KR20170103691A - Authentication mehtod and system using ip address and short message service - Google Patents

Abstract

Disclosed is an authentication service system which performs user authentication using a short message service (SMS), and includes an authentication service component and a verification component. The authentication service component transmits user information received as authentication basic information to the verification component, confirms an Internet protocol (IP) address which is access information of a mobile device connected for user authentication, and transmits the confirmed IP address of the mobile device and an SMS authentication value inputted by the mobile device to the verification component. The verification component generates the SMS authentication value to be used for the user authentication corresponding to the transmitted user information, transmits the generated SMS authentication value to a registered mobile device corresponding to the user information, confirms an IP address allocated by a telecommunication company with respect to the registered mobile device, and verifies suitability on the user authentication in accordance with correspondence between the SMS authentication value transmitted from the authentication service component and the generated SMS authentication value, and correspondence between the IP address transmitted from the authentication service component and the confirmed IP address allocated by the telecommunication company.

Description

Technical Field [0001] The present invention relates to an authentication method and system using IP address and SMS,

The present invention relates to an authentication method and system associated with user authentication and / or service authentication.

The importance of user authentication is increasing day by day in various web sites, mobile apps, financial or payment services. In recent years, the concept of service authentication has also been introduced in accordance with the need to confirm that a service site is not a false site as the risk of phishing increases.

First, the most commonly used method for authenticating the user is a method of utilizing the ID and password of the corresponding user. However, there is a problem in that the method of utilizing the user ID and the password is not easy because the information is easily leaked or taken.

Recently, SMS (Short Message Service) has been used as an authentication service using an SMS to check user identity (ie, identity verification of a service user) in an online web or a mobile app service Or device possessive authentication services are widely used.

Typically, the identity authentication service using SMS is a real name verification service for comparing user information (e.g., name, resident registration number, phone number, etc.) input from a user and member information registered in a communication company, When the mobile phone user inputs the authentication value into the authentication window within a predetermined validity time and the transmitted authentication value matches the input authentication value, (Refer to FIG. 1).

In addition, regardless of the member DB of the communication company, the mobile phone owner authentication service using the SMS sends the SMS authentication value to the mobile phone number input through the wireless communication network to check whether the mobile phone number input from the user is correct, If the user inputs the authentication value in the authentication window within the valid time and matches with each other, it is a device authentication service that confirms whether the mobile phone is owned by the user.

However, due to frequent accidents caused by hackers impersonating users through SMS authentication service, SMS authentication service is no longer a reliable authentication method. The main reason that SMS authentication is easily hacked is that personal information (eg name, phone number, social security number, e-mail, etc.) used in the SMS authentication service is already exposed to hackers due to a large personal information leakage accident, If a malicious code or malware is installed by a mobile phone number or an email account that sends a malicious SMS or e-mail message to the targeted mobile phone, the SMS can be intercepted by the hacker .

Therefore, even if the SMS sent to the user's mobile phone is hijacked by the hacker, a new SMS-based authentication technology is required to verify the SMS authentication value only in the user's mobile phone.

In order to solve the above problems, according to an embodiment of the present invention, in providing the authentication service using SMS, the access information of the corresponding user mobile phone accessing the identity verification service and the SMS authentication value received by the mobile phone A method and system for a user authentication service that enables an SMS authentication value to be valid only in a mobile phone as a user authentication service for authenticating that a mobile phone user is a person using the mobile phone.

According to an aspect of the present invention, an authentication service system is disclosed that performs user authentication using Short Message Service (SMS), and includes an authentication service component and a verification component.

Wherein the authentication service component transmits the received user information as authentication basic information to the verification component, identifies an IP address that is connection information of the connected mobile device for user authentication, And transmits the SMS authentication value input from the mobile device to the verification component.

Wherein the verification component generates an SMS authentication value to be used for authentication of the user corresponding to the delivered user information and transmits the generated SMS authentication value to a registered mobile device corresponding to the corresponding user information, And determines whether the SMS authentication value transmitted from the authentication service component matches the generated SMS authentication value and whether the IP address delivered from the authentication service component and the confirmed carrier allocation IP address The verification of the authenticity of the user authentication is performed according to whether or not there is a coincidence between them.

