KR20180135222A - Method for authentication using multi-channel, Authentication Server and AuthenticationAPPARATUS - Google Patents

Abstract

Provided are a multichannel authentication method including the steps of: forming an authentication terminal in which a transaction processing request through a first channel is previously registered and a second communication channel; and authenticating a user using a knowledge-based authentication element, a software possession-based authentication element, and a hardware possession-based authentication element, an authentication server therefor and authentication terminal therefor. Accordingly, the present invention can increase security reliability.

Description

[0001] The present invention relates to a multi-channel authentication method, an authentication server and an authentication terminal,

The present invention relates to a multi-channel authentication method and an authentication server and an authentication terminal for the same, and more particularly, to a multi-channel authentication method using multiple authentication factors, an authentication server and an authentication terminal for the same.

With the development of information and communication technology, various financial transactions are being processed online. In order to prevent financial accidents caused by personal information leakage, various security technologies are applied to online financial transactions to protect financial traders from the risk of hacking.

The security technology is classified into a knowledge based authentication (What you know), an OTP (One Time Password), a security token, and the like that perform authentication through information known to a legitimate user such as a password and a Personal Identification Number Based authentication (What you are) that carries out authentication using unique characteristics of a user such as what you have, fingerprint, iris, etc., which performs authentication based on whether the user owns the element, Can be classified.

Recently, in order to enhance the security of online banking transactions, a knowledge - based authentication method and an OTP - based authentication method are used together.

However, if OPT does not have an OTP, it will not be possible to use the financial service. Even if a true user purchases the token, it will be impossible to use the service. .

Furthermore, as pointed out in the case of RSA in the United States in 2011, OTP generation technology is leaked, or, as pointed out in Diablo 3, there is still a problem in vulnerability to hacking when using time-synchronization loopholes.

In addition, OTP technology still has limitations in single-channel authentication. Specifically, as shown in FIG. 1, a hacker may distort a communication channel between a service providing server (an Internet banking server) and a user terminal through malicious software (malware) and take a password, OTP, It can be authenticated as a legitimate user.

In order to solve such a problem, a 2-channel application authentication system and system (patent application No. 10-20-0802062) and a 2-channel authentication agent system capable of detecting an application forgery and alteration (Patent Application No. 10-2016-008062) Has been proposed, but it has not been commercialized due to the problem of reverse engineering.

SUMMARY OF THE INVENTION The present invention provides a multi-channel authentication method, a multi-channel authentication method, and an authentication terminal.

The technical problem to be solved by the present invention is not limited to the above.

In order to solve the above-mentioned technical problems, the present invention provides a multi-channel authentication method, and an authentication server and an authentication terminal therefor.

A multi-channel authentication method according to an exemplary embodiment includes a step in which a service providing apparatus requests a user authentication to an authentication server for transaction processing of a user, a step in which an authentication server acquires user ID, session ID, transaction information, A step of generating an at least one transaction record, a step of the authentication server searching for an authentication key preset for the authentication terminal and the authentication terminal corresponding to the user ID, and the step of transmitting the authentication key to the authentication application stored in advance in the authentication terminal And a step in which the authentication application decrypts the user token previously stored in the authentication terminal using the authentication key and transmits the decrypted user token to the authentication server, and when the decrypted user token is transmitted from the authentication application, the authentication server transmits the transaction information to the authentication application And authentication application Generates transaction information, receives a password from a user, generates a password encrypted using the user token and the authentication key decrypted by the authentication application using the authentication key, and authentication information composed of device information of the authentication terminal And a step of the authentication server verifying the user based on the authentication information and pushing the verification result to the listener provided in the service providing apparatus.

At this time, the step of transmitting the authentication information may include a step of generating a channel for communication between the authentication terminal and the authentication server.

The transmitting of the authentication information to the authentication server may further include deleting the authentication key transmitted from the authentication server when the generation of the authentication information is completed.

