriber information (IMSI, ICCID) is stored in the USIM. In the embodiment of the present invention, unique information given to each USIM is simply referred to as 'ICCID'.

The service server 120 is a normal service site in which a user connects to the user PC 110 or the mobile phone via the Internet 102 to use content or purchase goods, . In other words, the service server 120 is a server of a company that mediates various sites, online shopping malls, portal sites, or settlement businesses that require login, and authentication services.

The authentication server 130 is a server for providing user authentication using a USIM according to the present invention. The authentication server 130 stores information necessary for user authentication such as a mobile phone number and ICCID, performs authentication, transmits an authentication result, It serves to mediate certification work.

The mobile communication company server 140 stores information on the mobile communication subscriber (subscriber information stored in the USIM), thereby authenticating whether the mobile phone user is a subscriber of the mobile communication company, transmitting the necessary customer information to the authentication server 130, Update information.

The payment server (PG) 150 is a payment gateway (PG) or a payment agency service server for processing payment according to a request of the service server 120. [

According to the present invention for authenticating a user using the user authentication system 100, the procedure differs depending on whether or not a password is stored in the USIM of the mobile phone 110. In the embodiment of the present invention, A first embodiment of authenticating using an authentication application of the mobile phone and authenticating with an ICCID by the authentication server 130; and a second embodiment of authenticating by using the ICCID in the service server 120 without storing the password in the USIM, A second embodiment for authenticating with ICCID, and a third embodiment, which is a micropayment procedure to which the authentication service of the present invention is applied, will be described below.

[First Embodiment]

FIG. 2 is a flowchart illustrating a procedure in which a user directly inputs and stores a password in a USIM according to a first embodiment of the present invention. That is, in the method of FIG. 2, the password is not stored in the service server 120 but directly stored in the USIM of the user's cell phone 112 to authenticate the user.

Referring to FIG. 2, the user enters cell phone information necessary for using the user authentication using the USIM in the user PC 110 or the cellular phone to the service server 120, and the service server 120 transmits To the server 130 (S101, S102).

The authentication server 130 transmits the mobile phone information to the communication company server 140 and requests the user to authenticate whether the user is a legitimate user capable of authenticating the user using the USIM (S103).

After receiving the mobile phone information, the communication server 140 transmits the authentication result and the customer information to the authentication server 130 (S104, S105). Here, the customer information is the information of the user registered in the communication company server 140 such as the mobile phone number and the ICCID.

The authentication server 130 stores the customer information (ICCID) transmitted from the communication company server 140 in the database DB of the authentication server 130 and pushes the authentication application to the user mobile phone 112 to request the password input (S106).

The authenticated app executed in the user cell phone 112 requests the user to input the password, and stores the password in the USIM of the user's cell phone 112 when the password is input (S107, S108).

3 is a flowchart illustrating a procedure for storing a password in a USIM through a mobile communication network for user authentication using a USIM according to a first embodiment of the present invention. That is, FIG. 2 illustrates a method in which a user directly inputs a password through an authentication application, FIG. 3 illustrates a method in which the service server 120 provides a password in a case where a user ID and a password (ID / PWD) The authentication server 130 stores the password to the USIM of the corresponding user's cellular phone 112 via the mobile communication network 104. [

Referring to FIG. 3, an ID and a password PWD are registered in the service server 120 by the user.

After the user logs in the service server 120 using the user PC 110 or the cellular phone and inputs the cellular phone information to the service server 120 for user authentication, the service server 120 transmits the cellular phone information of the user And transmits the password to the authentication server 130 (S201, S202).

The authentication server 130 temporarily stores the password, and transmits the cellular phone information to the communication company server 140 to request the user to authenticate whether the user is a legitimate user capable of authenticating the user using the USIM (S203).

The communication company server 140 having received the mobile phone information transmits the authentication result, the mobile number, and the ICCID to the authentication server 130 (S204, S205).

The authentication server 130 stores the user information (customer information) transmitted from the communication company server 140 in the database DB of the authentication server 130 and moves the password of the user received from the service server 120 (S206, S207), the authentication application transmits the password to the USIM of the user's cell phone 112 by pushing the authentication app.

4 is a flowchart illustrating a procedure for authenticating a user using a USIM stored with a password according to the first embodiment of the present invention.

4, the user inputs cell phone information to the service server 120 to request user authentication using the USIM from the user PC 110 or the cellular phone, and the service server 120 transmits the cellular phone information to the authentication server 130 (S301, S302).

