KR20200024426A - User authentication system and method using combination of user pattern authentication and quantum random number - Google Patents

Abstract

The present invention relates to a system and a method for authenticating a user combined with a pattern input by a user and a quantum random number. The method of the present invention comprises: a user registration step including a step of transmitting a hash function value to a terminal and a step of generating a quantum strong password (QSP); and a user authentication step. According to the present invention, even when the same user pattern authentication is used for several domains, a unique QSP for each domain and use is generated to enhance security.

Description

User authentication system and method using combination of user pattern authentication and quantum random number}

The present invention relates to a user authentication system and method combining a user pattern and a quantum random number, and in particular, using a QSP (Quantum Strong Password) generated by combining a pattern input to the touch screen of the terminal and the quantum random number generated by the authentication server A user authentication system and method.

As the use of mobile devices is becoming more common, there is a growing interest in technologies that prevent personal information from being exposed. In general, what you are user authentication (password, PIN number, pattern authentication) used in mobile devices is easy to use, change and replace at a low cost, and has less advantage of rejection due to ideological and ideological use. . However, there is a problem in that hacking and impersonation are easy, and the same pattern of passwords are repeatedly used on multiple sites with limitations depending on the memory of the individual.

Related prior arts include Korean Patent Publication No. 10-2015-0082876 "Authentication method and apparatus for authentication password combining letters and patterns" and Patent No. 10-1823057 "Authentication method and apparatus using layered patterns". .

An object of the present invention is to provide a user authentication system and method for enhanced security using a QSP (Quantum Strong Password) generated by combining user pattern authentication and quantum random number of a terminal using a touch screen. .

A user authentication method combining a pattern input by a user and a quantum random number according to an embodiment of the present invention may include a user registration step and a user authentication step, wherein the user registration step generates a user ID (UUID) by the terminal. After requesting registration, the authentication server generates a quantum random number (QRN) including a first random number (QRN1), a second random number (QRN2), and a third random number (QRN3), and generates a quantum random number (QRN) and a quantum random number ( Transmitting a hash function value of the QRN to the terminal, checking the received quantum random number (QRN), and receiving a pattern from the user. generating a derivation ID), and generating a session key by generating, by the terminal, a verification key DK and inducing the first random number QRN1 and the second random number QRN2 received from the authentication server. And the terminal using the session key generated by the terminal. Encrypting a child KDI, a user ID (UUID), a verification key DK, and a third random number (QRN3) and transmitting an encryption value to the authentication server, wherein the authentication server has a first random number (QRN1) and a second random number (QRN2). To generate a session key, generate a user ID (UUID), request the legacy server for redundancy, and generate the third random number (QRN3) generated from the authentication server and the third random number (QRN3) received from the terminal. And comparing the verification key DK 'with the authentication server to derive the verification key DK', comparing the verification key DK received from the terminal, and verifying the verification key DK 'based on the verification key DK'. Generating a quantum strong password, and registering the quantum strong password with the legacy server and receiving a result value to transmit a registration success to the terminal.

According to the present invention, a verification key (DK) and no personal information are not stored in the terminal during pattern authentication, and a unique QSP (Quantum strong password) for each domain and purpose is used even when the same user pattern authentication is used for multiple domains. Is generated to enhance security.

In addition, since the terminal uses a different quantum random number as an input value each time, even if a challenge value is stolen, it cannot be used for an attack, thereby enhancing security.

1 is a view for explaining a user registration step in a user authentication method according to an embodiment of the present invention.
2 is a view for explaining a user authentication step in a user authentication method according to an embodiment of the present invention.
3 is a view for explaining a user registration step in a user authentication method according to another embodiment of the present invention.
4 is a view for explaining a user authentication step in a user authentication method according to another embodiment of the present invention.
5 and 6 are diagrams for explaining a QSP (Quantum Strong Password) generation method of the user authentication method of the present invention.
7 is a diagram illustrating a method of updating a QSP in a user authentication method according to an embodiment of the present invention.

Specific structural or functional descriptions of the embodiments according to the inventive concept disclosed herein are provided only for the purpose of describing the embodiments according to the inventive concept. It may be embodied in various forms and is not limited to the embodiments described herein.

Embodiments according to the inventive concept may be variously modified and have various forms, so embodiments are illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments in accordance with the concept of the present invention to the specific forms disclosed, it includes all changes, equivalents, or substitutes included in the spirit and scope of the present invention.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described herein, but one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining a user registration step in a user authentication method according to an embodiment of the present invention.