In one embodiment, the SMS authentication value may be an authentication value generated by utilizing all or a part of the IP address assigned by the communication company for the registered mobile device as a seed value.

In one embodiment, if the user authentication is being executed through a mobile app installed in the mobile device of the user,

The authentication service component may receive the push ID of the mobile app and forward the received push ID to the validation component. The verification component generates a push authentication value, transmits the push authentication value generated by referring to the push ID to the mobile application as a push message, and uses the push authentication value as an additional authentication element of the user authentication process .

In one embodiment, the authentication service component may communicate the push authentication value received from the connected mobile device to the verification component. In addition, the verification component may utilize the additional matching between the push authentication value delivered from the authentication service component and the generated push authentication value to verify the validity of the user authentication.

In one embodiment, if the mobile device connected for user authentication and the registered mobile device receiving the SMS authentication value are different devices,

Wherein the verification component compares position information obtained corresponding to the IP address of the connected mobile device with position information obtained corresponding to the current GPS information of the registered mobile device and determines whether or not the position information is within a pre- And can verify the validity of the user authentication.

In one embodiment, the authentication service component is implemented in a service server relating to a service to be accessed by a user or an authentication proxy server that performs an authentication procedure with respect to the service server, and the verification component is connected to a communication company server or the authentication proxy server Can be implemented.

According to the embodiment of the present invention, even if the SMS authentication value is hacked by the hacker, only a legitimate user can use the authentication service using the SMS, so that the trusted user authentication service in the PINTECH service, the IOT service, There is an effect that it becomes possible.

Brief Description of the Drawings Fig. 1 shows a personal authentication service using SMS in the prior art. Fig.
FIGS. 2 to 5 are views for explaining a method and system for authentication service using an IP address and SMS according to an embodiment of the present invention. FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, throughout the specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Also, throughout the specification, when an element is referred to as "including" an element, it is understood that the element may include other elements as well, without departing from the other elements unless specifically stated otherwise. Also, the terms "a "," module ", and the like in the description mean a unit for processing at least one function or operation, which means that it can be implemented by one or more hardware or software or a combination of hardware and software . In addition, the push ID represented by the mobile application developer usually means Push Token, and the push message service means a message service provided by a mobile operating system such as Google or Apple.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. 2 to 5 are views for explaining a method and system for authentication service using an IP address and SMS according to an embodiment of the present invention. 2 through 5 illustrate various types of personal authentication (e.g., personal authentication for accessing a web site, personal authentication for on-line / mobile financial transaction or payment, etc.) using a mobile device owned by the user, The authentication method is performed.

2 to 5, a mobile phone (particularly, a smart phone) is used as the 'user mobile device 100'. However, it is first clarified that the user mobile device may be various. Also, the 'authentication server 200' of FIG. 2 to FIG. 5 may be a separate server for proxy authentication only, but may be integrated into another server. For example, the operations and roles of each step to be performed in the authentication service server 200 may be implemented as a part of functions in the target server to which the user actually wants to access. 2 to 5, the final confirmation (or verification) of the identity authentication is performed by the communication company server 300, but this is not necessarily required. For example, the final verification (verification) procedure (refer to S19 in FIG. 2, S39 in FIG. 3, S59 in FIG. 4, and S79 in FIG. 7) may be performed by an external verification server that exists separately from the authentication service server The authentication service server of the user may be able to integrate the functions. That is, various modifications may be made to the system design method, and the present invention may also be variously modified in a form suitable for the designed system.

It should be noted that the identification numbers (i.e., S11, S12, S13, etc.) for each step in the personal authentication procedure of FIGS. 2 to 5 to be described below are for describing each step separately, Make it clear. It goes without saying that each step may be executed in parallel or simultaneously, regardless of the end of the identification number, unless a different step can be executed only after one step has been logically carried out. It is also obvious that each step may be executed in a different order from the end of the identification number in some cases. As long as the essential technical features of the present invention can be fully reflected, the order of each step may also be variously modified. Hereinafter, each step will be described in accordance with the procedure shown in the drawings in terms of concentration and convenience.