In the multi-channel authentication method, the authentication server issues a temporary ID for registration of the authentication terminal, the authentication terminal having the authentication application requests registration to the authentication server using the temporary ID, A step of issuing a user token and an authentication key, and transmitting the user token, the authentication key, the password transmitted through the authentication terminal, Storing the user record including the device information of the authentication key, and encrypting the user token to be decrypted by the authentication key and transmitting the encrypted user token to the authentication terminal.

The authentication server according to an embodiment of the present invention includes a transaction management unit for generating a transaction record composed of at least one of a user ID requesting authentication, a session ID, transaction information, and a progress status when a user authentication request for transaction processing is received from the service providing apparatus, A push processing unit for transmitting an authentication key to an authentication application pre-stored in the authentication terminal, and a user token decrypted using the authentication key from the authentication application, An authentication processing unit for receiving and verifying authentication information composed of information provided to transmit the transaction information to the authentication application and the authentication information composed of the user token decrypted from the authentication application, the password encrypted using the authentication key, and the device information of the authentication terminal artillery Can.

At this time, when the verification is completed, the authentication processing unit may push the verification result to the listener provided in the service providing apparatus and change the progress status of the transaction record to the completion.

When the access using the provisional ID issued in advance from the authentication terminal occurs, the information management unit verifies the user by using the temporary ID, issues the user token and the authentication key, A user record management unit for generating and storing a user record composed of device information, a user token and an authentication key, encrypting the user token using the authentication key, and transmitting the encrypted user token to the authentication terminal accessed using the temporary ID.

The authentication terminal according to an embodiment includes a communication unit for transmitting and receiving data with an authentication server, a storage unit for storing an encrypted user token and an authentication application, and a process for executing an authentication application according to an authentication key push of an authentication server, Can generate the authentication information including the password input from the user, the user token decrypted using the authentication key, and the device information of the authentication terminal, and can transmit the authentication information to the authentication server.

In addition, the authentication application can create a communication channel with the authentication server and transmit the authentication information through the communication channel.

The authentication application further includes an input / output unit that displays transaction information received from the authentication terminal and receives a password from the user, and the authentication application transmits the decrypted user token through the communication channel to the authentication server, Lt; / RTI >

Also, the process can delete the authentication key when the generation of the authentication information is completed.

According to the embodiment of the present invention, the security reliability is improved by authenticating the transaction processing request by using the password as the knowledge-based authentication element, the user token as the software possession-based authentication element, and the device information as the hardware possession- do.

Also, by providing a multi-channel authentication method for processing transaction and authentication through a plurality of channels, and an authentication server and an authentication terminal for the multi-channel authentication method, the security of an online financial transaction can be further improved.

1 is a view for explaining a weak point of a security method using a conventional OTP.
FIG. 2 is a diagram schematically illustrating a multi-channel authentication system according to an embodiment.
3 is a diagram illustrating an example of a communication security method between devices constituting the multi-channel authentication system of FIG.
4 is a diagram schematically showing a multi-channel authentication system according to another embodiment.
FIG. 5 is a diagram illustrating a registration procedure for using a multi-channel authentication method according to an embodiment.
6 is a diagram schematically illustrating a multi-channel authentication method according to an embodiment.
7 is a diagram showing an example of transaction information provision.
8 is a diagram showing an example of authentication information used for user verification.
9 is a diagram illustrating an example of channel setting of the multi-channel authentication method according to an embodiment.
10 is a diagram illustrating another example of channel setting of the multi-channel authentication method according to the embodiment.
11 is a control block diagram of an authentication terminal of a multi-channel authentication system according to an embodiment.
12 is a control block diagram of an authentication server of a multi-channel authentication system according to an embodiment.

Brief Description of the Drawings The advantages and features of the present invention, and how to accomplish them, will become apparent with reference to the embodiments described hereinafter with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention. Hereinafter, the present invention will be described in detail with reference to the drawings.

Hereinafter, it will be described that the transaction processing processed by the multi-channel authentication system is a financial transaction such as a financial information inquiry, a money transfer, a transfer, etc. However, the transactions that can be processed through the multi-channel authentication system are not limited thereto.

