KR20190117967A - User authentication method using one time identifier and authentication system performing the same - Google Patents

Abstract

Disclosed are a system and a method for enabling a user to confirm that the user has authority for using a predetermined service (for example, login, finding an ID/password, and online payment) without a password and an ID by using a one-time identifier which the user receives by an inbound call. According to an aspect of the present invention, a user authentication method using the one-time identifier includes: a step of issuing the one-time identifier (OTID) which can be used in a predetermined service system and correspond to a phone number of a mobile phone obtained during a receiving process of the inbound call by an authentication system in case that the inbound call is started between the authentication system and the mobile phone by the mobile phone of the user; a step of providing the OTID issued to the mobile phone of the user by the authentication system; and a step of authorizing effectiveness of the OTID by the authentication system in case that the service system requests the authentication of the OTID to the authentication system after the authentication system provides the OTID by using the inbound call.

Description

User authentication method using one time identifier and authentication system performing the same}

The present invention relates to a system and a method for authenticating a user, and more particularly, a user can use a one-time identifier guided through an inbound call, without using an ID and a password, to provide a predetermined service (eg, login, ID / password search, It relates to a system and a method for verifying (ie, authenticating) a legitimate user authorized to use an online payment.

Recently, with the development of wired and wireless communication networks and the spread of computers and the Internet in each home, various online services such as online commerce and internet banking have been provided. These services, by their very nature, are very important for identity verification to ensure that the user is a legitimate user.

Conventionally, an ID / PW-based method of authenticating a legitimate user is mainly used depending on whether or not a pre-registered ID and password (P / W) are correctly input. However, this method uses a user's personal information obtained through an illegal path. To register or use it to illegally obtain an ID or password, or use IDs through packet sniffing, key stroke interception, or phishing And passwords could be hacked. In addition, in the case of missing or forgotten ID / PW registered in advance, it is inconvenient that a very complicated procedure is required in order to find ID / PW that is impossible to login or forgot.

The technical problem to be achieved by the present invention is that the user is authorized to use a certain service (for example, login, ID / password search, online payment, etc.) without an ID or password using a one-time identifier guided through an inbound call. It is to provide a system and a method for verifying that the user is a legitimate user (ie, identity authentication).

According to an aspect of the present invention, when an inbound call is initiated between the cellular phone and the authentication system by the user's cellular phone, the authentication system acquires the cellular phone obtained during the establishment of the inbound call call. Issuing a One Time Identifier (OTID) corresponding to the telephone number of the telephone system and available in a predetermined service system; providing, by the authentication system, the issued one-time identifier to the user's mobile phone; If the service system requests the authentication system to verify the one-time identifier after the system provides the one-time identifier over the inbound call call, the authentication system including validating the one-time identifier. A user authentication method using a one-time identifier is provided.

In one embodiment, the authentication system comprises a plurality of Auto Response Systems (ARS) assigned different telephone numbers, wherein each of the plurality of auto answering systems corresponds to a different service system. Issuing a one-time identifier corresponding to a telephone number of the cellular phone and available in a predetermined service system may be used by the authentication system in a service system corresponding to an answering system connected to the cellular phone and the inbound call call. Issuing a possible one-time identifier.

In one embodiment, the step of issuing a one-time identifier corresponding to the telephone number of the cellular phone and available in a predetermined service system, if any one of a plurality of service systems is selected by the cellular phone through the inbound call call And, by the authentication system, issuing a one-time identifier usable in the service system selected by the cellular phone.

In an embodiment, the providing of the issued one-time identifier to the user's mobile phone by the authentication system may include: providing, by the authentication system, the issued one-time identifier in voice form through the inbound call. It may include.

In an embodiment, the providing of the issued one-time identifier information to the mobile phone of the user may include: generating, by the authentication system, the issued one-time identifier information in the form of a text message. It may include providing a.

In one embodiment, the authentication system may further include the step of discarding the one-time identifier after completing the validation of the one-time identifier.

In one embodiment, the authentication system, the step of configuring a DB for storing the login information and the mobile number of each of a plurality of users subscribed to the service system, where the login information is necessary for the user to log in to the service system Information, and if the one-time identifier is valid, the authentication system reads the login information of the mobile phone user corresponding to the one-time identifier to allow the service system to log in to the mobile phone user corresponding to the one-time identifier. The method may further include providing the service system.

