KR20180024994A - Radio link authentication system and methods using Devices and automation devices - Google Patents

Abstract

The present invention relates to a method for authenticating a wireless section which promotes cost reduction/system establishment procedure simplification/service expandability by using an asymmetric key of a PKI manner by eliminating a secure access module (SAM) which is an essential element when using a symmetric key when transmitting data between an automation device such as an ATM and a POS or a device in a wireless device such as a smart phone, simplifies an encryption process in a wireless communication section between a server (device) and the automation device to shorten a transaction time and strengthens availability so that only an authorized customer can use. The method for authenticating a wireless section comprises the following steps of: the automation device reading a device exclusive ID; the automation device generating a random value R, and dual-encrypting the R to transmit the R to the device; the device primarily decoding a value received by a personal key p′, and transmitting the primarily decoded value to a server; the server extracting a withdrawal account number (A), and extracting the R by secondarily decoding a D value which is primarily decoded; the server encrypting the A and the R with a personal key d to transmit to the device; the device transmitting the encrypted information transmitted from the server to the automation device; and the automation device permitting the automation device transaction.

Description

[0001] The present invention relates to a radio link authentication system and method using a device and an automation device,

The present invention relates to a wireless section authentication method using an asymmetric key, and more particularly, to a device and an automation method in which a service provider transmits authentication data securely with respect to a predetermined transaction to an automation device such as a POS terminal or an ATM And more particularly, to a system and method for wireless section authentication using a device.

In general, various electronic devices capable of wireless communication through the development of electronic communication technology are used for financial services. Online financial transactions through personal mobile have surpassed PC banking, and online financial transactions via mobile will continue to increase in the future.

Offline transactions through mobile are possible through ATMs and merchant transactions using wireless communication. You can issue a real card and save it on your mobile, or you can issue a mobile-only card to pay for the merchant.

In addition, ATMs are used by storing withdrawal accounts on a mobile or bank server.

Although the ratio of payment cards using the current card is high, the ratio of payments through mobile is also rising, so that the mobile payment payment ratio is expected to be higher than the real card payment ratio in the future.

Also, it is expected that the ratio of payments based on bank transfer will increase without issuing a card. However, due to the high probability that commissions will be generated lower than the card due to the absence of card-related charges, it is expected that the payment payment market based on the account transfer will be developed.

At present, ATM service is the only service based on offline account based on mobile, and there is no settlement payment based on account transfer.

When ATM service is selected in 'Service menu' such as 'mobile phone transaction' and withdrawal / transfer, the server encrypts the account number in the symmetric key method and transmits it to ATM through wireless communication, and decrypts the account number encrypted in ATM with the same key And the transaction number is extracted using the CD public network.

Here, the symmetric key method stores the same key in a separate bank server (or mobile phone) and a separate H / W (Secure Access Module (SAM) -IC chip) in the ATM to secure the confidentiality of the wireless communication section.

However, this symmetric-key ATM service requires a SAM (IC-Chip) -related procedure in contrast to the asymmetric key scheme, adds a mutual authentication procedure between the server and the ATM, .

The symmetric key method ATM service requires a separate H / W (SAM) in the automation equipment to decrypt the account number, and the symmetric key is injected into the introduced SAM (IC chip) Chip introduction -> key injection -> ATM installation). As new operators require repetition of the above procedure when requesting the same type of ATM, it is almost impossible to enter new ATMs into existing ATMs related to cost / development / application procedures.

In addition, for encrypted sessions between the server and ATM (IC-Chip), ATM and the server perform procedures to create encrypted paths separately and transfer account numbers. The asymmetric key method is simpler than the symmetric key method because it transmits the encrypted account number directly without the encrypted path generation procedure.

In addition, since the symmetric key method uses the same key (bank or affiliated organization or ATM), it is impossible to know where the key is leaked when the key is leaked. Therefore, There is a risk of Therefore, there is a limit to the expansion of services such as 2 financial institutions, since only mutual trusting institutions (one financial sector) can be serviced.

