KR20200043321A - Method for sso service through blockchain, and terminal and server using the same - Google Patents

Abstract

The present invention relates to a blockchain-based integrated login method, a terminal using the same and a server thereof. The blockchain-based integrated login method comprises the following steps of: checking if a first master certificate corresponding to login information is registered in a first blockchain corresponding to a first service server when integrated login request information using the login information of a specific application of a specific user terminal is obtained from the specific user terminal or the first service server in a state where each of user certificates using a PKI certificate generated through each of applications installed in a user terminal and making each service provided from each service server available is registered in each of blockchains corresponding to each of service servers; and transmitting a first push token ID and a first verification check value to the first service server such that the first service server requests a first signature value obtained by signing a first verification check value by a first master private key of a first master PKI certificate to a first master application of a first master user terminal corresponding to the first push token ID when it is checked that the first master certificate is registered in the first blockchain and the first push token ID and the first verification check value corresponding to the first master certificate are obtained and transmitting a first signature value verification result to the first service server such that the first service server approves an integrated login request when the first signature value is obtained from the first master application of the first master user terminal and is verified to be valid.

Description

Blockchain-based integrated login method, terminal and server using it {METHOD FOR SSO SERVICE THROUGH BLOCKCHAIN, AND TERMINAL AND SERVER USING THE SAME}

The present invention relates to an integrated login method based on a blockchain, a terminal, and a server using the same, and more specifically, each generated through apps installed on a user terminal to enable use of each service provided by each service server. In the state where each user certificate using the PKI certificate is registered in respective blockchains corresponding to each service server, the integrated login request information using the login information in the specific app of the specific user terminal is the specific user terminal or the agent. 1 Obtained from the service server, it is checked whether the first master certificate corresponding to the login information is registered in the first blockchain corresponding to the first service server, and it is confirmed that it is registered in the first blockchain, and thus the first master When the first push token ID corresponding to the certificate and the first verification confirmation value are obtained, the first push Send the token ID and the first verification confirmation value to the first service server to cause the first service server to verify the first verification confirmation value with the first master app of the first master user terminal corresponding to the first push token ID. Request the first signature value signed with the first master private key of the PKI certificate, and verify if the first signature value is obtained from the first master app of the first master user terminal. It relates to a blockchain-based integrated login method, a terminal, and a server using the same, by transmitting to a service server to allow the first service server to approve the integrated login request.

With the development of the high-speed Internet network, user requirements for various services have increased. In addition, users using these services manage individual IDs and passwords for each service when using multiple services or using application programs.

In addition, in order to more accurately determine the access authority of users, service providers or applications that provide financial services, personal information such as a password for an accredited certificate is required in addition to an ID and password.

However, as the service provided by the user increases, the ID and password that the user must remember increase, which causes a lot of inconvenience for the user to use the web service or application.

And, recently, as the number of services to be provided by users increases exponentially due to the development of smart phones, remembering separate IDs and passwords for each of these services is more than just an individual inconvenience. It came to the problem of social cost. That is, as the service providers provide various linked services, many cost problems have to be managed separately for authentication information of duplicate users.

An authentication system called single sign on (SSO), which is an integrated login method, has been introduced to solve these problems and to efficiently manage ID and password to access services.

However, the single sign-on system has a problem that an attacker can access all services when the user's authentication information is stolen by the attacker.

Accordingly, there is a need for a new security algorithm that can effectively protect user authentication information such as personal information from external attacks while enabling integrated login such as single sign-on.

The present invention aims to solve all of the above-mentioned problems.

In addition, another object of the present invention is to provide an integrated login that effectively protects a user's authentication information from external attacks using a blockchain technology of virtual currency.

In addition, another object of the present invention is to provide an integrated login for which security is guaranteed and a forgery / tamper is impossible using a hash function and encryption technology.

In addition, another object of the present invention is to provide an integrated login to prevent problems caused by theft of user information in advance because the user is authenticated through a one-time verification confirmation value.

The representative configuration of the present invention for achieving the above object is as follows.

According to an embodiment of the present invention, in a blockchain-based integrated login method, (a) a plurality of apps in a user terminal-each of the plurality of apps are installed in the user terminal and provided in respective service servers, respectively This is an app that enables the service to be used-Each user certificate using a PKI certificate generated through each-Each of the user certificates is a master certificate and a slave corresponding to apps for using each service provided by the same service server Includes certificates-In the state registered in the respective blockchains corresponding to the respective service servers, the integrated login request information using the login information in the specific app of the specific user terminal is the specific user terminal or the first service If obtained from the server, the authentication support server, the login information corresponding to the 1, checking whether a master certificate is registered in a first blockchain corresponding to the first service server or assisting other devices linked to the authentication support server to check; And (b) if it is confirmed that the first master certificate is registered in the first blockchain and is registered, a first push token ID corresponding to the first master certificate and a first verification confirmation value are obtained. , By supporting the authentication support server to transmit the first push token ID and the first verification confirmation value to the first service server or to allow other devices linked to the authentication support server to transmit to the first service server A first signature signed by the first service server with the first master private key of the first master PKI certificate with the first master app of the first master user terminal corresponding to the first push token ID To request a value, and the first signature from the first master app or the first service server of the first master user terminal When it is obtained, if the first signature value is verified and valid, the first signature value verification result is transmitted to the first service server or another device interlocked with the authentication support server is configured to receive the first signature value verification result. Supporting the first service server to approve the integrated login request by supporting transmission to a service server; A method is provided that includes.

In addition, according to an embodiment of the present invention, in the authentication support server for performing an integrated login based on a blockchain, a plurality of apps in a user terminal-each of the plurality of apps is installed in the user terminal in each service server It is an app that makes available each service provided-Each user certificate using a PKI certificate generated through-Each user certificate corresponds to apps for using each service provided by the same service server Including the master certificate and the slave certificates-in the state registered in the respective blockchains corresponding to each of the service servers, the specific user terminal receives the integrated login request information using the login information in the specific app of the specific user terminal. Or a communication unit obtained from the first service server; And in response to the integrated login request information obtained through the communication unit, check whether a first master certificate corresponding to the login information is registered in the first blockchain corresponding to the first service server or to the authentication support server. A first process that supports other devices to be interlocked to be verified, and a first push corresponding to the first master certificate that is confirmed as being registered as a result of checking whether the first master certificate is registered in the first blockchain When the token ID and the first verification confirmation value are obtained, the first push token ID and the first verification confirmation value are transmitted to the first service server or another device interlocked with the authentication support server is made to the first service server. By supporting the first service server to the first push token ID. The first master app of the corresponding first master user terminal requests the first signature value signed by the first verification private value of the first master PKI certificate with the first master app, and the first master user terminal When the first signature value is obtained from the first master app or the first service server, if the first signature value is verified and valid, a first signature value verification result is transmitted to the first service server or to the authentication support server A processor performing a second process to assist the first service server to approve the integrated login request by supporting another device to be linked to transmit the first signature value verification result to the first service server; An authentication support server is provided.

In addition to this, a computer readable recording medium for recording a computer program for executing the method of the present invention is further provided.

According to the present invention, there are the following effects.

The present invention can effectively protect the user's authentication information from external attacks by implementing an integrated login using blockchain technology of virtual currency.

In addition, the present invention is to secure the user certificate for the integrated login by using a hash function and encryption technology, thereby ensuring security and providing an integrated login that cannot be forged / tampered.

In addition, the present invention authenticates a user for an integrated login through a one-time verification confirmation value, and thus it is possible to prevent a problem caused by theft of user information.

1 schematically shows a blockchain-based integrated login system according to an embodiment of the present invention,
Figure 2 schematically shows an example of registering a user certificate in a blockchain-based integrated login method according to an embodiment of the present invention,
3 schematically shows another example of registering a user certificate in a blockchain-based integrated login method according to an embodiment of the present invention,
4 schematically illustrates another example of registering a user certificate in a blockchain-based integrated login method according to an embodiment of the present invention,
5 schematically illustrates an integrated login method based on a blockchain according to an embodiment of the present invention,
6 schematically illustrates a block chain-based integrated login method according to another embodiment of the present invention.

For a detailed description of the present invention, which will be described later, reference is made to the accompanying drawings that illustrate, by way of example, specific embodiments in which the invention may be practiced. These examples are described in detail enough to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain shapes, structures, and properties described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. In addition, it should be understood that the location or placement of individual components within each disclosed embodiment can be changed without departing from the spirit and scope of the invention. Therefore, the following detailed description is not intended to be taken in a limiting sense, and the scope of the present invention, if appropriately described, is limited only by the appended claims, along with all ranges equivalent to those claimed. In the drawings, similar reference numerals refer to the same or similar functions across various aspects.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily implement the present invention.

