KR20160035523A - Multi-factor authentication with dynamic handshake quick-response code - Google Patents

Abstract

Disclosed are a method and a system for authenticating multiple elements based on a dynamic interaction quick response (QR) code. The method comprises the steps of: generating a one time authentication tunnel for authentication between a user terminal, which is a target to be authenticated, and a fixed type terminal to determine whether the user terminal accesses; generating multidimensional codes according to a sequential request of the user terminal and the fixed type terminal; and authenticating the user terminal and the fixed type terminal according to whether the one time authentication tunnel is passed through handshaking using the multidimensional codes between the user terminal and the fixed type terminal.

Description

[0001] MULTI-FACTOR AUTHENTICATION WITH DYNAMIC HANDSHAKE QUICK-RESPONSE CODE [0002]

Embodiments of the present invention relate to authentication techniques using QR (Quick Response) codes.

Authentication is used as an important means to authorize legitimate rights through identification of subjects. As an example of the authentication technique, Korean Patent Laid-Open No. 10-2006-0114079 (published on November 06, 2006) discloses a technology for performing an authentication procedure of a network user using a public certificate stored in a mobile communication terminal .

Authentication can be classified into three types according to the identification medium.

TYPE 1 authentication has the disadvantage of easy analogy and reuse by using information (Something You Know) that is known to the user such as password, personal identification number, mother name, lock number, and telephone number.

TYPE 2 authentication is a Something You Have, such as a key, a swipe card, an access card, or a certificate of authenticity. It can be copied by a third party by means of a lost, stolen, It is possible to have a disadvantage.

TYPE 3 certification recognizes biometric information such as iris, retina, fingerprint, face, and voice. It is the authentication medium of the self (Something You Are), and some biometric information such as fingerprints can be copied and reused, (FRR) that denies the access of the authorized user and the ratio of allowing the access of the user to be rejected, which satisfies the recognition environment characteristic of the critical section similar to the first extraction time of the biometric information, The False Acceptance Rate (FAR) can be kept below a certain level.

The strength of security is high in the order of TYPE 3 authentication, TYPE 2 authentication and TYPE 1 authentication. However, the strength of multi-factor authentication (2-factor authentication, 3-factor authentication) combining two or more of TYPE 1 ~ 3 authentication is higher than TYPE 3 It is powerful.

On the other hand, the QR code can be configured in a two-dimensional form by vertically and horizontally to have more information. In addition to the numerals, it is possible to store multilingual character data such as alphabets, kanji, and Japanese, so that a conventional bar- And the QR code is generally printed statically on a print medium or can be created on a mobile terminal such as a web site screen or a smart phone.

A QR code reader is implemented in an application of a mobile terminal such as a hardware or a smart phone, reads a QR code, and connects the user with a specific URL.

Using the QR code, it can be used for the URL access of the official certificate download for mobile in the domestic and overseas banking industry, or the QR code generated by the online store as a credit card mobile payment method is read from the mobile credit card app (app) It is being created as an initial means.

The QR code is cheaper than RFID (Radio Frequency Identification) as an authentication means and can be generated in various applications including a general printing method, a mobile terminal, and a web browser, and its use range is rapidly expanding.

However, as an authentication means, QR codes have security obstacles that can not be used in sensitive areas such as access control, despite their excellent cost effectiveness because they can easily be duplicated and easily generated or falsified easily.

Recently, in some domestic companies, QR codes are dynamically generated and used for authentication. However, within 30 seconds of authentication, the authentication time can be shortened by multimedia messages (MMS) There is a security vulnerability that can receive the generated QR code from the unauthorized person and pass the authentication.

QR code has economical, convenience, and maintainability that can be utilized as alternative technology in various fields such as access control and traffic card based on existing RFID, but it has limitations in application of technology due to security vulnerability such as duplication and counterfeiting.

In order to overcome the limitations of the existing authentication technology, the present invention provides an authentication method and system that can guarantee economy, convenience, portability and security in terms of system construction and maintenance by applying QR code as an alternative authentication means.

The present invention provides an authentication method and system that can provide a handshaking authentication environment using a dynamic interaction method using a QR code.

The present invention provides an authentication method and system using a QR code that can effectively block unauthorized access to a remote place using a video call.