FIG. 2 is a diagram schematically illustrating a multi-channel authentication system according to an embodiment, FIG. 3 is a diagram illustrating an example of a method for securing communication between devices constituting the multi-channel authentication system of FIG. 2, 1 is a diagram schematically illustrating a multi-channel authentication system according to an embodiment of the present invention.

2, a multi-channel authentication system according to an embodiment includes a service providing apparatus 100, an authentication server 200, a push server 300, and an authentication terminal 400, ), It verifies that it is a legitimate user request and processes the requested transaction.

At this time, a predetermined security protocol may be applied to the communication between the service providing apparatus 100, the authentication server 200, the push server 300, and the authentication terminal 400 constituting the multi-channel authentication system. For example, as shown in FIG. 3, the service providing apparatus 100 and the authentication server 200 are configured as a virtual private network (VPN) to communicate with each other by applying a special communication scheme and an encryption scheme. The authentication server 200, The authentication terminal 400 and the push server 300 are composed of SSL (Secure Socket Layer or TLS, Transport Layer Security) and can communicate with each other.

2, the authentication server 200 and the push server 300 are separately configured. However, the authentication server 200 and the push server 300 may be constituted by one device as shown in FIG. 4 .

Hereinafter, a multi-channel authentication method and system according to an embodiment will be described with reference to FIG. 5, and a user registration step required for authentication will be described first. FIG. 5 is a diagram illustrating a registration procedure for using a multi-channel authentication method according to an embodiment.

The user can use the multi-channel authentication method and system through the step of registering the authentication terminal 400 in the authentication server 200. [ The user can request the registration of the authentication terminal 400 by transmitting the user information for identifying the user such as the account number and the card number to the authentication server 200. In this case, The registration procedure may be performed.

When the authentication terminal registration request is received, the authentication server 200 determines whether the user who requested the registration using the received user information together with the authentication terminal registration request is a registered user (510).

If the user who requested registration is the top registered user (YES in step 510), the user registration step 520 (step 510) of issuing the temporary ID by matching with the previously registered user ID and generating the user ID (530). ≪ / RTI > In this case, the temporary ID may be in the form of a number or a letter, but it may be a predetermined code form such as a QR code or a BAR code in some cases, and may have a temporary ID time record and be processed for a predetermined time only .

When the temporary ID is issued, the user can request registration of the authentication terminal 400 using the issued temporary ID (540). Specifically, when an authentication application previously designated in the authentication terminal 400 requiring registration is installed (541), the user registers the temporary ID input and the password through the authentication application (542, 543).

When the temporary ID input and the password registration are completed, the authentication application can extract the device information of the authentication terminal 400. [

Here, the device information may be device information if it is information that can distinguish the authentication terminal 400 from other terminals, based on the physical characteristics of the authentication terminal 400. For example, the authentication terminal 400 includes a model number, a Wi-Fi address, a Bluetooth address, a fixed number (89) constituting a SIM card number together with IMEI and IMSI which are terminal unique serial numbers of 15 digits embedded in a WCDMA mobile phone And a MEID, which is a series of codes used by some CDMA operators to uniquely identify each mobile phone, to generate device information.

When the generation of the device information is completed, the authentication application transmits the temporary ID input from the user, the registered password, and the device information to the authentication server 200 (544). At this time, in order to confirm that the user requesting registration is a legitimate user, the authentication application stores information stored at the time of user registration, e.g., User ID and the like may be transmitted together.

When the temporary ID, the password, and the device information are transmitted through the authentication application, the authentication server 200 may generate a user record by matching with the pre-registered user ID (550).

Specifically, the authentication server 200 confirms the identity of the user requesting the registration using the information transmitted together with the temporary ID and the temporary ID (551), and generates a device token using the transmitted device information (552) .

The device token is used to identify the authentication terminal 400 to another terminal. The device token may be composed of at least one of device information, and may be generated by converting device information according to a predetermined algorithm. By converting the device information into tokens and managing them in this way, the device information can be protected more safely from external threats.

In addition, the authentication server 200 may generate an authentication key to be used for encryption and decryption of the user token and the user token (553).