1 schematically illustrates a blockchain-based integrated login system according to an embodiment of the present invention, wherein the system includes a first master user terminal 110, a second master user terminal 120, and a first service server ( 210), a second service server 220, a first authentication support server 310, a second authentication support server 320, a first blockchain 410, and a second blockchain 420. .

First, the first master user terminal 110 and the second master user terminal 120 respectively display information serviced to the user and are devices for input and display of information for integrated login, PC, mobile computer, PDA / EDA, mobile phone, smart phone, tablet, and the like. In addition, each of the first master user terminal 110 and the second master user terminal 120 is not limited thereto, and may include all communication devices such as a portable game machine having a wired / wireless communication function and a personal navigation of a digital camera. Further, the first master user terminal 110 and the second master user terminal 120 may be the same user terminal. In addition, each of the first user terminal 110 and the second master user terminal 120 may include a communication unit and a processor that processes information.

Next, each of the first service server 210 and the second service server 220 provides various services that can be used by a user, and includes a communication unit that supports transmission and reception of information and a processor that processes information. You can.

Next, the first authentication support server 310 and the second authentication support server 320 respectively perform a blockchain-based integrated login, and may include a communication unit and a processor, respectively. What is indicated using the same reference numerals is for convenience of description only, and is not intended to mean that these individual devices are the same. Further, in another embodiment of the present invention, the method may be performed by configuring the server differently, or the method may be performed through the same authentication support server. In addition, the first authentication support server 31 and the second authentication support server 320 correspond to each node of each blockchain corresponding to the first service server 210 and the second service server 220, respectively. It can be a server, a server that manages each blockchain node, or a transaction server.

Specifically, the first authentication support server 310 and the second authentication support server 320 typically include computing devices (eg, computer processors, memory, storage, input and output devices, and other components of existing computing devices). Devices that may include; electronic communication devices such as routers, switches, etc .; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., allowing computing devices to function in certain ways) It may be to achieve the desired system performance using a combination of instructions).

The communication unit of such a computing device can transmit and receive requests and responses with other computing devices that are linked. As an example, such requests and responses may be made by the same TCP session, but are not limited thereto. For example, UDP data It may also be transmitted and received as a gram.

In addition, the processor of the computing device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. Also, it may further include a software configuration of an operating system and an application performing a specific purpose.

Next, the first block chain 410 and the second block chain 420 may be a subject that performs data distribution processing by linking blocks for data to a distributed ledger, respectively. At this time, the first blockchain 410 and the second blockchain 420 may each be composed of a plurality of blockchains, and each blockchain may be a private blockchain or a public blockchain.

When explaining the integrated login method based on the blockchain according to an embodiment of the present invention through the system configured as described above is as follows.

First, a method of registering a first master certificate in a blockchain-based integrated login method according to an embodiment of the present invention will be described with reference to FIG. 2.

In order to register the first master certificate corresponding to the services provided by the first service server 210, the user may select a first master certificate corresponding to the first master certificate to be registered among the plurality of apps installed in the first master user terminal 110. The first master PKI certificate is requested to be generated through the first master app, and accordingly, the first master user terminal 110 allows the user to perform the first master PKI certificate, preferably the first master PKI certificate through the first master app. To set the pass information for allowing access to the first master private key in step S51. At this time, the pass information may include at least one of a password, a PIN code, a user's fingerprint information, and a user's biometric information. In addition, setting of pass information for access control to the first master PKI certificate may be omitted.

Thereafter, when the pass information by the user is set, the first master user terminal 110 generates a first master PKI certificate including the first master private key and the first master public key through the first master app (S52). ). In this case, the first master private key may be stored in the SE area of the first master user terminal 110.

Then, the first master user terminal 110 transmits the first master certificate registration request information using the first master PKI certificate generated through the first master app to the first authentication support server 310 or the first master user terminal It may be to be transmitted to the first authentication support server 310 through the other device or the first service server 210 linked to (110) (S53). At this time, the first master certificate registration request information corresponds to user identification information such as a first master public key, a phone number, user terminal identification information such as a universally unique identifier (UUID), first master app identification information, and first master app It may include at least one of the push token ID, and user personal information.

Prior to the operation of generating the first master PKI certificate, the user is connected to the first service server 210 by a general method using an ID and password through the first master app of the first master user terminal 110 In addition, it is possible to perform the operation for registering the first master certificate, and by using the personal identification information such as ARS authentication, account, credit card, public certificate, etc. while logged in to the first service server 210 by a general method. Authentication can also be performed.

Then, the first authentication support server 310 obtains first master certificate registration request information transmitted from the first master user terminal 110 or the first service server 210 through the communication unit, and the processor acquires it through the communication unit A third signature signed a third verification confirmation value using the first master private key of the first master PKI certificate with the first master app of the first master user terminal 110 in response to the requested first master certificate registration request information A request for a third signature value is transmitted to a first master app through a first service server 210 or another device interworking with the first authentication support server 310 (S54). At this time, the third verification confirmation value may include a nonce, a one time password (OTP), or a timestamp.

Then, in response to the third signature value request, the first master app of the first master user terminal 110 generates a third signature value that signs the third verification confirmation value using the first master private key (S55). , The third signature value is the first authentication through the first service server 210 or another device that is connected to the first master user terminal 110 or transmits the generated third signature value to the first authentication support server 310. It is to be transmitted to the support server 310 (S56). At this time, before generating the third signature value, the first master app of the first master user terminal 110 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 1 It is possible to enable signing of the third verification confirmation value using the master private key.

Thereafter, the first authentication support server 310 verifies whether the acquired third signature value is valid or allows another device linked to the first authentication support server 310 to verify (S57).

In this case, verification of the third signature value is verified by verification of the third signature value used for signing the third signature value using the first master public key corresponding to the first master private key used to sign the third signature value. It can be achieved by checking the value and comparing whether the verified verification value of the verified third signature value matches the third verification verification value transmitted when the signature is requested.

And, when the verification of the third signature value is confirmed to be valid, the first authentication support server 310 requests to register the first master certificate including at least the first master public key and certificate registration information in the blockchain 410 Or by requesting (S58) another device interworking with the first authentication support server 310 to register the first master certificate with the first blockchain 410, thereby allowing the first blockchain 410 to receive the first master certificate. To register (S59), to transmit the registration result to the first authentication support server 310 (S60), and when the registration result is obtained, the first authentication support server 310 registers the registration result to the first master user terminal 110 ) Or may be transmitted to the first master user terminal 110 through another device or the first service server 210 that is linked to the first authentication support server 310 (S61). At this time, the first master certificate registered in the first blockchain 410 includes user identification information such as a first master public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), and first master app identification information. , A push token ID corresponding to the first master app, and at least one of user personal information. In addition, the first master certificate includes user identification information such as a first master public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), first master app identification information, and a push token corresponding to the first master app It may include a hash value of at least one of the ID and user personal information.

In the above, the first master certificate has been registered in the first blockchain 410, but the first blockchain 410 may be composed of a plurality, for example, the first blockchain 410 is the first-first blockchain and When configured as a twelfth blockchain, the process of registering the first master certificate to the first-first blockchain and the first-second blockchain by the first authentication support server 310 will be described as follows.

The first authentication support server 310 registers the first master certificate on the 1-1 block chain or allows other devices linked to the first authentication support server 310 to register on the 1-1 block chain.

And, when the triggering condition for registering a predetermined hash value in the 1-2 blockchain is satisfied, the first authentication support server 310 and the first specific hash value generated by applying the hash function to the first master certificate By calculating at least one neighboring hash value matching the first specific hash value, a first representative hash value, which is a Merkle root, or a processed value of the first representative hash value is generated.

In addition, the first authentication support server 310 registers the generated first representative hash value or the value processed by the first representative hash value in the 1-1 block chain, or other linked to the first authentication support server 310. It is possible to cause the device or the 1-1 block chain to register the first representative hash value or the value processed by the first representative hash value in the 1-2 blockchain.

Meanwhile, the first authentication support server 310 may store and manage the first specific hash value and at least one neighbor hash value in a predetermined data structure. Here, the data structure may be various, for example, may be a Merkle tree structure.

That is, the first authentication support server 310 may support to generate or generate a merkle tree in which the first specific hash value is assigned to a specific leaf node, and when the triggering condition is satisfied, the first specific hash value and Register the first representative hash value or the first representative hash value, which is a Merkle root generated by calculating the hash value assigned to at least one other leaf node that is matched, or register it to the 1-2 blockchain or support the first authentication. It may support other devices linked to the server 310 or allow the 1-1-1 blockchain to register with the 1-2 blockchain.