In one embodiment, if the one-time identifier is valid, the authentication system is configured to allow the service system to log in of the mobile phone user corresponding to the one-time identifier to the service system of the mobile phone corresponding to the one-time identifier. The method may further include providing a telephone number.

According to another aspect of the present invention, there is provided a computer program installed in a data processing apparatus and stored in a recording medium for performing the above-described method.

According to another aspect of the present invention, an authentication system includes a processor and a memory storing a program, wherein the program, when executed by the processor, causes the authentication system to perform the above-described method. This is provided.

According to another aspect of the present invention, when an inbound call call is initiated between the mobile phone and the authentication system by the user's mobile phone, the service corresponds to the telephone number of the mobile phone obtained during the establishment of the inbound call call. An issuing module for issuing a one-time identifier available in the system, a response module for providing the issued one-time identifier to the mobile phone of the user, and the service system after providing the one-time identifier through the inbound call call; When requesting verification of the one-time identifier to the authentication system, an authentication system including a verification module for validating the one-time identifier is provided.

In one embodiment, the authentication system further comprises a plurality of answering machines assigned different telephone numbers, wherein each of the plurality of answering machines corresponds to a different service system; The one-time identifier available in the service system corresponding to the answering machine connected to the cellular phone and the inbound call may be issued.

In one embodiment, the issuing module may issue a one-time identifier available in the service system selected by the mobile phone when any one of a plurality of service systems is selected by the mobile phone through the inbound call call. have.

In one embodiment, the response module may provide the issued one-time identifier information in a voice form through the inbound call.

In one embodiment, the response module may provide the issued one-time identifier information to the mobile phone of the user in the form of a text message.

In one embodiment, the method may further include a discard module for discarding the one-time identifier after completing validation of the one-time identifier.

In one embodiment, a DB for storing the login information and mobile phone number of each of a plurality of users subscribed to the service system, where the login information is information necessary for the user to log in to the service system and the one-time identifier is valid. In this case, the service system may further include a providing module for providing login information of the mobile phone user corresponding to the one-time identifier to the service system in order to allow the mobile phone user to log in corresponding to the one-time identifier.

In one embodiment, if the one-time identifier is valid, providing the telephone number of the mobile phone corresponding to the one-time identifier to the service system to allow the service system to log in of the mobile phone user corresponding to the one-time identifier. It may further include a providing module.

When performing user authentication using a one-time identifier as in the above-described embodiment of the present invention, a user acquires through an inbound call call without inputting a conventional ID / password or entering his / her phone number into a service system. You can log in or authenticate yourself just by entering a one-time identifier.

In addition, since the user may be provided with information necessary to log in or authenticate himself / herself through a phone call (that is, a one-time identifier), the user may install a predetermined IC chip or separate software for authentication on the mobile phone 210 or the user terminal 220. There is an effect that it is not necessary. Therefore, the service according to the embodiment of the present invention may be utilized even in a conventional 2G phone.

In addition, according to the technical idea of the present invention as described above, the user has enough information (that is, one-time identifier) to log in or authenticate by simply dialing the telephone number guided by the service system using his mobile phone. Since it can be obtained, even if you forget or forget your ID / password for login, there is an advantage that you can easily log in to the online service.

In addition, the one-time identifier used for identity authentication is not provided to the user through a data communication network (for example, the Internet) that is easy to hack, but is provided through a call network that is difficult to eavesdropping or intercepting, thereby increasing security. .

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.
1 is a view for explaining an execution environment of a user authentication method using a one-time identifier according to an embodiment of the present invention.
2 is a flowchart illustrating a user authentication method using a one-time identifier according to an embodiment of the present invention.
3 is a diagram illustrating an example of a user authentication UI.
4A is a diagram for explaining an example of a user authentication method using a one-time identifier interworking with a plurality of service systems.
4B is a diagram for explaining another example of a user authentication method using a one-time identifier interworking with a plurality of service systems.
5 is a block diagram showing the configuration of an authentication system according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described in the specification, one or more other It is to be understood that the present invention does not exclude the possibility of the presence or the addition of features, numbers, steps, operations, components, parts, or a combination thereof.

In addition, in the present specification, when one component 'transmits' data to another component, the component may directly transmit the data to the other component, or through at least one other component. Means that the data may be transmitted to the other component. On the contrary, when one component 'directly transmits' data to another component, it means that the data is transmitted from the component to the other component without passing through the other component.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a view for explaining an execution environment of a user authentication method using a one-time identifier according to an embodiment of the present invention.

