KR20180037169A - User authentication method and system using one time password - Google Patents

Abstract

The present invention relates to a computer implemented method for authenticating a service user connected to an online service server. The method comprises a step of allowing an authentication server to receive the access terminal connection information of a service user connected to an online service server; a step of the OTP generator of the service user to generate a user OTP using the access terminal connection information when the access terminal connection information is received from the authentication server; and a step of allowing the authentication server to generate a verification OTP for the authentication of the service user using the access terminal connection information and to compare the generated verification OTP with the user OTP transmitted from the online service server, and to perform authentication for the service user. It is possible to use an information service such as online banking securely.

Description

[0001] USER AUTHENTICATION METHOD AND SYSTEM USING ONE TIME PASSWORD [0002]

The present invention relates to a user authentication method and system, and more particularly, to an authentication method and system for authenticating a user using an OTP (one time password) generated using connection information of an access terminal.

OTP applications based on smartphones are becoming popular in order to protect important information services such as online banking and mail services, but the level of attacks for stealing the generated OTP values on the smartphone screen is increasing.

Regardless of the security of OTP apps created by smartphones, normal users can attack OTP values created by their smartphones with screen scraping software that hackers read from the screen remotely, If you read the phone screen and use it at the terminal of the hacker, you can browse the information of the system or intercept important transactions such as money transfer.

 In addition, barcode systems of various electronic money types that are generated by applying OTP technology may cause serious problems with a normal authentication system if they are stolen by a hacker and stolen within a time limit when they are displayed on the screen.

In particular, since the conventional security technology can not prevent the screen from being read by the human eye or read by the barcode reader, there is a problem that can not be prevented if the screen generated by the OPT generator application is stolen by the hacker within the OTP input valid time .

Also, referring to conventional prior arts related to an OTP and a session, a user terminal uses an OTP value to authenticate a session to which the user terminal is connected, and is not a technique structure for authenticating different OTP values for each connected terminal.

Therefore, there is a need for improved authentication security technologies that enable users to securely use online services using mobile OTP apps whenever and wherever they are.

The present invention provides a method and system for generating an OTP using connection information of an access terminal connected to a corresponding service and making the corresponding OTP valid only in a connected access terminal in order to safely use an information service such as online banking.

According to an aspect of the present invention, there is provided a computer implemented method for authenticating a service user connected to an online service server,

Wherein the authentication server receives connection terminal connection information of the service user connected to the online service server from the online service server, wherein the connection terminal connection information includes a connection continuation sequence between the online service server and the access terminal of the service user Server-terminal connection information generated and managed by the online service server to manage data transmission / reception;

When the access terminal connection information is received from the authentication server, the OTP generator of the service user generates a user OTP using the access terminal connection information; And

The authentication server generates an authentication OTP for authentication of the service user using the access terminal connection information and compares the generated verification OTP with the user OTP transmitted from the online service server, There is provided a user authentication method including performing authentication for a service user.

In one embodiment, the access terminal connection information may be a session ID or a socket handle information generated and allocated by the online service server when the service user accesses the terminal.

In one embodiment, the access terminal connection information may be sent to the OTP generator installed in the mobile user of the service user via a push message or socket data communication.

In one embodiment, the authentication server further receives the account information of the service user from the online service server, and based on the received account information, transmits the device value of the mobile device installed with the OTP generator or the push of the OTP generator And transmits the connection terminal connection information to the OTP generator based on the confirmed device value or the push ID.

In one embodiment, when the access terminal is the mobile device in which the OTP generator is installed,

Wherein the authentication server requests transmission of connection terminal connection information of the mobile device to the online service server based on the push ID of the OTP generator identified based on the received account information, To the OTP generator.

