KR20210006782A - An OTP configuration method of setting time seed with unique cycle by using active time offset window per each client - Google Patents

Abstract

The present invention relates to an OTP setting method of a unique time scheme through an active time offset window for each client, which comprises the steps of: (a) requesting, by a service server, an authentication server for registration of an OTP device for an accessed user; (b) generating, by the authentication server, a unique ID and a secret key to register the same in an OTP device list, and setting a time offset as a default value; (c) transmitting, by the authentication server, OTP device information including the unique ID and the secret key to an OTP client; (d) extracting, by the OTP client, the unique ID and the secret key from the OTP device information; (e) generating, by the OTP client, a first offset seed, and generating a first time offset from the first offset seed; (f) transmitting, by the OTP client, the first offset seed to the authentication server; and (g) generating, by the authentication server, the first time offset using the first offset seed, and setting a corresponding time offset of the OTP device list as the first time offset. According to the present invention, an offset of time information on each OTP device is differently set for each device, such that OTP security can be further strengthened.

Description

OTP configuration method of setting time seed with unique cycle by using active time offset window per each client}

In the present invention, a seed is generated with a secret key and time information to generate an OTP value, but the time information is set by applying an offset to the current time, and the offset is different for each device. The present invention relates to a method of setting OTP of a unique time method through an active time offset window for each client.

In general, the two-factor authentication (2FA) method refers to a method of authentication using additional elements after the first authentication, and each element is knowledge, possession, and inheritance. There are factors such as. The method of using ID and password is called knowledge-based authentication, and the method of using OTP (one time password) is called ownership-based authentication.

As shown in FIG. 1, a method of using OTP is a method using an OTP dongle a long time ago, and nowadays, an OTP implemented in a smartphone is used. In particular, the OTP use method has increased security by using a mobile security device [Patent Documents 1 and 2].

In smart OTP, there is a Time-based One Time Password (TOTP) method that uses time information as an input value, and there is an event method that uses a synchronized event. In other words, when creating an OTP, the shared secret and the current time or event number are input and created in combination. The server and the smart OTP client must have the same secret, and the server must send a secret to the client.

Mobile OTP may communicate with an authentication server in both directions, and may register a key when there is no network connection. In the case of a bidirectional connection, the secret key is distributed through an encrypted secure network. However, if there is no connection to the authentication server through the network, a secret shared between the authentication client and the authentication server must be transmitted to have the same.

Since the method according to the prior art regards visual information as information that cannot be changed, visual synchronization between the server and the client was a very important factor. However, since the OTP Dongle uses an inexpensive vibrating element, the time may be drifted. In order to compensate for this, when the OTP client raises an incorrect value at a specific time zone within the same allowable limit in the server, a technology for changing the time information in the server has been proposed [Patent Document 3]. This method is server dependent and is intended to correct some errors. In other words, this method does not allow different clients to have their own time zone according to the active user will.

In the conventional technology, when OTP is generated, the main information, the time information, is the same for each device. Therefore, this visual information only serves as a trigger, but it is not a factor that significantly affects the OTP value. That is, time synchronization is performed through NTP (network time protocol) or the like. Therefore, visual information is not information that must be obtained through hacking or hard work to attackers such as hackers.

In other words, in the existing OTP based on visual synchronization, visual information is not important information, and has meaning only as information that is already shared. Therefore, it is not possible to obtain additional security through this visual information, and it plays the role of just matching the cycle through synchronization between the server and the client.

However, if each device has a different view, the attacker has to do additional work to obtain such visual information. In other words, different visual information for each device may make it difficult to hack the OTP device, and through this, security may be improved.

Korean Patent Application Publication No. 10-2016-0081255 (published on March 12, 2019) Korean Patent Publication No. 10-1580291 (announced on December 24, 2015) Korean Registered Patent Publication No. 10-1494313 (announced on February 23, 2015)

An object of the present invention is to solve the above-described problems, and generate an OTP value by generating a seed with a secret key and time information, but applying an offset to the current time It is to provide a method of setting an OTP of a unique time method through an active time offset window for each client in which an offset is set differently for each device.