Referring to FIG. 1, in order to implement an authentication method using a one-time identifier according to an embodiment of the present invention, an authentication system 100, a user's mobile phone 210, a user's user terminal 220, and a service system ( 300).

A user may access the service system 300 through the user terminal 220 and receive a service from the service system 300 after login or authentication.

The service system 300 may be a system for providing a predetermined online service (eg, online payment, online shopping mall, online community, SNS, etc.) to the user terminal 220.

In the service system 300, an account of each user may be previously created. When the user's account is created, the service system 300 registers user identification information (e.g., an account name, ID, etc.) designated by each user, and an ordinary user authentication means (e.g., a login password, etc.). Can be. In addition, the mobile phone number of the user may be pre-registered in the service system 300 when the user's account is created or after the user's account is created. That is, the user may register the telephone number of his mobile phone 210 in advance in the service system 300 before performing user authentication using the one-time identifier according to the technical idea of the present invention.

In some embodiments, each user may further register his or her personal information. Each user's personal information may include at least one of a user's name, date of birth, social security number, payment method information (eg, credit card number, check card number, etc.), landline phone number, gender, email address, and address. have. In addition, the user's personal information may of course include any information dependent on the user.

The mobile phone number and / or personal information registered in advance in the service providing system 300 may be used later by the authentication system 100. In one embodiment, the authentication system 100 may obtain a mobile phone number and / or personal information registered in advance to perform a user authentication method according to an embodiment of the present invention from the service system 300. .

On the other hand, the user terminal 200 may be used to mean any type of data processing device or computing device (eg, laptop, desktop, mobile terminal, set-top box, etc.).

The user terminal 200 and the service system 300 may be connected through a wired or wireless data communication network (for example, the Internet) to transmit and receive various information, data, and / or signals necessary to implement the technical idea or provide a service of the present invention. Can be.

Meanwhile, the authentication system 100 issues / manages a one-time identifier used for the user's login or authentication and guides it to the user through the user's mobile phone 210. Validation of the one-time identifier from the service system 300 is performed. If requested, verification can be performed.

The authentication system 100 may be a server.

The authentication system 100 may be connected to the mobile phone 210 through a mobile communication network, and a call for a phone call may be established between the authentication system 100 and the mobile phone 210. To this end, the authentication system 100 may include an Auto Response System (ARS).

In particular, the call established between the authentication system 100 and the mobile phone 210 may be an inbound call initiated by the user's mobile phone 210. An inbound call call is a call call made by a user's cellular phone 210 and established by the authentication system 100. That is, when a user calls the mobile phone 210 to the authentication system 100 or the telephone number assigned to the answering machine in the authentication system 100, the mobile phone 210 and the authentication system 100 Inbound call calls can be established between them.

The authentication system 100 may transmit and receive various information, signals, and / or data necessary to implement the technical idea of the present invention through a call call connected to the user's mobile phone 210.

Meanwhile, as illustrated in FIG. 1, the authentication system 100 may be implemented in the form of a separate system separate from the service system 300, and according to an implementation example, the service system 300 may be configured. It may be implemented as part of. In the former case, the service system 300 and the authentication system 100 may be connected via a network to transmit and receive various information and / or data necessary to implement the technical idea of the present invention. In the latter case, the authentication system 100 may be in the form of a combination of software and hardware installed in the subsystem of the service system 300 or the service providing system 300.

According to an exemplary embodiment, some of the components of the authentication system 100 may be implemented to be included in the service system 300.

The mobile phone 210 may be a computing device including a smartphone, tablet PC, personal digital assistant (PDA), and processing connected to a wireless computing device or other wireless modem, including a handheld device having other wireless connectivity capabilities. It may be a device.

Although FIG. 1 illustrates an embodiment in which the user's mobile phone 210 and the user terminal 220 are physically divided, according to the embodiment, the mobile phone 210 and the user terminal 220 are physically separated. It may be the same device. That is, the user may be informed of the one-time identifier from the authentication system 100 by using one device, and may perform identity authentication or login using the same.

2 is a flowchart illustrating a user authentication method using a one-time identifier according to an embodiment of the present invention.

Referring to FIG. 2, a user may access the service system 300 through the user terminal 220 (S110). For example, the user may access the service system 300 by inputting the address of the service system 300 into an application (for example, a web browser) installed in the user terminal 220.