Referring to FIG. 1, the present invention is a user authentication method combining a pattern input by a user and a quantum random number, and includes a user registration step and a user authentication step.

In the user registration step, when the terminal 100 generates a user ID (UUID) (S111) and requests registration to the authentication server 200 (S113), the authentication server 200 generates a first random number (QRN1). A quantum random number (QRN) including two random numbers (QRN2) and a third random number (QRN3) is generated (S115), and a hash function value hashed from the quantum random number (QRN) and the quantum random number (QRN) is transmitted to the terminal. (S117). In this case, the first random number (QRN1), the second random number (QRN2), the third random number (QRN3) is a quantum random number generated by using a random pulse generated corresponding to the emission time of the alpha particles released during the natural collapse of the atomic nucleus Can be.

When the terminal 100 checks the received quantum random number QRN and receives a pattern from the user (S119), the terminal 100 generates a user KDI (Key derivation ID) (S121). In this case, the input pattern may be a pattern in which at least three vertices are connected to each other, and the user KDI may be a combination of code values mapped to each of the connected vertices. Thereafter, the terminal 100 generates a validation key DK (S122). The verification key DK may be generated using PBKDF2 (Password-Based Key Derivation Function 2) and Quantum SALT. At this time, the verification key DK may be derived by PBKDF2 (PRF, Password, Quantum SALT, c, DLen). PRF (Pseudo-random function) may be HMAC-SHA256, Quantum SALT may be a quantum random number generated by an authentication server, c may be a desired iteration repetition number, and DLen may be a desired digest length.

The terminal 100 generates a session key by inducing the first random number QRN1 and the second random number QRN2 received from the authentication server (S123). The terminal 100 encrypts the user KDI, the verification key DK, the user ID UUID, and the third random number QRN3 using the session key, and transmits an encryption value to the authentication server (S127). After transmission, the terminal 100 deletes the user KDI and the verification key DK (S129).

The authentication server 200 generates a session key by deriving the generated first random number QRN1 and the second random number QRN2 (S125). Thereafter, the user ID (UUID) is checked (S131), and the legacy server 300 to request whether the user ID is duplicated (S133). The legacy server 300 checks whether there is a duplication based on the user ID (S135), and transmits the result value to the authentication server 200 (S137).

The authentication server 200 decrypts the received encryption value by using a session key derived from the same first random number QRN1 and the second random number QRN2 generated by the existing authentication server 200, and receives the first encryption value received from the terminal. It is checked whether or not the three random numbers QRN3 and the third random number QRN3 generated by the authentication server match (S139).

The authentication server 200 derives and stores the verification key DK '(Digest Key) (S141). The authentication server 200 verifies by comparing the verification key DK received from the terminal and the verification key DK 'derived from the authentication server (S142).

The authentication server 200 may generate a QSP (Quantum Strong Password) based on the verification key (DK). In this case, the QSP (Quantum Strong Password) is a quantum added to the quantum random number sequence (4byte * 4) matched to the QST (Quantum Seed Table) based on the user KDI and the quantum padding random number (4byte * 5) generated by the quantum random number server. It may be a random number sequence (4 bytes * 9).

That is, the quantum random number of the quantum random number table corresponding to the position of the pattern input by the user is extracted to generate a quantum random number sequence, and the quantum random number is padded on the generated quantum random number sequence to generate a QSP (Quantum Strong Password) quantum egg. It can generate a sequence. Through the KDI, a Digest Key (DK) can be generated using PBKDF2 (Password-Based Key Derivation Function 2) and Quantum SALT.

The generated QSP can be derived from the authentication server and used as a password for authentication to the legacy server. The security can be enhanced, and the QSP can be used as an electronic signature by encrypting the QSP with the generated verification key (DK). have. According to an embodiment, two or more QSTs (Quantum Seed Tables) may be derived from the user KDI and updated in the authentication server, and security may be enhanced by using a newly generated QST (Quantum Seed Table) at each login.

The authentication server 200 requests registration of the generated QSP (Quantum Strong Password) to the legacy server 300 (S145), and receives a registration result value from the legacy server 300 (S147). 100) (S149). According to the present invention, since a different quantum random number is used as an input value, even if a challenge value is stolen, it cannot be used for an attack, and thus security is high.

