KR20200091138A - Authentication method and system using private domain name - Google Patents

Abstract

The present invention relates to an authentication method which performs the authentication of a website conveniently by using a private domain name and a system thereof. According to one embodiment of the present invention, the authentication method using the private domain name comprises: a step in which a web server receives the private domain name and a user public key from a second communication terminal; a step in which the web server acquires a link token stored relating to the private domain name and the user public key from a blockchain; a step in which the web server checks a first communication terminal linked to the second communication terminal based on the link token, transmits an authentication processing alert message to the first communication terminal, and induces the generation of a disposable authentication token; a step in which the web server acquires the disposable authentication token which is generated in the first communication terminal and stored in the blockchain; a step in which the web server receives the disposable authentication token from the second communication terminal; and a step in which the web server checks if the disposable authentication token acquired from the blockchain matches the disposable authentication token received from the second communication terminal, and performs the authentication of the second communication terminal.

Description

Authentication method and system using private domain name}

The present invention relates to an authentication technology, and more particularly, to an authentication method and system for easily authenticating a website using a personal domain name.

2. Description of the Related Art As technology of communication networks and mobile communication devices develops today, users access web sites and perform login authentication, and then receive web services. In general, users set the same or different ID and password for each web site, input the corresponding ID and password to the web site, and then perform login authentication.

In addition, various authentication technologies such as image authentication technology, public certificate authentication technology, and authentication technology through one-time password have been disclosed, away from the existing password and ID-based authentication methods. The following patent document discloses a method and system for performing automatic login based on an image code.

However, such an authentication technology is also a technology that can be authenticated only when a password and a password are inputted from a user, which causes a hassle of a user in login authentication.

Meanwhile, data related to different website domains may be recorded in one web page. When data of multiple web site domains appear in a single web page, cross domain problems may occur. The cross-domain problem is that when the domains of web sites are different, access to information is blocked from each other. Specifically, in a cross-domain environment, information exchange is restricted when domains are different between a parent window (portal site) and a pop-up window. The cross-domain environment refers to a case where a domain address such as a parent window and a pop-up window or a frame is different on an Internet browser. If JavaScript operations between web pages with different domain addresses are allowed, illegal attacks using JavaScript are facilitated for various web pages. Therefore, the web browser blocks JavaScript control in the cross domain environment, thereby improving security.

However, when authentication is performed in a state in which access to information is blocked between cross domains, a user has to input authentication information several times, and also has a hassle of separately managing each domain.

Korean Patent Publication No. 10-2013-0093838 (published August 23, 2013)

The present invention has been proposed to solve this problem, and has an object to provide an authentication method and system using a personal domain name that improves user convenience and security by using a personal domain name.

In addition, another object of the present invention is to provide an authentication method and system for smooth authentication by allowing authentication information to be shared with each other even in a cross domain environment through a personal domain name.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by examples of the present invention. In addition, it will be readily appreciated that the objects and advantages of the present invention can be realized by means of the appended claims and combinations thereof.

An authentication method using a personal domain name according to a first aspect of the present invention for achieving the above object comprises: a web server receiving a personal domain name and a user public key from a second communication terminal; Obtaining, by the web server, a linked token stored in association with the personal domain name and the user public key on a blockchain; Confirming, by the web server, a first communication terminal interworking with the second communication terminal based on the interlocking token, and sending an authentication progress notification message to the first communication terminal to induce generation of a one-time authentication token; Obtaining, by the web server, a one-time authentication token generated in the first communication terminal and stored in the blockchain; The web server receiving the one-time authentication token generated by the first communication terminal and transmitted to the second communication terminal from the second communication terminal; And confirming whether the web server matches the one-time authentication token obtained from the blockchain with the one-time authentication token received from the second communication terminal, and performing authentication of the second communication terminal.