In one embodiment, the user OTP and the verification OTP use the access terminal connection information and the private key allocated to the user at the time of initial registration of the OTP generator as an OTP seed value, Lt; / RTI >

According to another aspect of the present invention, there is provided an authentication system for authenticating a service user connected to an online service server,

Receiving the connection terminal connection information of the service user connected to the online service server from the online service server, transmitting the connection terminal connection information to the OTP generator of the service user, An authentication server for generating a verification OTP for authenticating a user and performing authentication for the service user by comparing whether the user OTP is matched with the verification OTP when the user OTP is transmitted from the online service server And the connection terminal connection information is server-to-terminal connection information generated and managed by the online service server to manage continuous data transmission / reception between the online service server and the access terminal of the service user; And

And an OTP generator for receiving the access terminal connection information from the authentication server and generating a user OTP using the access terminal connection information.

In one embodiment, the access terminal connection information may be a session ID or a socket handle information generated and allocated by the online service server when the service user accesses the terminal.

In one embodiment, the OTP generator is installed in the mobile device of the service user,

The authentication server may transmit the connection terminal connection information to the OTP generator through a push message or a socket data communication.

In one embodiment, the authentication server further receives the account information of the service user from the online service server, and based on the received account information, transmits the device value of the mobile device installed with the OTP generator or the push of the OTP generator And transmits the connection terminal connection information to the OTP generator based on the confirmed device value or the push ID.

In one embodiment, when the access terminal is the mobile device in which the OTP generator is installed,

Wherein the authentication server requests transmission of connection terminal connection information of the mobile device to the online service server based on the push ID of the OTP generator identified based on the received account information, To the OTP generator.

In one embodiment, the user OTP and the verification OTP use the access terminal connection information and the private key allocated to the user at the time of initial registration of the OTP generator as an OTP seed value, Lt; / RTI >

According to the embodiment of the present invention, in order to securely use an information service such as online banking, an OTP generation method in which an OTP is generated using connection information of an access terminal connected to the service, and the corresponding OTP is valid only in a connected access terminal And a system are provided. Thereby, even if the OTP value is leaked by the hacker, the authentication is performed only for the server connection by the access terminal.

1 is a view for explaining a user authentication method and an authentication system according to an embodiment of the present invention;
2 is a block diagram of one embodiment of an online service server associated with a user authentication method in accordance with an embodiment of the present invention.
3 is a block diagram of an embodiment of an OTP authentication server implementing a user authentication method in accordance with an embodiment of the present invention.
4 is a block diagram of an embodiment of an OTP generator implementing a user authentication method in accordance with an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, throughout the specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Also, throughout the specification, when an element is referred to as "including" an element, it is understood that the element may include other elements as well, without departing from the other elements unless specifically stated otherwise. Also, the terms "a "," module ", and the like in the description mean a unit for processing at least one function or operation, which means that it can be implemented by one or more hardware or software or a combination of hardware and software .

In the following description, the OTP generator is mainly described as a software OTP generator installed in the form of an application program on a mobile device owned by the user, but it is not necessarily limited thereto. For example, the OTP generator may be a hardware OTP generator having a communication function. Hereinafter, embodiments of the present invention will be described on the assumption of the former case for convenience and concentration of explanation.

In the following description, it is assumed that the client terminal and the OTP generator, which are access terminals connected to the online service server based on FIG. 1, are physically separated from each other. However, the OTP generator may be integrally implemented with the client terminal. In the latter case, the mobile device shown in Fig. 1 will be omitted. It is also clear that the client terminal itself may be a mobile device.

1 is a view for explaining a user authentication method and an authentication system according to an embodiment of the present invention. FIG. 2 is a block diagram of an online service server related to a user authentication method according to an embodiment of the present invention. FIG. 3 is a flowchart illustrating an OTP authentication server implementing a user authentication method according to an embodiment of the present invention. 4 is a block diagram of an embodiment of an OTP generator implementing a user authentication method in accordance with an embodiment of the present invention. Hereinafter, a user authentication method and an authentication system according to an embodiment of the present invention will be described in detail with reference to FIG. 1 together with FIG. 2 through FIG.