The user token is used to safeguard user information from external threats and is generated to have a unique value distinguishable from other users according to a predetermined algorithm. In some cases, user information such as a user ID, an account number, and the like may be used for generating a user token. The authentication key means a key used for encrypting and decrypting a user token.

The authentication server 200 may generate a user record by matching the user ID with the device token, the password, the user talk, and the authentication key, and store the user record. At this time, the user record may include a device ID for the push server 300 or the authentication server 200 to communicate with the authentication terminal 400. Here, the device ID may be a unique character or an identification code of the authentication terminal 400, or may be a Universally Unique IDentifier (UUID), which is a standard identifier used in software construction, but is not limited thereto.

If the user records generated through the above process can be stored in a predetermined database format, the user records may be stored in a separate database device as needed.

When the user record creation is completed, the authentication server 200 encrypts the user token using the authentication key 560 and transmits the encrypted user token to the authentication terminal 400 (570). An Advanced Encryption Standard (AES) encryption scheme may be used for encryption of the user token, but the encryption scheme is not limited thereto. The encryption scheme may be a known encryption scheme that can be decrypted using an authentication key, May be applied.

Meanwhile, the authentication application can store the encrypted user token received from the authentication server 200 in the authentication terminal 400 (580). At this time, the user token is stored in the nonvolatile memory.

FIG. 6 is a diagram schematically illustrating a multi-channel authentication method according to an embodiment, FIG. 7 is a diagram showing an example of transaction information provision, and FIG. 8 is a diagram showing an example of authentication information used for user verification FIG. 9 is a diagram illustrating an example of channel setting in the multi-channel authentication method according to an embodiment, and FIG. 10 is a diagram illustrating another example of channel setting in the multi-channel authentication method according to an embodiment.

Hereinafter, the authentication procedure of the multi-channel authentication system according to one embodiment will be described in detail with reference to FIG. 2 and FIG.

The service providing apparatus 100 receives a transaction processing request from the service requesting terminal 10 (601). At this time, the transaction processing request may include a user ID requesting transaction processing, a session ID, transaction information, and the like.

When the transaction processing request is received, the service providing apparatus 100 generates a transaction record composed of at least one of a user ID, a session ID, transaction information, and a progress state (603). Here, the transaction information is related to the transaction for which processing is requested, and may be, for example, transfer related information such as a transfer account, a transfer amount, an account holder, and the like.

On the other hand, the server can respond only when there is a request from the client on the characteristics of the HTTP / HTTPS protocol. Therefore, the service request terminal 10, which is a client during the authentication procedure through the authentication terminal 400, The service providing apparatus 100 transmits a transaction processing request to the service providing apparatus 100 periodically (5 to 10 ") via the communication network 100. Therefore, when a transaction processing request is received from the service requesting terminal 10, (605) whether the requested transaction processing request is a request by the user.

Specifically, the service providing apparatus 100 compares the generated transaction record with the transaction record being processed, and if there is a transaction record in process having at least one of the generated transaction record and the user ID, session ID, and transaction information, It is determined that the transaction request is periodically transmitted to check the status (NO in 605), the generated transaction record is discarded and the authentication result can be confirmed.

On the contrary, if at least one of the generated transaction record and the transaction ID of the user ID, the session ID, and the transaction information is not in the same transaction record, it is determined that the request is a user request (Yes in 605) And may request the authentication server 200 to authenticate the user (606). At this time, the service providing apparatus 100 may transmit the transaction record together with the authentication request.

When an authentication request is received from the service providing apparatus 100, the authentication server 200 searches for a user record (607).

Specifically, the authentication server 200 searches the user record corresponding to the user ID, and transmits the authentication key of the user record to the authentication terminal 400 corresponding to the device ID stored in the user record (609). 2, when the push server 300 receives a request from the authentication server 200, the push server 300 transmits an authentication key to the authentication application installed in the authentication terminal 400 corresponding to the device ID The authentication server 200 may push the authentication key to the authentication application installed in the authentication terminal 400 when the authentication server 200 performs the function of the push server 300 as shown in FIG. .

The authentication terminal 400 having received the authentication key executes the authentication application (611). At this time, execution of the authentication application may be performed automatically, but may be executed by a user's operation in some cases.