In order to achieve the above object, the present invention relates to a method for setting OTP in a unique time system through an active time offset window for each client, in which an OTP client installed in a user terminal, a service server, and an authentication server are connected through a network, (a) requesting the authentication server to register an OTP device for a user connected to the service server; (b) the authentication server generating a unique ID and a secret key and registering it in the OTP device list, setting a time offset as a default value; (c) the authentication server transmitting OTP device information including the unique ID and secret key to the OTP client; (d) the OTP client extracting a unique ID and secret key from the OTP device information; (e) the OTP client generating a first offset seed, and generating a first time offset from the first offset seed; (f) the OTP client transmitting the first offset seed to the authentication server; And, (g) the authentication server generating a first time offset by using the first offset seed, and setting a corresponding time offset of the OTP device list as the first time offset. .

In addition, the present invention is a dynamic shared secret distribution method of OTP security management, in the step (g), the authentication server requests and receives a one-time password from the OTP client, and uses the generated time offset to receive the OTP A one-time password of the device is generated, and the time offset is verified by comparing the generated password with the received password.

In addition, in the present invention, in the OTP security management method of the dynamic shared secret distribution method, the authentication server or the OTP client generates a time seed value by adding the time offset to the current time, and calculates the secret key and the time seed value. The combined value is set as a seed, and a random number is generated by a random number generator to generate a one-time password.

In addition, in the OTP security management method of the dynamic shared secret distribution method, the present invention is characterized in that the time offset is a random number generated by a random number generator using the offset seed as a seed.

In addition, the present invention provides a dynamic shared secret distribution method of OTP security management, the method comprising: (h1) connecting the OTP client to the authentication server; (h2) the authentication server performing OTP authentication by the OTP device for the OTP client; (h3) when the OTP authentication passes, the OTP client generates an offset seed (hereinafter referred to as a second offset seed), and transmits the second offset seed to the authentication server; (h4) The authentication server comprises the step of generating a second time offset by using the second offset seed, and updating a corresponding time offset of the OTP device list with the second time offset.

As described above, according to the OTP setting method of the unique time method through the active time offset window for each client according to the present invention, the OTP security can be further strengthened by setting the offset of the time information of each OTP device differently for each device. A possible effect is obtained.

Since the visual information in the existing OTP system is designed to have the same value for each terminal, the visual information of each terminal is public information and has no important value in maintaining security. According to the present invention, since each terminal is configured to operate with different visual information, the visual information has value as personal information that is not disclosed. That is, the OTP value generated through this visual information can have a higher level of security.

In addition, clients that have been synchronized by relying only on the existing server can actively change security parameters, making it a more complex and cumbersome system for hackers. Also, by doing this, the strength of the security is increased. That is, qualitatively, the user can increase his/her security by being the subject of security, and by allowing the user to directly participate, it is possible to proactively increase secondary authentication or security.

1 is an exemplary diagram for a method of using OTP for mobile according to the prior art.
2 is a block diagram of an entire system for implementing the present invention.
3 is a block diagram of a configuration of a smart terminal according to an embodiment of the present invention.
4 is an exemplary table for a list of OTP devices according to an embodiment of the present invention.
5 is a flowchart illustrating a method of registering an OTP device in a unique time system through an active time offset window for each client according to the first embodiment of the present invention.
6 is a flowchart illustrating a method of authenticating OTP using a unique time method through an active time offset window for each client according to a second embodiment of the present invention.
7 is a flowchart illustrating a method of updating an offset of a unique time method through an active time offset window for each client according to a third embodiment of the present invention.
8 is a flowchart illustrating a method of downloading OTP device information in a unique time method through an active time offset window for each client according to a fourth embodiment of the present invention.

Hereinafter, specific details for the implementation of the present invention will be described with reference to the drawings.

In addition, in describing the present invention, the same parts are denoted by the same reference numerals, and repeated explanations thereof are omitted.

First, a configuration of an entire system according to an embodiment of the present invention will be described with reference to FIG. 2.

As shown in FIG. 2, the entire system according to an embodiment of the present invention performs user authentication by verifying the OTP one-time password and the OTP client 20 installed in the smart terminal 10 to generate an OTP one-time password. It consists of an authentication server (30). In addition, it is configured to further include a service server 50 that provides a service to the user.

First, the smart terminal 10 is a mobile terminal used by a user, and is a smart terminal having ordinary computing functions such as a smart phone, phablet, and tablet PC. In particular, the smart terminal 10 is a terminal in which an application or a mobile application (or an app, an application) can be installed and executed. Hereinafter, a description of a task performed by a user means a task performed through the smart terminal 10 or a program (or app) installed in the smart terminal 10.