Hereinafter, the personal authentication procedure of FIG. 2 will be described.

Referring to FIG. 2, when the user information is transmitted from the user mobile device 100 to the authentication service server 200 (see S11 in FIG. 2), the authentication service server 200 transmits the authentication information And transmits the user information received from the server 100 to the communication company server 300 (refer to S12 in Fig. 2).

At this time, there is no particular limitation on the usable user information, and various types of personal information, unique information, device information, etc., which can be utilized as basic information enabling user identification, can be utilized. Examples of such user information include a name, a resident registration number, a date of birth, a phone number, a PIN number, a USIM number, and a user ID (this is also true in FIGS. 3 to 5).

The user information may be directly input by the user (for example, directly inputting through a smartphone web browser or a mobile application), or may be automatically input at the initial authentication step. For example, when a user executes a specific application installed in his / her smart phone, at the same time, predetermined information may be automatically input as user information.

After the user information is input as described above, the identity authentication service server 200 requests the SMS (Short Message Service) authentication value input (refer to S13 in FIG. 2). Accordingly, an authentication window for inputting the SMS authentication value may be displayed on the screen of the user mobile device 100. [ In the future, the user will input the SMS authentication value into the corresponding authentication window to request the authentication shown (see S16 in FIG. 2).

At this time, the SMS authentication value is generated by the communication company server 300 (refer to S14 in FIG. 2). That is, when the user information is transmitted according to S14 of FIG. 2, the communication company server 300 generates an authentication value composed of an arbitrary variable value, and then transmits a smartphone number corresponding to the received user information based on the member DB And transmits the authentication value to the smartphone through SMS (refer to S15 in Fig. 2). At this time, according to the design method of the communication company server 300, a public or private IP address allocated to the smartphone number by the communication company may be checked in advance.

When the user inputs the SMS authentication value transmitted from the communication company server 300 (refer to S16 in FIG. 2), the authentication server 200 transmits the access information of the user mobile device (the public IP or / And a private IP address, hereinafter abbreviated as IP address) (refer to S17 in FIG. 2), and transmits the input SMS authentication value and the confirmed IP address of the corresponding mobile device to the communication company server 300 See S18 of FIG.

At this time, there are various methods of grasping the connection information of the connected client (in this example, the user mobile device 100 in this example). However, in the case of the web server, for example, the public IP and the private IP of the connected client terminal can be grasped have.

When the SMS authentication value and the IP address of the mobile device are transmitted, the communication company server 300 performs the identity verification according to S19 of FIG. This can be performed in the following manner. First, the correspondence between the user information transmitted in S12 of FIG. 2 and the member information of the communication company member DB is compared. Second, the SMS authentication value (i.e., the SMS authentication value entered by the user) And compares the generated SMS authentication value (that is, the SMS authentication value transmitted to the user according to S15 in FIG. 2, hereinafter referred to as SMS verification value) according to S14 in FIG. 2, The authentication of the user can be performed by comparing the IP address of the mobile device delivered according to the mobile terminal with the correspondence between the IP address of the mobile device that is confirmed by the communication company itself (i.e., the mobile device assigned by the communication company).

Upon completion of the identity verification process, the communication company server 300 transmits the identity verification result (i.e., success or failure) to the identity authentication service server 200 (refer to S20 in FIG. 2). Based on the transmitted result of the authentication of the user, the authentication server 200 determines whether or not the user is authenticated.

Hereinafter, the personal authentication procedure shown in FIG. 3 will be described. FIG. 3 shows a case where the user performs authentication using the mobile app 50 installed in the user mobile device 100. That is, FIG. 3 illustrates a case where a mobile application is accessed using a Push ID assigned by a mobile operating system provider (i.e., Google, Apple, etc.) when installing an IP address, an SMS authentication value, Indicate the procedure for the service to authenticate that the person is the user.