When the authentication application is executed, the authentication application decrypts the user token using the pushed authentication key (613). At this time, the decryption technique of the authentication key corresponds to the encryption technique used in the registration step. For example, when AES is used to encrypt a user token, the authentication application may decrypt the user token using the AES decryption scheme.

When the authentication key is decrypted through the authentication application, the authentication terminal 400 transmits the decrypted user token to the authentication server 200 (615). When the received user token is valid, the authentication server 200 stores the decrypted user token in the transaction record And transmits the transaction information to the authentication terminal 400 (617). At this time, the validity of the user token may be verified by comparing the user token received from the authentication terminal 400 with the user token stored in the user record.

When the transaction information is received from the authentication server 200, the authentication application generates the authentication information (621).

Specifically, the authentication application displays the transaction information received from the authentication server 200 as shown in FIG. 7 (701), and receives the password registered from the user.

In addition, the authentication application can extract device information, which is a physical characteristic of the authentication terminal 400. [ At this time, the device information corresponds to the device information extracted in the registration step and may include at least one of Wi-Fi address, Bluetooth address, IMEI, ICCID, and MEID as described above.

When the generation of the device information is completed, the authentication terminal 400 generates (621) authentication information composed of a user token, a password and device information as shown in 8 (a), and transmits the authentication information to the authentication server 200 (623)

At this time, the authentication information can be encrypted and transmitted. Since the authentication terminal 400 and the authentication server 200 share the authentication key, the authentication terminal 400 can encrypt and transmit at least one of the user token, the password, and the device information using the authentication key. The encryption of the authentication information may be the same as the encryption technique of the user token, but an encryption technique different from the encryption technique of the user token may be optionally used.

In addition, the authentication terminal 400 may generate a channel different from the conventional communication channel with the authentication server 200 in order to protect authentication information, and may transmit the authentication information through the channel.

When the transmission of the authentication information is completed, the authentication terminal 400 can release the encryption key stored in the authentication terminal 400 from the memory.

On the other hand, the authentication server 200 receiving the authentication information performs verification of the user using the authentication information (625). Specifically, the user token and the password included in the authentication information are compared with the user token and the password included in the user record, and the device token generated using the device information included in the authentication information is compared with the device token included in the user record Thereby verifying the user. At this time, the method of generating the device token may be the same as the registration step described above.

The authentication terminal 400 may transmit the authentication result to the service providing apparatus 100 (627) and change the processing state of the transaction record to the end state when the authentication is completed through the above process.

If the verification result can be transmitted to the service providing apparatus 100 in a push form, the service providing apparatus 100 may be provided with a listener (110 of FIG. 12) to receive the push type verification result.

The service providing apparatus 100 confirms the authentication result through inquiry of the listener 110 (629), and processes the transaction requested by the user when the authentication result is valid.

6, the authentication terminal 400 encrypts the authentication information using the authentication key, but the authentication information encryption method is not limited thereto.

As another example of the encryption of the authentication information, the authentication information can be encrypted using the password inputted by the user.

Specifically, the authentication terminal 400 encrypts all or a part of the authentication information by using the password inputted by the user as an encryption key, or by using an encryption key generated by a combination of a password and an authentication key according to a preset rule, (200).

For example, the authentication terminal 400 can encrypt the user token using the password as the encryption key, or encrypt the device information using the encryption key generated using the combination of the password and the authentication key.

Furthermore, different encryption keys may be used for each field of the authentication information. For example, the user token is encrypted with a password, the device information is encrypted with an authentication key, the user token is encrypted again with an authentication key, the password is encrypted with an authentication key, and the device information is encrypted with an encryption key Lt; / RTI >

When the authentication information is encrypted using the password, the authentication server 200 generates a decryption key using the secret and the authentication key stored in the user record, and decrypts the received authentication information using the generated decryption key.

 When a password is used for the authentication information encryption, the authentication information may be composed only of the user token and the device information as shown in FIG. 8 (b).

 By using the secret information for encryption of the authentication information, the security can be further improved.