SUMMARY OF THE INVENTION The present invention has been made to solve the conventional problem of symmetric key cryptography, and it is an object of the present invention to provide a symmetric key cryptosystem which uses a PKI asymmetric key when transmitting data between automation devices such as ATM, POS, By eliminating the SAM, which is an essential element when using the symmetric key, it is possible to reduce costs, simplify the system construction procedure, improve the service scalability, and shorten the transaction time by simplifying the encryption process of the wireless communication section between the server (device) And a wireless section authentication system and method using a device and an automation device that are enhanced in availability so that only an authorized customer can use the wireless section.

According to an aspect of the present invention, there is provided a method for authenticating a wireless zone using an asymmetric key,

A wireless section authentication method of a wireless section authentication system using an asymmetric key in which an automation device and a server communicate with each other through a device of a customer,

When a service is entered, a PIN is registered in the device, and a private key p 'corresponding to the PIN and a private ID (character string mapped 1: 1 with the Internet banking ID) are generated and stored in the device. And the server generates a private key d corresponding to the private ID (service registration step);

The automated device reads the private ID (financial institution identification) of the device

If the customer selects 'mobile phone transaction' from the automation device and selects 'service menu' such as cash withdrawal and inputs a PIN according to the guidance of the automation device, the automation device transmits the PIN number (R, ID)], generating a random value R to obtain the random number R to obtain the random number R, and encrypting the random number R with a dedicated ID and PIN (P) ;

The device first decrypts the received double encrypted value with the private key p 'for the public key P stored therein and transmits a secondary encrypted value (R, ID), which is a decryption value, to the server

Comparing the device inherent value (automatic transmission at the time of communication) with the device inherent value stored in the internal database of the server

If it is determined that the device is a registered device, the server extracts the withdrawal account number (A) corresponding to the dedicated ID stored in the Internet banking ledger of the database, and extracts the withdrawal account number (A) A step of extracting R by secondary decoding the encryption value

The server encrypts A and R with the private key d and transmits it to the device

The device transmits the encrypted information transmitted from the server to the automated device

The automation device includes a step of decrypting the information S encrypted with the private key d in the device by ID, extracting A and R, and displaying the automated device transaction if the extracted R value is equal to the initially generated R value .

If the extracted R value is different from the initially generated R value, the method further includes an error message output by the automation device.

According to another aspect of the present invention, there is provided a method of authenticating a wireless zone using an asymmetric key,

When a service is entered, a PIN is registered in the device, and a private key p 'corresponding to the PIN and a private ID (character string mapped 1: 1 with the Internet banking ID) are generated and stored in the device. The server generates a private key d corresponding to the private ID, encrypts the withdrawal account number A with d into the block chain processing unit, and stores the stored address value H in the server

The automated device reads the private ID (financial institution identification) of the device

If the customer selects 'mobile phone transaction' from the automation device and selects 'service menu' such as cash withdrawal and inputs a PIN according to the guidance of the automation device, the automation device transmits the PIN number (R, ID)], generating a random value R to obtain the random number R to obtain the random number R, and encrypting the random number R with a dedicated ID and PIN (P) ;

The device first decrypts the received double encrypted value with the private key p 'for the public key P stored therein and transmits a secondary encrypted value (R, ID), which is a decryption value, to the server

Comparing the device inherent value (automatic transmission at the time of communication) with the device inherent value stored in the internal database of the server

If it is determined that the device is a registered device, the device decrypts the secondary encryption value in the device with the private key d corresponding to the dedicated ID, which is a public key,

The server encrypts the withdrawal account number (A) and the block chain store address (H) corresponding to the dedicated ID stored in the block-chain processing unit with the private key (d), and transmits the encrypted A, H and R to the device

The device transmits the encrypted information transmitted from the server to the automated device

When the automation device decrypts the information S encrypted with the private key d in the device by ID and extracts H and R, and if the extracted R value is equal to the R value initially generated, the block chain processor fetches B And extracting the decrypted withdrawal account number (A) with the dedicated ID and displaying the automated machine transaction.

If the extracted R value is different from the initially generated R value, the method further includes an error message output by the automation device.

