KR20160150097A - Apparatus and method for user authentication - Google Patents

Abstract

A user device that communicates with an authentication server according to an aspect of the present invention includes one or more processors; a memory; and a program that is stored in the memory and is configured to be executed by the one or more processors, and the program includes: a secret hash value generating module that generates a secret hash value by inputting a secret divisor input by a user to a hash function as a seed value and stores the generated secret hash value, and transmits the secret hash value to an authentication server and registers the transmitted secret hash value; a user authentication key generating module that generates a user authentication key by inputting a personal password input by the user and the secret hash value as seed values, and transmits a user authentication key to the authentication server and registers the user authentication key; a disposable secret password input module that receives a disposable password issued by the authentication server; and a disposable authentication key generating module that generates a disposable authentication key by inputting the disposable password input by the disposable password input module and the user authentication key to a hash function as a seed value, transmits the disposable authentication key to the authentication server, and receives a comparison result of the transmitted disposable authentication key and the disposable authentication key generated by the authentication server from the authentication server. Accordingly, security may be enhanced by using a plurality of safety units.

Description

[0001] APPARATUS AND METHOD FOR USER AUTHENTICATION [0002]

The present invention relates to user authentication, and more particularly, to an apparatus and method for user authentication that realizes multiple security using a hash function.

Today, communication networks around the world are interconnected so that the exchange of information through the Internet is becoming common, so that the retrieval, storage and extraction of information becomes more and more active. On the other hand, the technique of recognizing a user using a specific server is used The leakage of personal information and the hacking of the network are also serious social problems. Major hacking activities that have occurred in Korea in the meantime are simple intrusion, identity theft, data cut, data modification and destruction. Hacking situation in foreign countries is very serious compared to domestic ones.

In a conventional general user authentication method, when a user provides his or her identification information (ID) and a password to a server, the server compares the identification information and the password provided by the user with the previously registered identification information and password . However, in the conventional user authentication method, when the user identification information and the password are exposed, personal information may be exposed together, which may result in poor security. Also, when an authentication program is copied or copied, personal information may be leaked . Also, there is a problem that security is weak because of one-dimensional authentication by identification information and password.

Korean Patent Publication No. 10-2010-0101887 (2010.09.20)

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the above problems, and it is an object of the present invention to provide an apparatus and method for enhancing security and authenticating a user by using a plurality of safeguards.

According to an aspect of the present invention, there is provided a user apparatus communicating with an authentication server, the apparatus comprising: at least one processor; Memory; And a program stored in the memory and configured to be executed by the one or more processors, wherein the program generates a secret hash value by inputting a secret divisor input from a user as a seed value into a hash function A secret hash value generation module that stores the secret hash value and transmits the secret hash value to the authentication server; A user authentication key generation module for generating a user authentication key by inputting the personal password inputted by the user and the secret hash value into the hash function as a seed value and transmitting the user authentication key to the authentication server and registering the user authentication key; A one-time secret password input module for receiving the one-time secret password issued by the authentication server; And generating a one-time authentication key by inputting the one-time secret password and the user authentication key, which are input from the one-time secret password input module, to the hash function as a seed value, and transmitting the one-time authentication key to the authentication server, And a disposable authentication key generation module for receiving a result of a comparison between the key and the one-time authentication key generated by the authentication server from the authentication server.

The user device collects unique information of the user device and generates and stores a device authentication key by inputting the inherent information as a seed value in a hash function and transmits the device authentication key to the authentication server to register the device authentication And a key generation module.

The device authentication key generation module may generate a device authentication key each time the program is executed, compare the device authentication key with a previously stored device authentication key, and delete the program if the device authentication key does not match.

The user device generates and stores a program authentication key by inputting the time stamp, the secret hash value, and the device authentication key into the hash function as a seed value after generating the time stamp, And a program authentication key generation module for registering the program authentication key by transmitting the program authentication key.

The user device further comprises a pre-authentication request module for transmitting a pre-authentication request including the device authentication key and the program authentication key to the authentication server upon receiving the authentication notification message from the authentication server, The one-time secret password is generated by the authentication server if the device authentication key and the program authentication key included in the pre-authentication request match the device authentication key and the program authentication key registered in the authentication server, .

The pre-authentication request module may receive the authentication notification message from the authentication server when the authentication server receives the identification information of the user from the service server.

The user device further comprises a change module for sending a secret division number change request including the device authentication key and the program authentication key to the authentication server, When the authentication key and the program authentication key match with the device authentication key and the program authentication key previously registered in the authentication server and the one-time authentication key generation module receives the matching response of the one-time authentication key, Module, the user authentication key generation module, and the program authentication key generation module to generate a new secret hash value, a new user authentication key, and a new program authentication key.

The user device further includes a change module for transmitting a personal password change request including the device authentication key and the program authentication key to the authentication server, When the authentication key and the program authentication key match with the device authentication key and the program authentication key previously registered in the authentication server and the disposable authentication key generation module receives the matching response of the one-time authentication key, The module can be controlled to generate a new user authentication key.

The user authentication key generating module, the device authentication key generating module, and the program authentication key generating module, when the program is reinstalled, to generate a secret hash value, a user authentication key, After generating the authentication key and the program authentication key, transmits a re-registration message including the user authentication key, the device authentication key, and the program authentication key to the authentication server, and transmits the user authentication key and the device authentication When receiving a matching response of the one-time authentication key from the one-time-use authentication key generation module, receiving a re-establishment registration completion response from the authentication server if the key matches the user authentication key and the device authentication key previously registered in the authentication server, And a change module.

The user authentication key generation module, the device authentication key generation module, and the program authentication key generation module at the time of changing the user device, thereby generating a secret hash value, a user authentication key, After generating the device authentication key and the program authentication key, a device change registration message including the user authentication key, the device authentication key, and the program authentication key is transmitted to the authentication server, and the user authentication key A change module for receiving a device change registration completion response from the authentication server when the one-time authentication key match module matches the user authentication key previously registered in the authentication server and the one-use authentication key matching response is received from the one-time authentication key generation module; .

The one-time secret password may be generated using the secret hash value in the authentication server.

The disposable secret cipher may be generated using a time stamp and the secret hash value.

According to another aspect of the present invention, there is provided an authentication apparatus for communicating with a user apparatus, the apparatus comprising: at least one processor; Memory; And a program stored in the memory and configured to be executed by the one or more processors, the program comprising: inputting a secret divisor input from a user as a seed value into a hash function; A secret hash value registration module for receiving and registering from the user device; A user authentication key registration module for receiving and registering a user authentication key generated by inputting a user's personal password and the secret hash value into a hash function as a seed value; A one-time secret password generation module for generating a one-time secret password and transmitting it to the user; And a disposable authentication key generated by inputting the received disposable authentication key, the registered user authentication key, and the disposable secret password into a hash function as a seed value, when the disposable authentication key is received from the user device, And a disposable authentication key comparison module for transmitting the comparison result to the user device.

The authentication device may further include a device authentication key registration module for receiving and registering a device authentication key generated by inputting unique information of the user device as a seed value in a hash function, from the user device.

Wherein the authentication device generates a time stamp, and transmits the program authentication key generated by inputting the time stamp, the secret hash value, and the device authentication key as a seed value to the hash function, And a registration module.