Then, the service system 300 may provide the user authentication UI information to the user terminal 220, and the user terminal 220 may display the user authentication UI using the provided UI information (S120 and S130). The identity authentication UI may be a UI that provides a user with a procedure or guide information for login or identity authentication, and allows a user to log in to the service system 300 or input information for identity verification. The identity authentication UI information may refer to information necessary for the user terminal 220 to display the identity authentication UI. For example, the user authentication UI may be a web page including a form for entering login information.

3 is a diagram illustrating an example of a user authentication UI.

As shown in FIG. 3, the user authentication UI 400 may include a phone number 410 assigned to the authentication system 100 or the answering machine included in the authentication system 100. In addition, the user authentication UI 400 may include a UI 430 for inputting a one-time identifier to be described later.

According to an embodiment, the identity authentication UI 400 may further include a system unique number 420 assigned to the service system 300. The authentication system 100 may be information used to identify the service system 300.

Referring back to FIG. 2, the user can dial the phone number of the authentication system 100 or the answering machine included in the authentication system 100 using the mobile phone 210. An inbound call call may be established between 210 and the authentication system 100 (S140).

The authentication system 100 may obtain a phone number of the mobile phone 210 in the process of establishing an inbound call call with the mobile phone 210.

When an inbound call is established between the mobile phone 210 and the authentication system 100, the authentication system 100 may generate (issuance) a one-time identifier corresponding to the phone number of the mobile phone 210 ( S150).

The generated one-time identifier may be used for a user of the mobile phone 210 to log in to the service system 300 or authenticate himself / herself.

The authentication system 100 may store the phone number of the mobile phone 210 and the issued one-time identifier in correspondence with each other.

The one-time identifier may be information written once and discarded. That is, the one-time identifier may be information that is discarded and cannot be used again after the user of the mobile phone 210 is used for login or authentication.

The one-time identifier may also be information having a unique value permanently or for a period of time. That is, the one-time identifier may be information that never overlaps with another one-time identifier already issued or information that does not overlap with another valid one-time identifier within a period of time.

In one embodiment, the authentication system 100 may store / store the issuance history of the generated one-time identifier. The issuance history may include a one-time identifier, a mobile phone number corresponding thereto, login information of a mobile phone user corresponding thereto, information about an issuance time point, and / or information about an expiration time point. Alternatively, the issuance details may further include a unique number of the service system (eg, 300) to which the one-time identifier is applied.

The authentication system 100 may provide the issued one-time identifier to the mobile phone 210 (S160).

In one embodiment, the authentication system 100 may provide the issued one-time identifier to the mobile phone 210 of the user in the form of a text message. For example, the authentication system 100 may transmit a one-time identifier to the mobile phone 210 of the user through a short message system (SMS) or a multimedia message system (MMS). Alternatively, the one-time identifier may be transmitted to a dedicated application installed in the mobile phone 210.

In another embodiment, the authentication system 100 may transmit the issued one-time identifier in voice form through an inbound call call established between the mobile phone 210 and the authentication system 100.

However, if the one-time identifier is provided in the form of voice at once, the user may not remember it. In order to solve this problem, the authentication system 100 may provide the issued one-time identifier to the user one letter by the following method.

If the one-time identifier is 'ABCD', the authentication system 100 may first provide 'A', which is the first letter of the one-time identifier, in a voice form. Then, the user inputs 'A' into the one-time identifier input UI (for example, 430 of FIG. 3) on the user terminal 220, and then a predetermined indicator (for example, '#', through the mobile phone 210). '*', Etc.) can be entered. Then, the authentication system 100 provides the next letter 'B' in the form of a voice, and the user inputs it to the one-time identifier input UI (for example, 430 of FIG. 3) on the user terminal 220 and the mobile phone ( An indicator (eg, '#', '*', etc.) may be input through 210. In this manner, the authentication system 100 may provide a one-time identifier in the form of a voice.

The authentication system 100 may include a speech-to-text (STT) system to provide a one-time identifier in the form of a voice.

On the other hand, if the user is provided with a one-time identifier through the mobile phone 210, the user may input it to the user terminal 220 (S170). For example, the user may input the one-time identifier to the one-time identifier input UI 430 included in the login guide screen 400 of FIG. 3.