A computer-implemented authentication method, comprising: generating a one-time authentication tunnel for authentication between a user terminal to be authenticated and a fixed terminal that determines whether to access the user terminal; Generating a multi-dimensional code according to a sequential request of the user terminal and the fixed terminal; And authenticating the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking using the multi-dimensional code between the user terminal and the fixed terminal .

According to an aspect of the present invention, the step of generating the multi-dimensional code may generate a decaying Quick Response (QR) code valid within an Authentication Threshold Value.

According to another aspect, the step of generating the one-time authentication tunnel may generate the one-time authentication tunnel including a random permutation according to the number of handshaking performed between the user terminal and the fixed terminal.

According to another aspect, the step of generating the one-time authentication tunnel may generate the one-time authentication tunnel together with a unique session key for authentication between the user terminal and the fixed terminal.

According to another aspect of the present invention, the step of authenticating the user terminal and the fixed terminal may include: when the user terminal and the fixed terminal sequentially pass the random permutation through handshaking using the multi-dimensional code, It is possible to perform authentication pass processing of the fixed terminal.

At least one program loaded memory; And at least one processor, wherein the at least one processor is a one-time authentication tunnel for authentication between a user terminal to be authenticated and a fixed terminal that determines whether to access the user terminal, Tunnel); Generating a multi-dimensional code according to a sequential request of the user terminal and the fixed terminal; And a step of authenticating the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking using the multi-dimensional code between the user terminal and the fixed terminal .

A user terminal to be authenticated; A fixed terminal for determining whether the user terminal is accessed; And an authentication server for generating a multi-dimensional code for authentication between the user terminal and the fixed terminal and a one-time authentication tunnel (One Time Authentication Tunnel), wherein the authentication server is configured to transmit the multi-dimensional code between the user terminal and the fixed terminal Wherein the authentication processing unit authenticates the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking.

According to an aspect of the present invention, the authentication server generates the one-time authentication tunnel including an arbitrary permutation according to an authentication request of the user terminal, sequentially generates the multidimensional code according to the random permutation, The stationary terminal may pass through the one-time authentication tunnel with handshaking that performs display and recognition of the multi-dimensional code in an alternating manner.

According to another aspect, the authentication server may generate a decaying quick response (QR) code within an Authentication Threshold Value.

According to another aspect, the authentication server may generate the one-time authentication tunnel together with a unique session key for authentication between the user terminal and the fixed terminal.

According to another aspect of the present invention, the fixed terminal requests the user terminal to rotate using at least one rotation pattern tuple of the rotation direction, the rotation speed, and the rotation angle determined by the authentication server, analyzes the moving image acquired by the camera, The user terminal can be verified.

According to another aspect, an authentication system includes: a storage for managing authentication information associated with the user terminal and authentication information associated with the fixed terminal; And an access control center for blocking access to the one-time authentication tunnel in an illegal form using the repository.

According to another aspect, an authentication system includes: a repository for managing pre-registration information including per-user authenticated services and access rights; And an authorization server for transferring the pre-registration information corresponding to the user terminal to the fixed terminal when the authentication of the user terminal and the fixed terminal is completed.

According to the embodiment of the present invention, by implementing the multi-element authentication using the QR code, the limitation of the existing authentication technology can be overcome and the QR code can be applied as the alternative authentication means to provide economical, Portability and security can be guaranteed.

According to an embodiment of the present invention, a QR code can be enhanced as a strong security authentication means by providing a multi-element authentication environment based on a QR code, and it can replace a complicated existing authentication means.

According to the embodiment of the present invention, by implementing the dynamic interaction method of handshaking using the QR code, it is possible to effectively block the unauthorized authentication of the remote authorizers.

According to the embodiment of the present invention, a one-time authentication tunnel can be provided in order to secure safety and security of handshaking, and a protection barrier that blocks and detects an unauthorized one- Can be implemented.

1 shows an authentication system using a QR code in an embodiment of the present invention.
2 is a flowchart showing an authentication method using a QR code in an embodiment of the present invention.
3 is a flowchart illustrating a process of detecting a remote open competition authentication through a fixed terminal according to an exemplary embodiment of the present invention.
4 is a structural diagram for explaining an authentication process using a one-time authentication tunnel (OTAT) in an embodiment of the present invention.
5 is a structural diagram for explaining an access control center, which is a protection barrier against OTAT, according to an embodiment of the present invention.
6 is a block diagram for explaining an example of an internal configuration of a computer system in an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present embodiments relate to a multi-element authentication technology applying a QR code as a dynamic interaction method and can be applied to authentication fields related to access control and door lock, and furthermore, It is possible to enlarge.