According to another aspect of the present invention, there is provided a method of authenticating a wireless zone using an asymmetric key,

1. A wireless section authentication method for allowing an automatic device connected to a device to send data to a server to authenticate the server,

Generating and storing a first random number and transmitting the random number to the device

Generating a first cipher text in which the device encrypts the first random number with a customer private key and transmitting the first cipher text to a server

The server decrypts the first cipher text with a customer public key to extract a second random number, generates a second random number private key with the second random number as a public key, and encrypts the second random number with the second random number private key Generating a second cipher text and transmitting the second cipher text to the automation device through the device

Wherein the automated device decrypts the second cipher text with the first random number as a public key, extracts a third random number, and permits the transaction of the automated machine if the third random number matches the first random number

.

According to another aspect of the present invention, there is provided a wireless section authentication system using an asymmetric key,

A wireless section authentication system connected to a device and an automation device via a network,

Database that stores master public key and master private key

The automated device generates and stores a first random number and transmits the generated first random number to the device, and when the device generates and transmits a first cipher text encrypted with the first random number with a customer private key,

Generating a second random number private key by decrypting the first cipher text with a customer public key to extract a second random number, using the second random number as a public key, generating a second cipher text in which the second random number is encrypted with the second random number private key And transmits the generated data to the automated device through the device.

The automation device decrypts the second cipher text with the first random number as a public key, extracts a third random number, and permits the transaction of the automated machine if the third random number matches the first random number.

According to another aspect of the present invention, there is provided an automation apparatus including:

As an automated device for exchanging data with a device and a server,

A storage unit for storing master public key information

A communication unit for communicating with the server and the device

Generates a first random number, stores the first random number in the storage unit, and transmits the first random number to the device,

The device generates a first cipher text in which the first random number is encrypted with a customer private key and transmits the first cipher text to a server, the server decrypts the first cipher text with a customer public key to extract a second random number, Generates a second random number private key, generates a second cipher text in which the second random number is encrypted with the second random number private key, and transmits the second cipher text through the device, Decrypts the third random number, extracts the third random number, and permits the transaction when the third random number matches the first random number.

A device according to another aspect of the present invention for solving the above-

A device for communicating with a server and an automation device,

A master public key, a customer public key, and a customer private key encrypted with a password designated by the customer (PIN)

A wireless communication unit for communicating with the server and the automation equipment

And generating and transmitting a first cipher text in which the first random number is encrypted with the customer private key and transmitting the first cipher text to the server when the first random number is generated and transmitted by the automated device, A second random number generating unit for generating a second random number private key by using the second random number as a public key and generating a second cipher text in which the second random number is encrypted with the second random number private key, .

The automation device decrypts the second cipher text with the first random number as a public key, extracts a third random number, and permits the transaction of the automated machine if the third random number matches the first random number.

In the embodiment of the present invention, SAM, which is an essential element when using a symmetric key using a PKI-based asymmetric key, is omitted when transmitting data between automation devices such as ATM and POS in a wireless device such as a smart phone, Simplify the construction procedure / service extensibility, simplify the encryption process of the wireless communication section between the device and the automation device, shorten the transaction time, and increase the availability (available) A wireless section authentication system and method using the wireless section can be provided.

1 is a configuration diagram of a wireless section authentication system using an asymmetric key according to a first embodiment of the present invention.
2 is a configuration diagram of the automation apparatus of FIG.
3 is a configuration diagram of the device of FIG.
4 is a flowchart illustrating an operation of a wireless section authentication method using an asymmetric key according to the first embodiment of the present invention.
5 is a flowchart illustrating an operation of a wireless section authentication method using an asymmetric key according to a second embodiment of the present invention.
6A and 6B are flowcharts illustrating an operation of a wireless section authentication method using an asymmetric key according to a third embodiment of the present invention.
7 is a configuration diagram of a wireless section authentication system using an asymmetric key according to a fourth embodiment of the present invention.
FIG. 8 is a flowchart illustrating an operation of an operation system of a wireless zone authentication method using an asymmetric key according to a fourth embodiment of the present invention.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, .

On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a configuration diagram of a wireless section authentication system using an asymmetric key according to a first embodiment of the present invention, and FIG. 2 is a configuration diagram of the automation apparatus of FIG.

Referring to FIG. 1, a customer's device 300 is connected to the automation device 300 via a Wi-Fi wireless link such as RF, and stores a unique value (device serial number, USIM serial number, telephone number, etc.) have. Also, the private key P 'corresponding to the private ID and the public key PIN is stored in the internal memory.