In the method, after the step of deriving, the first communication terminal generates the one-time authentication token, associates the one-time authentication token with the personal domain name and the user public key, and stores the blockchain in the blockchain. It may include the step of transmitting to the second communication terminal. In this case, the step of acquiring the one-time authentication token acquires the one-time authentication token associated with the personal domain name and the user public key from the blockchain.

In the step of receiving from the second communication terminal, the web server transmits a web page in which the domain of the personal domain service server is recorded in the iframe tag to the second communication terminal, and the menu associated with the iframe tag is the second. When selected in a communication terminal, a personal domain name and a user public key may be received from the second communication terminal.

The obtaining of the one-time authentication token may include: sending, by the web server, a domain query message including the personal domain name and the user public key to a personal domain service server; And the web server receiving, from the personal domain service server, an interworking token associated with the personal domain name and the user public key, in response to the domain query.

An authentication system for performing user authentication using a personal domain name according to the second aspect of the present invention for achieving the above object, receives a personal domain name and a user public key from a second communication terminal, and the personal domain name and Acquire the interworking token stored in association with the user public key from the blockchain, identify the first communication terminal interworking with the second communication terminal based on the interworking token, and send an authentication progress notification message to the first communication terminal. A sending web server; And mounted on the first communication terminal, upon receiving the authentication progress notification message, generates a one-time authentication token, stores the generated one-time authentication token on the blockchain, and sends the generated one-time authentication token to the second communication terminal. Includes authentication application provided.

The web server receives the one-time authentication token generated and provided by the authentication application from the second communication terminal, acquires the one-time authentication token stored in the blockchain, and then obtains the one-time authentication token and the second communication It is checked whether the one-time authentication token received from the terminal matches, and the second communication terminal is authenticated.

The present invention has an advantage that authentication is easily performed by clicking a specific link or menu related to an iframe without entering a login ID and password.

In addition, according to the present invention, one-time authentication information (that is, authentication token) is generated by new user approval whenever authentication is performed, and user authentication is performed based on the authentication information, thereby improving security for authentication. There is this.

In addition, the present invention has the advantage of being able to provide a personal domain name only for the user regardless of overlap with the existing public domain name, thereby maximizing convenience in using the personal domain name.

In addition, the present invention has an advantage of solving a cross-domain problem by smoothly sharing data between different domains in a cross-domain environment through data acquisition through a private domain name and a public key.

The following drawings attached to this specification are intended to illustrate preferred embodiments of the present invention, and serve to further understand the technical idea of the present invention together with specific details for carrying out the invention, and thus the present invention is described in such drawings. It should not be interpreted as being limited to the matter.
1 is a view showing the configuration of an authentication system using a personal domain name according to an embodiment of the present invention.
2 is a flowchart illustrating a method of registering a personal domain name according to an embodiment of the present invention.
3 is a flowchart illustrating a method of interworking between a first communication terminal and a second communication terminal according to an embodiment of the present invention.
4 is a flowchart illustrating a method for a second communication terminal to perform authentication using a personal domain name according to an embodiment of the present invention.
5 is a flowchart illustrating a method for performing user authentication in an authentication system according to an embodiment of the present invention.

The above objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, those skilled in the art to which the present invention pertains can easily implement the technical spirit of the present invention. There will be. In addition, in the description of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the configuration of an authentication system using a personal domain name according to an embodiment of the present invention.

As shown in Figure 1, the authentication system according to an embodiment of the present invention includes a communication terminal (110, 120), a personal domain service server 200, a blockchain network 300 and a web server 400. .

Each of the communication terminals 110 and 120, the personal domain service server 200, and the web server 400 communicates with each other through the communication network 500. The communication network 500 includes a mobile communication network and a wired communication network.

The blockchain network 300 is connected to a plurality of nodes, and performs verification of transactions. In addition, each node belonging to the blockchain network 300 performs verification for this transaction when a transaction occurs. Each node included in the blockchain network 300 records a transaction and shares a block chain having a connection structure between blocks. The transaction occurs when an authentication token or a linkage token is newly stored, or when a personal domain name is registered/changed/deleted. The block includes a user public key, a personal domain name, and a link token. Also, the block may include a one-time authentication token.

