KR20180116666A - Method and system of mobile authentication - Google Patents

Abstract

A method for mobile authentication according to one aspect of the present invention comprises: a step of extracting a phone number of a user mobile device by the user mobile device; a step of transmitting member information including the phone number to an authentication server; a step of receiving a self-authentication number using the member information from the authentication server; a step extracting unique user identifiers (UUID) of an application (App) installed in the user mobile device; and a step of transmitting the extracted UUID of the App and the received self-authentication number to a service server.

Description

[0001] METHOD AND SYSTEM OF MOBILE AUTHENTICATION [0002]

The present invention relates to a mobile authentication method and system, and more particularly, to a mobile authentication method and system thereof, and more particularly, to a mobile authentication method and system thereof, The present invention relates to an authentication method and system for authenticating a user using a mobile terminal and conducting a financial transaction such as settlement.

Recently, as smartphones have become widespread, various financial transaction services such as payment and account transactions using smartphone apps are being provided. In addition to financial transactions, various services requiring authentication are being utilized using smartphone apps.

In the case of financial transactions, since the authentication of the user or the mobile device is important, a lot of authentication using an official certificate, ARS, SMS or the like is performed. However, a transaction password is input for each transaction or a call is made to the ARS system, And received a SMS and entered the identification number included in the SMS.

In the case of smartphone applications (apps or applications), various apps are produced and used because they can be easily produced and distributed by anyone, and users can easily use various services such as financial transactions in smart phones. There is a problem that the app is likely to be stolen or altered because it can be produced and distributed.

In addition, when hacking a smart phone and copying an app or copying and using the smart phone itself, there is a problem that personal information or financial transaction information may be leaked.

The present invention is based on the technical background as described above. The present invention utilizes the user authentication number and the UUID of the application generated based on the member information including the phone number of the mobile device, Thereby preventing duplication or illegal use of the application, and a system thereof.

Another object of the present invention is to provide a method for extracting a telephone number of a portable device using an SMS server and using the telephone number for security when the portable telephone device can not be extracted due to a policy limitation of a portable device manufacturer.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided a mobile authentication method including: extracting a telephone number of a user portable device; Transmitting member information including the telephone number to an authentication provider server to authenticate a subscriber; Receiving a personal identification number using the member information from the authentication provider server; Extracting a UUID (Unique User Identifiers) of an application (App) installed in the user portable device, transmitting the UUID of the extracted app and the received authentication ID to the service server; And receiving, from the service server, the serial number of the application generated so as to correspond to the UUID of the app and the personal authentication number received by the service server.

The mobile payment system according to another aspect of the present invention transfers member information including a telephone number to an authentication server server to receive a user authentication number, and transmits a UUID of the installed application and the user authentication number to a service server A user portable device that receives the application serial number; An authentication provider server for receiving the member information, performing member authentication using the phone number included in the member information, and transmitting the authentication number after authentication to the user portable device; And a service server for generating and storing the serial number of the app using the UUID of the app and the user authentication number received from the user portable device and transmitting the serial number of the generated app to the user portable device do.

According to the present invention, it is possible to enhance the security in the mobile financial transaction by performing the authentication of the user and the application for the financial transaction together using the member information including the phone number of the user portable device and the UUID of the application for financial transaction, It is possible to prevent illegal use by copying of an app for financial transactions, thereby preventing an economic loss due to leakage of financial information.

In addition, even when the portable telephone number can not be extracted due to the policy limitation of the portable device manufacturer, it can be extracted and used for security by using an external device such as an SMS server.

1 is a flow chart of an authentication method for mobile financial transactions according to an embodiment of the present invention;
FIG. 2 is a flowchart of a telephone number extracting method according to an embodiment of the present invention; FIG.
3 is a flowchart of an application authentication method using UUID of a financial transaction app according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating a financial transaction method using an application for a financial transaction that has been authenticated according to an exemplary embodiment of the present invention. FIG.
5 is a structural view of a mobile settlement system according to another embodiment of the present invention;
6 is a structural diagram of a service server for performing authentication according to another embodiment of the present invention;

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms " comprises, " and / or "comprising" refer to the presence or absence of one or more other components, steps, operations, and / Or additions.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. It will be appreciated that the present invention may be applied to various types of apps requiring authentication, but the present invention is not limited thereto.

1 shows a flowchart of the authentication method according to an embodiment of the present invention.