The server 110 stores the intrinsic value (device serial number, USIM serial number, telephone number, etc.), the dedicated ID and the withdrawal account number for each device in the Internet banking ledger of the database 120.

In addition, the server 110 stores a private key d corresponding to a dedicated ID that is a public key.

The private ID is generated as a PIN as an ID for authentication and consists of a (special) character string and a numeric column mapped to the Internet banking ID 1: 1. Even if it is leaked, the actual Internet banking ID is unknown and acts as a public key.

The PIN (Personnel Identification Number) is a 4 to 6 digit sequence number that the customer registers in advance, and acts as a kind of password as a public key.

d can be generated only from the server 110 with the private key generated by the ID.

P 'is the private key generated by the PIN.

R is used for mutual authentication between the automation device 200 and the server 110 as a disposable random number value generated by an automatic device (ATM).

ENC stands for Encryption.

DEC means Decryption.

A (Account) is the withdrawal account number.

The block chain (BC, Blockchain) is a distributed transaction server on the Internet and is provided in the form of a service in the MS. However, the present invention is not limited thereto and can be implemented in the server 110 or another server of the present invention.

2, the automatic device 200 includes a display unit 210, an input unit 220, a control unit 230, a communication unit 240, and a storage unit 250.

The input unit 220 receives a user's selection as input means such as a keypad or a touch device and transfers the input to the control unit 230.

The communication unit 240 performs a communication function with the device 300 or the block chain processing unit using a wired communication network or a wireless communication network.

The display unit 210 displays information.

The control unit 230 performs a process related to authentication according to the selection of the input unit 220 and may display the information received from the server 110 on the display unit 210. [

The storage unit 250 stores a control program related to authentication, and the control program is executed by the control unit 230. [

The automation apparatus 200 may be an ATM or a POS terminal, and further includes other functional units as needed.

3, the device 300 includes a display unit 310, an input unit 320, a control unit 330, a wireless communication unit 340, and a storage unit 350.

The input unit 320 receives a user's selection as input means such as a keypad or a touch device and transfers the input to the control unit 330.

The wireless communication unit 340 performs a communication function with the automation device 200 or the server using a wireless communication network, a short distance communication, or the like.

The display unit 310 displays information.

The control unit 330 performs a process related to authentication according to the selection of the input unit 320 and may perform a function of displaying information received from the server 110 or the automation device 200 on the display unit 210 .

The storage unit 350 stores a control program related to authentication, and the control program is executed in the control unit 330. [

A wireless section authentication method using an asymmetric key according to an embodiment of the present invention having such a configuration will be described.

4 is a flowchart illustrating an operation of a wireless section authentication method using an asymmetric key according to the first embodiment of the present invention.

First, the user registers the used device. A PIN (Personnel Identification Number) is registered in the customer's device 300 when a customer subscribes to a service (for example, a 'mobile cash card service') in which the automation device 200 can be used as a mobile banking subscription or a wireless communication, 200) is selected.

The device 300 transmits to the server 110 a private ID generated by the PIN (mapping 1: 1 with the Internet banking ID with an ID newly generated through the PIN (P) instead of the Internet banking ID) and a withdrawal account number The private key P 'corresponding to the private ID and the public key PIN is stored in the internal memory. Hereinafter, the ID is a dedicated ID unless otherwise noted.

The server 110 registers the device-specific values (device serial number, USIM serial number, telephone number, etc.), ID, and withdrawal account number received from the device 300 in the Internet banking ledger.

With this service subscription, the customer will use a bank account or other financial service that requires authentication according to his / her needs. Here, the authentication method will be described as follows.

Referring to FIG. 4, a customer connects a communication with an automation device 300 through a wireless communication to a device 300, and the automation device 200 reads a dedicated ID of the device 300 (S300).

When the customer inputs the PIN according to the guidance of the automatic apparatus 200, the automatic apparatus 200 generates a random value R to obtain the party PIN authentication and the withdrawal account number registered in the server 110, Encrypted with a key-only ID and PIN (P), and transmitted to the device 300 (S310). At this time, the transmission value is [C = ENC (ENC (R, ID), P)].

Then, the customer's device 300 first decrypts the received C value with the private key p 'for the public key P stored therein, and transmits the secondary encrypted value D to the server 110 (S320). The transmission value D at this time is as follows.