Here, the authentication token is authentication information used for authenticating a user, and may be a numeric string or a string having a predetermined number of digits, or a combination of numbers and letters. The authentication token is one-time authentication information that can be used only once. In addition, the interworking token is data for identifying the first communication terminal 110 interworking with the second communication terminal 120, and a push token may be used. In addition, the personal domain name is a search key dedicated to users used to store and acquire data on the blockchain. When the personal domain name is queried by the personal domain service server 200, the corresponding personal domain name and the user public key are matched. The extracted data is extracted, and the extracted data is provided to the communication device in response to a domain query.

When a transaction requesting information from the blockchain network 300 occurs, each node included in the blockchain network 300 verifies the transaction and, if successful, corresponds to a personal domain name and a user public key. Data (eg, an interworking token, an authentication token) may be extracted from the blockchain and provided to the web server 400 or the personal domain service server 200.

The first communication terminal 110 is a terminal owned by a user, and is a mobile communication device such as a smart phone, a tablet computer, and the like. An authentication application 111 for simple authentication service is installed in the first communication terminal 110. The authentication application 111 may generate a private key and a public key dedicated to the user. The user may register a personal domain name using the authentication application 111. At this time, the authentication application 111 generates a transaction including an electronic signature, a personal domain name, and an interlocking token through the personal domain service server 200, and registers a block containing the transaction to the blockchain network 300. Can.

The authentication application 111 of the first communication terminal 110 may store an interworking token, and may store biometric information of a user, such as a fingerprint. The first communication terminal 110 may obtain and store an interworking token from an external push service server (not shown in the figure). The first communication terminal 110, the authentication application 111 transmits the private domain name and the user's public key to the second communication terminal 120, thereby sharing the personal domain name and public key with the second communication terminal 120. do. In addition, the authentication application 111 generates a one-time authentication token, and the authentication token is stored in the blockchain and transmits the authentication token to the second communication terminal 120.

The second communication terminal 120 is a communication device such as a mobile communication terminal, a server, a personal computer, an IPTV, and the like, and can be easily authenticated with the web server 400 in conjunction with the first communication terminal 110. The second communication terminal 120 establishes a session with the personal domain service server 200, outputs a barcode in which identification information (ie, session ID) of the session is recorded, and the barcode is the first communication terminal 110 ) Can be interlocked with the first communication terminal 110. The second communication terminal 120 receives the authentication token from the first communication terminal 110 in a state in which the stored private domain name and the user's public key are provided to the web server 400, and then receives the authentication token. By providing the web server 400, simple authentication may be attempted.

When the iframe-related menu (or link) in which the domain name of the personal domain service server 200 is recorded is clicked on the web page, the second communication terminal 120 may perform simple authentication. A dedicated program for simple authentication is installed in the second communication terminal 120, and a barcode is generated through the simple authentication-only program and output to a screen, and may be interlocked with the first communication terminal 110.

The domain name of the personal domain service server 200 and the domain name of the web server 400 are generally used as the domain name of a server used on the Internet, and are different from the personal domain name used only for individuals.

The personal domain service server 200 manages a personal domain name and performs a function for responding to a personal domain name query. The personal domain service server 200 registers, changes or deletes the personal domain name in the blockchain network 300. When the personal domain service server 200 is requested to register for a personal domain name from the authentication application 111 of the first communication terminal 110, the personal domain service server 200 performs a transaction including an electronic signature, a personal domain name, a user public key, and an interworking token. By generating it in the blockchain network 300, the personal domain name, user public key and interlocking token can be associated and stored in the blockchain network 300.

In addition, when the personal domain service server 200 receives a domain name query including the personal domain and the public key, the interlocking token corresponding to the personal domain name and the user public key is obtained from the blockchain network 300, and the The obtained interlocking token is provided to the web server 400. After verifying the authenticity of the electronic signature included in the domain name query, the personal domain service server 200 may extract the interworking token from the blockchain network 300 if the verification is successful.