More specifically, (x1) the first authentication support server 310 calculates (i) the first specific hash value and (ii) the hash value assigned to the sibling node of the node to which the first specific hash value is assigned. Or, to support the other devices linked to the first authentication support server 310 to calculate, assign the hash value for the calculation value to the parent node of the node, or allow the other devices linked to the first authentication support server 310 to It can support assignment to the parent node. (x2) If the parent node is the root node of the Merkle tree, the hash value assigned to the parent node is a first representative hash value or a value obtained by processing the first representative hash value. (x3) On the other hand, if the parent node is not the root node of the Merkle tree, the first authentication support server 310 repeats (x1) to (x3) using the hash value assigned to the parent node as the first specific hash value. To do.

And, the first authentication support server 310 finally registers or removes the hash value allocated to the root node of the Merkle tree as the first representative hash value or the first representative hash value as a processed value. 1 It supports other devices linked to the authentication support server 310 or the 1-1 block chain to register with the 1-2 block chain. In this case, the value processed by the first representative hash value may be, for example, a result value of the hex operation performed on the first representative hash value.

Meanwhile, the first authentication support server 310 stores the first specific hash value and at least one neighbor hash value in a predetermined first-first data structure, and thereafter, the first-first data structure having the same form as the first-first data structure. 2 When data structures are stored and managed, the 1-1 data structure and the 1-2 data structure may be connected in a chain form.

In particular, as in the above-described example, when the 1-1 data structure and the 1-2 data structure are Merkle trees, the root value of the 1-1 data structure or the hash value of the root value of the 1-2 data structure Can be assigned to the first leaf node.

In addition, when the 1-2 data structure is generated, data integrity can be further guaranteed by verifying the 1-1 data structure.

In addition, in the case of the first Merkle tree among at least one Merkle tree connected in a chain form, a hash value of a predetermined message data consisting of text, numbers, or symbols or a processed value thereof may be assigned to the first leaf node of the first Merkle tree. have. For example, when creating the Merkle tree, a hash value of an input message first given by the first authentication support server 310 may be allocated.

Meanwhile, the triggering conditions described above are (i) a condition in which a transaction related to the first master certificate is generated by a predetermined number, (ii) a condition in which a predetermined time has elapsed, and (iii) a block is generated in the 1-1 block chain. Conditions, and (iv) conditions for service characteristics.

For example, if a transaction related to the first master certificate is obtained as many as the number of leaf nodes of the Merkle tree, the Merkle tree can be created, and the root value of the Merkle tree can be registered in the 1-2 blockchain or other devices can be registered. have.

In addition, the first authentication support server 310 may generate the root value of the Merkle tree described above in units of a predetermined time (condition (ii) above). In this case, when the predetermined time has elapsed, the first authentication support server 310 generates a Merkle tree using the input values up to then, and registers the root value of the Merkle tree in the 1-2 blockchain or the first authentication support server It can support other devices linked to or the 1-1 block chain to register with the 1-2 block chain.

However, in this case, a value may not be assigned to a sibling node of a node to which a specific hash value of the Merkle tree is assigned even though a predetermined time has elapsed. If the hash value is not assigned to the sibling node of the node to which the first specific hash value is allocated even though the triggering condition is satisfied as described above, the first authentication support server 310 allocates or allocates a predetermined hash value to the sibling node. By supporting it, the root value of the Merkle tree can be calculated in the above-described manner. For example, the first authentication support server 310 may duplicate the first specific hash value and allocate it to a sibling node or support the assignment.

In addition, the service characteristics include cost information provided by the issuer who issued the transaction related to the first master certificate, time zone information in which transaction registration related to the first master certificate is made, area information in which transaction registration service related to the first master certificate is performed, and first. It may be at least a part of company type information that has requested a transaction registration related to the master certificate. However, the present invention is not limited to those described herein, and includes various condition information on which generally recognized differential services can be provided.

On the other hand, when a new Merkle tree generation is started and the triggering condition is satisfied while there is no transaction related to the first master certificate, the first authentication support server 310 assigns predetermined message data to the first leaf node and the second leaf node. Support to create or create an existing Merkle tree, register the root value or a processed value of the Merkle tree in a 1-2 blockchain, or another device or 1-1 block interlocked with the first authentication support server 310 It can assist the chain to register in the 1-2 blockchain. In this case, a 2 leaf node merkle tree may be created.

In addition, as described above, the first authentication support server 310 stores the first specific hash value and at least one neighboring hash value in a predetermined first-first data structure, and then has the same form as the first-first data structure. When the 1-2 data structure is stored and managed, the 1-1 data structure and the 1-2 data structure may be connected in a chain form. In particular, when the 1-1 data structure and the 1-2 data structure are merkle trees, the root value of the 1-1 data structure or the hash value of the root value is allocated to the first leaf node of the 1-2 data structure. You can.

Next, a method of registering a first slave certificate in a blockchain-based integrated login method according to an embodiment of the present invention will be described with reference to FIG. 3.

In order to register the first slave certificate corresponding to the services provided by the first service server 210, the user may select a first slave certificate corresponding to the first slave certificate to be registered among the plurality of apps installed in the first master user terminal 100. 1 Send the first master certificate inquiry request information to the first authentication support server 310 through the slave app, or perform the first authentication through another device or the first service server 210 linked to the first master user terminal 110 It is to be transmitted to the support server 310 (S71). At this time, the user performs the operation for registering the first slave certificate in the state of being connected to the first service server 210 by the general method of using the ID and password through the first slave app of the first master user terminal 110. It may be performed, and additional authentication using personal identification information such as ARS authentication, account, credit card, and public certificate may be performed while logged in to the first service server 210 by a general method.

Then, the first authentication support server 310 requests the first master certificate verification using the user identification information or the user terminal identification information to the first blockchain 410, or another linked to the first authentication support server 310. The first blockchain 410 is requested to request the first master certificate verification through the device (S72), and the first blockchain 410 is responded to the first master certificate verification request from the first authentication support server 310. Checks the registered first master certificate in response to user identification information or user terminal identification information (S73) and transmits the first master certificate verification result including at least the fourth verification confirmation value to the first authentication support server 310 It is done (S74). At this time, the first master certificate verification result is transmitted to the fourth verification confirmation value, the app corresponding to the first master certificate, that is, the first master app ID for the first master app, and the fourth verification confirmation value to the first master app And a URL scheme for requesting a signature for the fourth verification confirmation value. Also, the fourth verification confirmation value may include a nonce, a one time password (OTP), or a timestamp.

On the other hand, when the first blockchain 410 is composed of the first-first blockchain and the twelfth blockchain, the first representative registered in the 1-2 blockchain in response to user identification information or user terminal identification information. Check the processed value of the hash value or the first representative hash value, and correspond to the processed value of the first representative hash value or the first representative hash value identified in the 1-2 blockchain to the 1-1 block chain. The registered Merkle tree information and leaf node information can be checked, and the first master certificate registered in the 1-1 block chain can be verified with reference to the Merkle tree information and leaf node information, or other devices can be verified.

In addition, the first authentication support server 310 transmits the obtained first master certificate verification result to the first master user terminal 110 or another device or first service server linked to the first authentication support server 310 ( 210, the first master certificate verification result is transmitted to the first master user terminal 110 (S75).

Then, the first master user terminal 110 receives the first master certificate verification result, and calls the first master app to transmit the signature value signing the fourth verification confirmation value to the first authentication support server 310 Request (S76). That is, the first master user terminal 110 calls the first master app by the URL scheme obtained from the first master certificate verification result, and allows the fourth verification app to sign and transmit the fourth verification confirmation value. have.

Then, the first master app of the first master user terminal 110 signs the fourth verification confirmation value using the first master private key to generate a fourth signature value (S77), and generates the generated fourth signature value. The fourth signature value is transmitted to the first authentication support server 310 through another device or the first service server 210 that is connected to the first master user terminal 110 or transmitted to the first authentication support server 310. (S78). At this time, before generating the fourth signature value, the first master app of the first master user terminal 110 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 1 The fourth verification confirmation value using the master private key can be signed.

Thereafter, the first authentication support server 310 verifies whether the acquired fourth signature value is valid or allows another device or the first blockchain 410 linked to the first authentication support server 310 to verify (S79) ) (S80).

In this case, verification of the fourth signature value is verified by verifying the fourth signature value used for signing the fourth signature value using the first master public key corresponding to the first master private key used for signing the fourth signature value. It can be achieved by checking the value and comparing whether the verified verification value of the verified fourth signature value matches the fourth verification verification value transmitted when the signature is requested.