The authentication server 130 compares the cellular phone information requested to be authenticated with the information of the database (DB) stored in the authentication server 130 and confirms whether the user can use the user authentication method using the USIM (S303). When the requested user is identified as a legitimate user who can use the user authentication method using the USIM, the authentication server 130 requests the password input by pushing the authentication application to the corresponding user's cell phone 112 (S304).

When the user inputs the password in the user's cell phone 112, the authentication app compares the password stored in the USIM of the user's cell phone 112 with the password input by the user and authenticates (S305, S306).

When the password authentication is completed, the authentication application extracts and encrypts the ICCID of the user mobile phone USIM 112, and transmits the password authentication result and ICCID to the authentication server 130 (S307, S308).

The authentication server 130 compares the ICCID stored in the database DB of the authentication server 130 with the ICCID transmitted from the user's cellular phone 110 or the ICCID of the mobile communication company server 140 to perform USIM authentication, And the authentication result of the ICCID to the service server 120 (S309, S310).

When the authentication result is successfully completed, the service server 130 provides a service such as login and payment. If the authentication result does not normally complete, the service server 130 notifies the user of the authentication failure message (S311 to S313).

 [Second Embodiment]

5 is a flowchart illustrating a procedure for subscribing to an authentication service according to a second embodiment of the present invention.

Referring to FIG. 5, a user is registered in the service server 120 and an ID and a password PWD are registered in the subscriber database (S401 and S402).

After the user inputs the user's mobile phone number into the user's PC 110 or cellular phone, the service server 120 transmits the mobile phone number to the authentication server 130 and requests the authentication service subscription S403, S404).

The authentication server 130 transmits the delivered mobile phone number to the communication company server 140 to request a name confirmation, and the communication company server 140 confirms the name and transmits the corresponding customer information to the authentication server 130 (S405- S407).

After the authentication server 130 stores the customer information requesting the authentication service in its own database, the authentication server 130 transmits a text message (SMS) including the download URL for installing the authentication app to the corresponding user's cellular phone 112 (S408 and S409) .

Accordingly, the user's cell phone 112 installs the authentication application, subscribes to the authentication service, inputs the ID and the password of the service server 120, and requests the authentication server 130 to perform ID and password verification (S410- S413).

The authentication server 130 transmits the ID and the password to the service server 120 to request the ID and the password verification. The service server 120 verifies the received ID and password, and then transmits the verification result to the authentication server 130 (S414 to S416).

The authentication server 130 receives the result of the ID and the password verification, processes the completion of the authentication service subscription if the user is a legitimate user, transmits the authentication service subscription information to the service server 120, And notifies completion (S417 to S419).

6 is a flowchart illustrating a procedure for using a user authentication service according to a second embodiment of the present invention. First, the subscriber information about the authentication service subscribers is updated frequently between the authentication server 130 and the mobile communication server server 140, and the latest customer information is stored in the database of the authentication server 130 (S513).

6, the user accesses the service server 120 and selects 'authentication login (secure login)' among the general login and 'authentication login (secure login)', and inputs the mobile phone number (S501 and S502) .

The service server 120 sends the mobile phone number to the authentication server 130 to request user authentication, and the authentication server 130 activates the authentication application of the mobile phone (S503 to S505).

The authentication application of the mobile phone extracts the ICCID from the USIM of the user's cell phone 112, receives the ID and the password, and transmits it to the authentication server 130 (S506 to S508).

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the internal database DB or the ICCID of the mobile communication company server 140 to authenticate the user and transmits the ICCID authentication result, To the server 120 (S509, S510).

If the ICCID authentication result is a valid user, the service server 120 compares the ID and the password transmitted from the user with the self-registered ID and password, and permits the login according to the verification result (S511, S512).

[Third Embodiment]

7 is a flowchart illustrating a procedure of applying an authentication service to a micropayment according to a third embodiment of the present invention. In the third embodiment, the service server 120 is a web site such as a shopping mall or a contents provider (CP) site .

Referring to FIG. 7, when a user purchases goods or contents from a web site 120 such as a shopping mall or a contents provider site subscribed to the authentication service according to the present invention using the PC 110 or a mobile phone, Subscriber information such as a mobile phone number is input (S601). The web site 120 requests payment from the payment gateway 150 and the payment server 150 requests the communication company 140 to perform subscriber authentication in steps S602 and S603. The communication company 140 transmits the subscriber authentication result to the payment server 150. If the subscriber is a legitimate subscriber, the payment server 150 requests the authentication server 130 to authenticate using the USIM (S604, S605).