2 is a view for explaining a user authentication step in a user authentication method according to an embodiment of the present invention.

Referring to FIG. 2, in the user authentication step according to the embodiment of the present invention, the authentication server 200 includes a quantum random number (QRN1), a second random number (QRN2), and a third random number (QRN3). Create a QRN (S311), if an authentication request is received from the terminal 100, check the user ID (UUID) (S315), and requests the legacy server 300 to search for the user ID (UUID) (S317) ) Receives a customer number (S319).

The authentication server 200 transmits the hash function value hashing the user ID (UUID), the quantum random number (QRN), and the quantum random number (QRN) to the terminal 100 (S321).

When the terminal 100 checks the received quantum random number (QRN) and the user ID (UUID) (S323) and receives a pattern from the user (S325), a user KDI is generated based on the pattern (S327). The session key is generated by deriving the first random number QRN1 and the second random number QRN2 (S329).

The terminal 100 encrypts the third random number QRN3 and the user KDI using the session key, and transmits an encryption value to the authentication server 200 (S332). Thereafter, the terminal 100 deletes the user KDI (S333).

The authentication server 200 generates a session key by inducing the first random number QRN1 and the second random number QRN2 (S331). The authentication server 200 induces the verification key DK '(S335). The authentication server 200 checks the received third random number QRN3 by comparing the third random number QRN3 generated by the authentication server (S339). The DK 'derived from the stored DK' 'as the KDI verification key is verified (S341). The authentication server 200 generates a QSP based on the verification key DK '(S343).

The authentication server 200 requests the verification of the QSP to the legacy server 300 (S345), receives the verification result (S347), and transmits an authentication success message to the terminal 100 (S349).

3 is a view for explaining a user registration step in a user authentication method according to another embodiment of the present invention. 3 is a private certificate and a method for registering user information for non-repudiation.

Referring to FIG. 3, in the user registration step according to another embodiment of the present invention, when the terminal 100 generates a user ID (UUID) (S411) and requests a registration to the authentication server 200 (S413), authentication is performed. The server 200 generates a quantum random number QRN including a first random number QRN1, a second random number QRN2, and a third random number QRN3 (S415). The authentication server 200 transmits a hash function value of the generated user ID (UUID), the quantum random number (QRN), and the quantum random number (QRN) to the terminal (S417).

The terminal 100 checks the received quantum random number (QRN) (S418) and, upon receiving a pattern from the user (S419), derives the verification key DK to the user KDI, and generates a private key Kpriv and a public key Kpub ( S421). At this time, the private key Kpriv and the public key Kpub may be derived by the ECDSA algorithm by a quantum random number (QRN).

The terminal 100 encrypts the private key Kpriv using a verification key DK, stores the private key Kpriv '(S422), and induces the first random number QRN1 and the second random number QRN2 received from the authentication server. Generate a session key (SS423). Using the generated session key, the user KDI, the verification key DK, the user ID (UUID), the third random number (QRN3), and the public key (Kpub) are encrypted to transmit the encryption value (S427).

The authentication server 200 generates a session key by inducing the first random number QRN1 and the second random number QRN2 (S425), and decrypts the received encryption value using the session key. The user ID (UUID) is checked and the legacy server 300 is requested to be duplicated (S431), and a result value is received (S435).

The authentication server 200 compares the received third random number with the third random number generated by the authentication server, and stores the received public key Kpub (S437).

The authentication server 200 guides the decrypted KDI to the verification key DK ', stores the derived verification key DK' as the verification key DK '', and compares the derived verification key DK 'to the verification key DK received from the terminal. Verify by (S439).

A QSP (Quantum strong password) is generated based on the verification key DK '(S441).

The authentication server 200 registers the generated QSP (Quantum Strong Password) in the legacy server 300 (S443), and receives a result value (S445), and transmits a registration success message to the terminal 100 (S447). .

4 is a view for explaining a user authentication step in a user authentication method according to another embodiment of the present invention. 4 is a private certificate and an authentication method for non-repudiation.

Referring to FIG. 4, in the user authentication step according to another embodiment of the present invention, the authentication server 200 includes a first random number QRN1, a second random number QRN2, and a third random number QRN3. When generating a random number (QRN) (S511), the terminal 100 requests the user ID (UUID) authentication (S513), to check the user ID (UUID) (S515), the user ID to the legacy server 300 Search request (UUID) (S517), and receives the customer number from the legacy server (S519).