Then, the user terminal 220 may submit a one-time identifier input by the user to the service system 300 in order to request login or identity authentication (S180).

When the one-time identifier is submitted, the service system 300 may request verification of the one-time identifier to the authentication system 100 (S190), and the authentication system 100 requests the verification of the service system 300. In response to the one-time identifier may be verified (S200).

In one embodiment, the authentication system 100 may check the issuance history of the one-time authentication information to determine whether the one-time identifier that is the verification target is normally issued by the authentication system 100. Alternatively, according to an embodiment, the authentication system 100 may determine that the one-time identifier that is the verification target is issued in a normal manner but is not valid when the expiration period has elapsed. In addition, the authentication system 100 may extract a mobile phone number corresponding to the one-time identifier to be verified.

The authentication system 100 may transmit a verification result to the service system 300 (S210). When the one-time identifier is verified to be valid, the service system 300 may allow a user login or identity authentication. (S220).

According to an exemplary embodiment, the authentication system 100 may or may not include a database that stores account information and a mobile phone number of each of a plurality of users subscribed to the service system 300.

If so, the authentication system 100 extracts user account information from a database through a mobile phone number corresponding to the verified one-time authentication information, and the service system 300 includes a mobile phone (corresponding to the one-time identifier). In order to allow the user to log in, the account information of the user of the mobile phone 210 corresponding to the one-time identifier may be transmitted to the service system 300.

If not, the authentication system 100 sends the one-time identifier to the service system 300 to allow the service system 300 to log in a user of the mobile phone 210 corresponding to the one-time identifier. The phone number of the mobile phone 210 corresponding to the transmission may be transmitted. Then, the service system 300 may allow the user to log in by extracting user account information corresponding to the telephone number of the mobile phone 210 from the database held by the service system 300.

Meanwhile, the authentication system 100 may discard the one-time identifier after completing validation of the one-time identifier. There may be various ways to discard the one-time identifier. In an embodiment, the item related to the one-time identifier to be discarded may be physically deleted from the issuance history of the authentication system 100. Alternatively, a mark indicating that the one-time identifier has been discarded may be described in an item regarding the one-time identifier to be discarded in the issuance details. In addition, there may be a variety of revocation methods that prevent one-time identifiers that have already been validated from being considered valid again.

Meanwhile, FIG. 2 illustrates an embodiment in which the authentication system 100 interworks with one service system 300, but according to an embodiment, the authentication system 100 interworks with a plurality of service systems 300. You may. Hereinafter, a case in which the authentication system 100 interworks with a plurality of service systems will be described with reference to FIGS. 4A and 4B. 4A and 4B illustrate an example of interworking with two service systems, but the technical spirit of the present invention is not limited thereto, and the authentication system 100 may interoperate with three or more service systems. Those of ordinary skill in the art will appreciate.

4A is a diagram for explaining an example of a user authentication method using a one-time identifier interworking with a plurality of service systems.

Referring to FIG. 4A, the authentication system 100 may include a plurality of automated response systems (eg, 170-1 to 170-2). Each answering machine 170-1 to 170-2 is assigned a different telephone number.

In addition, each of the plurality of answering machines 170-1 to 170-2 may correspond to a different service system. For example, the first answering machine 170-1 corresponds to the first service system 300-1, and the second answering system 170-2 corresponds to the second service system 300-2. Can be.

When the user connects to the first service system 300-1 through the user terminal 220, the first service system 300-1 may provide the user terminal 220 with the first authentication UI. . In this case, the first authentication UI may include a phone number assigned to the first answering machine 170-1. The user can then dial the telephone number assigned to the first answering system 170-1 to establish an inbound call call with the first answering system 170-1. In this case, the authentication system 100 may issue a one-time identifier available in the service system (that is, the first service system 300-1) corresponding to the first answering machine 170-1.

If the user accesses the second service system 300-2 through the user terminal 220, the second service system 300-2 may provide the user terminal 220 with a second authentication UI. have. In this case, the second authenticator UI may include a phone number assigned to the second answering machine 170-2. The user may then call the telephone number assigned to the second answering system 170-2 to establish an inbound call call with the second answering system 170-2. In this case, the authentication system 100 may issue a one-time identifier available in the service system (that is, the second service system 300-2) corresponding to the second answering machine 170-2.

4B is a diagram for explaining another example of a user authentication method using a one-time identifier interworking with a plurality of service systems.