In addition, the personal domain service server 200 performs a function of interlocking the first communication terminal 110 and the second communication terminal 120.

Although the personal domain service server 200 has been described as being a single server, the personal domain service server 200 may be implemented by being divided into a plurality according to its function.

The web server 400 is a server supporting web services such as an email service, a financial service, an online shopping service, a performance reservation service, and the like, and includes member information including a user's public key, user ID, user's date of birth, and user's email address. To save. The web server 400 provides web pages on which domain names (ie, server domain names) of a plurality of web sites are described to the communication terminals 110 and 120. At this time, the web server 400 may record the iframe tag in which the domain name of the personal domain service server is recorded in the source code of the web page, and configure the web page by setting the iframe tag as an authentication related menu or link. have.

When the menu related to the iframe tag is clicked on the second communication terminal 120, the web server 400 may receive a user public key and a personal domain name from the second communication terminal 120. In addition, the web server 400 may transmit a domain query message including the domain name and the user public key to the personal domain service server 200, and obtain an interworking token in response. The web server 400 transmits a message indicating that authentication is in progress in the second communication terminal 120 to the authentication application 111 of the first communication terminal 110 based on the interlocking token. The web server 400 may authenticate the second communication terminal 120 by checking whether the one-time authentication token received from the second communication terminal 120 matches the one-time authentication token stored in the blockchain. When the authentication is successful, the web server 400 may identify the user based on the user's public key and provide a web service dedicated to the user.

2 is a flowchart illustrating a method for registering a personal domain name according to an embodiment of the present invention.

Referring to FIG. 2, the authentication application 111 of the first communication terminal 110 generates a private key and a public key dedicated to the user.

Subsequently, the authentication application 111 of the first communication terminal 110 receives a domain from a user, and adds a preset personal domain code (eg, kt.tin) to the input domain to generate a personal domain name ( S201). As another embodiment, the authentication application 111 of the first communication terminal 110 may receive a personal domain name including both the domain and the personal domain code.

Next, the authentication application 111 checks the interworking token (eg, push token) stored in the first communication terminal 110 (S203). The first communication terminal 110 may obtain and store the interlocking token in advance from an external push service server (not shown in the figure).

Next, the authentication application 111 performs electronic signature with the user's private key (S205). At this time, the authentication application 111 may combine one or more of a personal domain name, a user's public key, and a link token, and electronically sign the combined information with the user's private key.

Subsequently, the authentication application 111 transmits a domain registration request message including a personal domain name, a user's public key, an interlocking token, and an electronic signature to the personal domain service server 200 (S207).

Then, the personal domain service server 200 generates a domain registration transaction including the personal domain name, the user's public key, a link token, and an electronic signature to the blockchain network 300 (S209).

Subsequently, each node included in the blockchain network 300 verifies the authenticity of the electronic signature. At this time, each node included in the blockchain network 300 combines one or more of a personal domain name, a user's public key, and a link token in the same manner as the authentication application 111, and the combined information and the user public key Is input to a preset signature verification algorithm to obtain a result value, and by verifying whether the result value matches the public key of the user, the electronic signature can be verified.

Subsequently, when each of the nodes included in the blockchain network 300 succeeds in the verification of the electronic signature, it checks whether a block including both the private domain name and the user's public key is stored in the blockchain, and the private domain The duplicate check for the name is performed (S211). Here, it is checked whether a block having both the user public key and the private domain name exists, rather than checking only the private domain name. Incidentally, even if the personal domain name is the same, if the user public key is different, it can be used in the service. That is, in the present invention, when users differ from each other and user public keys are different, the same personal domain name may be used between users.