And a pre-authentication request receiving module for receiving a pre-authentication request including the device authentication key and the program authentication key from the user device in response to the authentication notification message sent to the user device Wherein the one-time secret password generation module compares the device authentication key and the program authentication key included in the pre-authentication request with the pre-registered device authentication key and the program authentication key, and if the one- Lt; / RTI >

The pre-authentication request receiving module may transmit the identity authentication notification message to the user device upon receiving the identification information of the user from the service server.

The authentication apparatus further includes a change registration module for receiving a secret division number change request including the device authentication key and the program authentication key from the user device, and the change registration module includes the change secret number change request When the device authentication key and the program authentication key match with each other and the one-time authentication key is compared with the previously registered device authentication key and the program authentication key, Value, a new user authentication key, and a new program authentication key.

The authentication apparatus further includes a change registration module that receives a personal password change request including the device authentication key and the program authentication key from the user device, and the change registration module includes the change password in the personal password change request When the device authentication key and the program authentication key match with each other and the one-time authentication key is compared with the previously registered device authentication key and the program authentication key, Keys can be received and updated.

The authentication device receives from the user device a re-registration message including a secret hash value, a user authentication key, a device authentication key, and a program authentication key generated at the user device when re-installing the program in the user device, When the user authentication key and the device authentication key included in the registration message coincide with the previously registered user authentication key and the device authentication key and when the one-time authentication key comparison module compares the one-time authentication key with the device authentication key, And a change registration module for updating the change registration module.

The authentication device receives a device change registration message including a secret hash value, a user authentication key, a device authentication key, and a program authentication key from the user device after changing the user device, and includes the device change registration message When the one-time authentication key is compared with the user authentication key previously registered in the authentication server and the one-time authentication key is compared in the one-time authentication key comparison module, the device authentication key and the program authentication key are updated Module. ≪ / RTI >

The one-time secret password generation module may generate the one-time secret password using the secret hash value.

The disposable secret password generation module may generate the one-time secret password using the time stamp and the secret hash value.

The present invention creates personalized disposable secret passwords and uses them for user authentication, thereby preventing leakage of one-time secret passwords and enhancing security.

In addition, the present invention can prevent denial of the user that the user has not signed by authenticating the user by using the one-time authentication key generated by using the user authentication key and the one-time secret password.

Further, in the present invention, when an authentication program is copied and used in another user terminal or an unregistered authentication program is used, security is enhanced by performing an authentication failure process.

1 is a diagram illustrating an authentication system according to an embodiment of the present invention.
FIG. 2 is a diagram showing a configuration of a user terminal of FIG. 1. FIG.
3 is a diagram illustrating a configuration of an authentication program according to an embodiment of the present invention.
4 is a diagram showing the configuration of the authentication server of FIG.
5 is a flowchart illustrating a method of registering a device authentication key in a user terminal according to an embodiment of the present invention.
6 is a flowchart illustrating a method of registering a secret hash value and a program authentication key according to an embodiment of the present invention.
7 is a flowchart illustrating a method of registering a user authentication key according to an embodiment of the present invention.
8 is a flowchart illustrating a method for a user to authenticate a user when joining a service server according to an exemplary embodiment of the present invention.
9 is a flow chart illustrating a method for changing secret divisors in accordance with one embodiment of the present invention.
10 is a flowchart illustrating a method of changing a personal password according to an embodiment of the present invention.
11 is a flowchart illustrating a method for reinstalling an authentication program at a user terminal according to an embodiment of the present invention.
12 is a flowchart illustrating a method for changing a user terminal according to an embodiment of the present invention.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating an authentication system according to an embodiment of the present invention, and FIG. 2 is a diagram illustrating a configuration of a user terminal of FIG.

As shown in FIG. 1, the authentication system according to the present embodiment includes a user terminal 100, an authentication server 200, a communication network 300, and a service server 400.

The user terminal 100 installs an authentication program and generates a secret hash value, a device authentication key, a program authentication key, and a user authentication key using the hash algorithm through the authentication program, And registers it. The user terminal 100 also transmits user identification information as authentication information to the authentication server 200 for registration.

The authentication server 200 stores and registers the authentication information. When the user authentication is required, the authentication server 200 compares the device authentication key and the program authentication key received from the user terminal 100 with the previously registered device authentication key and the program authentication key to perform the pre-authentication. If the pre-authentication is successful, the authentication server 200 issues a one-time secret password to the user. When the authentication server 200 receives the one-time authentication key using the disposable secret cipher from the user terminal 100, the authentication server 200 generates the one-time authentication key using the previously registered user authentication key and the issued one- And performs final authentication by comparing with the one-time authentication key received from the terminal 100. [

Upon receiving the user identification information from the service server 400, the authentication server 200 identifies the user's authentication information and the user using the user identification information, and transmits the authentication information to the user terminal 100, Can be performed. The authentication server (200) returns the authentication result to the service server (400).

The service server 400 may be an Internet web server that requires login, a server of a financial institution that provides Internet banking, a payment server that provides electronic payment, or an offline kiosk or an agent terminal of an offline consultation counter such as a financial institution Connected servers, and the like. When authentication of the user is required, the service server 400 transmits the user identification information received from the user to the authentication server 200 and requests authentication of the user. Here, the user identification information is user identification information stored in the authentication server 200.

The user terminal 100 may be a mobile communication terminal such as a smart phone or a personal computer. 2, the user terminal 100 includes a memory 110, a memory controller 121, one or more processors (CPUs) 122, a peripheral interface 123, an input / output (I / O) A display device 141, an input device 142, and a communication circuit 152. The display device 141, These components communicate through one or more communication buses or signal lines. The various components shown in FIG. 2 may be implemented in hardware, software, or a combination of both hardware and software, including one or more signal processing and / or application specific integrated circuits.

The memory 110 may include a high-speed random access memory and may also include one or more magnetic disk storage devices, non-volatile memory such as a flash memory device, or other non-volatile semiconductor memory device. In some embodiments, the memory 110 may include a storage device, e.g., a communication circuit 152, located remotely from the one or more processors 122, and an Internet, Intranet, Local Area Network (WLAN) , A Storage Area Network (SAN), or the like, or any suitable combination thereof, via a network (not shown). Access to the memory 110 by other components of the user terminal 100, such as the processor 122 and the peripheral interface 123, may be controlled by the memory controller 121.

The peripheral interface 123 connects the input / output peripheral device of the user terminal 100 to the processor 122 and the memory 110. The one or more processors 122 execute various software programs and / or a set of instructions stored in the memory 110 to perform various functions for the device 100 and process the data. In some embodiments, peripheral interface 123, processor 122, and memory controller 121 may be implemented on a single chip, such as chip 120. In other embodiments, they may be implemented as separate chips.

The I / O subsystem 130 provides an interface between the input / output peripheral of the user terminal 100, such as the display device 141, the input device 142, and the peripheral interface 123.

The display device 141 may be a liquid crystal display (LCD) technology or a light emitting polymer display (LPD) technology. The display device 141 may be capacitive, resistive, infrared, or the like. The touch display provides an output interface and an input interface between the terminal and the user. The touch display displays a visual output to the user. The visual output may include text, graphics, video, and combinations thereof. Some or all of the visual output may correspond to a user interface object. The touch display forms a touch sensitive surface that accommodates user input.