Referring to FIG. 4B, different system unique numbers may be pre-assigned to each service system 300-1 to 300-2. For example, a unique number '1111' may be previously assigned to the first service system 300-1, and a unique number '2222' may be previously assigned to the second service system 300-2.

After the user calls the authentication system 300 through the mobile phone 210 to log in to the first service system 300-1 or the second service system 300-2, the user establishes an inbound call call. Select one of the first service system 300-1 or the second service system 300-2 by entering a system unique number of the first service system 300-1 or the second service system 300-2. Can be. When either the first service system or the second service system is selected by the cellular phone 210 via the inbound call, the authentication system 100 is used in the service system selected by the cellular phone 210. Possible one-time identifiers can be issued.

When the system unique number is made of numbers, the authentication system 100 may receive a number in DTMF tones. Alternatively, when the system unique number is input in the form of a voice signal, the authentication system 100 may recognize a system unique number from the voice signal through voice recognition.

In one embodiment, the system identification number of each service system 300-1 and 300-2 may be guided by the answering machine of the authentication system 100.

In another embodiment, each service system 300-1 and 300-2 may allow a system unique number assigned to the service system 300 to be included on the user authentication UI. For example, when the user terminal 220 accesses the first service system 300-1, the first service system 300-1 includes its own unique number ('1111' in the above example). The user authentication UI may be displayed on the user terminal 220. When the user terminal 220 accesses the second service system 300-2, the second service system 300-2 may have its own unique number ( In the above example, the user authentication UI including '2222' may be displayed on the user terminal 220.

Then, the user inputs the system unique number displayed on the user authentication UI to the authentication system 100, and the authentication system 100 may issue a one-time identifier available in the service system corresponding to the inputted unique number.

5 is a block diagram illustrating a configuration of an authentication system 100 according to an embodiment of the present invention. As shown in FIG. 5, the authentication system 100 may include an issuance module 110, a response module 120, a verification module 130, a disposal module 140, and a provision module 150. In some embodiments, the authentication system 100 may further include at least one answering machine 170-1 to 170 -N. In some embodiments, the authentication system 100 may further include a database 160.

According to an embodiment of the present invention, some of the above-described elements may not necessarily correspond to the elements necessary for the implementation of the present invention, and according to the embodiment, the authentication system 100 Of course, more components may be included. For example, the authentication system 100 may include other components included in the authentication system 100 (eg, the issuance module 110, the response module 120, the verification module 130, and the disposal module 140). , A control module (not shown) capable of controlling the functions and / or resources of the provision module 150, the answering machines 170-1 to 170 -N, and / or the database 160, etc.). have. In addition, the authentication system 100 may further include a communication module (not shown) capable of performing wired and wireless data communication.

The authentication system 100 may include hardware resources and / or software necessary to implement the technical idea of the present invention, and does not necessarily mean one physical component or one device. . That is, the authentication system 100 may mean a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, the authentication system 100 may be installed in devices spaced apart from each other to perform respective functions. As a result, it may be implemented as a set of logical configurations for implementing the technical idea of the present invention. In addition, the authentication system 100 may refer to a set of components that are separately implemented for each function or role for implementing the technical idea of the present invention. For example, the issuance module 110, the response module 120, the verification module 130, the disposal module 140, the provision module 150, and the database 160 may be located in different physical devices. It may be located on the same physical device. In addition, according to the implementation example, a combination of software and / or hardware configuring each of the issuance module 110, the response module 120, the verification module 130, the disposal module 140, and the provision module 150 may also be mutually different. Configurations located in different physical devices and components located in different physical devices may be organically combined with each other to implement each of the modules.

In addition, the term "module" in the present specification may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for performing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware. It can be easily inferred by the average expert in the technical field of the present invention.

In the present specification, a database (DB) may be implemented as at least one table, and further includes a separate DBMS (Database Management System) for searching, storing, and managing information stored in the DB. It may be used as. In addition, it may be implemented in various ways such as linked-list, tree, relational DB, and all the data storage media and data structures capable of storing information to be stored in the pattern DB 130. It can be used to include.

Referring to Figure 5, the issuance module 110 is obtained in the process of establishing the inbound call call when the inbound call call is initiated between the mobile phone 210 and the authentication system 100 by the user's mobile phone 210 The one-time identifier corresponding to the telephone number of the mobile phone 210 and available in the service system 300 may be issued.