And, if the verification result of the verification of the fourth signature value is confirmed to be valid or the verification result that the fourth signature value is valid is obtained from the first blockchain 410 (S81), the first authentication support server 310 is verified. Is transmitted to the first slave app of the first master user terminal 110 or through another device or the first service server 210 linked to the first authentication support server 310 (S82) (S83).

Then, the first master user terminal 110 sets the pass information for allowing the user to access the first slave PKI certificate, preferably the first slave PKI certificate, to the first slave private key through the first slave app. (S84). At this time, the pass information may include at least one of a password, a PIN code, a user's fingerprint information, and a user's biometric information. Also, setting of pass information for controlling access to the first slave PKI certificate may be omitted.

Thereafter, when the pass information is set by the user, the first master user terminal 110 generates a first slave PKI certificate including a first slave private key and a first slave brick key through the first slave app (S85). ). At this time, the first slave private key may be stored in the SE area of the first master user terminal 100.

Then, the first master user terminal 110 transmits the first slave certificate registration request information using the first slave certificate generated through the first slave app to the first authentication support server 310 or the first master user terminal ( 110 may be transmitted to the first authentication support server 310 through another device or the first service server 210 linked to the server (S86). At this time, the first slave certificate registration request information corresponds to user identification information such as a first slave public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), first slave app identification information, and first slave app It may include at least one of the push token ID, and user personal information.

Then, the first authentication support server 310 obtains first slave certificate registration request information transmitted from the first master user terminal 110 or the first service server 210 through the communication unit, and the processor acquires it through the communication unit A fifth signature that signs the fifth verification confirmation value using the first slave private key of the first slave PKI certificate with the first slave app of the first master user terminal 110 in response to the requested first slave certificate registration request information Request the value or allow the fifth signature value request to be transmitted to the first slave app through the first service server 210 or another device interlocked with the first authentication support server 310 (S87). At this time, the fifth verification confirmation value may include a nonce, a one time password (OTP), or a timestamp.

Then, in response to the fifth signature value request, the first slave app of the first master user terminal 110 generates a fifth signature value that signs the fifth verification confirmation value using the first slave private key (S88). , The fifth signature value is the first authentication through the first service server 210 or another device that is connected to the first master user terminal 110 or transmits the generated fifth signature value to the first authentication support server 310. It is to be transmitted to the support server 310 (S89). At this time, before generating the fifth signature value, the first slave app of the first master user terminal 110 requests the user to input the pass information, and when the pass information input by the user matches the set pass information. It is possible to enable signing of the fifth verification confirmation value using the 1 slave private key.

Thereafter, the first authentication support server 310 verifies whether the obtained fifth signature value is valid or allows another device or the first blockchain 410 linked to the first authentication support server 310 to verify (S90) ).

In this case, the verification of the fifth signature value is verified by using the first slave public key corresponding to the first slave private key used to sign the fifth signature value, and verifying the fifth signature value used in the signature of the fifth signature value. It can be achieved by checking the value and comparing whether the verified verification value of the verified fifth signature value matches the fifth verification verification value transmitted when the signature is requested.

In addition, when it is confirmed that the fifth signature value is valid as a result of verification, the first authentication support server 310 registers the first slave certificate including at least the first slave public key and certificate registration information in the first blockchain 400. The first blockchain 410 to the first slave by requesting or requesting another device linked to the first authentication support server 310 to register the first slave certificate with the first blockchain 410 (S91). The certificate is registered (S92), the registration result is transmitted to the first authentication support server 310 (S93), and when the registration result is obtained, the first authentication support server 310 sends the registration result to the first master user terminal It may be transmitted to (110) or to be transmitted to the first master user terminal 110 through another device or the first service server 210 interlocked with the first authentication support server 310 (S94). At this time, the first slave certificate registered in the first blockchain 410 includes user identification information such as a first slave public key, a phone number, user terminal identification information such as a universally unique identifier (UUID), and first slave app identification information. , A push token ID corresponding to the first slave app, and at least one of user personal information. In addition, the first slave certificate includes user identification information such as a first slave public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), first slave app identification information, and a push token corresponding to the first slave app It may include a hash value of at least one of the ID and user personal information.

In the above, the first slave certificate has been registered in the first blockchain 410, but the first blockchain 410 may be composed of a plurality, for example, the first blockchain 410 is the first-first blockchain and When configured as a 1-2 blockchain, a process in which the first authentication support server 310 registers the first slave certificate to the 1-1 blockchain and the 1-2 blockchain is described in detail as follows.

The first authentication support server 310 registers the first slave certificate in the 1-1 block chain or allows other devices linked to the first authentication support server 310 to register in the 1-1 block chain.

And, when the triggering condition for registering a predetermined hash value in the 1-2 blockchain is satisfied, the first authentication support server 310 and the second specific hash value generated by applying the hash function to the first slave certificate By calculating at least one neighboring hash value matching the second specific hash value, a second representative hash value, which is a Merkle root, or a processed value of the second representative hash value is generated.

In addition, the first authentication support server 310 registers the generated first hash value or the second representative hash value processed value in the 1-2 blockchain or other device interlocked with the first authentication support server 310. Alternatively, the 1-1 block chain may be registered to register the second representative hash value or the second representative hash value to the 1-2 blockchain.

Meanwhile, the first authentication support server 310 may store and manage the second specific hash value and at least one neighbor hash value in a predetermined data structure. Here, the data structure may be various, for example, may be a Merkle tree structure.

That is, the first authentication support server 310 may support to generate or generate a merkle tree in which the first specific hash value is assigned to a specific leaf node, and when the triggering condition is satisfied, the second specific hash value and Register the first representative hash value or the second representative hash value, which is a Merkle root generated by calculating the hash value assigned to at least one other leaf node that is matched, or register it in the 1-2 blockchain or support the first authentication. It may support other devices linked to the server 310 or allow the 1-1-1 blockchain to register with the 1-2 blockchain.

Since a detailed description of this can be understood from the description of FIG. 2, it will be omitted.

In addition, in the above, as a result of checking the first master certificate for registering the first slave certificate, it is assumed that the first master certificate is registered in the first blockchain 410, but unlike this, the first master certificate is the first block If not registered in the chain 410, the first authentication support server 310 may register the master certificate in response to the first slave certificate registration request information through the first slave app.

That is, as a result of checking the first master certificate registered in the first blockchain 410 in response to the first master certificate inquiry request information through the first slave app of the first master user terminal 110, the first master certificate is removed. 1 If it is confirmed that the blockchain 410 is not registered, the first authentication support server 310 causes the first slave app of the first master user terminal 110 to request the master certificate registration using the first slave PKI certificate To the first authentication support server 310 or the master certificate registration request information using the second slave PKI certificate through another device interworking with the first master user terminal 110 or the first service server 210. 1 to be transmitted to the authentication support server 310, and when the master certificate registration request information using the second slave PKI certificate is obtained, the first slave app of the first master user terminal 100 Request a sixth signature value that signs the sixth verification confirmation value using the first slave private key of the first slave PKI certificate, and is interlocked with the first master user terminal 100 or the first master user terminal 110 When the sixth signature value is obtained from the other device or the first service server 210, the sixth signature value is verified or the other device or the first blockchain 410 interlocked with the first authentication support server 310 is removed. 6 Supports verifying the signature value, and if the sixth signature value is confirmed to be valid, the master certificate using the first slave PKI certificate including at least the first slave public key and certificate registration information of the first slave PKI certificate is the first block. Whether to be registered in the chain 410 or another device interlocked with the first authentication support server 310 to register the master certificate using the first slave PKI certificate to the first blockchain 410. Can.

At this time, the first block chain 400 may be composed of a 1-1 block chain and a 1-2 block chain, and the operation thereof can be confirmed from the above description, so a detailed description thereof will be omitted.

Next, a method of registering a second master certificate in a blockchain-based integrated login method according to an embodiment of the present invention will be described with reference to FIG. 5.

The second master certificate is defined for convenience of description, and may be another slave certificate corresponding to the first master certificate, and a second service server 220 different from the first service server 210 corresponding to the first master certificate It may be a user certificate registered to use the service provided by). In addition, the second master user terminal 120 described below may be the same user terminal as the first master user terminal 110.