Processor 122 is a processor configured to perform an operation associated with user terminal 100 and to perform instructions, such as, for example, using instructions retrieved from memory 110, Reception and manipulation of data can be controlled.

In some embodiments, software components are installed (installed) in memory 110, such as an operating system 111, a graphics module (instruction set) 112, and an authentication program (instruction set)

The operating system 111 may be an embedded operating system such as, for example, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, Management, storage control, power management, etc.), and facilitates communication between the various hardware and software components.

Graphics module 112 includes a number of well known software components for providing and displaying graphics on display device 141. The term "graphics" includes, without limitation, text, web pages, icons (e.g., user interface targets including soft keys), digital images, video, animations, .

The communication circuit 152 transmits / receives a signal to / from the wire or wirelessly transmits / receives an electromagnetic wave. The communication circuit 152 converts electrical signals to electromagnetic waves and vice versa and communicates with the communication network, other mobile gateways, and communication devices through the electromagnetic waves. The communication circuit 152 includes, for example, an antenna system, an RF transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a CODEC chipset, a subscriber identity module And may include well-known circuits for performing such functions without limitation. The communication circuitry 152 may be any of a variety of communication networks, including the Internet, referred to as the World Wide Web (WWW), a network such as an intranet and / or a cellular telephone network, a wireless LAN and / or a metropolitan area network It can communicate with other devices by communication. The wireless communication may be implemented in a variety of communication systems such as Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), wideband code division multiple access (WCDMA), code division multiple access (CDMA), time division multiple access (TDMA) Protocol), Wi-MAX, Bluetooth, zigbee, Near Field Communication (NFC), or any other suitable communication protocol including communication protocols not yet developed at the time of the filing of the present application But not limited to, any of a plurality of communication standards, protocols, and techniques.

The authentication program 113 can be downloaded and installed from the authentication server 200 or the application store, and when executed by the user after the initial installation, accesses the authentication server 200 and proceeds with the membership registration procedure. The authentication program 113 can receive, as member information, the ID, the name, the date of birth, the address, and the telephone number to the authentication server 200. The authentication program 113 generates a secret hash value, a device authentication key, a program authentication key, and a user authentication key, and transmits the secret hash value, the device authentication key, and the user authentication key to the authentication server 200 as authentication information. Thereafter, when the user logs in to the service server 400 or conducts transactions such as financial transaction or electronic commerce, the authentication program 113 generates the authentication information from the one-time secret password issued by the authentication server 200 And performs an authentication process with the authentication server 200 using the one-time authentication key. Hereinafter, it will be described in detail with reference to FIG.

3 is a diagram illustrating a configuration of an authentication program according to an embodiment of the present invention.

3, the authentication program 113 according to the present embodiment includes a secret hash value generation module 210, a device authentication key generation module 220, a program authentication key generation module 230, Module 240, a one-time secret password input module 250, a one-time authentication key generation module 260, a pre-authentication request module 270, and a modification module 280.

The secret hash value generation module 210 receives the secret divisor from the user through the input device. Here, the secret divisor may be any one of a long string, an image file, a sound file, or a video file, but is not limited thereto and is data that only the user can know.

The secret hash value generation module 210 sets the result obtained by inputting the secret divisor as a seed value to the hash function as a secret hash value. The secret hash value may be stored in a binary file. The secret hash value generation module 2210 transmits the secret hash value to the authentication server 200 and registers the secret hash value. The secret hash value generated by the secret hash value generation module 210 may be stored in the user terminal 100 or may be stored in a separate storage medium such as an NFC card through the communication circuit 152. [ When the secret hash value is stored in a separate storage medium such as an NFC card, the secret hash value is not stored in the user terminal 100. [

The device authentication key generation module 220 collects unique information of the user terminal 100 such as a MAC address or a universally unique identifier (UUID) of the network interface card (NIC) when the authentication program 113 is executed for the first time And generates a device authentication key using the collected unique information. Specifically, the device authentication key management module 220 inputs the unique information of the user terminal 100 as a seed value to the hash function, and stores the generated value as the device authentication key. The device authentication key generation module 220 transmits the device authentication key generated first to the authentication server 200 and registers the same.

The device authentication key generation module 220 generates a device authentication key at each execution of the authentication program 113 and compares it with the previously stored device authentication key. The device authentication key generation module 220 automatically deletes the authentication program 113 when the device authentication key does not match as a result of the comparison. For example, when the authentication program 113 installed in the user terminal 100 is copied and transferred to another device and executed, the previously stored device authentication key and the device authentication key generated at the time of execution are not coincident with each other, The authentication program 113 copied to the device is automatically deleted.

The program authentication key generation module 230 generates and stores a program authentication key using the device authentication key, the time stamp, and the secret hash value generated by the device authentication key generation module 220. The program authentication key may be stored in the authentication program 113 as a binary file. The time stamp is a character string indicating the time at which the program authentication key is generated. The program authentication key generation module 230 transmits the initially generated program authentication key to the authentication server 200 and registers it. When the secret hash value is stored in a separate storage medium such as an NFC card, the program authentication key generation module 230 generates a program authentication key from the storage medium such as an NFC card through the communication circuit 152, To read the secret hash value.

The user authentication key generation module 240 generates a user authentication key using the secret hash value generated by the secret hash value generation module 210 and the personal password input from the user through the input device. Specifically, the user authentication key generation module 240 uses the secret hash value and the input personal password as a seed value in a hash function, and generates a user authentication key. The user authentication key generation module 240 transmits the initially generated user authentication key to the authentication server 200 and registers the same. When the secret hash value is stored in a separate storage medium such as an NFC card, the user authentication key generation module 240 generates a user authentication key from the storage medium such as an NFC card via the communication circuit 152, such as Bluetooth communication or short- To read the secret hash value.

The personal password may be, for example, a six-digit number. However, it is not limited thereto and may be a combination of numbers and letters. Compared with the secret divisor, the secret divisor is a long text string or an image file, but the personal password input by the user when generating the user authentication key is a certain number of digits.

In the above description, the device authentication key and the program authentication key are both stored in the authentication program 113 and the authentication server 200. However, the user authentication key is not stored in the authentication program 113, And is preferably stored in the memory.

The user can register with the authentication server 200, and the secret hash value, the device authentication key, the program authentication key, and the user authentication key are authenticated with the authentication (e.g., ID) based on the user identification information And is stored in the server 200 as authentication information. The authentication server 200 may store not only user identification information but also personal information such as name, date of birth, date of birth, sex, and the like.

The disposable secret password input module 250 receives the disposable secret password generated at the authentication server 200 and received at the destination designated by the user. The destination designated by the user may be the user terminal 100 or a wearable device carried by another user, or it may be an email address. However, it is not limited thereto. The one-time secret password may be received in the form of a short message (SMS) or a push message. The disposable secret password input module 250 can receive the disposable secret password through the keypad or input through the image.