D = ENC (R, ID)

Then, the server 110 compares the device inherent value automatically transmitted from the device with the device inherent value stored in the internal database 120.

The server 110 extracts the withdrawal account number A corresponding to the dedicated ID stored in the Internet banking ledger of the database 120 and transmits the withdrawal account number A corresponding to the dedicated ID as the public key And extracts R by secondary decoding the D value transmitted from the device 300 with the private key d.

Then, the server 110 encrypts A and R with the private key d and transmits it to the device 300 (S330).

At this time, the transmission value S is as follows. S = ENC (AllR, d)

On the other hand, if it is not the registered device 300, the server 110 encrypts the error message value F with the private key d and transmits the encrypted error message F to the device 300. The transmission value S at this time is as follows. S = ENC (F, d)

Next, the device 300 transmits S transmitted from the server 110 to the automation device 200 (S340).

Then, the automation apparatus 200 verifies S transmitted from the device 300 with ID, extracts A and R or F, and if the extracted R value is equal to the R value initially generated, do. That is, authentication is performed. In this case, A is transmitted to CD public network.

On the other hand, if the extracted R value is different from the initially generated R value, the automatic machine 200 outputs an error message.

P 'and ID are stored in the device 300, but even if the ID is exchanged, the actual Internet banking ID can not be used, and since P' is used only for the primary decoding, it is meaningless even if it flows out.

Since it is possible to deal with only PINs and authenticated devices (USIM, device serial number, SMS_ARS authentication, etc.) (Whether or not to check for forgery is basic security application of mobile banking program, Security is enhanced because it is impossible to deal with replica phones alone.

As described above, according to the first embodiment of the present invention, since the authentication is performed using the automation device 200, a separate H / W is unnecessary, the process is simplified, and the availability can be enhanced by PIN / device authentication.

The first embodiment of the present invention can be modified in various ways, and modified examples using block chains will be described.

5 is a flowchart illustrating an operation of a wireless section authentication method using an asymmetric key according to a second embodiment of the present invention.

)가 저장되어 있다. 그리고, 디바이스(300)에는 마스터 공개키(N), 고객 공개키(ID), 고객 개인키(d)가 저장되어 있다.First, the server 110 transmits a master public key N and a master private key < RTI ID = 0.0 >

) Are stored. The device 300 stores a master public key N, a customer public key ID, and a customer private key d.

The master device public key (N) is stored in the automation device (200).

5, a transaction is started when a customer selects a mobile phone transaction menu of the automatic device 200 and contacts the automatic device 200 with the device 300 (S401). At this time, the automation device 200 may recognize the nfc chip or the like embedded in the device 300, or perform short-range communication with each other.

Then, the controller 230 of the automatic device 200 generates and stores the first random number R1 in the internal storage unit 250 and transmits the first random number R1 to the device 300 (S402).

Next, the control unit 330 of the device 300 generates the first cipher text D1 by encrypting the first random number R1 with the customer private key d.

D1 = ENC (N, d, R1)

Then, the control unit 330 of the device 300 transmits the ID and the first cipher text (ID, D1) to the server 110 (S403).

Then, the server 110 decrypts the first cipher text D1 received from the device 300 with the customer public key ID, and extracts the second random number R2.

R2 = DEC (N, ID, D1)

Then, the server 110 generates a second random number private key r by using the second random number R2 as a public key.

)r = GEN (R2,

)

Next, the server 110 generates the second cipher text D2 by encrypting the second random number R2 with the second random number private key r.

D2 = ENC (N, r, R2)

Then, the server 110 transmits the generated second cipher text D2 to the device 300 (S404).

Then, the device 300 transmits the second cipher text D2 received from the server 110 to the automation device (S405).

Next, the automation apparatus 200 decrypts the second cipher text D2 using the first random number R1 as a public key, and extracts the third random number R3.

R3 = DEC (N, R1, D2)

If the extracted third random number R3 matches the first random number R1, the automatic machine 200 permits automatic machine transaction (S406).

In the above process, ENC (N, d, M) is an example of a public key cryptosystem, and can be an RSA cryptographic operation such as M ^ d mod N.

Also, DEC (N, e, C) is an example of public key decryption and can be RSA cryptographic operation such as C ^ mod N.