In the present specification, QR code is applied as an authentication means. However, the present invention is not limited to this, and it is needless to say that all kinds of multidimensional codes such as Data Matrix and Maxicode can be applied in addition to QR codes .

Hereinafter, a 'QR code' will be described as a representative example of the multi-dimensional code. For example, codes of Japanese Industrial Standards (JIS) and International Organization for Standardization (ISO) standards can be used as QR codes.

1 shows an authentication system using a QR code in an embodiment of the present invention.

Referring to FIG. 1, an authentication system according to the present invention includes a user terminal 102, a fixed terminal 104, an access control center 108, an authentication server 112, a repository 114, And an Authorization Server (116).

The user terminal 102 may be a mobile terminal having a mobile phone such as a smart phone, a tablet, and a wearable computer, and may be a terminal equipped with a camera and a display. The user terminal 102 may refer to all terminals capable of connecting to a web / mobile site related to the authentication system or installing and executing a service-dedicated application. At this time, the user terminal 102 can perform operations of the entire service such as service screen configuration, data input, data transmission / reception, and data storage under the control of a web / mobile site or a dedicated application.

When the user to be authenticated passes the primary authentication through the user terminal 102, the authentication server 112 can generate a valid annotation QR code only within the authentication threshold value (ATV) specified in the pre-policy. At this time, the user terminal 102 can display the QR code generated by the authentication server 112 through the display, and the user can recognize the QR code displayed on the display to the fixed terminal 104 within a time specified by the ATV Can be requested.

The primary authentication of the user terminal 102 includes a TYPE 2 authentication using a medium such as a key, a swipe card, an access card, and an official certificate, and a TYPE 2 authentication using an iris, a retina A single element authentication method using any one of TYPE 3 authentication using biometric information such as fingerprint, face, and voice, or a multi-element authentication method using a combination of two or more. TYPE 1 + TYPE 2, TYPE 1 + TYPE 3, TYPE 2 + TYPE 3, TYPE 1 + TYPE 2 + TYPE 3 may be used as the multi-element authentication method.

The storage 114 is a server which is applied with technical / physical / administrative security for storing authentication and authorization information and processing results. The storage 114 stores user identification information, identification information of the fixed terminal 104, Authentication / authorization of the subject and resources such as physical installation location, installation location or zone-specific user information of the user terminal 102, identification information of the user terminal 102, authorized service and access right per user, authentication record, And can manage the result information.

The authentication server 112 is responsible for generating a One Time Authentication Tunnel (OTAT) 110, which is a communication tunnel for authentication at the time of generating the first QR code. The OTAT is configured with an arbitrary permutation according to the number of handshaking times (n = 1) performed between the user terminal 102 and the fixed terminal 104 and is generated together with a unique session key of the corresponding authentication subject . In this embodiment, the configuration of the OTAT may include the use of an arbitrary character string having an order other than a permutation order. The authentication server 112 performs the final authentication pass processing when the user terminal 102 and the fixed terminal 104 sequentially pass the permutation through the QR code and the URL corresponding to the QR code is transmitted to the authentication server 112 The session key, the expectation value of the permutation of the OTAT, and the authentication request terminal information are received in a gateway application operating on an encryption communication environment based on a public key such as HTTPS on the authentication server 116 ) Authentication process. One-way functions can be applied to protect generated permutations and session keys.

The access control center 108 is responsible for all access to the OTAT in a non-legitimate manner, such as a terminal or unauthorized terminal not listed in the store 114 as a protection barrier against OTAT, a non-existent session key, And an alarm may be generated to the administrator when a certain level of invasion attempts continue.

The authorization server 116 forwards the user-accessible fixed terminal 104 and the authorized service and authority to the fixed terminal 104 based on the pre-registration information of the store 114 for the authenticated user.

The fixed terminal 104 plays a role of confirming whether the user terminal 102 can be accessed by a dynamic interaction with the user terminal 102 in the form of a fixed terminal. To this end, the fixed terminal 104 operates in three stages, and performs QR code verification in one step, remote cooperative authentication detection in two steps, and handshaking in three steps. In this embodiment, it is possible to relocate the order for the three steps, and the security strength can be increased by rearranging the three steps at least once.