The authentication server 200 transmits the hash function value hashing the user ID (UUID), the quantum random number (QRN), and the quantum random number (QRN) to the terminal 100, and the terminal 100 checks the user ID (UUID). (S523).

When the terminal 100 checks the quantum random number (QRN) and the user ID (UUID), and receives a pattern from the user (S525), the terminal 100 induces a DK to the user KDI (Key derivation ID) (S527).

The encrypted private key Kpriv is decrypted with the verification key DK, and the third random number QRN3 is electronically signed with the private key Kpriv (S528). The session key is generated by deriving the first random number QRN1 and the second random number QRN2 (S529).

The terminal 100 encrypts the sig (QRN3) and the user KDI using the session key and transmits an encryption value to the authentication server (S533).

The authentication server 200 induces the first random number QRN1 and the second random number QRN2 to generate a session key (S531), derives a verification key DK '(S537), and stores the verification key DK as a KDI verification key. Verify the verification key DK 'derived from' '(S539). The authentication server 200 generates a QSP based on the verification key DK '(S543), verifies the QSP to the legacy server (S545), checks a third random number (QRN3) upon receiving the verification result. Verify the sig (QRN3) using the public key KPpub and transmit an authentication success message to the terminal (S549).

5 and 6 are diagrams for explaining a QSP (Quantum Strong Password) generation method of the user authentication method of the present invention.

Referring to FIGS. 5 and 6, FIG. 5A may receive a pattern based on a point shown on a touch screen of a terminal. For example, when a user connects an AECF, the user KDI may be set to 'AECF'. Can be generated. The authentication server 200 generates a quantum seed table (QST) and matches a quantum random sequence corresponding to 'AECF'. For example, a quantum random sequence is generated by matching 'A' and '03e0e286', 'E' and '913df9d3', 'C' and '02af7037', and 'F' and '61024578'. A quantum padding random number (4byte * 5) generated by the quantum random number server may be added to generate a QSP (Quantum Strong Password) quantum random number sequence (4byte * 9). You can then generate a hash key through QSP.

7 is a diagram illustrating a method of updating a QSP in a user authentication method according to an embodiment of the present invention. Referring to FIG. 7, the QSP is updated at every login to improve security.

Although the present invention has been described with reference to the embodiments shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

none.

Claims (7)