Here, (d, e) is a mutual private key and public key relationship.

The relationship between ENC and DEC is as follows: M = DEC (N, e, C) if C = ENC (N, d, M)

)는 공개키암호에서 공개키에 대응되는 개인키를 생성하는 일례로써 1/e mod

과 같은 수학적 연산이 될 수 있다.Also, GEN (e,

) Is an example of generating a private key corresponding to a public key in a public key cryptosystem. The 1 / e mod

And so on.

In addition to the second embodiment, the device may have a customer private key d encrypted and stored with a password (PIN) designated by the customer. In this case, in the expansion flowchart, a method of receiving and processing the PIN from the automation device may be added

Such a modification will be described.

6A and 6B are flowcharts illustrating an operation of a wireless section authentication method using an asymmetric key according to a third embodiment of the present invention.

)가 저장되어 있다. 그리고, 디바이스(300)에는 마스터 공개키(N), 고객 공개키(ID), 고객 개인키(d)가 저장되어 있다. 또한, 디바이스(300)에는 고객이 지정한 비밀번호(PIN)으로 암호화된 고객 개인키(dE)가 저장된어 있다. 이때, dE=ENC_S(PIN, d)6A and 6B, the server 110 receives a master public key N and a master private key N

) Are stored. The device 300 stores a master public key N, a customer public key ID, and a customer private key d. Also, the device 300 stores a customer private key dE encrypted with a password (PIN) designated by the customer. At this time, dE = ENC_S (PIN, d)

The master device public key (N) is stored in the automation device (200).

6A and 6B, a transaction is started when a customer selects a mobile phone transaction menu of the automatic device 200 and contacts the automatic device 200 with the device 300 (S411). At this time, the automation device 200 may recognize the nfc chip or the like embedded in the device 300, or perform short-range communication with each other.

Then, the control unit 230 of the automation device 200 receives the customer PIN.

The controller 230 of the automation device 200 generates and stores the first random number R1 in the internal storage unit 250 and transmits the first random number and the customer's password R1 and PIN to the device 300 (S412).

Next, the control unit 330 of the device 300 decrypts the encrypted customer private key dE into the customer PIN to extract the customer private key d.

d = DEC_S (PIN, dE)

The controller 330 of the device 300 encrypts the first random number R1 with the customer private key d to generate the first cipher text D1.

D1 = ENC (N, d, R1)

Then, the control unit 330 of the device 300 transmits the ID and the first cipher text (ID, D1) to the server 110 (S413).

Then, the server 110 decrypts the first cipher text D1 received from the device 300 with the customer public key ID, and extracts the second random number R2.

R2 = DEC (N, ID, D1)

Then, the server 110 generates a second random number private key r by using the second random number R2 as a public key.

)r = GEN (R2,

)

Next, the server 110 generates the second cipher text D2 by encrypting the second random number R2 with the second random number private key r.

D2 = ENC (N, r, R2)

Then, the server 110 transmits the generated second cipher text D2 to the device 300 (S414).

Then, the device 300 transmits the second cipher text D2 received from the server 110 to the automated device (S415).

Next, the automation apparatus 200 decrypts the second cipher text D2 using the first random number R1 as a public key, and extracts the third random number R3.

R3 = DEC (N, R1, D2)

If the extracted third random number R3 matches the first random number R1, the automatic machine 200 permits automatic machine transaction (S416).

In the above procedure, ENC_S (K, d) can use various symmetric key ciphers such as AES, SEED, and 3DES as an example of the symmetric key cryptosystem.

And DEC_S (K, dE) is an example of symmetric key decryption and can use the same symmetric key cipher used in ENC_S.

The relationship between ENC_S and DEC_S is d = DEC_S (K, dE) if dE = ENC_S (K, d).

Another embodiment will be described as follows.

7 is a configuration diagram of a wireless section authentication system using an asymmetric key according to a fourth embodiment of the present invention.

In the fourth embodiment, only ID and p 'are stored in the device 300.

Referring to FIG. 7, a wireless section authentication system using an asymmetric key according to a fourth exemplary embodiment of the present invention includes a server 110, a block-chain processing unit, and an automation apparatus 200.