Accordingly, in the case of FIG. 3, it is possible to confirm the user's identity, confirm the user's smartphone ownership, and confirm the user's app. In the description process of FIG. 3, a description of a portion that can be applied in the same manner as in FIG. 2 will be omitted (this is also true in FIG. 4 and FIG. 5).

3, when the user inputs user information through the mobile app 50, the user information is transmitted from the mobile app 50 to the authentication service server 200 and the push of the corresponding mobile app 50 ID is transmitted to the identity authentication service server 200 (refer to S31 in Fig. 3). Thus, the identity authentication service server 200 delivers the received user information and the push ID to the communication company server 300 (refer to S32 in Fig. 3).

3, the communication server 300 generates an SMS authentication value and a push authentication value (refer to FIG. 3), and the authentication server 200 transmits the SMS authentication value to the mobile app 50 S34). Here, both the SMS authentication value and the push authentication value may be configured as arbitrary variable values. Then, the communication company server 300 transmits the generated SMS authentication value as a phone number corresponding to the corresponding user information through an SMS message, and transmits the generated push authentication value to the mobile app 50 (See S35 in Fig. 3).

3, the input SMS authentication value and the push authentication value are transmitted to the authentication service server 200 according to the user inputting the SMS authentication value and the push authentication value transmitted through the mobile app according to S35 of FIG. 3 S36). In some cases, if the service is configured as a mobile application, the SMS message and push message received in the smartphone may be automatically obtained and transmitted to the authentication service server 200.

When the SMS authentication value and the push authentication value are received, the authentication server 200 transmits the received authentication values and the access information of the user's mobile device (public and / or private IP addresses, as in the above example) (S38 in Fig. 3). To this end, the identity authentication service server 200 confirms the IP address of the user mobile device connected to the service (refer to S37 in Fig. 3). The method of grasping the connection information of the connected client has been described above, and redundant description will be omitted.

When the SMS authentication value, the push authentication value, and the IP address of the mobile device are transmitted, the communication company server 300 performs the identity authentication confirmation in accordance with S39 in FIG. This can be performed in the following manner. First, the correspondence between the user information transmitted in S32 of FIG. 3 and the member information of the communication company member DB is compared. Second, the SMS authentication value transmitted in accordance with S38 of FIG. 3 (that is, the SMS authentication value input by the user) (SMS verification value) generated according to S34 of FIG. 3, and third, it is checked whether the IP address of the mobile device transmitted in accordance with S38 of FIG. 3 is confirmed by the communication company itself 3) and the push authentication value generated according to S34 of FIG. 3 (i.e., the push authentication value of FIG. 3 The push authentication value transmitted to the user in accordance with S35).

Upon completion of the identity verification process, the communication company server 300 transmits the identity verification result (i.e., success or failure) to the identity authentication service server 200 (see S40 in FIG. 3). Based on the transmitted result of the authentication of the user, the authentication server 200 determines whether or not the user is authenticated.

According to another embodiment, the authentication procedure of FIG. 3 described above may be executed normally only in a communication environment as described below. For example, the mobile app 50 may check the communication status of the user mobile device 100 so that the above-described personal authentication procedure is executed only when the communication network is a 3G / LTE network. As a hacking method, there is a case where a hacker who is within a range capable of short-range wireless communication such as WIFI seizes user's information. In order to block such a hacking attempt, a hacking method such as 3G / LTE network, It is possible to introduce a method which allows only trial.

According to another embodiment, in addition to the authentication procedure described with reference to FIG. 3, the following procedures may be further added.

In the case of FIG. 3 described above, the case where the mobile app 50 is installed in the user mobile device 100 is mainly described. However, various cases may exist. For example, when the mobile application 50 is a mobile application for authentication, a terminal (hereinafter referred to as an authentication terminal) having the mobile application for authentication and a terminal (hereinafter referred to as an access terminal) May exist separately.

In such a case, as the additional authentication condition, the access terminal accessing the service is compared with the position of the authentication terminal used by the accessor, and only when the mutual position is within the predetermined range (i.e., (Only if it is located within a predetermined range).