As another example of the encryption of the authentication information, the authentication terminal 400 converts the device information extracted from the authentication terminal 400 into a device token according to a predetermined algorithm in advance, as shown in Fig. 8 (c) The security for the device information can be further improved.

As described above, the multi-channel authentication method according to an embodiment authenticates a transaction processing request by using a password as a knowledge-based authentication element, a user token as a software owned authentication element, and device information as a hardware owned authentication element together , The security reliability is improved.

In addition, since the above-described multi-channel authentication method processes authentication using two communication channels, it has strong security even in a key locker or memory hacking. 9, the service requesting terminal 10 requests transaction processing through the first channel 901 formed with the service requesting terminal 10, and the authentication procedure is performed between the authentication terminal 400 and the authentication terminal 100. [ Is processed through a second channel (902) formed between the second channel (400). Therefore, even if a single channel is hacked, the multichannel authentication method according to an embodiment has higher security because it is not affected by authentication and transaction processing.

On the other hand, the multi-channel authentication method may further expand the number of channels used for authentication. For example, as shown in FIG. 10, the transmission of the user token and additional information 615 and 617 is performed through the second channel 1021 formed between the authentication server 200 and the authentication terminal 400, The authentication information used in the second channel 1021 may be transmitted through a third channel provided separately from the second channel 1021. [

Hereinafter, major components of the multi-channel authentication system will be described in detail with reference to the drawings.

11 is a control block diagram of an authentication terminal of a multi-channel authentication system according to an embodiment.

11, the authentication terminal 400 includes a communication unit 410, a terminal storage unit 420, a display unit, an input unit, and a control unit. The authentication terminal 400 may be a smart phone having high portability and easy access to the communication network, as shown in FIG. 2, but is not limited thereto. For example, the authentication terminal 400 may be an information processing device used at a fixed location such as a desktop or a portable information processing device such as a portable media player (PMP), a personal digital assistant (PDA), a tablet PC, It should be understood that the term " device "

The communication unit 410 is connected to the communication network and can exchange data with the authentication server 200. The communication unit 410 may be connected to a communication network through a GSM / 3GPP communication scheme (GSM, HSDPA, LTE Advanced), a 3GPP2 communication scheme (CDMA or the like), or a wireless communication protocol such as WiMAX, Lt; RTI ID = 0.0 > and / or < / RTI >

The communication unit 410 may receive an authentication key transmitted in a pushing manner from the authentication server 200 or the push server 300 and may communicate with the authentication server 200 under the control of the processor 440. [ Channels, receive additional information through a formed communication channel, or transmit authentication information.

The input / output unit 430 displays various information necessary for authentication to the user, and receives various inputs from the user. The input / output unit 430 may be a display panel (PDP), a liquid crystal display (LCD) panel, a light emitting diode (LED) panel, or an organic light emitting diode (OLED) panel, an active-matrix organic light-emitting diode (AMOLED) panel, and the like, and may include a keypad, a push button, or a membrane button Button input means, a touch pad, or the like, and may be implemented as a touch screen capable of both input and output.

Specifically, the input / output unit 430 displays the additional information received from the authentication server 200 and receives a preset password from the user.

The terminal storage unit 420 stores various data required for channel authentication. The terminal storage unit 420 may be a flash memory type, a hard disk type, a solid state disk type, an SDD type (Silicon Disk Drive type), a multimedia card type micro type, card type memory (e.g., SD or XD memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (PROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, and optical disk.

Specifically, the terminal storage unit 420 may store data generated according to the execution of the authentication application and the authentication application, and may store the authentication key received from the authentication server 200. [ At this time, the authentication key may be deleted when the authentication procedure is terminated or the execution of the authentication application is terminated.

The processor 440 controls each device using various information stored in the terminal storage unit 420. The processor 440 may be a CPU, a micro CPU, or the like. That is, it should be appreciated that the operations performed by the authentication application herein are substantially effected through the actuation of the processor 440.

Specifically, when the authentication key is pushed from the authentication server 200, the processor 440 executes the authentication application stored in the terminal storage unit 420. [ At this time, the authentication key may be stored in the volatile storage device, unlike the user token.