Next, each node of the blockchain network 300 is a duplicate check result, if a block having both the public key and the private domain name of the first communication terminal 110 does not exist in the blockchain, including the domain registration transaction By creating a block and linking the created block with an existing block, the personal domain name is stored in the blockchain (S213). Accordingly, the decryption key, personal domain name and interlocking token are registered on the blockchain together.

Subsequently, the blockchain network 300 notifies the transaction success to the personal domain service server 200 (S215). Then, the personal domain service server 200 notifies the authentication application 111 of a successful response to domain registration (S217).

On the other hand, if each node of the blockchain network 300 fails to verify the electronic signature, or if a block containing the private domain name and user public key is already stored in the blockchain, the domain registration failure is reported to the private domain service server ( 200), and the personal domain service server 200 notifies the first communication terminal 110 of the domain registration failure.

When the personal domain name is registered, the user can modify or delete the personal domain name using the authentication application 111. When the personal domain name is changed, through a procedure similar to FIG. 2, the personal domain service server 200 is a block chain network (e.g., an electronic signature signed with the user's private key, a user public key, and a domain change transaction including the changed personal domain name) 300). Then, if the electronic signature verification is successful in the blockchain network 300, a block for changing the existing personal domain name with the personal domain name included in the domain change transaction is generated, and the block is connected with the existing block Extend the chain.

On the other hand, when the user deletes the personal domain name using the authentication application 111, the personal domain service server 200 blocks the domain deletion transaction including the electronic signature signed by the user's private key and the user's public key (300). ), and the blockchain network 300 generates a block that deletes the user's personal domain name after verifying the electronic signature, and stores it in the blockchain by connecting with an existing block.

3 is a flowchart illustrating a method of interworking between a first communication terminal and a second communication terminal according to an embodiment of the present invention.

Referring to FIG. 3, the second communication terminal 120 connects to the personal domain service server 200 and establishes a session with the personal domain service server 200 (S301).

Subsequently, the second communication terminal 120 checks the session identification information (that is, the session ID) formed with the personal domain service server 200 and generates a barcode on which the session ID is recorded and outputs it to the screen (S303). . That is, the second communication terminal 120 displays the barcode including the session ID so that the session ID can be recognized through barcode reading.

Next, the authentication application 111 of the first communication terminal 110 image-recognizes the barcode being output on the screen of the second communication terminal 120 through the camera to identify the session ID included in the barcode (S305) , S307). The barcode may be a two-dimensional barcode, and in this case, the first communication terminal 110 may recognize the barcode through the camera and read a session ID recorded in the barcode.

Subsequently, the authentication application 111 identifies the private domain name and user public key stored in the first communication terminal 110 and transmits the session ID, private domain name and user public key to the private domain service server 200. (S309).

Then, based on the session ID, the personal domain service server 200 recognizes that the terminal interworking with the first communication terminal 110 is the second communication terminal 120 among the plurality of terminals currently connected to itself. 2 The personal domain name and the user public key are transmitted to the communication terminal 120 (S311).

Subsequently, the second communication terminal 120 stores the user public key and the personal domain name received from the personal domain service server 200 (S313).

According to the procedure of FIG. 3, the first communication terminal 110 may provide the public key and the private domain name to the first communication terminal 110 by recognizing the barcode output from the second communication terminal 120.

4 is a flowchart illustrating a method for a second communication terminal to perform authentication using a personal domain name according to an embodiment of the present invention.

Referring to FIG. 4, the second communication terminal 120 accesses the web server 400 and receives a web page including the URL of the personal domain service server 200 in the iframe tag from the web server 400 ( S401). The web server 400 is a server interworking with the personal domain service server 200, the domain name of the personal domain service server 200 is recorded, and an iframe tag associated with an authentication-related menu is included in the web page. can do. In addition, the web server 400 includes tag information related to its domain in the web page.

When the menu associated with the iframe tag in which the domain of the personal domain service server 200 is recorded is clicked (S403), the second communication terminal 120 has a web browser embedded in the second communication terminal 120 storing the personal domain name being stored. And confirm the public key (S405).