Referring to step S1 of FIG. 1, when a user wants to use an online service by an online service site provided by the online service server 330, the service user requests a connection to the online service server 330. [

For example, if the online service to be used is an online banking service, the user can access a specific online service server that provides the online banking service (i.e., a specific bank server that provides the online banking service). The connection to the online service server 330 may be made through a mobile connection through the mobile device 310 (e.g., smart phone, etc.) owned by the user himself or herself, 310 via a client terminal 300 (e.g., a company PC, etc.).

Referring to step S2 of FIG. 1, in response to a connection request to the online service server 330, the online service server 330 may request input of user account information to a service user who wants to use the online service. Here, the user account information means identification information of a corresponding user stored (registered) in advance in the online service server 330 through a user registration procedure (or a service registration procedure). Typically, a user ID (Identifier) and a password (password) can be utilized as the user account information. However, if it is information capable of identifying a user who uses the on-line service, various information (for example, an email address, a telephone number, a certificate password on a PKI (Public Key Infrastructure) Etc.) can be alternatively utilized.

Referring to step S3 of FIG. 1, according to a request for inputting user account information, the service user inputs user account information to the corresponding online service site. Referring to step S4 of FIG. 1, when the user account information is input from the service user, the online service server 330 checks whether there is an account matching the user account information input from the user. The account DB 340 shown in FIG. 1 may be utilized for checking the account information. In the account DB 340, account information on users (i.e., members) who can receive online services through the online service server 330 is stored. Although FIG. 1 illustrates a case where the account DB 340 is provided separately from the online service server 330, it is needless to say that the account DB 3140 may be integrated with the online service server 330.

Also, depending on the system implementation method, the account DB 340 may be integrated with the OTP authentication server 350 and implemented. In this case, the user account information checking procedure of step S4 of FIG. 1 may be executed after the user account information is transmitted to the OTP authentication server 350 according to step S5 of FIG. 1 described later. However, for the purpose of concentrating the description in this specification, the embodiment of the present invention will be described with reference to Fig.

1, if the input user account information matches the user account stored in the account DB 340, the online service server 330 transmits the OTP authentication request message to the OTP authentication server 350 through the communication interface unit 331 ) To the access terminal connection information and the user account information.

Here, the connection terminal connection information transmitted from the online service server 330 to the OTP authentication server 350 is transmitted to the online service server 330 using the access terminal (the client terminal 300 in FIG. 1) Terminal connection information generated and managed by the online service server 330 to manage continuous data transmission / reception between the two.

The connection terminal connection information may include, for example, session information (e.g., a session ID or the like) to be allocated to the access terminal of the service user by the corresponding online service server when accessing the service user, Socket information in the communication (e.g., socket handle information) may be used. Such connection terminal connection information can be assigned by the connection information setting unit 333 of the online service server 330.

Here, the session ID is a value assigned by the server to manage continuous data transmission / reception between the server and the access terminal, and the socket handle information is used to manage a socket that is a unit for transmitting / receiving data between the server and access terminals It is an arbitrary connection unique value assigned by the server itself. Such a session ID or socket handle information is dynamically allocated, and is a value that is assigned by the server itself, and is difficult to be hacked by a hacker outside the server. Therefore, when the session ID or the socket handle information is used as a seed value for OTP generation in the future, .

Also, the user account information to be transmitted from the online service server 330 to the OTP authentication server 350 may be any one or a part of the various user account information described above. For example, in step S5 of FIG. 1, the online service server 330 may transmit only the ID of the service user to the OTP authentication server 350 as the user account information. At this time, the user account information is used to identify the target (the mobile device 310 or the OTP generator 320 owned by the service user in FIG. 1) to which the connection terminal connection information is to be transmitted in the OTP authentication server 350 And is transmitted to the OTP authentication server 350 as an application. Therefore, the user account information to be transmitted according to this step can be modified in various ways within the scope of achieving the purpose.