At this time, the location of the access terminal may be acquired based on the confirmed access IP address value, and the location of the authentication terminal may be acquired based on the GPS information of the terminal. Of course, the location of the access terminal can also be acquired based on the GPS information of the terminal. In this way, the positional difference between each other can be calculated and the authentication process can be normally allowed only when the positional difference is not large. It is common that a user having an authentication terminal tries to access a service using an access terminal. On the other hand, when a service access attempt through an access terminal far from the authentication terminal is regarded as a connection attempt by a hacker, It is because it is.

Hereinafter, the authentication process of FIG. 4 will be described. 4, steps S51, S52, S53, S55, S56, S57, S58, S59, and S60 are steps substantially the same as those in FIG. 2 described above. Hereinafter, And only the differences are explained.

In the case of FIG. 4, the IP address of the user mobile device 100 is used in the process of generating the SMS authentication value through S54. For this, according to S53-2 of FIG. 4, the IP address of the user mobile device 100 to be used for SMS authentication value generation is confirmed. That is, FIG. 4 differs from FIG. 2 in that the IP address (all or a part of the IP address) assigned to the mobile device 100 by the communication company is used as an authentication value generation variable.

Hereinafter, the authentication process of FIG. 5 will be described. 5, the steps S71, S73, S74, S75, S76, S77, S78, S79, and S80 are substantially the same as those in FIGS. 2 and 4 described above. Hereinafter, Only the differences from the previous drawings will be described.

In the case of FIG. 5, when the authentication server 200 transmits the user information to the communication company server 300 through S72-2, the authentication server 200 transmits not only the user information but also the IP address of the user mobile device 100 Feature. To this end, the authentication service server 200 performs a process of confirming the IP address of the user mobile device 100 in the first half of the entire procedure (see S72 of FIG. 5).

The authentication method according to the above-described embodiments of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims And changes may be made without departing from the spirit and scope of the invention.

Claims (6)

An authentication service system for performing user authentication using SMS (Short Message Service), the system comprising an authentication service component and a verification component,
The authentication service component comprising:
Transmits the received user information as authentication basic information to the verification component, identifies an IP address which is connection information of the connected mobile device for user authentication, and checks the IP address of the mobile device, Transferring the authentication value to the verification component,
The verification component comprising:
Generates an SMS authentication value to be used for authentication of the user corresponding to the delivered user information, transmits the generated SMS authentication value to a registered mobile device corresponding to the user information, and transmits the SMS authentication value to the registered mobile device Determining whether the SMS authentication value transmitted from the authentication service component matches the generated SMS authentication value and whether the IP address delivered from the authentication service component matches the confirmed communication agent assignment IP address; The authentication service system carries out verification as to the adequacy of user authentication.
The method according to claim 1,
Wherein the SMS authentication value is an authentication value generated by utilizing all or a part of the IP address assigned by the communication company for the registered mobile device as a seed value.
The method according to claim 1,
When the user authentication is executed through a mobile application installed in the mobile device of the user,
Wherein the authentication service component receives a push ID of the mobile app, passes the received push ID to the validation component,
Wherein the verification component generates a push authentication value, transmits the push authentication value generated by referring to the push ID to the mobile application as a push message, and utilizes the push authentication value as an additional authentication element of the user authentication process, Authentication service system.
The method of claim 3,
Wherein the authentication service component passes the push authentication value received from the connected mobile device to the verification component,
Wherein the verification component utilizes a further match between the push authentication value delivered from the authentication service component and the generated push authentication value to verify validity of the user authentication.
The method according to claim 1,
When the mobile device connected for the user authentication and the registered mobile device receiving the SMS authentication value are different devices,
Wherein the verification component compares position information obtained corresponding to the IP address of the connected mobile device with position information obtained corresponding to the current GPS information of the registered mobile device and determines whether or not the position information is within a pre- And performs verification on the validity of the user authentication.
The method according to claim 1,
Wherein the authentication service component is implemented in a service server relating to a service to be accessed by a user or an authentication proxy server that performs an authentication procedure regarding the service server,
Wherein the verification component is implemented in a communication company server or in the authentication proxy server.

Images