Subsequently, the second communication terminal 120 transmits a request message of another web page according to the iframe click to the web server 400 (S407). At this time, the second communication terminal 120 may transmit the identified personal domain name and public key to the web server 400. The personal domain name and public key can be recorded in the header of the request message.

Next, the web server 400 receives the web page request message related to the iframe and the domain recorded in the iframe tag is the domain of the personal domain service server 200, so that the personal domain to the personal domain service server 200 Query to proceed with the process of obtaining information. Specifically, the web server 400 sets at least one of the public key and the personal domain name of the user received from the second communication terminal 120 as original data, and electronically signs the original data with its own private key (S409) ). At this time, the web server 400 may convert the electronic signature into a character string having a predetermined number of digits (eg, a hexadecimal character string). Subsequently, the web server 400 transmits the personal domain query message including the electronic signature, the user's public key, and the personal domain name to the personal domain service server 200 (S411).

Then, the personal domain service server 200 performs verification of the authenticity of the digital signature of the web server 400 (S413). That is, the personal domain service server 200 sets one or more of the user's public key and personal domain name as original data, and inputs the original data and the public key into a preset signature verification algorithm to obtain a result value. , By checking whether the result value matches the public key of the user, the electronic signature of the web server 400 can be verified.

The personal domain service server 200 notifies the web server 400 of the failure of the electronic signature when the verification of the digital signature of the web server 400 fails. On the other hand, if the personal domain service server 200 succeeds in verifying the digital signature of the web server 400, the public key and the private domain name of the user included in the domain query message are checked, and the public key and the private domain name are The included information request transaction is generated to the blockchain network 300 (S415).

Then, the blockchain network 300 checks the block including the personal domain name and the user's public key in the blockchain, and checks the interworking token in the corresponding block (S417). Subsequently, the blockchain network 300 transmits a transaction processing message including the extracted interlocking token to the personal domain service server 200 (S419).

Next, the personal domain service server 200 transmits the interworking token to the web server 400 in response to the domain query in step S411 (S421).

5 is a flowchart illustrating a method for performing user authentication in an authentication system according to an embodiment of the present invention.

The procedure according to FIG. 5 follows the procedure according to FIG. 4.

Referring to FIG. 5, the web server 400 confirms that the first communication terminal 110 is interlocked with the second communication terminal 120 based on the interworking token received in response to the domain query. Subsequently, the web server 400 transmits a message to the second communication terminal 120 informing that the authentication is in progress in the second communication terminal 120 using the interlocking token (S501). At this time, the web server 140 may transmit the identification information (eg, IP address) of the second communication terminal 120 to the first communication terminal 110. The authentication progress notification message sent from the web server 400 is transmitted to the push service server (not shown in the figure) together with the interlocking token, and the push service server identifies the first communication terminal 110 mapped with the interlocking token. The information can be confirmed and the authentication progress notification message can be transmitted to the first communication terminal 110.

Next, the authentication application 111 of the first communication terminal 110 outputs a message on the screen indicating that authentication is in progress in the second communication terminal 120, and then approves the authentication process from the user or disapproves the authentication process. Can be input. When the authentication application 111 receives an unauthorized authentication progress from the user, the authentication application 111 transmits an unauthenticated progress message to the web server 400, and the web server 400 fails to authenticate the second communication terminal 120.

On the other hand, the authentication application 111 generates a one-time authentication token when an authentication progress approval is input from the user (S503). The authentication application 111 receives authentication information such as a fingerprint and a password from a user using an input means provided in the first communication terminal 100, and the authentication information is previously transmitted to the first communication terminal 110. Only when it matches the stored authentication information, the user's authentication progress can be finally approved. The authentication application 111 may generate a one-time authentication token by using the current time, the user's public key, and random numbers as seeds.