As described above, according to an embodiment, the authentication system 100 may include a plurality of automatic answering systems 170-1 to 170-N to which different telephone numbers are assigned, and the issuing module 110 may include: The one-time identifier available in the service system corresponding to the answering machine connected to the cellular phone and the inbound call may be issued.

Alternatively, when the issuing module 110 selects one of a plurality of service systems by the mobile phone 210 through the inbound call, the one-time identifier available in the service system selected by the mobile phone 210 is selected. Can be issued.

The response module 120 may provide the issued one-time identifier to the mobile phone 210 of the user.

In one embodiment, the response module 120 may provide the issued one-time identifier information in the form of voice through the inbound call.

In another embodiment, the response module 120 may provide the issued one-time identifier information to the user's mobile phone 210 in the form of a text message (eg, SMS, MMS, app message). .

The verification module 130, when the authentication system 110 provides the one-time identifier through the inbound call call, the service system 300 requests the authentication system 100 to verify the one-time identifier. The validity of the one-time identifier may be verified.

The discard module 140 may discard the one-time identifier after completing validation of the one-time identifier.

The providing module 150 may provide a result of validating the one-time identifier to the service system 300.

In one embodiment, the providing module 150, if the one-time identifier is valid, the mobile phone corresponding to the one-time identifier to allow the service system 300 to log in of the mobile phone user corresponding to the one-time identifier The login information of the user may be provided to the service system 300.

In another embodiment, if the one-time identifier is valid, the providing module 150 sends the service system 300 to the service system 300 to allow the mobile phone user to log in corresponding to the one-time identifier. The telephone number of the cellular phone corresponding to the one-time identifier may be provided.

When performing user authentication using a one-time identifier as in the above-described embodiment of the present invention, a user acquires through an inbound call call without inputting a conventional ID / password or entering his / her phone number into a service system. You can log in or authenticate yourself just by entering a one-time identifier.

In addition, since the user may be provided with information necessary to log in or authenticate himself / herself through a phone call (that is, a one-time identifier), the user may install a predetermined IC chip or separate software for authentication on the mobile phone 210 or the user terminal 220. There is an effect that it is not necessary. Therefore, the service according to the embodiment of the present invention may be utilized even in a conventional 2G phone.

In addition, according to the technical idea of the present invention as described above, the user has enough information (that is, one-time identifier) to log in or authenticate by simply dialing the telephone number guided by the service system using his mobile phone. Since it can be obtained, even if you forget or forget your ID / password for login, there is an advantage that you can easily log in to the online service.

In addition, the one-time identifier used for identity authentication is not provided to the user through a data communication network (for example, the Internet) that is easy to hack, but is provided through a call network that is difficult to eavesdropping or intercepting, thereby increasing security. .

On the other hand, the authentication system 100 according to an embodiment of the present invention may be used not only to log in to a predetermined service providing system 300 but also to find an ID / password. To this end, if the user authentication by the one-time identifier is successful, the service system 300 may transmit a login ID and / or password corresponding to the user's account to the user terminal 220 or the mobile phone 210.

In some implementations, the authentication system 100 may include a processor and a memory that stores a program executed by the processor. The processor may include a single core CPU or a multi core CPU. The memory may include fast random access memory and may include nonvolatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other nonvolatile solid state memory devices. Access to memory by the processor and other components may be controlled by the memory controller. In this case, when the program is executed by the processor, the authentication system 100 according to the present embodiment may enable the user authentication method using the one-time identifier described above.

On the other hand, the user authentication method using a one-time identifier according to an embodiment of the present invention is implemented in the form of computer-readable program instructions can be stored in a computer-readable recording medium, the control program according to an embodiment of the present invention And the target program can also be stored in a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

The program instructions recorded on the recording medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the software art.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, floppy disks, and the like. Included are hardware devices specifically configured to store and execute the same magneto-optical media and program instructions such as ROM, RAM, flash memory, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Examples of program instructions include not only machine code generated by a compiler, but also devices that process information electronically using an interpreter, for example, high-level language code that can be executed by a computer.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. .