1 corresponds to a user information registration step for authentication according to the present invention.

When an application (application) for financial transactions is downloaded and operated (S110) for financial transactions such as settlement of accounts or account transactions, the user agrees to the terms for financial transactions, and the user's name and date of birth, (S112).

Thereafter, a step of extracting a telephone number of the portable device is performed (S120).

If the operating system of the mobile device provides the phone number of the mobile device such as Google's Android operating system, the operating system can simply extract the phone number from the device information of the mobile device.

However, if the operating system does not provide the device information such as the phone number of the portable device, such as the mobile device such as the iPhone using the iOS operating system, a method of extracting the phone number using the SMS can be used.

The portable device obtains the telephone number through the telephone number extracting step (S120), acquires the communication company to use through the user selection input (S130), and transmits the telephone number together with the already inputted member information such as the name and date of birth to the service server (S132).

The service server transmits the received information to the authentication server server and requests authentication (S134). It is needless to say that the transmission of the member information including the telephone number can be directly transmitted to the authentication server server without going through the service server.

When the authentication server server transmits the member information including the received phone number to the communication company server to request the subscriber confirmation (S136), the communication company server compares the member information including the telephone number with the subscriber information to perform subscriber confirmation ( S138) to the authentication server (S140).

When the authentication of the subscriber is completed, the authentication server generates and transmits the authentication number to the service server (S142). The service server transmits the authentication number to the user's portable device (S144). The authentication number may be directly transmitted from the authentication server to the user's portable device without going through the service server.

When the authentication is performed as described above, the application is subsequently authenticated. The user mobile device having received the identification number can further carry out the financial transaction service with enhanced security by receiving the application authentication confirmation for the financial transaction (S150) using the telephone number and the UUID of the application for financial transaction

Hereinafter, a method for extracting a telephone number of a user's mobile device will be described in detail in a case where a mobile device OS such as iOS restricts or does not support extraction of a telephone number. Then, in a subsequent step, Will be described in detail.

2 is a flowchart showing a method of extracting a telephone number.

The mobile device transmits an SMS message including a server authentication number (index of a kind used by the service server to identify and manage the mobile phone number) generated by the application for financial transaction to the SMS server (S1210).

When receiving the SMS message transmitted from the mobile device, the SMS server extracts and acquires the phone number automatically included in the server authentication number and the SMS message to receive the SMS message (S1220), and transmits it to the service server (S1230) Together with the server authentication number (S1240). That is, the telephone number of the portable device and the server authentication number are stored in association with each other.

Since the SMS message is transmitted to the SMS server, the phone number of the portable device is automatically confirmed in the process. Therefore, it is possible to prevent the phone number from being altered due to the input of the phone number of the portable device operator (for example, cutter) The phone number can also be obtained from a mobile device such as an iPhone that can not acquire device information.

The mobile device transmits the server authentication number again to the service server to request the telephone number (S1250). The service server compares the stored server authentication number with the server authentication number received from the mobile device, and if there is a matching server authentication number The corresponding telephone number is extracted (S1260).

By using the extracted telephone number, the service server transmits the telephone number to the user portable device (S1270), thereby preventing the telephone number of the portable device from being altered or altered. On the other hand, the portable device receiving the telephone number may be configured to display the telephone number automatically received in the portable device, and to confirm that the telephone number extraction has been successfully performed to the user (S 1280).

On the other hand, it is needless to say that step S1260 may be omitted, and the service server may acquire the portable device number at step S1240, and then the process may proceed to step S1280 to transfer the phone number to the portable device.

In the above process, the mobile device transmits the SMS text message to the service provider, and the SMS server transmits the SMS message transmitted by the mobile device to the service server or a separate server operated by the service provider. Or the like. In this case, the server authentication number may not be needed.

Unlike the case where the user inputs the telephone number of the conventional portable device through the telephone number extracting method and the user authentication number is requested to the authentication server by the user, it can be extracted automatically by the SMS server to prevent the telephone number from being up / modulated .

FIG. 3 is a flowchart illustrating a method of confirming an application authentication for financial transaction using a UUID of a financial transaction application. When the user confirms and inputs the authentication number received in the portable device (S1510), the portable device extracts the UUID (Unique User Identifiers) of the application for financial transaction through the operating system (S1520). It will be apparent to those skilled in the art that the user portable device may be configured to automatically process the UUID of the app without the user's input, since the user's authentication number has already been received and stored.