Next, the authentication application 111 propagates the token storage transaction including the user's public key, personal domain name, and the one-time authentication token to the blockchain network 300 (S505). When the authentication application 111 cannot access the blockchain network 300, the token storage transaction is transmitted to the personal domain service server 200, and the personal domain service server 200 transmits the token storage transaction. It can propagate to the blockchain network 300.

Then, each node included in the blockchain network 300 creates a new block containing the token storage transaction and connects it with an existing block, thereby storing the one-time authentication token in the blockchain (S507).

Next, the authentication application 111 of the first communication terminal 110 notifies the web server 400 that the one-time authentication token is stored in the blockchain (S509), and also generates the second communication terminal 120. The one-time authentication token is transmitted (S511).

Subsequently, the second communication terminal 120 requests authentication by transmitting the one-time authentication token received from the first communication terminal 110 to the web server 400 (S513).

Then, the web server 400 propagates the authentication token request transaction including the user's public key and the personal domain name obtained in step S407 of FIG. 4 to the blockchain network 300, so that the personal domain name and the public key The one-time authentication token stored with the received from the blockchain network 300 (S515, S517). When the web server 400 cannot access the blockchain network 300, the authentication token request transaction is transmitted to the personal domain service server 200, and the personal domain service server 200 authenticates the authentication token request transaction. Is propagated to the blockchain network 300, and after obtaining a one-time authentication token from the blockchain, the one-time authentication token can be provided to the web server 400.

The web server 400 checks whether the one-time authentication token received from the second communication terminal 120 and the one-time authentication token received from the blockchain network 300 match, thereby authenticating the second communication terminal 120 (S519). If the one-time authentication token received from the second communication terminal 120 matches the one-time authentication token obtained from the blockchain, the web server 400 treats the authentication as successful, otherwise it is treated as a failed authentication.

Next, the web server 400 may transmit a web page in which the authentication result is recorded to the second communication terminal 120, and provide a web service required for the successful second communication terminal 120 (S521). . The web server 400 may identify a user who has successfully authenticated based on the user public key, and provide a specialized web service to the user.

5, authentication of the second communication terminal 120 to the web server 400 is performed through control of the first communication terminal 110. In addition, according to the approval of the first communication terminal 110, a new one-time authentication token is generated through the authentication application 111 each time the authentication of the second communication terminal 120 is stored in the blockchain, the second communication terminal 120. In addition, the user does not enter a separate login ID and password, and simply clicks on the designated menu (ie, the iframe tag menu related to the domain of the personal domain service server) to perform simple login and provide the desired web service. Can receive

While this specification includes many features, such features should not be construed as limiting the scope of the invention or the claims. In addition, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features that are described in this specification in a single embodiment may be implemented in various embodiments individually or in combination as appropriate.

Although the operations in the drawings have been described in a specific order, it should not be understood that such operations are performed in a specific order as shown, or a series of sequences, or all described actions are performed to obtain a desired result. . In certain circumstances, multitasking and parallel processing may be advantageous. In addition, it should be understood that the division of various system components in the above-described embodiment does not require such division in all embodiments. The above-described program components and systems may be generally implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a computer readable form on a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.). Such a process will not be described in detail any more as those skilled in the art to which the present invention pertains can easily carry out.

The present invention described above, as the person skilled in the art to which the present invention pertains, various substitutions, modifications and changes are possible within the scope of the technical spirit of the present invention, and the above-described embodiments and the attached It is not limited by the drawings.

110, 120: communication terminal
111: authentication APP
200: personal domain service server
300: Blockchain network
400: web server
500: communication network

Claims (11)