This configuration is similar to that of the first embodiment, and a block chain processing unit 500 is added. In the server 110, encrypted account number information is registered in the block chain and confirmed by the automatic device 200.

The operation of the wireless section authentication system using the asymmetric key according to the fourth embodiment will now be described.

FIG. 8 is a flowchart illustrating an operation of an operation system of a wireless zone authentication method using an asymmetric key according to a fourth embodiment of the present invention.

Since the used device registration procedure is the same as that of the first embodiment, a detailed description will be omitted.

Referring to FIG. 8, a customer connects a communication with an automation device 300 through a wireless communication to a device 300, and the automation device 200 reads a dedicated ID of the device 300 (S500).

When the customer inputs the PIN according to the guidance of the automatic apparatus 200, the automatic apparatus 200 generates a random value R to obtain the party PIN authentication and the withdrawal account number registered in the server 110, Encrypted with a key-only ID and a PIN (P), and transmitted to the device 300 (S510). At this time, the transmission value is C = ENC (ENC (R, ID), P).

Then, the customer's device 300 first decrypts the received C value with the private key p 'for the public key P stored therein, and transmits the secondary encrypted value D to the server 110 (S520). The transmission value D at this time is as follows.

D = ENC (R, ID)

Then, the server 110 compares the delivered device unique value with the device unique value stored in the internal database 120.

The server 110 extracts the withdrawal account number A corresponding to the dedicated ID stored in the Internet banking ledger of the database 120 and transmits the withdrawal account number A corresponding to the dedicated ID as the public key And extracts R by secondary decoding the D value transmitted from the device 300 with the private key d.

Then, the server 110 encrypts the withdrawal account number A and the block chain storage address H corresponding to the dedicated ID stored in the block chain with the private key d and encrypts H and R to the device 300 S530).

At this time, the transmission value S is as follows. S = ENC (H11R, d)

Next, the device 300 transmits S transmitted from the server 110 to the automation device 200 (S540).

Then, the automation apparatus 200 verifies S transmitted from the device 300 with ID, extracts H and R, extracts H and R when the extracted R value is equal to the initially generated R value, B to obtain the withdrawal account number A and decrypt the withdrawal account number A to allow the automated apparatus 200 to be traded (S550).

On the other hand, if the extracted R value is different from the initially generated R value, the automatic machine 200 outputs an error message.

In the embodiment of the present invention, only the authorized customer can deal with the automation device 200 and the availability is enhanced. Further, since the key is not stored in the automation device 200, the security is enhanced more than the existing symmetric key method, It is possible to simplify the process of transferring data between the device 300 and the automation device 200. In addition,

In addition, the embodiment of the present invention can be applied to a bank transfer system based on a bank transfer service, which enables an account-based financial transaction in a simple and secure manner without issuing a check / credit card in various wireless environments.

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (10)