UUID is the ID that the store gives when downloading the app from the app store, such as the app store, which is assigned to the app differently each time you download the app, which is stored in the operating system of the downloaded device The UUID can not be cloned even if it is replicated, so it can prevent the app from being tampered with.

The UUID of the application for financial transaction, the personal identification number, and the mobile phone number are transmitted to the service server (S1530), and the service server transmits the personal identification number and the telephone number to the authentication server server again to request identification of the personal identification number S1540).

The authentication provider server compares the authentication number and the telephone number generated at the time of telephone number authentication with the authentication number and telephone number received from the service server at step S1540 to determine whether the user (portable device holder) is the same as the subscriber Authentication is performed (S1550). That is, it is possible to confirm whether the UUID transmitted from the portable device requesting the generation of the authentication number in step S110 to step S144 (hand authentication).

The authentication server notifies the service server of the authentication result (S1560). After confirming that the user authentication is completed, the service server registers the member information for providing the financial transaction service (S1570). The registered member information includes the phone number of the portable device, date of birth, domestic / foreigner, sex, and the UUID of the app for financial transactions.

On the other hand, the service server can additionally generate the application serial number when the authentication of the user is completed, and store and manage the application serial number together with the authentication number, the application UUID, and / or the portable device phone number. When the user authentication and the member information registration are completed, the user's mobile device is notified that the authentication and registration process has been completed, and the generated application serial number for the financial transaction is transmitted together (S1580) and stored in the user's mobile device. To be used for authentication at execution time.

In the above description, the service server and the authentication server are assumed to be separate servers. However, the service server and the authentication server are implemented as one server and can be managed by one operator. In this case, data transmission / reception between the service server and the authentication server is not required.

When the authentication of the user and the authentication of the application for the financial transaction are completed as described above, the user proceeds to the financial transaction using the application for the financial transaction after the authentication is completed. FIG. 4 is a flowchart illustrating a method of conducting a financial transaction using an application for financial transaction after authentication is completed.

When the user makes a payment request, the merchant transmits the payment amount, the phone number of the user portable device, and the user's date of birth to the service server providing the secure financial transaction (S410).

When the user's payment is made online on the portable device, the payment amount, the telephone number, and the date of birth information may be transmitted from the user's portable device to the service server.

The service server confirms whether the member is a member by comparing the telephone number and the date of birth information received from the merchant's device with the telephone number and the date of birth in the member information stored in the database upon member registration (S420). If the member is confirmed, The stored application serial number for the financial transaction is extracted (S430).

In step S440, the service server requests the user mobile device to operate the application for financial transaction by using the user phone number transmitted from the merchant device in step 440, and the user mobile device operates the application for financial transaction in step S440 ). The mobile device may have a plurality of apps for financial transactions installed. In this case, the apps to receive the app-driving request of the push method can be distinguished by using the app identifier (app ID). The app ID is created or acquired and stored and managed by the service server every time an app is installed on a mobile device.

A step of receiving a password from a user or receiving a biometric information such as a fingerprint or a signature may be added in order to prevent fraudulent use such as theft or loss of the user portable device when the application is running.

The activated application for financial transaction extracts the UUID of the application for financial transaction through the operating system, extracts the application serial number for the financial transaction received and stored at the service server at the authentication of the user (S460) And transmits the application serial number for financial transaction to the service server for financial transaction authentication (S470).

The service server compares the received UUID and the application serial number with the UUID of the financial transaction application and the application serial number for financial transaction in the member information stored in the database upon completion of member registration and authentication of the user, (S480).

By using the aforementioned phone number and date of birth as well as the application serial number for financial transactions and the UUID of the app for financial transactions in addition to the authentication for financial transactions, the security can be further strengthened, and the application serial number for financial transactions and the app for financial transactions The UUID of the UUID is not inputted directly by the user but is stored in the portable device and the service server of the user so that there is an advantage that the inconvenience of the user due to the security enhancement can be minimized.

When the authentication of the app for financial transaction is completed, a financial transaction can be performed in various ways for performing a normal payment service (S490).

On the other hand, the mobile device transmits the app UUID or the application serial number to the service server without using only one of the application serial number and the app UUID, and the service server judges whether the app is tampered with or not by using the app UUID or the application serial number The app serial number and app UUID can be used together to analyze this information along with the phone number to better understand the USIM replacement, app dump copy, and illegal app duplication, And an app UUID are preferably used together.