The authentication application executed by the processor 440 decrypts the user token stored in advance in the terminal storage 420 using the authentication key and transmits the decrypted user to the authentication server 200 through the communication channel established between the communication unit 410 and the authentication server 200. [ And transmits the token to the authentication server 200.

The processor controls the input / output unit 430 to receive the transaction information received from the authentication server 200, receive the password from the user, generate the authentication information including the password, the decrypted user token, and the device information .

When the authentication information is generated as described above, the authentication application can encrypt the authentication information using the authentication key or the password, and transmit the encrypted authentication key to the authentication server 200 as described above.

At this time, the encrypted authentication information may be transmitted through the same communication channel as the communication channel through which the user token is transmitted, but may be transmitted through a separate channel from the communication channel through which the user token and the additional information are transmitted. for example. When the authentication key is pushed, the authentication application forms a first communication channel for communication with the authentication server 200 to transmit and receive the authentication key and transaction information, and generates a second communication channel different from the first communication channel when authentication information is generated And transmit the authentication information through the second communication channel.

By thus forming a plurality of communication channels in the authentication procedure and communicating, the security of the multi-channel authentication system can be further improved.

In addition, the processor 440 can delete the authentication key from the terminal storage 420 when the generation and transmission of the authentication information is completed, or when the execution of the authentication application is terminated.

12 is a control block diagram of an authentication server of a multi-channel authentication system according to an embodiment.

Referring to FIG. 12, the authentication server 200 may include a transaction management unit 210, an information management unit 220, a push processing unit 230, an information providing unit 240, and an authentication processing unit 250.

The transaction management unit 210 stores the transaction record received together with the authentication request from the service providing apparatus 100, and can update the processing state of the transaction as the authentication processing step proceeds. If necessary, You can also store transaction records separately.

The information management unit 220 can generate a user record and retrieve a user record corresponding to the user who has requested authentication.

The information management unit 220 may further include a user record management unit 221 for generating a user record and the user record management unit 221 may register the authentication terminal 400 registration procedure of FIG. 5 in cooperation with the authentication terminal 400 . That is, the user record management unit 221 generates a user record by matching the device ID to push the device token, the password, the user talk, the authentication key, and the data to the user ID and sends the authentication key to the authentication terminal 400, May be used to transmit the encrypted user token.

The user record thus generated may be stored in the server storage unit 260. The user record management unit 221 may divide and manage the user record into a plurality of databases to improve security. For example, the user record management unit 221 manages the user ID, the authentication key, and the device ID, which are necessary for transmitting the authentication key to the authentication terminal 400, with the first database, and stores the user token, The password can also be managed by the second database.

The push processing unit 230 transmits the authentication key to the authentication terminal 400 previously registered by the user requesting the transaction processing. At this time, the authentication key may be transmitted in a push form. If the multi-channel authentication system has a separate push server 300, the push processing unit 230 may request the push server 300 to push the authentication key.

The information providing unit 240 transmits the transaction information stored in the transaction record to the authentication terminal 400 if the user token received from the authentication terminal 400 is valid.

The authentication processing unit 250 verifies the user based on the authentication information received from the authentication terminal 400 and transmits the verification result to the service providing apparatus 100 to the listener 110. [ At this time, the verification result can be transmitted in the push method.

Specifically, the authentication processing unit 250 can decrypt the authentication information. At this time, the key used for deciphering is the same as the key used for encryption in the authentication terminal 400. When the authentication terminal 400 encrypts the authentication information using the authentication key, as described above, Decrypts the encrypted authentication information using the password and encrypts the authentication information using an authentication key generated by a combination of a password and an authentication key. In the same manner as the authentication terminal 400, a password and an authentication key are combined It can be decoded.

Also, the authentication processing unit 250 compares the user token, the password, and the device information included in the decrypted authentication information with the corresponding values of the user record, performs the verification of the user, and pushes the verification result to the listener 110.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed methods should be considered in an illustrative rather than a restrictive sense. It is intended that the present invention cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents.