In the QR code verification step, the fixed terminal 104 performs the primary verification of the QR code displayed on the user terminal 102 through the camera, and may request the user to regenerate the QR code if there is a verification error such as expiration of the ATV . The fixed terminal 104 then requests the authorization server 116 to query the user for access to the physical location or zone and if it is accessible, performs normal processing and if not, stops the processing, Records the access and outputs the guidance to the user about unauthorized access via the display or the speaker.

If the QR code displayed on the user terminal 102 passes the verification normally, the remote coexistent authentication detection step is performed when a user who is not authenticated as a real-time moving image such as a video call and broadcasting equipment tries authentication through an open competition of an authorized user on the remote site . ≪ / RTI > The authentication server 112 determines a rotation pattern tuple (rotation direction, rotation angle, rotation speed) as a random function at each authentication request time and rotates the user terminal 102 according to the guidance through the display of the fixed terminal 104 And analyzes the rotated moving image captured by the camera of the fixed terminal 104 to verify whether the user terminal rotates according to the instruction, whether to maintain the verified QR code, whether to maintain the application boundary on the screen of the user terminal 102, and the like. The ATV of the present invention is set to a limit period in which a moving image can not be produced within a time period during which the authorized user of the remote location can open the moving picture, and the present invention is configured to irregularly request the locus of the rotation of the user terminal 102, It is not possible to precisely synchronize the accurate rotation direction and speed with the cooperative contestants in a state in which the rotation instruction screen of the fixed type terminal 104 can not be viewed, thereby detecting a logical error of the moving image, thereby effectively preventing remote competition contest authentication.

The handshaking of the stationary terminal 104 is performed by the authentication server 112 by generating a one-time QR code recognizable by the camera of the user terminal 102 based on the one-time authentication tunnel (OTAT) And interacts with the user terminal 102 until the OTAT passes normally according to the number of times. OTAT, it is detected as a security breach and the image of the user, the image of the requested QR code and other information displayed in the fixed terminal 104 are logged and the authentication server 112 is requested to store it.

The authorization server 112 provides the user with the service or authority authorized by the fixed terminal 104 to the user who has been authenticated. The authorization server 112 can be used to open the entrance door on the access control side, to express the purchase intention of the goods in the service, Electronic commerce, payment of electronic commerce, and the like, and may include authorization for the linked service on the user terminal 102. [

A specific authentication process will be described assuming that the TYPE 1 + TYPE 2 (2-factor) authentication method and the 5-way handshaking are applied to the user terminal 102.

If the smartphone registered as the user terminal 102 is utilized, the TYPE 2 authentication is satisfied. If the smartphone is requested to the authentication server 112 by combining the TYPE 1 authentication such as the date of birth or the login ID and the password with the smartphone, TYPE 1 + TYPE 2 (2-factor).

Five arbitrary permutations are generated only when the authentication server 112 performs a normal authentication pass and the first QR code in which the first number and the unique session key and the identification information of the user terminal 102 are combined is transmitted to the user terminal 102), and applying a one-way function to protect permutations. The user requests recognition of the QR code displayed on the user terminal 102 to the fixed terminal 104 within the time specified in the authentication threshold value (ATV).

The fixed terminal 104 performs the step of recognizing the QR code displayed on the user terminal 102 and checks whether the physical location or the area is accessible. The remote access subscription authentication detecting step of the fixed type terminal 104 proceeds after confirming the normal passage of the previous step and allows the authentication server 112 to rotate the user terminal 102 at a randomly designated direction and rotational speed each time. For example, if the result of an arbitrary function is (counterclockwise, 30 degrees, fast) and (clockwise, 45 degrees, slow), the user terminal 102, together with the user's guidance, Requires a 45 degree rotation movement in the clockwise direction at a higher speed after the 30 degree rotation movement in the counterclockwise direction from the required initial position. In the case where there is a remote open call for competition on the characteristic of the rotation operation, the display of the user terminal 102 causes inconsistency of rotation angles in the process of relaying a remote terminal to a video call or broadcasting equipment, The operation becomes difficult to match and can be easily detected. The handshaking step of the fixed terminal 104 proceeds after confirming the normal passage of the previous step and is performed by the authentication server 112 based on the one-time authentication tunnel 110 and the one-time QR Code and normally interacts with the user terminal 102 until the time when the one-time authentication tunnel (OTAT) 110 passes normally according to the preset number of handshaking 5 times. The approval step of the fixed type terminal 104 is performed after confirming the normal passage of the previous step and provides the user with the service and authority authorized by the fixed type terminal 104 to the user who has been authenticated. For example, And can be connected to an actual service.