5 illustrates an application authentication system 50 for authentication and financial transactions according to a preferred embodiment of the present invention.

The system 50 includes a user portable device 510, an SMS server 520, a service server 530, an authentication provider server 540, and a communication company server 550.

The user portable device 510 transmits a telephone number and a server authentication number by transmitting an SMS to the SMS server through the process described above. The user portable device 510 receives a telephone number and a server authentication number from the SMS server, And displays it on the screen.

The user portable device 510 may use a method of directly extracting the telephone number from the operating system of the user portable device 510 in addition to the method using the SMS.

According to the present invention, the user authentication is performed using the telephone number received from the service server 530 or directly extracted from the user portable device 510 and the identification number transmitted from the authentication server server 540, and the portable device 510 The application for financial transaction can be authenticated from the service server 530 using the UUID of the application for financial transaction and the application serial number for financial transaction to proceed the financial transaction.

The SMS server 520 obtains the telephone number of the portable device 510 from the SMS received from the user's portable device 510 and transmits the acquired telephone number to the service server 530 to be transmitted to the portable device 510 again, And extracts a telephone number from a portable device 510 such as an iPhone whose access is restricted.

The service server 530 transfers the telephone number to the user portable device 510 using the telephone number and the server authentication number received from the SMS server 520, registers the member information of the user for the financial transaction service, And transmits the generated application serial number to the portable device 510 to perform authentication of the user and authentication of the application for financial transaction.

If there is a payment request from the merchant terminal (not shown), the application for financial transaction of the user portable device 510 is operated in a pushing manner and the application serial number for financial transaction and the UUID of the application for financial transaction are transmitted from the portable device 510 The application serial number for the financial transaction stored in the database and the UUID of the application for financial transaction are compared with each other to check whether the app for financial transaction is up /

The authentication provider server 540 generates a personal identification number for authenticating the user. The authentication server 540 requests the communication company server 550 to confirm the subscriber using the member information including the telephone number transmitted from the service server 530, 550 notifies the result of the subscription information and generates a personal identification number and transmits the personal identification number to the portable device 510, thereby proceeding with the identity authentication.

The communication company server 550 compares the user information received from the authentication server server 540 with the subscriber information stored in the database of the communication company server 550 to perform the subscriber confirmation and transmits the result to the authentication server server 540, .

On the other hand, the SMS server function and the authentication server server function may be performed in the service server.

The above system can prevent the app from being tampered with or tampered with, which makes it possible to make a more secure financial transaction.

FIG. 6 is a block diagram of a service server 530 according to an exemplary embodiment of the present invention.

The service server 530 includes an authentication information transmitting and receiving unit 532, a member information storage unit 534, and an authentication performing unit 536.

The authentication information transmitting and receiving unit 532 exchanges necessary information with the user portable device 510 and the authentication provider server 540 for user authentication.

First, the user information including the telephone number is received from the user portable device 510, the received member information is transmitted to the authentication server server 540, and the authentication server server 540 performs user confirmation using the member information Receives the result together with the personal identification number, and transmits the result to the user portable device 510 again.

The member information storage unit 534 stores member information required for authentication.

Stores the member information including the telephone number received from the user portable device 510, and stores the personal authentication number received from the authentication server server 540. [

If the user authentication is successful using the authentication number of the user, the UUID received from the user portable device 510 and the application serial number generated corresponding to the UUID are also stored in the member information storage unit 534.

Finally, the authentication performing unit 536 compares the personal authentication number received from the user portable device 510 with the personal authentication number received and stored from the authentication server server 540, thereby performing user authentication.

When receiving the application serial number and / or UUID together with the payment request from the user portable device 510, the authentication performing unit 536 compares the application serial number and / or the UUID stored in the member information storage unit 534 with the application serial number and / In the payment step.

By using both the user authentication and the application authentication in this way, it is possible to further strengthen the financial transaction security in the mobile environment.

While the present invention has been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications, Of course this is possible. For example, since a specific application installed in a specific mobile device can be uniquely identified with only the UUID, it is possible to use a configuration in which the application serial number is not used for user authentication and / or authentication at the time of settlement, It is included in the technical idea of the present invention that it is stored in the service server and used for payment. Accordingly, the scope of protection of the present invention should not be limited to the above-described embodiments, but should be determined by the description of the following claims.