The disposable authentication key generation module 260 inputs the disposable secret password inputted from the one-time secret password input module 250 and the user authentication key generated in the user authentication key generation module 240 as a seed value in the hash function Generates a one-time authentication key, and transmits it to the authentication server 200. That is, when the one-time secret password is issued to the user from the authentication server 200, the user inputs the personal password and the issued one-time secret password in the user terminal 100. [ Then, the user authentication key generation module 240 generates the user authentication key using the personal password, and the one-time authentication key generation module 260 generates the one-time authentication key using the user authentication key and the one-time secret password.

The pre-authentication request module 270 can receive the pre-authentication request including the user identification information, the device authentication key, and the program authentication key to the authentication server 200 before the final authentication using the one-time secret password. When the user identification information, the device authentication key, and the program authentication key included in the pre-authentication request are the same as the pre-registered user identification information, the device authentication key, and the program authentication key, the authentication server 200 issues a one-time secret password .

The change module 280 performs the change of the secret divisor, the change of the personal password, the change of the program authentication key according to the reinstallation of the authentication program, and the change of the device authentication key and the program authentication key according to the change of the user terminal 100 . When the secret divisor is changed, since the secret hash value is changed, the program authentication key and the user authentication key using the secret hash value are changed together. When the personal password is changed, the user authentication key for using it is also changed.

Change of secret divisor

The change module 280 transmits a secret division number change request including the device authentication key and the program authentication key to the authentication server 200 when the secret division change input is received from the user. When the device authentication key and the program authentication key included in the secret division change request match the device authentication key and the program authentication key registered in the authentication server 200, the authentication server 200 transmits the one- Issued to the user. The one-time authentication key generation module 260 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 260. When the matching response is returned, the change module 280 controls the secret hash value generation module 210, the user authentication key generation module 240, and the program authentication key generation module 230 to generate a new secret hash value , A new user authentication key and a new program authentication key are generated. The secret hash value generation module 210, the user authentication key generation module 240 and the program authentication key generation module 230 send the newly generated secret hash value, the user authentication key and the program authentication key to the authentication server 200, And the authentication server 200 updates the previously registered secret hash value, the user authentication key, and the program authentication key to a new value. The change module 280 receives the secret division change completion response from the authentication server 200.

Change your personal password

The change module 280 transmits a personal password change request including the device authentication key and the program authentication key to the authentication server 200 when the personal password change input is received from the user. When the device authentication key and the program authentication key included in the personal password change request coincide with the device authentication key and the program authentication key registered in the authentication server 200, the authentication server 200 transmits a one- Issued to the user. The one-time authentication key generation module 260 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 260. When the matching response is returned as described above, the changing module 280 controls the user authentication key generating module 240 to generate a new user authentication key. The user authentication key generation module 240 transmits a new user authentication key to the authentication server 200, and the authentication server 200 updates the previously registered user authentication key with a new user authentication key. The change module 280 receives the personal password change completion response from the authentication server 200. [

Reinstall the Certification Program

Upon re-installation of the authentication program, the secret hash value generation module 210 receives the secret secret number from the user and generates and stores a secret hash value. The device authentication key generation module 220 and the program authentication key generation module 230 also generate a device authentication key and a program authentication key. The user authentication key generation module 240 newly generates a user authentication key. When the authentication program is reinstalled, the device authentication key, the user authentication key, and the secret hash value are the same as the existing ones, but the program authentication key is changed. The modification module 280 receives the user authentication key, the device authentication key, and the program authentication key generated by the user authentication key generation module 240, the device authentication key generation module 220, and the program authentication key generation module 230, And transmits the re-registration message including the re-registration message to the authentication server 200. [ The authentication server 200 issues a one-time secret password to the user when the user authentication key and the device authentication key included in the re-registration message match the user authentication key and the device authentication key that are pre-registered. The one-time authentication key generation module 260 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 260. Then, the authentication server 200 updates the existing program authentication key with a new program authentication key included in the re-registration message. The change module 280 receives a re-registration completion response from the authentication server 200. [

Change of user terminal

When the user terminal 100 is changed, the authentication program is also reinstalled. The secret hash value generation module 210 receives secret secrets from the user and generates and stores a secret hash value. The device authentication key generation module 220 and the program authentication key generation module 230 also generate a device authentication key and a program authentication key. The user authentication key generation module 240 newly generates a user authentication key. When the user terminal 100 is changed, the authentication program is also reinstalled. However, since the secret divisor and the personal secret number are the same, the device authentication key and the program authentication key are different from each other, and the user authentication key and secret hash value are the same. The modification module 280 receives the user authentication key, the device authentication key, and the program authentication key generated by the user authentication key generation module 240, the device authentication key generation module 220, and the program authentication key generation module 230, And transmits the device change registration message including the device change registration message to the authentication server 200. The authentication server 200 issues a one-time secret password to the user when the user authentication key included in the device change registration message is identical to the previously registered user authentication key. The one-time authentication key generation module 260 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 260. Then, the authentication server 200 updates the previously registered device authentication key and the program authentication key with the new device authentication key and the new program authentication key included in the device change registration message. The change module 280 receives a device registration completion response from the authentication server 200. [

The authentication server 200 can change the secret key number, change the personal password, change the program authentication key according to the reinstallation of the authentication program, change the device authentication key and the program authentication key according to the change of the user terminal 100, Can receive the user identification information from the user terminal 100 and confirm whether or not the user identification information matches the previously registered user identification information.

Referring to FIG. 4, the authentication server 200 includes a secret hash value registration module 410, a user authentication key registration module 420, a one- The device authentication key registration module 450, the program authentication key registration module 460, the pre-authentication request reception module 470, and the change registration module 480. The generation module 430, the one-time authentication key comparison module 440, do. These may be implemented as a program installed in a memory, or a combination of hardware and software. The authentication server 200 is configured to include a memory, a memory controller, one or more processors (CPUs), a peripheral interface, an input / output (I / O) subsystem, and a communication circuit. These components communicate through one or more communication buses or signal lines.

The memory may include high speed random access memory and may also include one or more magnetic disk storage devices, non-volatile memory such as flash memory devices, or other non-volatile semiconductor memory devices. In some embodiments, the memory may include a storage device located remotely from one or more processors. Access to the memory by other components such as the processor and the peripheral interface may be controlled by the memory controller.

The peripheral interface connects the input / output peripheral to the processor and memory. The one or more processors execute various functions for the authentication server 200 and process data by executing a set of instructions stored in various software programs and / or memory.

The I / O subsystem provides an interface between the I / O peripheral and the peripheral interface.

A processor is a processor configured to perform the operations associated with the authentication server 200 and to perform the instructions and to receive and manipulate input and output data between components of the authentication server 200 using, for example, Can be controlled. In some embodiments, a software component is loaded (installed) into an operating system, a graphics module (instruction set), and an authentication processing program (instruction set).

The operating system may be an embedded operating system such as, for example, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, etc. and may include general system tasks Device control, power management, etc.), and facilitates communication between the various hardware and software components.

The secret hash value registration module 410 receives and registers a secret hash value from the user terminal 100. Here, registration means storing with user identification information. The authentication server 200 processes the membership of the user and registers the secret hash value based on the generated user identification information. Since the secret hash value has been described above, the detailed description is omitted here.

The user authentication key registration module 420 receives the user authentication key from the user terminal 100 and registers the same. Since the user authentication key has been described above, the detailed description is omitted here.