The user registers the first master certificate corresponding to the service provided to the first service server 210 by the method as shown in FIG. 2, and the second corresponding to the services provided from the second service server 220 In order to register the master certificate, the second master certificate is searched by the second authentication support server 320 through the second master app corresponding to the second master certificate to be registered among the plurality of apps installed in the first master user terminal 120. The request information is transmitted or transmitted through another device or a second service server 220 that is linked to the second master user terminal 120 (S101). At this time, the user performs an operation for registering the second master certificate while connected to the second service server 220 by a general method using an ID and password through the second master app of the first master user terminal 110. It may be performed, and additional authentication using personal identification information such as ARS authentication, account, credit card, and public certificate may be performed while logged in to the second service server 220 by a general method.

Then, the second authentication support server 320 requests the second master certificate verification using the user identification information or the user terminal identification information to the second blockchain 420, or another linked to the second authentication support server 320. The second blockchain 420 is requested to request the second master certificate verification through the device (S102), and the second blockchain 420 is responded to the second master certificate verification request from the second authentication support server 320. Checks the registered second master certificate in response to user identification information or user terminal identification information (S103), and transmits the second master certificate verification result to the second authentication support server 300 (S104).

At this time, since the second master certificate is not registered, the second master certificate verification result may be no certificate.

Then, the second authentication support server 320 requests the first master certificate verification request from the first authentication support server 310 or the first authentication support server 310 through another device interworking with the second authentication support server 320. ) Can be requested to confirm the first master certificate (S105). In this case, the first master certificate verification request may include user identification information or identification information of the user terminal, and may also include a hash function of user identification information or identification information of the user terminal.

Then, the first authentication support server 310 requests the first master certificate verification to the first blockchain 410 in response to the first master certificate verification request obtained from the second authentication support server 320 (S106). , The first blockchain 410 checks whether the first master certificate is registered (S107) and transmits the verified first master certificate verification result to the first authentication support server 310 (S108). At this time, the first master certificate verification result is transmitted to the seventh verification confirmation value, the app corresponding to the first master certificate, that is, the first master app ID for the first master app, and the sixth verification confirmation value to the first master app And a URL scheme for requesting a signature for the sixth verification confirmation value. Further, the first verification confirmation value may include a nonce, a one time password (OTP), or a timestamp.

On the other hand, when the first blockchain 410 is composed of a 1-1 block chain and a 1-2 block chain, the first registered in the 1-2 block chain in response to user identification information or user terminal identification information Check the representative hash value or the value processed by the first representative hash value, and correspond to the processed value of the first representative hash value or the first representative hash value identified in the 1-2 blockchain, the 1-1 block chain It is possible to check the Merkle tree information and leaf node information registered to the first Master user certificate registered in the 1-1 block chain with reference to the Merkle tree information and leaf node information, or to assist other devices to check. .

Then, the first authentication support server 310 transmits the obtained first master certificate verification result to the second authentication support server 320 or the first user certificate through another device interworking with the first authentication support server 310. The verification result is transmitted to the second authentication support server 320 (S109).

Then, the second authentication support server 320 transmits the first master certificate verification result obtained from the first authentication support server 310 to the second master user terminal 110 or interlocks with the second authentication support server 320 To be transmitted to the second master user terminal 120 through the other device or the second service server 220 (S110).

Then, the second master user terminal 120 receives the first master certificate verification result through the second master app, and calls the first master app 110 of the first master user terminal 110 to confirm the seventh verification The signature value is requested to be transmitted to the first authentication support server 310 (S111). That is, the second master user terminal 120 transmits the URL scheme obtained from the first master certificate verification result to the first master user terminal 110, so that the first master user terminal 110 is the first by the URL scheme. The master app is called, and the seventh verification confirmation value can be signed and transmitted through the first master app.

Then, the first master app of the first master user terminal 110 signs the seventh verification confirmation value using the first master private key to generate a seventh signature value (S112), and generates the generated seventh signature value. The seventh signature value is transmitted to the first authentication support server 310 through another device or the first service server 210 that is connected to the first master user terminal 110 or transmitted to the first authentication support server 310. (S113). At this time, before generating the seventh signature value, the first master app of the first master user terminal 110 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 1 It is possible to enable signing of the seventh verification confirmation value using the master private key.

Thereafter, the first authentication support server 310 verifies whether the obtained seventh signature value is valid or allows another device or the first blockchain 410 linked to the first authentication support server 310 to verify (S114). ) (S115).

In this case, the verification of the seventh signature value is verified by using the first master public key corresponding to the first master private key used to sign the seventh signature value. It can be achieved by checking the value and comparing whether the verification verification value of the verified seventh signature value matches the seventh verification verification value transmitted when the signature is requested.

Then, when the verification result of the verification of the seventh signature value is confirmed to be valid or the verification result that the seventh signature value is valid is obtained from the first blockchain 410 (S116), the first authentication support server 310 is verified. Is transmitted to the first master app of the first master user terminal 110 or through another device or the first service server 210 linked to the first authentication support server 310 (S117).

Then, the first master user terminal 110 transmits the verification result for the seventh signature value obtained through the first master app to the second master user terminal 120 (S118), so that the second master user terminal 120 Let the second master app of the second master user certificate registration operation.

That is, in response to the verification result for the seventh signature value, the second master app of the first master user terminal 120 allows the user to use the second master PKI certificate, preferably the second master private key of the second master PKI certificate. To set the pass information for allowing access (S119). At this time, the pass information may include at least one of a password, a PIN code, a user's fingerprint information, and a user's biometric information. Also, setting of pass information for controlling access to the second master PKI certificate may be omitted.

Thereafter, when the pass information by the user is set, the second master user terminal 120 generates a second master PKI certificate including the second master private key and the second master public key through the second master app (S120). ). At this time, the second master private key may be stored in the SE area of the second master user terminal 120.

Then, the second master user terminal 120 transmits the second master certificate registration request information using the second master PKI certificate generated through the second master app to the second authentication support server 320 or the second master user terminal It may be transmitted to the second authentication support server 320 through another device or a second service server 220 interlocked with (120) (S121). At this time, the second master certificate registration request information corresponds to user identification information such as a second master public key, a phone number, user terminal identification information such as a universally unique identifier (UUID), second master app identification information, and second master app It may include at least one of the push token ID, and user personal information.

Then, the second authentication support server 320 obtains the second master certificate registration request information transmitted from the second master user terminal 110 or the second service server 220 through the communication unit, and the processor acquires it through the communication unit The eighth signature that signs the eighth verification confirmation value using the second master private key of the second master PKI certificate with the second master app of the second master user terminal 120 in response to the requested second master certificate registration request information Request the value or allow the eighth signature value request to be transmitted to the second master app of the second master user terminal 120 through another device or the second service server 220 linked to the second authentication support server 320. (S122). In this case, the eighth verification confirmation value may include a nonce, a one time password (OTP), or a timestamp.

Then, in response to the eighth signature value request, the second master app of the second master user terminal 120 generates an eighth signature value that signs the eighth verification confirmation value using the second master private key (S123). , The generated 8th signature value is transmitted to the second authentication support server 320 or the 8th signature value is the second authentication through another device or the second service server 220 interlocked with the second master user terminal 120. It is to be transmitted to the support server 320 (S124). At this time, before generating the eighth signature value, the second master app of the second master user terminal 120 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 2 It is possible to enable signing of the eighth verification confirmation value using the master private key.

Thereafter, the second authentication support server 320 verifies whether the obtained eighth signature value is valid or allows another device or the second blockchain 420 linked to the second authentication support server 320 to verify (S125) ).

At this time, the verification of the eighth signature value is verified by using the second master public key corresponding to the second master private key used to sign the eighth signature value. It can be achieved by checking the value and comparing whether the verification verification value of the verified eighth signature value matches the eighth verification verification value transmitted when the signature is requested.

And, when the verification of the eighth signature value is confirmed to be valid, the second authentication support server 320 registers the second master certificate including at least the second master public key and certificate registration information in the second blockchain 420. The second master 420 by requesting (S126) the second master certificate to be registered in the second blockchain 420 by the other device interlocked with the second authentication support server 320. To register the certificate (S127), to transmit the registration result to the second authentication support server 320 (S128), when the registration result is obtained, the second authentication support server 320 registers the result of the second master user terminal It may be transmitted to (120) or to be transmitted to the second master user terminal 120 through another device or a second service server 220 linked to the second authentication support server 320 (S129). At this time, the second master certificate registered in the second blockchain 420 includes user identification information such as a second master public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), and second master app identification information. , A push token ID corresponding to the second master app, and at least one of user personal information. In addition, the second master certificate includes user identification information such as a second master public key and a phone number, user terminal identification information such as a universally unique identifier (UUID), second master app identification information, and a push token corresponding to the second master app It may include a hash value of at least one of the ID and user personal information.