Although it is shown in FIG. 1 that this step (that is, step S5) is executed immediately after completion of the above-described user account checking procedure (that is, step S4), it goes without saying that it may be different. For example, this step may be executed only when the user selects the OTP authentication method as the authentication means after the user account confirmation procedure is completed.

The access terminal connection information and the user account information transmitted as described above are received (received) through the communication interface unit 351 of the OTP authentication server 350. [

1, the online service server 330 displays the user OTP input window on the screen of the online service site according to step S6, Lt; RTI ID = 0.0 > OTP. ≪ / RTI >

At this time, step S5 and step S6 of FIG. 1 may be executed at the same time, and may be executed differently from the order shown in FIG. Similarly, step S6 of FIG. 1 and step S7 to be described later may also be executed simultaneously, and may be executed differently from the order shown in FIG.

In addition, according to the embodiment of the present invention, when the access terminal connection information is received, the OTP authentication server 350 accesses the access terminal connection information through the communication interface 351 according to step S7 of FIG. To the OTP generator 320 installed in the mobile device 310 of FIG.

Although it is illustrated that the connection terminal connection information is transmitted through the push server 360 in step S7 of FIG. 1, the connection terminal connection information does not necessarily have to be transmitted to the OTP generator 320 directly from the OTP authentication server 350 Of course it is possible.

When transmitting the connection terminal connection information through the push server 360, the OTP authentication server 350 delivers the connection terminal connection information to the push server 360. At this time, the push server 360 transmits the connection terminal connection information through the push terminal 360, And may transmit the connection information to the OTP generator 320. Here, the push message may be a message service provided for each application (app) in a specific mobile operating system. However, it is obvious that the transmission of connection terminal connection information does not necessarily have to be performed by a push message. It may be applied to a variety of commercially available messaging services such as SMS and MMS, a specific communication protocol (for example, ). In other exemplary cases where the transmission of the access terminal connection information is not based on a push message, the above-described push server 360 may be replaced with a general communication server.

Although FIG. 1 illustrates the case where connection terminal connection information is directly transmitted to the OTP generator 320, this is not necessarily the case. For example, it is obvious that the access terminal connection information is transmitted to the mobile device 310 via a push message and the like, and the OTP generator 320 can read and access (acquire) the access terminal connection information. The connection terminal connection information can be received by the connection terminal connection information receiver 321 of the OTP generator 320.

The OTP authentication server 350 transmits the access terminal connection information to the OTP generator 320 based on the user account information received from the online service server 330 in order to transmit the access terminal connection information to the OTP generator 320. [ The device ID of the OTP generator 310 or the application push ID of the OTP generator 320 and transmits the access terminal connection information to the OTP generator 320 based on the confirmed device value or the application push ID.

As another example, the OTP authentication server 350 may send the access terminal connection information to the OTP generator 320 as a response to the request of the OTP generator 320. For example, when the input of the user OTP is requested according to step S6 of FIG. 1, the service user recognizing the user requests the transmission of the access terminal connection information to the OTP authentication server 350 through the OTP generator 320, Accordingly, the OTP authentication server 350 can transmit connection terminal connection information to the OTP generator 320 as the response.

1, if the access terminal is the mobile device 310 itself in which the OTP generator 320 is installed, the OTP authentication server 350 may generate the OTP generator 320 based on the received user account information, And requests the online service server 330 to transmit the access terminal connection information assigned to the mobile device 310, which is an access terminal, based on the confirmed application push ID. In response to the transmission request, And may transmit the received access terminal connection information to the OTP generator 320. That is, in this case, in step S5 of FIG. 1, only the user account information is transmitted first, and the connection terminal connection information is transmitted later according to the request of the OTP authentication server 350.