A wireless section authentication method of a wireless section authentication system using an asymmetric key in which an automation device and a server communicate with each other through a device of a customer,
The automated device reads the dedicated ID of the device
If the customer inputs a PIN according to the guide of the automation device, the automatic device generates a random value R to obtain the authorized PIN authentication and the withdrawal account number registered in the server, P) and transmitting the encrypted data to the device
The first decryption and the first decryption of the value received by the private key p 'for the public key P stored in the device, to the server
The server extracts the withdrawal account number A corresponding to the dedicated ID stored in the Internet banking ledger of the database and secondary decrypts the D value transmitted from the device using the private key d corresponding to the private ID as the public key Step of extracting R
The server encrypts A and R with the private key d and transmits it to the device
The device transmits the encrypted information transmitted from the server to the automated device
The automated device includes a step of verifying the encrypted information (S) transmitted from the device with an ID, extracting A, R or F , and allowing the automated device transaction if the extracted R value is equal to the R value initially generated Authentication Method Using Asymmetric Key. The method according to claim 1,
And if the extracted R value is different from the initially generated R value, the automatic device outputs an error message using the asymmetric key.
A wireless section authentication method of a wireless section authentication system using an asymmetric key in which an automation device and a server communicate with each other through a device of a customer,
When a service is entered, a PIN is registered in the device, and a private key p 'corresponding to the PIN and a private ID (character string mapped 1: 1 with the Internet banking ID) are generated and stored in the device. The server generates a private key d corresponding to the private ID, encrypts the withdrawal account number A with d into the block chain processing unit, and stores the stored address value H in the server
The automated device reads the dedicated ID of the device
If the customer inputs a PIN according to the guide of the automation device, the automatic device generates a random value R to obtain the authorized PIN authentication and the withdrawal account number registered in the server, P) and transmitting the encrypted data to the device
The device decrypts the value received by the private key p 'of the public key P stored in the device and verifies whether the PIN input from the automation device is valid or not
If it is not a party PIN, the device outputs a PIN error
In the case of normal decryption, the device transmits the secondary encryption value to the server
Comparing the device inherent value delivered by the server with a device inherent value stored in an internal database
If it is determined that the device is a registered device, the server extracts the withdrawal account number (A) corresponding to the dedicated ID stored in the Internet banking ledger of the database, and transmits it to the device as a private key d corresponding to the dedicated ID And extracting R by performing secondary decoding on the D values
The server encrypts the withdrawal account number (A) and the block chain store address (H) corresponding to the dedicated ID stored in the block-chain processing unit with the private key (d), and transmits the encrypted A, H and R to the device
If it is not the registered device, the server encrypts the error message value (F) with the private key d and transmits it to the device
The device transmits the encrypted information transmitted from the server to the automated device
The automatic machine extracts H, R or F by verifying S transmitted from the device with ID, extracts H, R from the extracted R value, and extracts B from the block chain processing unit And extracting a withdrawal account number (A) after decrypting with a private ID and allowing an automated transaction. The method of claim 3,
And if the extracted R value is different from the initially generated R value, the automatic device outputs an error message using the asymmetric key. 1. A wireless section authentication method for allowing an automatic device connected to a device to send data to a server to authenticate the server,
Generating and storing a first random number and transmitting the random number to the device
Generating a first cipher text in which the device encrypts the first random number with a customer private key and transmitting the first cipher text to a server
The server decrypts the first cipher text with a customer public key to extract a second random number, generates a second random number private key with the second random number as a public key, and encrypts the second random number with the second random number private key Generating a second cipher text and transmitting the second cipher text to the automation device through the device
Wherein the automated device decrypts the second cipher text with the first random number as a public key, extracts a third random number, and permits the transaction of the automated machine if the third random number matches the first random number
Wherein the wireless zone authentication method comprises: A wireless section authentication system connected to a device and an automation device via a network,
Database that stores master public key and master private key
The automated device generates and stores a first random number and transmits the generated first random number to the device, and when the device generates and transmits a first cipher text encrypted with the first random number with a customer private key,
Generating a second random number private key by decrypting the first cipher text with a customer public key to extract a second random number, using the second random number as a public key, generating a second cipher text in which the second random number is encrypted with the second random number private key And transmits the generated authentication information to the automated device through the device. The method according to claim 6,
Wherein the automated device decrypts the second cipher text with the first random number as a public key and extracts a third random number and permits the automated device to trade when the third random number matches the first random number, Authentication system. As an automated device for exchanging data with a device and a server,
A storage unit for storing master public key information
A communication unit for communicating with the server and the device
Generates a first random number, stores the first random number in the storage unit, and transmits the first random number to the device,
The device generates a first cipher text in which the first random number is encrypted with a customer private key and transmits the first cipher text to a server, the server decrypts the first cipher text with a customer public key to extract a second random number, Generates a second random number private key, generates a second cipher text in which the second random number is encrypted with the second random number private key, and transmits the second cipher text through the device, Decrypts the third random number, extracts the third random number, and permits the transaction when the third random number matches the first random number. A device for communicating with a server and an automation device,
A master public key, a customer public key, and a customer private key encrypted with a password designated by the customer (PIN)
A wireless communication unit for communicating with the server and the automation equipment
And generating and transmitting a first cipher text in which the first random number is encrypted with the customer private key and transmitting the first cipher text to the server when the first random number is generated and transmitted by the automated device, A second random number generating unit for generating a second random number private key by using the second random number as a public key and generating a second cipher text in which the second random number is encrypted with the second random number private key, / RTI > 10. The method of claim 9,
Wherein the automated device decrypts the second cipher text with the first random number as a public key, extracts a third random number, and permits a transaction of the automated machine if the third random number matches the first random number.

Images