In the above, the second master certificate has been registered in the second blockchain 420, but the second blockchain 420 may be composed of a plurality, for example, the second blockchain 420 may be connected to the 2-1 blockchain. When configured as a 2-2 blockchain, the process of registering the second user certificate to the 2-1 blockchain and the 2-2 blockchain by the second authentication support server 320 will be described in detail as follows.

The second authentication support server 320 registers the second master certificate in the 2-1 blockchain or allows other devices linked to the second authentication support server 320 to register in the 2-1 blockchain.

And, when the triggering condition for registering a predetermined hash value in the 2-2 blockchain is satisfied, the second authentication support server 320 and the third specific hash value generated by applying the hash function to the second master certificate By calculating at least one neighboring hash value matching the third specific hash value, a third representative hash value, which is a Merkle root, or a processed value of the third representative hash value is generated.

In addition, the second authentication support server 320 registers the generated third representative hash value or the value processed by the third representative hash value in the 2-2 blockchain or is linked to the second authentication support server 320. The device or the 2-1 blockchain may register the third representative hash value or the processed value of the third representative hash value in the 2-2 blockchain.

Meanwhile, the second authentication support server 320 may store and manage the third specific hash value and at least one neighbor hash value in a predetermined data structure. Here, the data structure may be various, for example, may be a Merkle tree structure.

That is, the second authentication support server 320 may support to generate or generate a merkle tree in which the third specific hash value is assigned to a specific leaf node, and when the triggering condition is satisfied, the third specific hash value and Registering the third representative hash value or the third representative hash value, which is a Merkle root generated by calculating the hash value assigned to at least one other leaf node that is matched, registers in the 2-2 blockchain or supports second authentication. It may support other devices linked to the server 320 or allow the 2-1 blockchain to register with the 2-2 blockchain.

The detailed description of this will be omitted because it can be understood through the description above.

Next, referring to FIG. 5, a blockchain-based integrated login method according to an embodiment of the spring invention will be described.

2 to 4, in the state in which user certificates are registered by the same method as in FIGS. 2 to 4, the user performs an integrated login for using the specific service provided by the first service server 210 using the specific user terminal 111. If requested (S1), the first service server 210 requests confirmation of the first master certificate corresponding to the login information according to the integrated login request to the first authentication support server 310 (S1).

In this case, the specific user terminal 111 may be a user terminal using a platform different from the platform in which the first master certificate, the first slave certificate, or the second master certificate is registered. For example, the service according to the user certificate certificate registration may use a mobile platform, while the specific user terminal 111 may use a web platform such as a PC. Of course, the platform for registering a specific user terminal 111 and a user certificate may be the same. In addition, the login information may include at least one of a public key, user identification information, and user terminal identification information. In particular, when user terminal identification information for a user terminal is different, a user having the same identification information such as a phone number The identification information may be used as login information.

Then, the first service server 210 requests confirmation of the first master certificate from the first authentication support server 310 using the login information (S2), and the first authentication support server 310 provides the first service In response to the request for confirming the first master certificate from the server 210, the first blockchain 410 requests the verification of the first master certificate corresponding to the login information, or another device interworking with the first authentication support server 310 Let the request for confirmation (S3).

Then, the first blockchain 410 checks the registered first master certificate in response to the first user certificate verification request from the first authentication support server 310 (S4), and confirms the confirmed first master certificate result Is transmitted to the first authentication support server 310 (S5).

As a result of the verification, when it is confirmed that the first master certificate is registered in the first blockchain 410, the first authentication support server 310 is the first master app of the first master user terminal 110 and the ninth verification confirmation value. The signature value request information including the information is transmitted or transmitted through another device or the first service server 210 linked to the first authentication support server 310 (S6) (S7). At this time, the signature value request information may include a ninth verification confirmation value and a push token ID corresponding to the first master app.

Then, the first master user terminal 110 calls the first master app using the push token ID included in the signature value request information and signs the ninth verification value using the first master private key. Generates a value (S8), and transmits the generated ninth signature value to the first authentication support server 310 or transmitted through another device or first service server 210 linked to the first master user terminal 110 To do so (S9). At this time, before generating the ninth signature value, the first master app of the first master user terminal 110 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 1 It is possible to enable signing of the ninth verification confirmation value using the master private key.

In addition, when the ninth signature value from the first master app of the first master user terminal 110 is obtained, the first authentication support server 310 verifies the ninth signature value or the first authentication support server 310. To verify through other devices or first blockchain 410 linked to (S10). In this case, verification of the ninth signature value is verified by verification of the ninth signature value used to sign the ninth signature value using the first master public key corresponding to the first master private key used to sign the ninth signature value. It can be achieved by checking the value and comparing whether the verification verification value of the verified ninth signature value matches the ninth verification verification value transmitted when the signature is requested.

As a result of verification, if the signature value is confirmed to be valid, the first authentication support server 310 allows the first service server 210 to log in to the first service server 210 through the specific user terminal 111. The user supports the service provided by the first service server 210 through a specific user terminal 111 (S11) (S12).

Then, the first authentication support server 310 requests to register an integrated login session with the first blockchain 410 or through another device interworking with the first authentication support server 310 (S13), and accordingly The first blockchain 410 registers an integrated login session (S14) and transmits the registration result to the first authentication support server 310 (S14).

At this time, even when the first blockchain 410 is composed of the first-first blockchain and the first-second blockchain, the information corresponding to the integrated login session by the same method as above is communicated with the first-first blockchain. You can register in the 1-2 blockchain.

Next, referring to FIG. 6, a block chain based integrated login method according to an embodiment of the present invention will be described.

When a user requests an integrated login to the first authentication support server 310 through a specific user terminal 111 or requests through another device or a first service server 210 linked to a specific user terminal (S21) (S22) ), The first authentication support server 310 requests the first master certificate verification to the first blockchain 410 in response to the integrated login request, or the other device linked to the first authentication support server 320 to confirm. Request it (S83).

Then, the first blockchain 410 checks the registered first master certificate in response to the first master certificate verification request from the first authentication support server 310 (S24), and the verified result information is first authenticated. It transmits to the support server 310 (S25).

As a result of the verification, when it is determined that the first master certificate is not registered, the first authentication support server 310 requests the second master certificate verification from the second authentication support server 320 or the first authentication support server 310. Request to the second authentication support server 320 through another interlocked device (S26).

Then, the second authentication support server 320 requests the second master certificate verification to the second blockchain 420 or requests it through another device linked to the second authentication support server 320 (S27). 2 Blockchain 420 checks whether the second master certificate is registered (S28).

As a result of verification, when the second master certificate is registered, the second blockchain 420 transmits the result information to the second authentication support server 320 (S29), and the second authentication support server 310 results The second master user terminal 120 transmits the signature value request information including the tenth verification confirmation value to the second master user terminal 120 with reference to the information or through another device interworking with the second authentication support server 320 ) (S30). At this time, the signature value request information may include a tenth verification confirmation value and a push token ID corresponding to the second master app.

Then, the second master user terminal 110 signs the tenth verification confirmation value using the second master private key by calling the second master app using the push token ID included in the signature value request information. The value is generated (S31), and the generated tenth signature value is transmitted to the second authentication support server 320 or transmitted through another device interlocked with the second master user terminal 120 (S32). At this time, before the second master app generates the tenth signature value, the second master app of the second master user terminal 120 requests the user to input the pass information, and if the pass information input by the user matches the set pass information. 2 It is possible to enable signing of the tenth verification confirmation value using the master private key.

Then, when the second authentication support server 310 obtains the tenth signature value from the second master app of the second master user terminal 120, the tenth authentication value is verified or the second authentication support server 320 To verify through another device or a second blockchain 420 linked to the (S33). In this case, the verification of the tenth signature value is verified by using the second master public key corresponding to the second master private key used to sign the tenth signature value. It can be achieved by checking the value and comparing whether the verification verification value of the verified tenth signature value matches the tenth verification verification value transmitted when the signature is requested.

As a result of verification, if the signature value is confirmed to be valid, the second authentication support server 320 transmits the verification result to the first authentication support server 310 (34), and the first authentication support server 310 responds to the verification result. Correspondingly, the first service server 210 allows the integrated login to the first service server 210 through the specific user terminal 111 so that the user can receive the first service server 210 through the specific user terminal 111. The provided service is supported to be available (S35) (S36).

Then, the first authentication support server 310 requests to register an integrated login session with the first blockchain 410 or through another device interworking with the first authentication support server 310 (S37), and accordingly The first blockchain 410 registers an integrated login session (S38) and transmits the registration result to the first authentication support server 310 (S39).

At this time, even when the first blockchain 410 is composed of the first-first blockchain and the first-second blockchain, the information corresponding to the integrated login session by the same method as above is communicated with the first-first blockchain. You can register in the 1-2 blockchain.