The one-time secret password generation module 430 may generate a one-time secret password as shown in Equation 1 or Equation 2 below.

(Equation 1)

ENC_eHPSS = f (eHPSS + TimeStamp),

One-time secret password = f (ENC_eHPSS + TimesTAMP)

(Equation 2)

One-time secret password = f (eHPSS + TimesTAMP)

In Eqs. 1 and 2, eHPSS is a secret hash value, and f () is a hash function.

The timestamp can be replaced by another value in f (ENC_eHPSS + TimesTAMP) or f (eHPSS + TimesTAMP), and in addition to the timestamp and secret hash value, additional data can be added as a seed value to generate a one- . Since the secret hash value is used when generating a one-time secret password, the one-time secret password becomes a personalized one-time secret password.

The one-time secret password generation module 430 transmits the generated one-time secret password to a destination designated by the user. The one-time secret password may be transmitted in the form of a text message (SMS) or a push message or an email or an Automatic Response Service (ARS). To this end, the one-time secret password generation module 430 may receive a telephone number or an e-mail address from the user.

Upon receiving the one-time authentication key from the user terminal 100, the one-time authentication key comparison module 440 compares the one-time authentication key with the self-generated one-time authentication key. Since the method of generating the one-time authentication key in the user terminal 100 has been described above, the description is omitted here. The one-time authentication key comparison module 440 compares the one-time secret password issued to the user in the one-time secret password generation module 430 and the user authentication key of the user registered in the user authentication key registration module 420, To generate a one-time authentication key, and compares the one-time authentication key from the user terminal 100 with the one-time authentication key. The one-time authentication key comparison module 440 transmits the result of the one-time authentication key comparison to the user terminal 100.

The device authentication key registration module 450 receives the device authentication key from the user terminal 100 and registers the device authentication key. Since the device authentication key has been described above, the detailed description is omitted here.

The program authentication key registration module 460 receives the program authentication key from the user terminal 100 and registers it. Since the program authentication key has been described above, detailed description thereof will be omitted here.

The authentication server 200 processes membership of a user and can store a secret hash value, a user authentication key, a device authentication key, and a program authentication key based on the generated user identification information.

The pre-authentication request receiving module 470, when receiving the user identification information for user authentication of the user from the service server 400, transmits the user authentication notification message to the user terminal 100 corresponding to the user identification information. As the user authentication notification message is received by the user terminal 100, the user terminal 100 transmits a pre-authentication request including user identification information, a device authentication key and a program authentication key, and the pre-authentication request receiving module 470 And receives the pre-authentication request.

The one-time secret password generation module 430 searches for the device authentication key and the program authentication key previously registered in the authentication server 200 using the user identification information included in the pre-authentication request. The one-time secret password generation module 430 compares the retrieved device authentication key and the program authentication key with the device authentication key and the program authentication key included in the pre-authentication request, generates a one-time secret password, Lt; / RTI >

Upon receiving the one-time authentication key from the user terminal 100, the one-time authentication key comparison module 440 compares the one-time authentication key with the self-generated one-time authentication key, do. If they do not match, the one-time authentication key comparison module 440 transmits the authentication failure response to the service server 400.

The change registration module 480 receives the device authentication key and the program authentication key corresponding to the change of the secret number, the change registration of the personal password, the change registration of the program authentication key according to the reinstallation of the authentication program, Change registration is performed. When the secret divisor is changed, the program authentication key and the user authentication key are changed together and registered. When the personal password is changed, the user authentication key that uses it is changed and registered together.

Change of secret divisor

The change registration module 480 receives a secret division number change request including the device authentication key and the program authentication key from the user terminal 100. [ When the device authentication key and the program authentication key included in the secret division number change request match the previously registered device authentication key and the program authentication key, the change registration module 480 controls the one-time secret password generation module 430 And issues a one-time secret password to the user. The one-time authentication key comparison module 440 transmits a matching response to the user terminal 100 as a result of comparison of the one-time authentication keys. The change registration module 480 receives the secret hash value, the user authentication key, and the program authentication key newly created from the user terminal 100 and replaces the previously registered secret hash value, the user authentication key, and the program authentication key Update.

Change your personal password

The change registration module 480 receives a personal password change request including the device authentication key and the program authentication key from the user terminal 100. [ When the device authentication key and the program authentication key included in the personal password change request coincide with the previously registered device authentication key and the program authentication key, the change registration module 480 transmits the one-time secret password generation module 430 And issues a one-time secret password to the user. The one-time authentication key comparison module 440 transmits a matching response to the user terminal 100 as a result of comparison of the one-time authentication keys. The change registration module 480 receives the new user authentication key from the user terminal 100 and replaces the already registered user authentication key to update it.

Reinstall the Certification Program

The change registration module 480 receives a re-registration message including the user authentication key, the device authentication key, and the program authentication key from the user terminal 100 as the authentication program is re-installed in the user terminal 100. [ When the user authentication key and the device authentication key included in the re-registration message are identical to the user authentication key and the device authentication key that are registered in advance, the change registration module 480 controls the one-time secret password generation module 430 to perform the disposable Issue a secret password to the user. The one-time authentication key comparison module 440 transmits a matching response to the user terminal 100 as a result of comparison of the one-time authentication keys. The change registration module 480 replaces the previously registered program authorization key with the program authorization key included in the reinstallation registration message.

Change of user terminal

The change registration module 480 receives the device change registration message including the user authentication key, the device authentication key, and the program authentication key from the user terminal 100 after the change according to the change of the user terminal 100. [ The change registration module 480 controls the one-time secret password generation module 430 to issue a one-time secret password to the user when the user authentication key included in the device change registration message is identical to a previously registered user authentication key. The one-time authentication key comparison module 440 transmits a matching response to the user terminal 100 as a result of comparison of the one-time authentication keys. The change registration module 480 replaces the previously registered device authentication key and the program authentication key with the device authentication key and the program authentication key included in the device change registration message.

5 is a flowchart illustrating a method of registering a device authentication key in a user terminal according to an embodiment of the present invention.

Referring to FIG. 5, the user terminal 100 accesses the authentication server 200 or the application store through the communication network 300 to download an authentication program (S401). The user terminal 100 executes the authentication program according to the input of the user (S403). The authentication program collects the unique information of the user terminal 100, for example, the MAC address or the UUID of the network interface card (S405). The authentication program generates and stores a device authentication key using the unique information (S407 and S409). The authentication program uses a value generated by inputting the unique information as a seed value in a hash function as a device authentication key. Then, the authentication program transmits the device authentication key to the authentication server 200 (S411).

6 is a flowchart illustrating a method of registering a secret hash value and a program authentication key according to an embodiment of the present invention.

Referring to FIG. 6, the authentication program of the user terminal 100 receives secret secrets from the user (S501), generates and stores secret secrets using the secret secrets (S503 and S505). The authentication program generates a secret hash value by inputting the secret divisor as a seed value into the hash function. Here, the secret divisor may be any one of a long string, an image file, a sound file, or a movie file.

After generating the secret hash value, a program authentication key generation process is performed. That is, the authentication program generates a time stamp (S507), generates a program authentication key by inputting the time stamp, the device authentication key, and the secret hash value into the hash function as a seed value (S509, S511). After generating the program authentication key, the authentication program transfers the secret hash value and the program authentication key to the authentication server 200 (S513).