2 is a flowchart illustrating an authentication method using a QR code in an embodiment of the present invention. The authentication method according to one embodiment may be performed by the authentication system described with reference to FIG.

In step 210, the identification information of the user previously authorized as information for authentication and service and authority information, user terminal information and the like that can be accessed can be registered in the storage 114.

In step 220, it is checked whether or not the user terminal is pre-registered in the storage 114, and if the user is registered in the storage 114, the user selects one of the following types: primary authentication (knowledge-based TYPE 1, TYPE 2 using medium, Authentication), a QR code is generated. In this case, primary authentication can be applied to one of TYPE 1, TYPE 2, TYPE 3, or multi-element authentication in which two or more authentication methods are combined. In multi-element authentication, a QR code .

In step 230, the authentication server 112 generates an arbitrary number of permutations as many times as a predetermined number of handshakes, assigns a session key, maps the identification number of the user terminal requesting authentication in step 220 to a session key To generate a one-time authentication tunnel (OTAT) and pass the first value of the permutation to the user terminal 102 so that the user terminal 102 can generate the first QR code.

In step 240, the user must recognize the QR code generated in the user terminal 102 within the authentication threshold (ATV) time by the fixed terminal 104, and if the ATV time is exceeded, the generated QR code is automatically canceled do. The ATV can be controlled, but it must be shorter than the time it can be created and transmitted from the remote site.

In step 250, the authentication server 112 is requested to verify whether the QR code transmitted in step 240 is made of the first permutation value of the one-time authentication tunnel OTAT, Information is transmitted together and the identification number of the fixed terminal 104 for mutual authentication is mapped to the OTAT. When the identification number of the stationary terminal 104 is already mapped to the OTAT, the authentication server 112 performs an error process, discards the OTAT, logs in the unauthorized access to the storage 114, and sends a warning to the administrator . When the identification number of the fixed terminal 104 for mutual authentication is mapped to the authentication server 112 normally, a rotation pattern tuple (rotation direction, rotation angle, rotation speed) is determined as an arbitrary function in the next step, Requests the user terminal 102 to rotate according to the guidance through the display, and analyzes the rotating motion image photographed by the camera module of the stationary terminal 104 and verifies whether or not to open the motion picture. It is possible to detect a logical error of a moving picture that can not be accurately synchronized with an accurate co-ordinate rotation direction and speed with the co-workers in the field in a state where an authorized user at a remote location can not view the rotation instruction screen of the fixed terminal 104, A detection method may include various verification methods such as whether the user terminal rotates according to an instruction, whether a verified QR code is maintained, whether an application boundary line is maintained on the screen of the user terminal, and flicker detection when a flash module is driven.

In step 260, authentication is performed by passing the one-time authentication tunnel (OTAT) in a manner of generating and recognizing mutual QR codes between the user terminal 102 and the fixed terminal 104 for the specified number of handshaking times.

In step 270, the authorization server 116 may retrieve the information of the user who has successfully authenticated from the repository 114 to authorize the user's accessable services and services.

3 is a flowchart illustrating a process of detecting a remote open competition authentication through a fixed terminal according to an exemplary embodiment of the present invention.

At step 310, the authentication server 112 generates at least two rotation pattern tuples (rotation direction, rotation angle, rotation speed) as an arbitrary function, the rotation direction is clockwise or counterclockwise, A random number less than or equal to the minimum value and less than the maximum value is generated and determined. The rotation speed is determined by generating a random number by dividing the rotation speed into a plurality of interval values by setting a minimum value to a maximum value or less within a range in which the human can rotate along the display.

In step 320, a rotation request is transmitted to the user terminal 102 according to the movement pattern tuple (rotation direction, rotation angle, rotation speed) determined in the fixed terminal 104, so that a moving image can be photographed.

In step 330, the stationary terminal 104 may extract the segmented image into the captured moving image. The classification image can be extracted using the image processing technique based on the region of interest.

In step 340, remote collaborative authentication can be verified, such as whether to execute the rotation instruction from the extracted images, whether to maintain the verified QR code, and whether to maintain the application boundary on the screen of the user terminal.

4 is a structural diagram for explaining an authentication process using a one-time authentication tunnel (OTAT) in an embodiment of the present invention.