In addition, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and can be recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention or may be known and available to those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs, DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

In the above, the present invention has been described by specific matters such as specific components, etc. and limited embodiments and drawings, which are provided to help the overall understanding of the present invention, but the present invention is not limited to the above embodiments , Those skilled in the art to which the present invention pertains can make various modifications and variations from these descriptions.

Therefore, the spirit of the present invention is not limited to the above-described embodiment, and should not be determined, and all claims that are equally or equivalently modified as well as the claims below will fall within the scope of the spirit of the present invention. Would say

110: first master user terminal,
111: a specific user terminal,
120: second master user terminal,
210: first service server,
220: second service server,
310: first authentication support server,
320: second authentication support server,
410: first blockchain,
420: second blockchain

Claims (16)

In the blockchain-based integrated login method,
(a) A plurality of apps on the user terminal-each of the plurality of apps is installed on the user terminal, each of which is an app that enables use of each service provided by a service server-using each generated PKI certificate through each User certificates-each of the user certificates includes a master certificate and slave certificates corresponding to apps for using each service provided by the same service server-respective blockchains corresponding to the respective service server In the registered state, when integrated login request information using login information in a specific app of a specific user terminal is obtained from the specific user terminal or the first service server, the authentication support server, the first master corresponding to the login information The certificate is registered in the first blockchain corresponding to the first service server Checking whether there is or assisting other devices linked to the authentication support server to check; And
(b) When it is confirmed that the first master certificate is registered in the first blockchain, it is confirmed that it is registered, and when a first push token ID and a first verification confirmation value corresponding to the first master certificate are obtained, The authentication support server transmits the first push token ID and the first verification confirmation value to the first service server or assists other devices linked to the authentication support server to transmit to the first service server. The first signature value signed by the first master private key of the first master PKI certificate with the first master server of the first master user terminal corresponding to the first push token ID by the first service server And the first signature value from the first master app or the first service server of the first master user terminal. When obtained, the first signature value verification result is valid, and when the first signature value verification result is valid, the first signature value verification result is transmitted to the first service server, or another device interlocked with the authentication support server sends the first signature value verification result to the first Supporting the first service server to approve the integrated login request by supporting transmission to a service server;
Method comprising a. According to claim 1,
In step (b), if it is determined that the first master certificate is registered in the first blockchain and is not registered, the authentication support server, (i) each corresponding to the respective service server Requesting the verification of the second master certificate corresponding to each service server to at least one other authentication support server of the other authentication support servers, causes the at least one other authentication support server to (i-1) log in to the login information. The corresponding second master certificate is checked in the second blockchain corresponding to the second service server to obtain a second push token ID and a second verification confirmation value corresponding to the second master certificate, and (i -2) The second push token ID is transmitted to the second service server by sending the second push token ID and the second verification confirmation value to the second service server. Support the second master app of the corresponding second master user terminal to request the second verification value signed by the second master private key of the second master PKI certificate with the second master app, (i-3) 2 When the second signature value is obtained from the second master app or the second service server of the master user terminal, verify the second signature value and, if valid, transmit the second signature value verification result to the authentication support server (Ii) when the second signature value verification result is obtained from the at least one other authentication support server, the authentication support server transmits the second signature value verification result to the first service server, or The first service server is connected to the authentication service server by supporting another device linked to the authentication support server to transmit the second signature value verification result to the first service server. Assisting to approve the sum login request;
Method further comprising a. According to claim 1,
In step (a),
The authentication support server,
A method of registering the approved integrated login session on the first blockchain or supporting another device linked to the authentication support server to register the integrated login session on the first blockchain. According to claim 1,
Before step (a),
(a01) When the first master certificate registration request information using the first master PKI certificate generated through the first master app of the first master user terminal is obtained from the first master user terminal, the authentication support server , Request a third signature value that signs a third verification confirmation value using the first master private key of the first master PKI certificate to the first master app of the first master user terminal, and the first master user When the third signature value is obtained from the terminal, when the third signature value is verified and verified as valid, the first master certificate including at least the first master public key and certificate registration information of the first master PKI certificate is the first Step 1 to be registered in the blockchain;
(a02) When the first master certificate inquiry request information through the first slave app of the first master user terminal is obtained from the first master user terminal, the authentication support server is registered in the first blockchain The first master certificate is supported, and the first master certificate is supported by transmitting verification result information for the first master certificate including at least a fourth verification confirmation value to the first slave app of the first master user terminal. Causing the slave app to request the first master app to transmit the fourth verification value signed with the first master private key to the authentication support server through the first master app. ; And
(a03) If at least the fourth signature value is obtained from the first master app of the first master user terminal, the authentication support server verifies the fourth signature value, and if it is determined to be valid, the fourth signature value verification result To the first master app of the first master user terminal to cause the first master app of the first master user terminal to transmit the fourth signature value verification result to the first master user terminal of the first master user terminal The first slave certificate registration request information using the first slave PKI certificate generated through the first slave app of the first master user terminal in response to the fourth signature value verification result is transmitted to the slave app. 1 obtained from the master user terminal, the first slave to the first slave app of the first master user terminal Request a fifth signature value that signs a fifth verification confirmation value using the first slave private key of the Eve PKI certificate, and verify the fifth signature value when the fifth signature value is obtained from the first master user terminal If it is confirmed to be valid, at least the first slave public key of the first slave PKI certificate and the first slave certificate including the certificate registration information to be registered in the first blockchain;
Method further comprising a. According to claim 4,
When the first master app or the first slave app generates the first master PKI certificate or the first slave PKI certificate, the first master private key of the first master PKI certificate or the first slave PKI certificate Method for allowing a user to set each pass information for allowing access to the first slave private key. According to claim 4,
In step (a02),
The authentication support server transmits a first master app ID corresponding to the first master certificate confirmed from the first blockchain, and the fourth verification confirmation value to the first master app and the fourth verification confirmation value The method of claim 1, further comprising a URL scheme for requesting a signature for the first master certificate and transmitting the result to the first slave app. According to claim 1,
Before step (a),
(a04) When the first master certificate registration request information using the first master PKI certificate generated through the first master app of the first master user terminal is obtained from the first master user terminal, the authentication support server , Request the sixth signature value signed the sixth verification confirmation value using the first master private key of the first master PKI certificate to the first master app of the first master user terminal, and the first master user When the sixth signature value is obtained from the terminal, the first master certificate including at least the first master public key and certificate registration information of the first master PKI certificate is verified when the sixth signature value is verified and valid. Step 1 to be registered in the blockchain;
(a05) A second master certificate through the second master app of the second master user terminal, wherein the second master app is an app installed on the second user terminal to use a service provided by a second service server- -The second master certificate is registered in the second blockchain in response to the second master app-As a result of checking with the second blockchain in response to a confirmation request, the second master certificate is registered in the second blockchain If it is determined that the request information of the first master certificate is obtained from another authentication support server interworking with the second service server, the authentication support server registers the first master certificate registered in the first blockchain. Or the other master interworking with the authentication support server to check the first master certificate registered in the first blockchain. Lock support, and transmits verification result information for the first master certificate including at least a seventh verification confirmation value to the second master app of the second master user terminal through the other authentication support server or the authentication support server Allows the second master app to be sent to the second master app of the second master user terminal through the other authentication support server through the other authentication support server to confirm the result information for the first master certificate, the The first master of the first master user terminal, so as to transmit the seventh signature value signed with the first private key to the authentication support server through the first master app of the first master user terminal. Causing the app to request; And
(a06) If at least the seventh signature value is obtained from the first master app of the first master user terminal or at least the seventh signature value is obtained from another device interworking with the first master user terminal, the authentication support The server verifies the seventh signature value or assists another device or the first blockchain that is linked to the authentication support server to verify the seventh signature value, and verifies if the seventh signature value is verified to be valid By transmitting a result to the first master app of the first master user terminal or by transmitting the verification result to the first master app of the first master user terminal through another device interworking with the authentication support server (i ) The first master app transmits the verification result to the second master app of the second master user terminal, so that the second The master app generates a second PKI certificate and sends the second master certificate registration request information using the second PKI certificate to the other authentication support server, and (ii) in response to the second master certificate registration request information. Another authentication support server (ii-1) requests the eighth signature value signed the eighth verification confirmation value using the second master private key of the second master PKI certificate to the second master app, and (ii- 2) When the eighth signature value is obtained from the second master user terminal or another device interworking with the second master user terminal, the eighth signature value is verified or another device or the second device linked to the other authentication support server 2 If the eighth signature value is confirmed to be valid by supporting the blockchain to verify the eighth signature value, at least the second master public of the second master PKI certificate The method comprising: a second master certificate including a certificate properties that support registered in the second block chain;