7 is a flowchart illustrating a method of registering a user authentication key according to an embodiment of the present invention.

Referring to FIG. 7, the authentication program of the user terminal 100 receives the personal password input from the user (S601). The personal password may be, for example, a six-digit number.

The authentication program generates a user authentication key by inputting the secret hash value and the personal password into the hash function as a seed value (S603). Then, the authentication program transfers the user authentication key to the authentication server 200 and registers it (S605).

8 is a flowchart illustrating a method for a user to authenticate a user when joining a service server according to an exemplary embodiment of the present invention.

Referring to FIG. 8, the user accesses the service server 400 to request the subscription to the user terminal 100 (S701). At the time of membership registration, the user can input an ID and a password, and further input gender, date of birth, telephone number, resident registration number, and the like. At this time, the ID inputted by the user is the same as the ID of the user stored in the authentication server 200. The service server 400 receiving the subscription application transmits the user authentication request including the ID inputted by the user to the authentication server 200 (S703). In the present embodiment, the ID is included in the authentication request, but the identification information of other users such as a telephone number, a resident registration number, an address, and the like are included in the authentication server 200 It is possible.

The authentication server 200 identifies the user's authentication information using the user's ID included in the user authentication request received from the service server 400 and transmits the user authentication notification message to the user terminal 100 (S705) . The user terminal 100 pops up a personal authentication notification message and receives an ID and an authentication start input from the user (S707).

The user terminal 100 transmits a pre-authentication request including the user ID, the device authentication key, and the program authentication key to the authentication server 200 (S709). The authentication server 200 compares the ID, the device authentication key, and the program authentication key included in the pre-authentication request with the pre-registered user's ID, the device authentication key, and the program authentication key, (S711).

The authentication server 200 generates a one-time secret password using the secret hash value of the previously registered user (S713). The one-time secret password is generated according to (Equation 1) or (Equation 2) described above. The authentication server 200 transmits the disposable secret password to the destination designated by the user. In the present embodiment, it is transmitted to the user terminal 100 (S715).

The user terminal 100 receives the one-time secret password issued by the authentication server 200 from the user and receives the personal password from the user (S717). The user terminal 100 generates a user authentication key using the secret hash value and the input personal password (S719). Then, the user terminal 100 generates the disposable authentication key using the user authentication key and the one-time secret password input from the user (S721).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S723). The authentication server 200 generates the one-time authentication key using the one-time secret password generated in step S713 and the user authentication key of the previously registered user, and transmits the generated one-time authentication key to the user terminal 100 (S725). ≪ / RTI >

When the results of the comparison of the one-time authentication keys match, the authentication server 200 transmits an authentication success response to the user terminal 100 and the service server 400 (S727, S729). On the other hand, when the result of the comparison of the one-time authentication keys indicates that there is a mismatch, the authentication server 200 transmits an authentication failure response to the user terminal 100 and the service server 400.

The present embodiment described with reference to FIG. 8 is a method for authenticating the user when joining the service server 400 as a user. However, it is not limited thereto. For example, the authentication process described above with reference to FIG. 8 is performed when authentication is performed offline, such as in a kiosk or a vending machine. That is, the kiosk or the vending machine receives the user identification information such as ID from the user and directly transmits the user identification information to the authentication server 200 or transmits the user identification information to the authentication server 200 via the service server 400 You can request your certification. At this time, the kiosk or the vending machine can read the user identification information from the user terminal 100 through short-distance communication such as NFC, RFID, or Bluetooth.

Also, the authentication process described with reference to FIG. 8 can be applied to a case where a user performs an offline consultation in a financial institution. When the user authentication is required, the user provides the user identification information to the agent. The agent terminal directly transmits the user identification information input from the agent to the authentication server 200 or the service server 400 The user authentication information can be transmitted to the authentication server 200 via the Internet. The user may orally provide the user identification information to the agent, or may present the card storing the user identification information to the agent, and the agent may acquire the user identification information by reading the card to the reader.

In addition, when the user purchases an item at the online shopping mall and performs payment authentication, the user authentication described with reference to Fig. 8 can be performed. In addition, when the transaction is performed using a POS terminal in a financial automation device (ATM) or an offline store, the above-described personal authentication may be performed even when the user is authenticated. As described above, the personal authentication according to the present embodiment can be applied to all services required for authentication.

According to the embodiment described above, the authentication server 200 performs a process of comparing the device authentication key and the program authentication key. That is, the authentication server 200 issues the one-time secret password only when the user uses the previously registered authentication program in the predetermined user terminal 100. [ Therefore, if the authentication program is copied and used in another user terminal or an unregistered authentication program is used, the authentication is unsuccessful and security is enhanced.

In addition, since the one-time secret password is generated using the secret hash value of the user, the one-time secret password can not be deduced. Also, the user terminal 100 can protect the one-time secret password by encrypting the user's personal password and the one-time secret password using a hash algorithm without sending the disposable secret password to the authentication server 200. Security can also be further enhanced by using timestamps when generating disposable secret passwords.

9 is a flow chart illustrating a method for changing secret divisors in accordance with one embodiment of the present invention.

Referring to FIG. 9, the user terminal 100 receives a secret divisor change input from a user. Accordingly, the user terminal 100 transmits a secret division number change request including the user identification information (ID), the device authentication key, and the program authentication key to the authentication server 200 (S801).

The authentication server 200 performs the primary authentication using the value included in the secret division number change request (S802). Specifically, the authentication server 200 confirms whether the user identification information, the device authentication key, and the program authentication key included in the secret division number change request are the same as the user identification information, the device authentication key, and the program authentication key previously registered.

When the primary authentication is successful, the authentication server 200 generates a one-time secret password using the secret hash value of the previously registered user (S803). The authentication server 200 transmits the disposable secret password to the destination designated by the user. In the present embodiment, it is transmitted to the user terminal 100 (S804).

The user terminal 100 receives the one-time secret password issued by the authentication server 200 and receives the personal password from the user (S805). The user terminal 100 generates a user authentication key using the secret hash value and the input personal password (S806). Then, the user terminal 100 generates a one-time authentication key using the user authentication key and the disposable secret code input from the user (S807).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S808). The authentication server 200 generates the one-time authentication key using the one-time secret password generated in step S803 and the user authentication key of the previously registered user, and transmits the generated one-time authentication key to the user terminal 100 (Step S809). In step S809, the second authentication is performed.

If the secondary authentication is successful, the authentication server 200 transmits a secret division input request to the user terminal 100 (S810). The user inputs a new secret secret number to the user terminal 100, and the user terminal 100 generates a new secret hash value, a new program authentication key, and a new user authentication key using the input new secret secret number (S811) .

The user terminal 100 transmits the new secret hash value, the new program authentication key, and the new user authentication key to the authentication server 200 in step S812. The authentication server 200 then transmits the secret hash value, The authentication key and the user authentication key are replaced with the new secret hash value, the new program authentication key, and the new user authentication key (S813).

10 is a flowchart illustrating a method of changing a personal password according to an embodiment of the present invention.