Claims (18)

When an inbound call is initiated between the cellular phone and the authentication system by the user's cellular phone, the authentication system corresponds to the telephone number of the cellular phone obtained during the establishment of the inbound call call and is available in a predetermined service system. Issuing a one-time identifier;
Providing, by the authentication system, the issued one-time identifier to the user's mobile phone; And
If the service system requests the authentication system to verify the one-time identifier after the authentication system provides the one-time identifier through the inbound call call, the authentication system to verify the validity of the one-time identifier. User authentication method using a one-time identifier comprising.
The method of claim 1,
The authentication system comprises a plurality of answering machines assigned different telephone numbers, wherein each of the plurality of answering machines corresponds to a different service system,
Issuing a one-time identifier corresponding to the telephone number of the cellular phone and available in a predetermined service system,
And issuing, by the authentication system, a one-time identifier usable in a service system corresponding to an answering system connected to the cellular phone and the inbound call call.
The method of claim 1,
Issuing a one-time identifier corresponding to the telephone number of the cellular phone and available in a predetermined service system,
A one-time identifier, if the one of a plurality of service systems is selected by the cellular phone via the inbound call call, the authentication system issuing a one-time identifier available in the service system selected by the cellular phone; User authentication method using.
The method of claim 1,
The step of providing, by the authentication system, the issued one-time identifier to the user's mobile phone,
And providing, by the authentication system, the issued one-time identifier in the form of a voice through the inbound call call.
The method of claim 1,
The step of providing, by the authentication system, the issued one-time identifier information to the user's mobile phone,
And providing, by the authentication system, the issued one-time identifier information to the mobile phone of the user in the form of a text message.
The method of claim 1,
And discarding the one-time identifier by the authentication system after completing validation of the one-time identifier.
The method of claim 1,
Configuring, by the authentication system, a DB for storing account information and a mobile phone number of each of a plurality of users subscribed to the service system, wherein the account information is information necessary for the service system to identify the user; And
If the one-time identifier is valid, the authentication system provides the service system with login information of the mobile phone user corresponding to the one-time identifier to allow the service system to log in to the mobile phone user corresponding to the one-time identifier. User authentication method using a one-time identifier further comprising the step of.
The method of claim 1,
If the one-time identifier is valid, the authentication system provides the service system with the telephone number of the mobile phone corresponding to the one-time identifier to the service system to allow the service system to log in to the mobile phone user corresponding to the one-time identifier. A user authentication method using a one-time identifier further comprising the step.
A computer program installed in a data processing apparatus and stored in a recording medium for carrying out the method according to any one of claims 1 to 8.
As an authentication system,
A processor;
Contains memory that stores the program,
The program, when executed by the processor, causes the authentication system to perform the method according to any one of claims 1 to 8.
When an inbound call is initiated between the cellular phone and the authentication system by the user's cellular phone, the one-time identifier corresponding to the telephone number of the cellular phone obtained in the process of establishing the inbound call is issued and is available in a predetermined service system. Issue module;
A response module for providing the issued one-time identifier to the mobile phone of the user; And
An authentication system including a verification module for validating the one-time identifier when the service system requests the authentication system to verify the one-time identifier after the response module provides the one-time identifier through the inbound call. .
The method of claim 11,
The authentication system further comprises a plurality of answering machines assigned different telephone numbers, wherein each of the plurality of answering machines corresponds to a different service system;
The issuing module,
An authentication system for issuing a one-time identifier usable in a service system corresponding to an answering system in which the cellular phone and the inbound call call are connected.
The method of claim 11,
The issuing module,
And if any one of a plurality of service systems is selected by the cellular phone via the inbound call call, issuing a one-time identifier usable in the service system selected by the cellular phone.
The method of claim 11,
The response module,
Authentication system for providing the issued one-time identifier information in the form of a voice through the inbound call.
The method of claim 11,
The response module,
An authentication system for providing the issued one-time identifier information to the user's mobile phone in the form of a text message.
The method of claim 11,
And a discard module for discarding the one-time identifier after completing validation of the one-time identifier.
The method of claim 11,
DB for storing the account information and the mobile number of each of a plurality of users subscribed to the service system, wherein the account information is information necessary for the service system to identify the user; And
If the one-time identifier is valid, the service module for providing a login information of the mobile phone user corresponding to the one-time identifier to the service system in order to allow the service system to allow the login of the mobile phone user corresponding to the one-time identifier further; User authentication method using a one-time identifier comprising.
The method of claim 11,
If the one-time identifier is valid, the service system further comprises a providing module for providing a phone number of the mobile phone corresponding to the one-time identifier to the service system in order to allow the service system allows login of the mobile phone user corresponding to the one-time identifier Certification system.

Images