The authentication server 130 pushes the authentication application to the mobile phone 112 of the subscriber and activates the authentication application in the user mobile phone 112. The payment server 150 transmits an OTP (One Time Password) authentication to the user PC 110 (S606, S607). The user inputs the OTP in the user's cellular phone 112, and the authentication app extracts the ICCID stored in the USIM and transmits it to the authentication server 130 together with the input OTP (S606 to S611). As described above, in the present invention, the payment server 150 transmits the OTP to the user PC 110, and allows the user phone 112 on which the USIM is installed to input the OTP.

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the corresponding subscriber registered in advance, authenticates the ICCID, and transmits the authentication result and the OTP to the payment server 150 (S612 and S613). The payment server 150 performs OTP authentication, and if all user authentication is successful, the payment server 150 approves the payment, and the website 120 completes the payment processing (S614 to S616).

8 is a flowchart showing an authentication procedure using a password instead of OTP in a micropayment according to a third embodiment of the present invention.

Referring to FIG. 8, when a user purchases goods or contents from a web site 120 such as a shopping mall or a contents provider site subscribed to the authentication service according to the present invention using the user PC 110, The subscriber information such as the number is input (S701). The web site 120 requests payment from the payment gateway 150 or the authentication agency and the payment server 150 or the authentication agency requests the communication company server 140 to perform subscriber authentication in steps S702, S703). The communication company server 140 transmits the subscriber authentication result to the payment server 150. If the subscriber is a legitimate subscriber, the payment server 150 requests the authentication server 130 to authenticate using the USIM (7604, S705).

The authentication server 130 pushes the authentication application to the cell phone 112 of the subscriber, activates the authentication application in the user cell phone 112, and requests the application password authentication (S706, S707). App passwords are passwords you have set up in advance.

The user inputs the app password in the user's cell phone 112 to perform the app password authentication, and the authentication app extracts the ICCID stored in the USIM and transmits it to the authentication server 130 together with the app password authentication result (S708 to S710).

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the corresponding subscriber registered in advance, authenticates the ICCID, and transmits the authentication result and the application password authentication result to the payment server 150 (S711) . The payment server 150 approves the settlement if all user authentication is successful, and the service site 120 completes the settlement processing accordingly (S712 to S714).

 As described above, according to the present invention, the payment server 150 can prevent the smsing by performing the application password authentication using the authentication application and the authentication using the USIM without using the OTP capable of smoothing.

That is, the present invention can prevent damage due to leakage of personal information by performing double user authentication using unique subscriber information stored in a USIM of a user's mobile phone and a password stored in a service server or a USIM, And authentication of the owner's cellular phone is authenticated by the subscriber information (ICC ID), which is a unique identification number assigned to the USIM, so that smsing due to SMS deception can be prevented. And subscriber information can be read only by a trusted carrier approved by the mobile carrier, thus preventing pharming due to up / modulation of the app.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

102: Internet 104: Mobile communication network
110: user PC 112: user mobile phone
120: service server 130: authentication server
140: carrier company server 150: payment server
100: User authentication system

Claims (2)

A first step of registering an ID and a password on a service server;
A second step of confirming whether the authenticated user is a valid user in the mobile communication company server when the authentication server receives the mobile phone number of the user in the authentication service subscription step and storing unique information (ICCID) for user authentication in its own database;
A third step of receiving the mobile phone number from the service server and transmitting the mobile phone number to the authentication server when the user requests authentication login in the authentication service use step;
A fourth step of confirming whether the authentication server is an authentication service subscriber when the authentication server receives the mobile phone number of the user and activating an authentication app of the user mobile phone to extract unique information (ICCID) if it is an authentication service subscriber;
A fifth step of the authentication app receiving the user's ID and password and transmitting the same to the authentication server together with unique information (ICCID);
A sixth step of the authentication server comparing the received unique information (ICCID) with the stored unique information (ICCID) or comparing it with unique information (ICCID) stored in the mobile communication company and performing primary authentication;
A seventh step of the service server receiving the primary authentication result and the ID and the password from the authentication server and comparing the ID and the password with the self-registered ID and password to perform secondary authentication; And
And the service server providing a service to the user according to the authentication result. The method of claim 1,
And an international mobile communication subscriber code (IMSI) or an integrated circuit card identifier (ICCID) corresponding to a user's mobile phone number.

Images