Referring to FIG. 10, the user terminal 100 receives a personal password change input from a user. Accordingly, the user terminal 100 transmits a personal password change request including the user identification information (ID), the device authentication key, and the program authentication key to the authentication server 200 (S901).

The authentication server 200 performs the primary authentication using the value included in the personal password change request (S902). Specifically, the authentication server 200 determines whether the user identification information, the device authentication key, and the program authentication key included in the personal password change request are the same as the user identification information, the device authentication key, and the program authentication key previously registered.

When the primary authentication is successful, the authentication server 200 generates a one-time secret password using the secret hash value of the previously registered user (S903). The authentication server 200 transmits the disposable secret password to the destination designated by the user. In the present embodiment, it is transmitted to the user terminal 100 (S904).

The user terminal 100 receives the one-time secret password issued by the authentication server 200 from the user and receives the personal password from the user (S905). Here, the personal password to be input is the personal password before the change. The user terminal 100 generates a user authentication key using the secret hash value and the input personal password (S906). Then, the user terminal 100 generates a one-time authentication key using the user authentication key and the disposable secret code input from the user (S907).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S908). The authentication server 200 generates the one-time authentication key using the one-time secret password generated in step S903 and the user authentication key of the previously registered user, and transmits the generated one-time authentication key to the user terminal 100 (Step S909). In step S909, the second authentication is performed to compare the one-time authentication key received from the one-time authentication key.

If the secondary authentication is successful, the authentication server 200 transmits a personal password input request to the user terminal 100 (S910). The user inputs a new personal password to the user terminal 100, and the user terminal 100 generates a new user authentication key using the new personal password (S911).

The user terminal 100 transmits the new user authentication key to the authentication server 200 (S912), and the authentication server 200 replaces the existing user authentication key with the new user authentication key to update the user authentication key (S913 ).

11 is a flowchart illustrating a method for reinstalling an authentication program at a user terminal according to an embodiment of the present invention.

Referring to FIG. 11, the user terminal 100 downloads an authentication program from the authentication server 200 or the application store and reinstalls the authentication program (S1001). Then, the user terminal 100 generates a device authentication key, a program authentication key, and a user authentication key (S1002). That is, the authentication program of the user terminal 100 collects unique information of the user terminal 100 and generates a device authentication key. And the authentication program generates a secret hash value by inputting the secret divisor from the user. The authentication program generates a program authentication key using the device authentication key, the time stamp, and the secret hash value. Also, the authentication program receives the personal password from the user, and generates the user authentication key using the personal password and the secret hash value. Since the authentication program is reinstalled without changing the user terminal 100, the device authentication key and the user authentication key are the same as before, and the program authentication key is different from the conventional one because the time stamp is different.

The user terminal 100 transmits a re-registration request including the user identification information input by the user, the device authentication key, the program authentication key, and the user authentication key to the authentication server 200 (S1003). The authentication server 200 performs the primary authentication using the value included in the re-registration request (S1004). Specifically, the authentication server 200 determines whether the user identification information, the device authentication key, and the user authentication key included in the re-registration request are identical to the user identification information, the device authentication key, and the program authentication key that are pre-registered.

When the first authentication is successful, the authentication server 200 generates a one-time secret password using the secret hash value of the previously registered user (S1005). The authentication server 200 transmits the disposable secret password to the destination designated by the user. In the present embodiment, it is transmitted to the user terminal 100 (S1006).

The user terminal 100 receives the one-time secret password issued by the user from the authentication server 200 and receives the personal password from the user. The user terminal 100 generates a user authentication key using the secret hash value and the input personal password. Then, the user terminal 100 generates a one-time authentication key using the user authentication key and the disposable secret code input from the user (S1007).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S1008). The authentication server 200 generates the one-time authentication key using the one-time secret password generated in step S1005 and the user authentication key of the previously registered user, and transmits the generated one-time authentication key to the user terminal 100 (Step S1009). In step S1009, the second authentication is performed to compare the one-time authentication key received from the one-time authentication key.

If the secondary authentication is successful, the authentication server 200 replaces the previously registered program authentication key with the program authentication key included in the reinstallation registration request (S1010).

12 is a flowchart illustrating a method for changing a user terminal according to an embodiment of the present invention.

Referring to FIG. 12, a new user terminal 100 downloads and installs an authentication program in the authentication server 200 or an application store (S1101). Then, the user terminal 100 generates a device authentication key, a program authentication key, and a user authentication key (S1102). That is, the authentication program of the user terminal 100 collects unique information of the user terminal 100 and generates a device authentication key. And the authentication program generates a secret hash value by inputting the secret divisor from the user. The authentication program generates a program authentication key using the device authentication key, the time stamp, and the secret hash value. Also, the authentication program receives the personal password from the user, and generates the user authentication key using the personal password and the secret hash value. Since the user terminal 100 is changed and the authentication program is newly installed, the device authentication key and the program authentication key are different from the existing one, and the user authentication key is the same as the existing one.

The user terminal 100 transmits a device change registration request including the user identification information input by the user, the device authentication key, the program authentication key, and the user authentication key to the authentication server 200 (S1103). The authentication server 200 performs the primary authentication using the value included in the device change registration request (S1104). Specifically, the authentication server 200 determines whether the user identification information included in the device change registration request and the user authentication key are the same as the user identification information and the user authentication key previously registered.

When the primary authentication is successful, the authentication server 200 generates a one-time secret password using the secret hash value of the previously registered user (S1105). The authentication server 200 transmits the disposable secret password to the destination designated by the user. In the present embodiment, it is transmitted to the user terminal 100 (S1106).

The user terminal 100 receives the one-time secret password issued by the user from the authentication server 200 and receives the personal password from the user. The user terminal 100 generates a user authentication key using the secret hash value and the input personal password. Then, the user terminal 100 generates a one-time authentication key using the user authentication key and the disposable secret code input from the user (S1107).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S1108). The authentication server 200 generates a one-time authentication key using the one-time secret password generated in step S1105 and the user authentication key of the previously registered user, and transmits the generated one-time authentication key to the user terminal 100 (Step S1109). The first authentication is performed by comparing the one-time authentication key received from the one-time authentication key.

If the secondary authentication is successful, the authentication server 200 replaces the previously registered device authentication key and the program authentication key with the device authentication key and the program authentication key included in the device change registration request (S1110).

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.