As an authentication method using a personal domain name,
A web server receiving a personal domain name and a user public key from a second communication terminal;
Obtaining, by the web server, a linked token stored in association with the personal domain name and the user public key on a blockchain;
Confirming, by the web server, a first communication terminal interworking with the second communication terminal based on the interlocking token, and sending an authentication progress notification message to the first communication terminal to induce generation of a one-time authentication token;
Obtaining, by the web server, a one-time authentication token generated in the first communication terminal and stored in the blockchain;
Receiving, by the web server, a one-time authentication token generated by the first communication terminal and transmitted to the second communication terminal from the second communication terminal; And
And the web server confirming whether the one-time authentication token obtained from the blockchain matches the one-time authentication token received from the second communication terminal and performing authentication of the second communication terminal. According to claim 1,
After the inducing step,
The first communication terminal generates the one-time authentication token, stores the one-time authentication token in association with the personal domain name and the user public key, and stores the one-time authentication token in the second communication terminal. And transmitting;
The step of obtaining the one-time authentication token,
An authentication method characterized by obtaining the one-time authentication token associated with the personal domain name and the user public key in the blockchain. According to claim 1,
The step of receiving from the second communication terminal,
When the web server transmits a web page in which the domain of the personal domain service server is recorded in the iframe tag to the second communication terminal, and the menu associated with the iframe tag is selected in the second communication terminal, the second communication Authentication method characterized by receiving the personal domain name and the user public key from the terminal. According to claim 1,
The step of obtaining the one-time authentication token,
Transmitting, by the web server, a domain query message including the personal domain name and the user public key to a personal domain service server; And
And receiving, by the web server, an interworking token associated with the personal domain name and the user public key from the personal domain service server in response to the domain query. According to claim 4,
Before the step of obtaining the one-time authentication token,
Transmitting, by the first communication terminal, a domain registration request message including the personal domain name, the user public key, and the interlocking token to a personal domain service server; And
Generating, by the personal domain service server, a domain registration transaction including the personal domain name, the user public key, and the interlocking token in a blockchain network, thereby storing a block including the registration transaction in the blockchain; Authentication method further comprising a. The method of claim 5,
If the block having both the user public key and the private domain name is not stored in the blockchain, the authentication method, characterized in that the block containing the registration transaction is stored in the blockchain. According to claim 1,
Checking, by the second communication terminal, identification information of a session formed with a personal domain service server, and outputting a barcode including identification information of the session;
After the first communication terminal reads the barcode and recognizes the identification information of the session, transmitting the identification information of the recognized session, the personal domain name, and the user public key to the personal domain service server; And
The personal domain service server identifies the second communication terminal interworking with the first communication terminal based on the identification information of the session received from the first communication terminal, and uses the personal domain name as the second communication terminal. And transmitting the user public key. An authentication system that performs user authentication using a personal domain name,
A personal domain name and a user public key are received from a second communication terminal, and an interlocking token stored in association with the personal domain name and the user public key is obtained in a blockchain, and based on the interlocking token, the second communication terminal and A web server that identifies an interlocked first communication terminal and transmits an authentication progress notification message to the first communication terminal; And
When mounted on the first communication terminal, upon receiving the authentication progress notification message, a one-time authentication token is generated, the generated one-time authentication token is stored in the blockchain, and the generated one-time authentication token is provided to the second communication terminal Including the authentication application;
The web server receives the one-time authentication token generated and provided by the authentication application from the second communication terminal, obtains the one-time authentication token stored in the blockchain, and then acquires the one-time authentication token and the second communication terminal An authentication system characterized in that the second communication terminal is authenticated by checking whether the one-time authentication token received from the user matches. The method of claim 8,
The authentication application stores the authentication token in the blockchain in association with the personal domain name and the user public key,
And the web server acquires the authentication token associated with the personal domain name and the user public key from the blockchain. The method of claim 8,
A domain query message including the personal domain name and the user public key is received from the web server, and an interlocking token associated with the personal domain name and the user public key is obtained from the blockchain and provided to the web server. Personal domain service server; further comprising an authentication system. The method of claim 10,
The personal domain service server,
The domain registration request message including the personal domain name, the user public key, and the interlocking token is received from the authentication application, and a domain registration transaction including the personal domain name, the user public key and the interlocking token is blockchained. Authentication system, characterized in that to store in the network, the block containing the registration transaction in the blockchain.

Images