According to the above-described various schemes, when connection terminal connection information is transmitted to the OTP generator 320, the OTP generator 320 generates a user OTP according to step S8 of FIG. At this time, the user OTP is generated using the transmitted access terminal connection information, which can be executed by the user OTP generation unit 325 of the OTP generator 320. Hereinafter, various embodiments of a user OTP generation method using connection terminal connection information will be described in detail.

In one embodiment, the OTP generation unit 325 may generate the user OTP by using the received access terminal connection information as a seed value, but applying a specific operation condition (e.g., number of attempts, time, etc.). More specifically, the OTP generation unit 325 can generate the user OTP with a value obtained by encrypting the value obtained by multiplying the received connection terminal connection information by the specific operation condition described above according to a specific hash function.

In another embodiment, the OTP generation unit 325 may generate a user OTP by adding another specific key value as a seed value in addition to the access terminal connection information. At this time, as the other specific key value, a pre-registered private key corresponding to the user account information of the service user may be used.

For example, the private key corresponding to the user account information may be any one or a combination of various user identification information such as the user ID, password, user's e-mail address, telephone number, certificate password, etc., . As another example, the private key corresponding to the user account information may be stored in a computer-readable medium such as a phone number, a product serial number, a USIM card number, a MAC address, etc. of a user's mobile device (e.g., smart phone) Any one or at least two combinations of identifiers may be pre-registered and used. As another example, the private key corresponding to the user account information may be a private key assigned by the user himself or herself when registering in the OTP authentication service or registered in the OTP authentication service registration.

The above-described private key used for generating the user OTP may be stored in the key storage unit 323 of the OTP generator 320 in advance. At this time, the private key stored in the key storage unit 323 of the OTP generator 320 is also stored in the key storage unit 353 of the OTP authentication server 350, so that the same can be used for the mutual OTP generation .

In addition to the embodiments described above, it is needless to say that more various values may be further utilized or alternatively utilized as a seed value for OTP generation. Although the OTP is generated using the key value stored in the OTP generator 320, it is not necessary to use the stored key value. For example, when transmitting access terminal connection information through step S7 in FIG. 1, a key value or a specific operation condition to be further utilized in OTP generation may be transmitted to the OTP generator 320 together. Alternatively, a method may be used in which the OTP authentication server 350 transmits the key value or operation condition further utilized in the OTP generation by the OTP generator 320. [

When the user OTP is generated according to the above-described steps, the OTP display unit 327 of the OTP generator 320 displays the generated user OTP through the screen of the mobile device 310. [

1, the authentication request unit 335 of the online service server 330 transmits the user OTP input by the service user through the communication interface unit 331 to the OTP authentication server (step < RTI ID = 0.0 > 350) (see step S10 in FIG. 1), thereby requesting verification of the input user OTP.

At this time, the input of the user OTP by the service user can be performed through the user OTP input window posted on the online service site screen provided by the online service server 330. Of course, it can be modified in various ways. For example, the user OTP may not be entered directly by the service user, but may be substituted for the input through a particular gesture. For example, by taking various gestures such as a simple touch selection of a user OTP displayed on a touch screen of a mobile device by a user, and a touch gesture of pushing up the screen in an upward direction, .

Accordingly, the OTP generation unit for verification 355 of the OTP authentication server 350 generates an OTP for verification corresponding to the inputted user OTP (see step S11 in FIG. 1). At this time, the generation method of the OTP for verification is essentially the same as that of the user OTP generation method described above, so that a duplicate description thereof will be omitted. Here, the OTP generation for verification according to step S11 in FIG. 1 is not necessarily executed after step S11 in FIG. 1, but may be executed at any time after step S5 in FIG. 1 depending on the system implementation method.

When the OTP for verification is generated as described above, the authentication processing unit 357 of the OTP authentication server 350 compares the delivered user OTP with the self-generated verification OTP to verify user authentication for the corresponding service user . At this time, the authentication result is notified (transmitted) to the online service server 330 through the communication interface unit 351 (refer to step S12 of FIG. 1).