In a user authentication method combining a pattern input by a user and a quantum random number,
Including a user registration step and a user authentication step,
The user registration step,
When the terminal generates a user ID (UUID) and requests registration, the authentication server generates a quantum random number (QRN) including a first random number (QRN1), a second random number (QRN2), and a third random number (QRN3). Transmitting a hash function value of the quantum random number (QRN) and the quantum random number (QRN) to the terminal;
Checking, by the terminal, a received quantum random number (QRN) and generating a user key derivation ID (KDI) corresponding to the pattern if a pattern is input from a user;
Generating, by the terminal, a verification key DK and generating a session key by deriving the first random number QRN1 and the second random number QRN2 received from the authentication server;
Encrypting the user KDI, a user ID (UUID), a verification key DK, and a third random number (QRN3) by using the generated session key, and transmitting the encrypted value to the authentication server;
The authentication server guides the first random number (QRN1) and the second random number (QRN2) to generate a session key, generates a user ID (UUID), and requests the legacy server for duplication. Comparing the random number QRN3 with the third random number QRN3 received from the terminal;
Deriving the verification key DK 'by the authentication server, storing the verification key DK ″, and verifying the verification key DK by comparing with the verification key DK received from the terminal;
Generating a QSP (Quantum strong password) based on the verification key DK '; And
And the authentication server registering the QSP (Quantum strong password) with the legacy server, receiving a result value, and transmitting a registration success to the terminal. The method of claim 1,
The user authentication step,
The authentication server generates a quantum random number (QRN) including a first random number (QRN1), a second random number (QRN2), a third random number (QRN3), and when an authentication request is received from the terminal, a user ID (UUID) Checking and receiving a customer number by requesting the legacy server to search for the user ID (UUID);
Transmitting, by the authentication server, a hash function value hashed by a user ID (UUID), a quantum random number (QRN), and a quantum random number (QRN) to the terminal;
When the terminal checks the received user ID (UUID) and the quantum random number (QRN), and receives a pattern from the user, the terminal generates a user key derivation ID (KDI), and generates the first random number (QRN1) and the second random number ( QRN2) to generate a session key;
Encrypting, by the terminal, a user KDI and a third random number (QRN3) using the session key and transmitting an encryption value to an authentication server;
The authentication server derives the first random number QRN1 and the second random number QRN2 to generate a session key, derives the verification key DK ', and receives the third random number QRN3 generated by the authentication server from the terminal. Comparing the third random number QRN3;
Verifying the verification key DK ′ derived from the verification key DK ″ stored as the KDI verification key;
Generating a QSP based on the verification key DK '; And
And authenticating, by the authentication server, the legacy server to verify the QSP, receiving a verification result, and transmitting the authentication success to the terminal. In a user authentication method combining a pattern input by a user and a quantum random number,
Including a private certificate and a non-repudiation user registration step and user authentication step,
The user registration step,
When the terminal generates a user ID (UUID) and requests registration, the authentication server generates a quantum random number (QRN) including a first random number (QRN1), a second random number (QRN2), and a third random number (QRN3). Transmitting a hash function value hashed from a user ID (UUID), a quantum random number (QRN), and a quantum random number (QRN) to the terminal;
When the terminal checks the received quantum random number (QRN) and receives a pattern from the user, the terminal derives a verification key DK with a user KDI (Key derivation ID) corresponding to the pattern, and generates a public key Kpub and a private key Kpriv. step;
Encrypting the private key Kpriv using the verification key DK, storing the private key Kpriv ', and generating a session key by deriving the first random number QRN1 and the second random number QRN2 received from an authentication server;
Encrypting the user KDI, a user ID (UUID), a verification key DK, a third random number (QRN3), and a public key Kpub using the session key generated by the terminal and transmitting an encryption value to the authentication server;
The authentication server checks the user ID (UUID), requests the legacy server for duplication, compares the third random number (QRN3) generated by the authentication server with the third random number (QRN3) received from the terminal, and public key Kpub. Storing the;
The authentication server deriving a verification key DK 'and storing the verification key DK'', and verifying the verification key DK' by comparing it with the verification key DK 'received from the terminal;
Generating a QSP (Quantum strong password) based on the verification key DK '; And
The authentication server includes the step of registering the QSP (Quantum strong password) to the legacy server and receiving a result value and transmitting the registration success to the terminal. The method of claim 1,
The user authentication step,
The authentication server generates a quantum random number (QRN) including a first random number (QRN1), a second random number (QRN2), a third random number (QRN3), and when an authentication request is received from the terminal, a user ID (UUID) Checking and receiving a customer number by requesting the legacy server to search for the user ID (UUID);
Transmitting, by the authentication server, a hash function value hashed by a user ID (UUID), a quantum random number (QRN), and a quantum random number (QRN) to the terminal;
Checking, by the terminal, a received user ID (UUID) and a quantum random number (QRN), and receiving a pattern from the user, inducing a DK with a user key derivation ID (KDI);
Decrypts the encrypted private key Kpriv with a verification key DK, electronically signs a third random number QRN3 with the private key Kpriv, and derives the first random number QRN1 and the second random number QRN2 to generate a session key step;
Encrypting, by the terminal, sig (QRN3) and user KDI using the session key and transmitting an encryption value to an authentication server;
The authentication server guides the first random number QRN1 and the second random number QRN2 to generate a session key, derives the verification key DK ', and derives the verification key DK' derived from the stored verification key DK '' as the KDI verification key. Verifying;
A QSP is generated based on a verification key DK ', a verification request is made to the legacy server for verification of the QSP, and when a verification result is received, a third random number QRN3 is checked, and sig (QRN3) is obtained using a public key Kpub. Verifying and sending an authentication success to the terminal. The method according to claim 1 or 3,
The first random number QRN1, the second random number QRN2, and the third random number QRN3 are quantum random numbers generated using random pulses generated corresponding to the emission time of the alpha particles emitted during the natural collapse of the atomic nucleus. Authentication method. The method according to claim 1 or 3,
The QSP is a quantum random number sequence in which a quantum padding random number generated by a quantum random number server is added to a quantum random number sequence matched to a quantum seed table (QST) based on a user KDI. The method of claim 6,
A user authentication method that renews a new QST (Quantum Seed Table) in the authentication server by deriving two or more QSTs (Quantum Seed Tables) with a user KDI.

Images