Referring to FIG. 4, it can be seen that the one-time authentication tunnel (OTAT) is composed of a session key, a user terminal identifier, a fixed terminal identifier, and an Nth permutation value.

A one-time authentication tunnel (OTAT) is generated by an authentication request of the user terminal 102. The user terminal 102 generates a QR code by combining information such as a first permutation value and a session key, do. When the fixed terminal 104 recognizes the first QR code and confirms the normal verification through the authentication server 112, the fixed terminal 104 combines information such as the second permutation value, the session key, and the fixed terminal identification number Lt; th > QR code on the display of the stationary terminal 104. [ When the authentication application waiting in the user terminal 102 recognizes the second QR code displayed on the fixed terminal 104 as a camera module and confirms the normal verification through the authentication server 112, Upon receiving the permutation value and generating a third QR code by combining information such as the session key and the user terminal identification number, and displaying the third QR code on the display of the user terminal 102, the camera module of the fixed terminal 104 recognizes the third QR code The normal verification is confirmed through the authentication server 112. [

If QR code generation and authentication process is performed 3 times, it is called 3-way handshake and this process is terminated within several seconds. The present invention presents an n-way handshake, and a value of n can be specified according to the required security strength.

5 is a structural diagram for explaining an access control center, which is a protection barrier against OTAT, according to an embodiment of the present invention.

The present invention can provide a structure in which the one-time authentication tunnel (OTAT) is protected by the access control center 108. [ Referring to FIG. 5, the access control center 108 intercepts authentication access in all cases where it does not access the correct session key and user terminal identifier, the fixed terminal identifier, logs to the store 114, and alerts the administrator . Also, even if the permutation values of the Nth order are not called in order, the authentication access can be blocked, logging to the storage 114, and a warning to the administrator.

6 is a block diagram for explaining an example of the internal configuration of a computer system in an embodiment of the present invention. The computer system 600 includes at least one processor 610, a memory 620, a peripheral interface 630, an input / output subsystem 640, A power circuit 650, and a communication circuit 660, as shown in FIG. At this time, the computer system 600 may correspond to each of the components included in the authentication system described with reference to FIGS. 1 to 5.

The memory 620 may include, for example, a high-speed random access memory, a magnetic disk, an SRAM, a DRAM, a ROM, a flash memory, or a non-volatile memory. have. The memory 620 may include software modules, a set of instructions, or various other data required for operation of the computer system 600. At this point, access to the memory 620 from other components, such as the processor 610 or the peripheral device interface 630, may be controlled by the processor 610.

Peripheral device interface 630 may couple the input and / or output peripheral devices of computer system 600 to processor 610 and memory 620. The processor 610 may perform various functions and process data for the computer system 600 by executing a software module or a set of instructions stored in the memory 620. [

The input / output subsystem 640 may couple various input / output peripheral devices to the peripheral interface 630. For example, the input / output subsystem 640 may include a controller for coupling a peripheral device such as a monitor, keyboard, mouse, printer, or a touch screen or sensor as needed, to the peripheral interface 630. According to another aspect, the input / output peripheral devices may be coupled to the peripheral device interface 630 without going through the input / output subsystem 640.

The power circuit 650 may provide power to all or a portion of the components of the terminal. For example, the power circuitry 650 may include one or more power supplies, such as a power management system, a battery or alternating current (AC), a charging system, a power failure detection circuit, a power converter or inverter, And may include any other components for creation, management, distribution.

The communication circuitry 660 may enable communication with other computer systems using at least one external port. Or as described above, the communication circuitry 660 may communicate with other computer systems by sending and receiving an RF signal, also known as an electromagnetic signal, including RF circuitry as needed.

6 is merely an example of the computer system 600, and the computer system 600 may include additional components not shown in FIG. 6, or some components shown in FIG. 6 may be omitted, Lt; RTI ID = 0.0 > components. ≪ / RTI > For example, in addition to the components shown in FIG. 6, a computer system for a mobile communication terminal may further include a touch screen, a sensor, and the like, and may be connected to a communication circuit 660 through various communication methods (WiFi, , Bluetooth, NFC, Zigbee, etc.). The components that may be included in computer system 600 may be implemented in hardware, software, or a combination of both hardware and software, including one or more signal processing or application specific integrated circuits.

The methods according to embodiments of the present invention may be implemented in the form of a program instruction that can be executed through various computer systems and recorded in a computer-readable medium.