Accordingly, the service processing unit 337 of the online service server 330 can refer to the notified authentication result and start the service to the corresponding service user when the authentication is normally performed (refer to step S13 of FIG. 1).

The method and apparatus according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination.

Program instructions to be recorded on a computer-readable medium may be those specially designed and constructed for the present invention or may be available to those skilled in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Includes hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims And changes may be made without departing from the spirit and scope of the invention.

Claims (12)

A computer implemented method for authenticating a service user connected to an online service server,
Wherein the authentication server receives connection terminal connection information of the service user connected to the online service server from the online service server, wherein the connection terminal connection information includes a connection continuation sequence between the online service server and the access terminal of the service user Server-terminal connection information generated and managed by the online service server to manage data transmission / reception;
When the access terminal connection information is received from the authentication server, the OTP generator of the service user generates a user OTP using the access terminal connection information; And
The authentication server generates an authentication OTP for authentication of the service user using the access terminal connection information and compares the generated verification OTP with the user OTP transmitted from the online service server, Performing authentication for the service user
And a user authentication method.
The method according to claim 1,
Wherein the access terminal connection information is session ID or socket handle information generated and allocated by the online service server when the service user accesses the terminal.
The method according to claim 1,
Wherein the access terminal connection information is transmitted to the OTP generator installed in the mobile device of the service user through a push message or socket data communication.
The method of claim 3,
Wherein the authentication server further receives account information of the service user from the online service server and checks the device value of the mobile device or the push ID of the OTP generator installed in the OTP generator based on the received account information, And transmits the access terminal connection information to the OTP generator based on the confirmed device value or the push ID.
5. The method of claim 4,
If the access terminal is the mobile device having the OTP generator,
Wherein the authentication server requests transmission of connection terminal connection information of the mobile device to the online service server based on the push ID of the OTP generator identified based on the received account information, And transmits the connection terminal connection information to the OTP generator.
The method according to claim 1,
Wherein the user OTP and the verification OTP are configured to use the access terminal connection information and the private key allocated to the user at the time of initial registration of the OTP generator as an OTP seed value, Way.
An authentication system for authenticating a service user connected to an online service server,
Receiving the connection terminal connection information of the service user connected to the online service server from the online service server, transmitting the connection terminal connection information to the OTP generator of the service user, An authentication server for generating a verification OTP for authenticating a user and performing authentication for the service user by comparing whether the user OTP is matched with the verification OTP when the user OTP is transmitted from the online service server And the connection terminal connection information is server-to-terminal connection information generated and managed by the online service server to manage continuous data transmission / reception between the online service server and the access terminal of the service user; And
Receiving the connection terminal connection information from the authentication server and generating the user OTP using the connection terminal connection information,
.
8. The method of claim 7,
Wherein the access terminal connection information is session ID or socket handle information generated and allocated by the online service server upon connection of the service user.
8. The method of claim 7,
Wherein the OTP generator is installed in the mobile device of the service user,
Wherein the authentication server transmits the connection terminal connection information to the OTP generator via a push message or socket data communication.
10. The method of claim 9,
Wherein the authentication server further receives account information of the service user from the online service server and checks the device value of the mobile device or the push ID of the OTP generator installed in the OTP generator based on the received account information, And transmits the access terminal connection information to the OTP generator based on the confirmed device value or the push ID.
11. The method of claim 10,
If the access terminal is the mobile device having the OTP generator,
Wherein the authentication server requests transmission of connection terminal connection information of the mobile device to the online service server based on the push ID of the OTP generator identified based on the received account information, And transmits the connection terminal connection information to the OTP generator.
8. The method of claim 7,
Wherein the user OTP and the verification OTP are generated by using the access terminal connection information and the private key allocated to the user at the time of initial registration of the OTP generator as an OTP seed value, .

Images