100: Service providing device
200: authentication server
300: push server
400: authentication terminal

Claims (11)

The service providing apparatus requesting the authentication server to authenticate the user for transaction processing of the user;
Generating, by the authentication server, a transaction record composed of at least one of a user ID, a session ID, transaction information, and a progress status corresponding to the transaction;
The authentication server searching for an authentication key corresponding to the user ID and an authentication key preset for the authentication terminal;
The authentication server transmitting the authentication key to an authentication application previously stored in the authentication terminal;
The authentication application decrypting the user token previously stored in the authentication terminal using the authentication key and transmitting the decrypted user token to the authentication server;
When the decrypted user token is transmitted from the authentication application, the authentication server transmits the transaction information to the authentication application;
The authentication application displaying the transaction information and receiving a password from the user;
Generating authentication information including the user token decrypted by the authentication application using the authentication key, the password encrypted using the authentication key, and the device information of the authentication terminal, and transmitting the authentication information to the authentication server; And
Verifying the user based on the authentication information, and pushing a verification result to a listener provided in the service providing apparatus;
And a multi-channel authentication method.
The method according to claim 1,
Wherein the transmitting the authentication information comprises:
And generating a channel for communication between the authentication terminal and the authentication server.
The method according to claim 1,
Wherein the step of transmitting to the authentication server comprises:
And deleting the authentication key transmitted from the authentication server when generation of the authentication information is completed.
The method according to claim 1,
The authentication server issuing a temporary ID for registration of an authentication terminal;
The authentication terminal having the authentication application requesting registration to the authentication server using the temporary ID;
Verifying the user who requested registration based on the temporary ID and the user information transmitted through the authentication terminal;
When the user verification is completed, issuing a user token and an authentication key, storing a user record including the user token, the authentication key, the password transmitted through the authentication terminal, and the device information of the authentication terminal ; And
Encrypting the user token to be decrypted by the authentication key and transmitting the encrypted user token to the authentication terminal;
And a multi-channel authentication method.
A transaction management unit for generating a transaction record composed of at least one of a user ID requesting authentication, a session ID, transaction information, and a progress status when a user authentication request for transaction processing is received from the service providing apparatus;
An information management unit for searching an authentication terminal corresponding to the user ID and an authentication key preset for the authentication terminal;
A push processing unit for transmitting the authentication key to an authentication application previously stored in the authentication terminal;
An information providing unit transmitting the transaction information to the authentication application when the decrypted user token is transmitted from the authentication application using the authentication key; And
An authentication processing unit for receiving and verifying authentication information including a user token decrypted from the authentication application, a password encrypted using the authentication key, and authentication information including device information of the authentication terminal;
.
6. The method of claim 5,
The authentication processing unit,
And when the verification is completed, pushing the verification result to a listener provided in the service providing apparatus, and changing the progress status of the transaction record to completion.
The method according to claim 6,
The information management unit,
When the access using the provisional ID issued in advance from the authentication terminal occurs, verifies the user using the provisional ID, issues the user token and the authentication key,
Generates and stores a user record composed of the device information of the authentication terminal accessed using the temporary ID, the user token, and the authentication key,
A user record management unit for encrypting the user token using the authentication key and transmitting the encrypted user token to the authentication terminal accessed using the temporary ID;
.
A communication unit for transmitting and receiving data to and from the authentication server;
A storage unit for storing an encrypted user token and an authentication application;
And a process of executing the authentication application according to an authentication key push of the authentication server,
The authentication application,
An authenticating terminal that generates authentication information including a password input from a user, a user token decrypted using the authentication key, and device information of the authentication terminal, and transmits the authentication information to the authentication server.
9. The method of claim 8,
The authentication application,
And generates an authentication channel with the authentication server, and transmits the authentication information through the communication channel.
10. The method of claim 9,
And an input / output unit for displaying transaction information received from the authentication terminal and receiving the password from a user,
Wherein the authentication application receives the transaction information from the authentication server by transmitting the decrypted user token from the authentication server via the communication channel.
9. The method of claim 8,
The authentication terminal deletes the authentication key when generation of the authentication information is completed.

Images