The program according to the present embodiment can be configured as a PC-based program or an application dedicated to a mobile terminal. The authentication application using the QR code in the present embodiment may be implemented in a program form that operates independently or in an in-app form of a specific application, and may be implemented to be able to operate on the specific application .

As described above, according to the embodiment of the present invention, it is possible to overcome the limitations of the existing authentication technology by implementing the authentication model using the QR code, and to apply the QR code as the alternative authentication means, , Portability and security can be guaranteed. According to the embodiment of the present invention, by implementing the dynamic interaction method of the handshaking using the QR code, the QR code can be enhanced as a strong security authentication means, and it is possible to replace the complicated existing authentication means. Further, It is possible to effectively block unauthorized authentication of the self-disclosure method.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

102: User terminal
104: stationary terminal
108: access control center
112: authentication server
114: Store
116: authorization server

Claims (13)

A computer-implemented authentication method comprising:
Generating a one-time authentication tunnel for authentication between a user terminal to be authenticated and a fixed terminal that determines accessibility of the user terminal;
Generating a multi-dimensional code according to a sequential request of the user terminal and the fixed terminal; And
Authenticating the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking using the multi-dimensional code between the user terminal and the fixed terminal
. The method according to claim 1,
Wherein generating the multi-dimensional code comprises:
Generate a valid decaying Quick Response (QR) code within the Authentication Threshold Value
. The method according to claim 1,
Wherein the generating the one-time authentication tunnel comprises:
And generating the one-time authentication tunnel including an arbitrary permutation according to the number of handshaking performed between the user terminal and the fixed terminal
. The method of claim 3,
Wherein the generating the one-time authentication tunnel comprises:
And generating the one-time authentication tunnel together with a unique session key for authentication between the user terminal and the fixed terminal
. The method of claim 3,
Wherein the step of authenticating the user terminal and the fixed terminal comprises:
And performing authentication pass processing of the user terminal and the fixed terminal when the user terminal and the fixed terminal sequentially pass the random permutation through handshaking using the multi-dimensional code
. At least one program loaded memory; And
At least one processor
Lt; / RTI >
Wherein the at least one processor, under control of the program,
Generating a one-time authentication tunnel for authentication between a user terminal to be authenticated and a fixed terminal that determines whether to access the user terminal;
Generating a multi-dimensional code according to a sequential request of the user terminal and the fixed terminal; And
A step of authenticating the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking using the multidimensional code between the user terminal and the fixed terminal
The authentication server. A user terminal to be authenticated;
A fixed terminal for determining whether the user terminal is accessed; And
An authentication server for generating a multi-dimensional code for authentication between the user terminal and the fixed terminal and a one-time authentication tunnel (One Time Authentication Tunnel)
Lt; / RTI >
The authentication server includes:
And authenticating the user terminal and the fixed terminal according to whether the one-time authentication tunnel is passed through handshaking using the multidimensional code between the user terminal and the fixed terminal
And the authentication system. 8. The method of claim 7,
The authentication server includes:
Generating the one-time authentication tunnel including an arbitrary permutation according to an authentication request of the user terminal, sequentially generating the multi-dimensional code according to the random permutation,
The user terminal and the stationary terminal may include:
Passing through the one-time authentication tunnel with handshaking that performs the display and recognition of the multidimensional code in an alternating manner
And the authentication system. 8. The method of claim 7,
The authentication server includes:
Generate a valid decaying Quick Response (QR) code within the Authentication Threshold Value
And the authentication system. 8. The method of claim 7,
The authentication server includes:
And generating the one-time authentication tunnel together with a unique session key for authentication between the user terminal and the fixed terminal
And the authentication system. 8. The method of claim 7,
The stationary terminal,
The authentication server requests the rotation of the user terminal using at least one rotation pattern tuple among the rotation direction, rotation speed and rotation angle determined by the authentication server, and then analyzes the moving image acquired by the camera to verify the user terminal
And the authentication system. 8. The method of claim 7,
A storage for managing authentication information related to the user terminal and authentication information associated with the fixed terminal; And
An access control center for blocking access to said one-time authentication tunnel in an illegal form using said repository;
Further comprising: 8. The method of claim 7,
A repository for managing pre-registration information including authorized services and access rights per user; And
When the authentication of the user terminal and the fixed terminal is completed, the authentication server transmits the pre-registration information corresponding to the user terminal to the fixed terminal
Further comprising:

Images