50: Personal authentication and app authentication system
510: user mobile device 520: SMS server
530: service server 532: authentication information transmission /
534: Member information storage unit 536: Authentication performing unit
540: Authentication provider server 550:

Claims (9)

A mobile authentication and registration method performed in a user portable device,
Extracting a telephone number of the user portable device;
Transmitting member information including the telephone number to an authentication server;
Receiving a personal identification number, which is a result of performing the personal identification using the member information from the authentication server;
Extracting Unique User Identifiers (UUID) of an application (App) installed in the user portable device;
Transmitting the extracted UUID of the app, the extracted phone number, and the received authentication number to the service server; And
Receiving, from the service server, a personal identification number and a telephone number received by the service server to the authentication server and verifying the identification result of the identification number;
The mobile authentication and registration method. The method of claim 1, wherein extracting the telephone number comprises:
Transmitting an SMS message including a server authentication number for authentication of the portable device created by the application to an SMS (Short Message Service) server;
Transmitting the server authentication number stored in the user portable device to the service server (receiving the phone number of the user portable device and the server authentication number from the SMS server and storing the server authentication number), and requesting the phone number of the user portable device ; And
Receiving the telephone number from the service server;
The mobile authentication and registration method.
A transaction-time authentication method performed by a service server after mobile authentication and registration according to claim 1,
Receiving a transaction approval request including member information from an affiliate store device;
Comparing the received member information with stored member information and transmitting an application execution request to the user portable device corresponding to the member information;
Receiving a UUID of the app from the user portable device that has received the app execution request; And
Comparing the received UUID with the UUID of the app included in the stored member information, and proceeding with settlement if the UUID is identical;
The method further comprising:
In order to authenticate the user, the user information is received from the user portable device, and the user authentication request is made to the authentication server using the phone number included in the member information. As a result, the user authentication number is received, Lt; / RTI >
A user authentication unit for receiving an application UUID, a telephone number, and the personal authentication number from the user portable device to authenticate the application, To a service server; And
A subscriber confirmation request is made to the communication company in response to a request for authentication of the service server by the service server, and a subscriber identification number is generated according to a result of the subscriber identification, and the subscriber identification number is stored together with the telephone number, Server,
An authentication server for comparing the personal authentication number and the telephone number received from the service server with the stored personal authentication number and telephone number for application authentication and delivering an application authentication result to the service server
The mobile authentication system comprising:
5. The method of claim 4,
Receiving an SMS message including a server authentication number from the user portable device and transmitting the server authentication number to the service server together with the phone number of the user portable device;
The mobile authentication system further comprising:
5. The service providing system according to claim 4,
Receiving a payment request including a phone number of the user portable device from the merchant device, transmitting an application execution request to the user portable device corresponding to the phone number, receiving the UUID of the application from the portable device, Is compared with the UUID of the corresponding application, and if it is matched, the payment is further performed
In mobile authentication system.
A method for performing user authentication in a service server using a user's portable device and an authentication server,
Receiving member information including a telephone number from the portable device;
Transmitting a subscriber confirmation request together with the telephone number to the authentication server;
Receiving the authentication number from the authentication server and transmitting the authentication number to the portable device;
Receiving a UUID of an application installed in the portable device, a phone number of the portable device, and the authentication number of the portable device from the portable device, and transmitting the same to the authentication server together with a request for authentication of the user; And
Transmitting an authentication confirmation result received from the authentication server to the portable device;
/ RTI >
Receiving member information including a telephone number from a user portable device, transmitting the member information to an authentication server, receiving a personal authentication number as a result of authentication using the member information from the authentication server, An authentication information transmitting and receiving unit for transmitting a number of the application to the portable device and receiving from the portable device the UUID of the application installed in the portable device, the telephone number of the portable device, and the personal authentication number stored in the portable device;
A member information storage unit for storing member information including the telephone number received by the authentication information transmitting and receiving unit, the personal authentication number, and the UUID; And
An authentication performing unit for performing authentication by comparing the UUID of the received application with the UUID stored in the member information storage unit together with the payment approval request from the portable device in the payment step;
The authentication service server comprising:
The apparatus of claim 8, wherein the authentication performing unit
And performs authentication of the application by comparing the authentication number received from the user portable device with the authentication number stored and received from the authentication server.

Images