Although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed to obtain a sequence of sequential orders, or a desired result . In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

110: Memory
113: Certification Program
210: Secret hash value generation module
220: Device authentication key generation module
230: Program Authentication Key Generation Module
240: User Authentication Key Generation Module
250: Disposable secret password input module
260: Disposable Authentication Key Generation Module
270: pre-authentication request module
280: Change module

Claims (23)

A user equipment communicating with an authentication server,
One or more processors;
Memory; And
A program stored in the memory and configured to be executed by the one or more processors,
The program includes:
A secret hash value generation module for generating and storing a secret hash value by inputting a secret divisor input from a user as a seed value into a hash function, and transmitting and registering the secret hash value to the authentication server;
A user authentication key generation module for generating a user authentication key by inputting the personal password inputted by the user and the secret hash value into the hash function as a seed value and transmitting the user authentication key to the authentication server and registering the user authentication key;
A one-time secret password input module for receiving the one-time secret password issued by the authentication server; And
Generates a one-time authentication key by inputting the one-time secret password input from the one-time secret password input module and the user authentication key into the hash function as a seed value, transmits the one-time authentication key to the authentication server, And a disposable authentication key generation module that receives a result of the comparison between the authentication server and the one-time authentication key generated by the authentication server, from the authentication server. The method according to claim 1,
A device authentication key generation module for generating and storing a device authentication key by inputting unique information of the user device as a seed value in a hash function and transmitting the device authentication key to the authentication server and registering the device authentication key; Further comprising: 3. The method of claim 2,
Wherein the device authentication key generation module comprises:
A device authentication key is generated and compared with a previously stored device authentication key each time the program is executed, and when the program is not matched, the program is deleted. 3. The method of claim 2,
Generates and stores a program authentication key by inputting the time stamp, the secret hash value, and the device authentication key into a hash function as a seed value, and transmits the program authentication key to the authentication server for registration And a program authentication key generation module. 5. The method of claim 4,
And a pre-authentication request module for transmitting a pre-authentication request including the device authentication key and the program authentication key to the authentication server upon receiving the authentication notification message from the authentication server,
The one-
When the device authentication key and the program authentication key included in the pre-authentication request match each other and the comparison result of the device authentication key and the program authentication key previously registered in the authentication server match each other, Device. 6. The method of claim 5,
Wherein the pre-
Wherein the authentication server receives the user authentication notification message from the authentication server upon receipt of the identification information of the user from the service server. 5. The method of claim 4,
Further comprising: a change module for transmitting a secret number change request including the device authentication key and the program authentication key to the authentication server,
Wherein the change module comprises:
The device authentication key and the program authentication key included in the secret division change request coincide with the device authentication key and the program authentication key registered in the authentication server and the disposable authentication key generation module generates a match response of the one- Wherein the control unit controls the secret hash value generation module, the user authentication key generation module and the program authentication key generation module to generate a new secret hash value, a new user authentication key, and a new program authentication key, Device. 5. The method of claim 4,
And a change module for transmitting a personal password change request including the device authentication key and the program authentication key to the authentication server,
Wherein the change module comprises:
Wherein the device authentication key and the program authentication key included in the personal password change request coincide with the device authentication key and the program authentication key registered in the authentication server and the disposable authentication key generation module generates a match response of the one- Wherein the user authentication key generation module controls the user authentication key generation module to generate a new user authentication key. 5. The method of claim 4,
A user authentication key, a program authentication key, and a program authentication key by controlling the secret hash value generation module, the user authentication key generation module, the device authentication key generation module, and the program authentication key generation module upon re- And transmits a re-registration registration message including the user authentication key, the device authentication key and the program authentication key to the authentication server, and the user authentication key and the device authentication key included in the re- And a change module for receiving a re-establishment registration completion response from the authentication server when the disposable authentication key generation module receives a matching response of the one-time authentication key, which is identical to the user authentication key and the device authentication key registered in advance User device. 5. The method of claim 4,
A user authentication key, a device authentication key, and a program authentication key by controlling the secret hash value generation module, the user authentication key generation module, the device authentication key generation module, and the program authentication key generation module, And transmits the device change registration message including the user authentication key, the device authentication key, and the program authentication key to the authentication server, and the user authentication key included in the device change registration message is transmitted to the authentication server And a change module for receiving a device change registration completion response from the authentication server when the disposable authentication key generation module receives a match response of the one-time authentication key, which matches the previously registered user authentication key, Lt; / RTI > 11. The method according to any one of claims 1 to 10,
The one-
And the authentication server generates the secret hash value using the hash value. 12. The method of claim 11,
The one-
A time stamp, and the secret hash value. An authentication device for communicating with a user device,
One or more processors;
Memory; And
A program stored in the memory and configured to be executed by the one or more processors,
The program includes:
A secret hash value registration module for receiving and registering a secret hash value generated by inputting a secret divisor input from a user as a seed value to a hash function from the user device;
A user authentication key registration module for receiving and registering a user authentication key generated by inputting a user's personal password and the secret hash value into a hash function as a seed value;
A one-time secret password generation module for generating a one-time secret password and transmitting it to the user; And
When the disposable authentication key is received from the user device, comparing the received disposable authentication key, the registered user authentication key, and the disposable secret password with the disposable authentication key generated by inputting the disposable secret key into the hash function as a seed value, And a disposable authentication key comparison module for transmitting the result to the user device. 14. The method of claim 13,
And a device authentication key registration module for receiving and registering a device authentication key generated by inputting unique information of the user device as a seed value in a hash function from the user device. 15. The method of claim 14,
A program authentication key registration module for receiving and registering a program authentication key generated by generating a time stamp, inputting the time stamp, the secret hash value, and the device authentication key into a hash function as a seed value, Authentication device. 16. The method of claim 15,
And a pre-authentication request receiving module for receiving a pre-authentication request including the device authentication key and the program authentication key from the user device in response to the user authentication notification message transmitted to the user device,
The disposable secret password generation module includes:
And compares the device authentication key and the program authentication key included in the pre-authentication request with the pre-registered device authentication key and the program authentication key, and generates the disposable secret cipher if all of them match. 17. The method of claim 16,
Wherein the pre-authentication request receiving module comprises:
And transmits the identity authentication notification message to the user device upon receiving the identification information of the user from the service server. 16. The method of claim 15,
Further comprising: a change registration module for receiving a secret number change request including the device authentication key and the program authentication key from the user device;
The change registration module includes:
When the device authentication key and the program authentication key included in the secret divisor change request coincide with the previously registered device authentication key and the program authentication key and the disposable authentication key comparison module compares the disposable authentication key, And a new secret hash value, a new user authentication key, and a new program authentication key from the user device. 16. The method of claim 15,
And a change registration module for receiving a personal password change request including the device authentication key and the program authentication key from the user device,
The change registration module includes:
When the device authentication key and the program authentication key included in the personal password change request coincide with the already-registered device authentication key and the program authentication key, and when the disposable authentication key comparison module compares the one- And receives a new user authentication key from the user device and updates the new user authentication key. 16. The method of claim 15,
Upon reinstallation of the program at the user device, the user device receives a re-registration message including a secret hash value, a user authentication key, a device authentication key, and a program authentication key generated at the user device from the user device, When the user authentication key and the device authentication key coincide with the user authentication key and the device authentication key that have been preliminarily registered and the one-time authentication key comparison result obtained by the one-time authentication key comparison module shows a match, the change registration module Further comprising: < / RTI > 16. The method of claim 15,
Upon the change of the user device, receives a device change registration message including a secret hash value, a user authentication key, a device authentication key and a program authentication key from the user device after the change, and the user authentication key included in the device change registration message And a change registration module for updating the device authentication key and the program authentication key when the one-time authentication key is identical to the user authentication key previously registered in the authentication server and the one-time authentication key is compared in the one-time authentication key comparison module And the authentication device. 22. The method according to any one of claims 13 to 21,
The disposable secret password generation module includes:
And generates a one-time secret password using the secret hash value. 23. The method of claim 22,
The disposable secret password generation module includes:
And generates a one-time secret code using the time stamp and the secret hash value.

Images