Method comprising a. According to claim 1,
The first master certificate or the first slave certificate may be the first master public key or the first slave public key, user identification information, user terminal identification information, the first master app identification information, or the first slave app, respectively. And identification information, a push token ID corresponding to the first master app or the first slave app, and user personal information. In the authentication support server that performs a blockchain-based integrated login,
A plurality of apps of the user terminal-each of the plurality of apps is installed on the user terminal, each of which is an app that enables each service provided by a service server-each user certificate using a PKI certificate generated respectively -Each of the user certificates includes a master certificate and slave certificates corresponding to apps for using each service provided by the same service server-Registered in respective blockchains corresponding to the respective service server In the state, a communication unit that acquires integrated login request information using login information from a specific app of a specific user terminal from the specific user terminal or a first service server; And
In response to the integrated login request information obtained through the communication unit, check whether a first master certificate corresponding to the login information is registered in the first blockchain corresponding to the first service server or interworking with the authentication support server A first process that supports other devices to be verified, and a first push token corresponding to the first master certificate that is confirmed as being registered as a result of checking whether the first master certificate is registered in the first blockchain When the ID and the first verification confirmation value are obtained, the first push token ID and the first verification confirmation value are transmitted to the first service server or another device linked to the authentication support server is sent to the first service server. By supporting the transmission, the first service server corresponds to the first push token ID Is to request the first signature value signed by the first master private key of the first master user terminal with the first master private key of the first verification PKI certificate to the first master app of the first master user terminal. 1 When the first signature value is obtained from the master app or the first service server, if the first signature value is verified and valid, the first signature value verification result is transmitted to the first service server or linked to the authentication support server A processor performing a second process to assist the first service server to approve the integrated login request by supporting another device to transmit the first signature value verification result to the first service server;
Authentication support server comprising a. The method of claim 9,
The processor,
In the second process, if it is determined that the first master certificate is registered in the first blockchain and is not registered, (i) among each other authentication support servers corresponding to the respective service servers Requesting confirmation of a second master certificate corresponding to each service server to at least one other authentication support server causes the at least one other authentication support server to (i-1) obtain a second master certificate corresponding to the login information. It is supported to check the second blockchain corresponding to the second service server to obtain the second push token ID and the second verification confirmation value corresponding to the second master certificate, and (i-2) the second push The second ID corresponding to the second push token ID by the second service server by transmitting the token ID and the second verification confirmation value to the second service server Support the second master app of the user terminal to request the second signature value signed by the second master private key of the second master PKI certificate with the second master app, and (i-3) the second master user terminal When the second signature value is obtained from the second master app or the second service server, the second signature value is verified, and when valid, the second signature value verification result is transmitted to the authentication support server. (ii) when the second signature value verification result from the at least one other authentication support server is obtained, the authentication support server transmits the second signature value verification result to the first service server or the authentication support server The first service server requests the integrated login by supporting another device interlocked with to transmit the second signature value verification result to the first service server. Authentication support server characterized in that the support to be cut. The method of claim 9,
The processor,
Authentication support server, characterized in that to register the approved integrated login session to the first blockchain or to other devices linked to the authentication support server to register the integrated login session to the first blockchain. The method of claim 9,
The processor,
Before the first process,
When the first master certificate registration request information using the first master PKI certificate generated through the first master app of the first master user terminal is obtained from the first master user terminal, the first master user terminal Request a third signature value that signs a third verification confirmation value using the first master private key of the first master PKI certificate with the first master app, and the third signature value is obtained from the first master user terminal When the third signature value is verified and verified as valid, the first master certificate including at least the first master public key and certificate registration information of the first master PKI certificate is registered in the first blockchain, and the The first master certificate inquiry request information through the first slave app of the first master user terminal is the first master user When obtained from a terminal, the first master user terminal supports verification of the first master certificate registered in the first blockchain, and confirms information on the first master certificate including at least a fourth verification confirmation value. By supporting the transmission to the first slave app of the first slave app, the authentication support server to the fourth signature value signed the fourth verification confirmation value with the first master private key through the first master app To be sent to the first master app, and if at least the fourth signature value is obtained from the first master app of the first master user terminal, the fourth signature value is verified and verified as valid. 4 The first value is supported by transmitting the verification result of the signature value to the first master app of the first master user terminal. The first master app of the master user terminal causes the fourth signature value verification result to be transmitted to the first slave app of the first master user terminal, and the first master corresponds to the fourth signature value verification result. When the first slave certificate registration request information using the first slave PKI certificate generated through the first slave app of the user terminal is obtained from the first master user terminal, the first slave app of the first master user terminal Request a fifth signature value that signs a fifth verification confirmation value using the first slave private key of the first slave PKI certificate, and when the fifth signature value is obtained from the first master user terminal, the fifth signature If the value is verified and verified to be valid, at least the first slave public key and the authentication of the first slave PKI certificate are authenticated. Authentication support server characterized in that the first slave certificate containing the property to be registered in the first block chain. The method of claim 12,
When the first master app or the first slave app generates the first master PKI certificate or the first slave PKI certificate, the first master private key of the first master PKI certificate or the first slave PKI certificate Authentication support server, characterized in that to allow the user to set each pass information for allowing access to the first slave private key. The method of claim 12,
The processor,
A first master app ID corresponding to the first master certificate confirmed from the first blockchain, and a request for a signature for the fourth verification confirmation value and the fourth verification confirmation value to the first master app Authentication scheme server, characterized in that further including the URL scheme in the verification result information for the first master certificate to the first slave app. The method of claim 9,
The processor,
Before the first process,
When the first master certificate registration request information using the first master PKI certificate generated through the first master app of the first master user terminal is obtained from the first master user terminal, the first master user terminal The first master app requests a sixth signature value that signs a sixth verification confirmation value using the first master private key of the first master PKI certificate, and the sixth signature value is obtained from the first master user terminal When it is verified that the sixth signature value is valid, the first master certificate including at least the first master public key and certificate registration information of the first master PKI certificate is registered in the first blockchain, and the Second master app of the second master user terminal-The second master app is installed on the second user terminal to the second service server This is an app that enables the service provided by the user-The second master certificate through-The second master certificate is registered in the second blockchain in response to the second master app-The second block in response to a confirmation request As a result of checking in the chain, when it is confirmed that the second master certificate is not registered in the second blockchain, when the request information for confirmation of the first master certificate is obtained from another authentication support server interworking with the second service server, the second master certificate is obtained. 1 Check the first master certificate registered in the blockchain or support other devices linked to the authentication support server to check the first master certificate registered in the first blockchain, and at least the seventh verification confirmation value The verification result information for the first master certificate including the second master through the other authentication support server The second master user terminal transmits the second master app to the second master user terminal through the other authentication support server. By allowing the second master app to be transmitted to the master app, the seventh verification value signed with the first private key through the first master app of the first master user terminal is supported by the authentication. Request to the first master app of the first master user terminal to transmit to the server, at least the seventh signature value is obtained from the first master app of the first master user terminal or to the first master user terminal If at least the seventh signature value is obtained from another device that is linked, the seventh signature value is verified or the Supports another device or the first blockchain that is linked to the support server to verify the seventh signature value, and when the seventh signature value is confirmed to be valid, the verification result is the first of the first master user terminal. The verification result is transmitted to the first master app of the first master user terminal through another device connected to the authentication support server or transmitted to a master app (i) the first master app provides the verification result. 2 Send to the second master app of the master user terminal, so that the second master app generates a second PKI certificate and transmits the second master certificate registration request information using the second PKI certificate to the other authentication support server And (ii) the second authentication support server responds to the second master certificate registration request information (ii-1) as the second master app. Request the eighth signature value that signed the eighth verification confirmation value using the second master private key of the second master PKI certificate, and (ii-2) the second master user terminal or the second master user terminal When the eighth signature value is obtained from another device interlocked with, the eighth signature value is verified or another device interlocked with the other authentication support server or the second block chain is supported to verify the eighth signature value. If the eighth signature value is confirmed to be valid, at least the second master public key of the second master PKI certificate and a second master certificate including certificate registration information are supported to be registered in the second blockchain. Support server. The method of claim 9,
The first master certificate or the first slave certificate may be the first master public key or the first slave public key, user identification information, user terminal identification information, the first master app identification information, or the first slave app, respectively. Authentication information server, characterized in that it comprises at least one of the identification information, the push token ID corresponding to the first master app or the first slave app, and user personal information.

Images