As shown in FIG. 3, the smart terminal 10 includes a camera 11 capable of capturing an image, a display 12 capable of displaying an output such as an image or image, an input device 13 such as a touch screen, and a gyroscope. It consists of a motion sensor 14 that detects rotation or movement of the terminal, a communication unit 15 that communicates with the outside, and a central processing unit 18 that can install and execute an application.

In particular, when the user shakes the terminal, the motion sensor 14 acquires a motion value for the user.

Next, the OTP client 20 is a mobile application (or app, application) installed and executed on the smart terminal 10, a program system that generates a one-time password (OTP, one-time password) according to a user's command to be.

The OTP client 20 registers the OTP device with the authentication server 30, and receives a secret key and a unique ID (ID) of the corresponding OTP device.

The OTP device is an object that acts as a device that creates a one-time password. The OTP client 20 may register and manage a plurality of OTP devices. As an example, in the OTP device, each user may be created for each service server 50. As another embodiment, when the OTP client 20 is limited to register only one OTP device, the OTP client itself may serve as an OTP device.

Each OTP device has a unique secret key and is identified by a unique ID. The secret key is a key distributed and shared by the OTP client 20 and the authentication server 50, and is used as a seed for generating a one-time password. The secret key is set differently for each OTP client or OTP device.

In addition, the unique ID is a secret key or identification information for identifying the OTP device. Preferably, a unique ID is generated using the user ID and the ID of the service server (hereinafter, service ID).

In addition, the OTP client 20 generates an offset (hereinafter, offset or time offset) or an offset seed of the time information, transmits the generated offset (or time offset) or an offset seed to the authentication server 30, and transmits the corresponding OTP device. Set or update the offset (or time offset) of.

Offset is a value added to the current time. That is, an offset is added to the current time to obtain a time value used for generating a one-time password (hereinafter, a time seed value). In particular, a seed (hereinafter referred to as an OTP seed) is generated by combining the secret key and the time seed value, and a one-time password is generated by generating a random number using the OTP seed. If the same random number generator is used with the same OTP seed, the same one-time password can be obtained.

The offset seed is a seed value for generating an offset. An offset is generated by generating a random number using an offset seed. If the offset is obtained through the same random number generator with the same offset seed, the same offset can be obtained. The OTP client 20 and the authentication server 30 share the same random number generator (RNG) with each other in advance.

Advantageously, when the OTP device is registered, the offset may be registered as a default value. For example, the default value may be set to 0. Alternatively, as another embodiment, when the OTP device is registered, the OTP client 20 may register by transmitting an offset or an offset seed generated by receiving a user's gesture to the authentication server 30.

Further, after the OTP device is registered, the OTP client 20 can access the authentication server 30 and change the offset.

Meanwhile, the offset seed recognizes a gesture based on a motion of a terminal or an input of a touch, and extracts a gesture value as a seed value. Preferably, the shaking of the terminal or the flicking touch of the touch screen may be recognized as one gesture, and the number of times the gesture is recognized may be set as an offset seed. For example, moving it left or right or up and down, and returning to its original position, may be recognized as a gesture of shaking once, or drawing in one direction on the touch screen and returning to the original position may be recognized as a gesture of flicking once.

In addition, the OTP client 20 generates a password for the corresponding OTP device according to a user request. In this case, the OTP client 20 generates a one-time password (OTP) using the generated secret key and time information (or time seed value). At this time, the time information is set as a value obtained by adding an offset from the current time.

The generated one-time password OTP is transmitted to the authentication server 50 together with the unique ID, and verification of the one-time password is performed by the authentication server 50. If the verification for OTP is successful, it is considered that the user authentication by OTP has passed.

Next, the authentication server 30 registers the secret key or OTP device, and verifies the OTP (one time password, one-time password) according to the request of the service server 50.

The authentication server 30 maps a unique ID, a secret key, and an offset into one set and registers it as an OTP device. As described above, the unique ID is a secret key or identification information for identifying an OTP device. In addition, the secret key is a key shared by the OTP client 20 and the authentication server 50. In addition, the offset is a value added to the current time, and the time seed value is obtained by adding the offset to the current time. A one-time password is generated using the combination of the secret key and the time seed value as a seed.

Preferably, as shown in FIG. 4, the authentication server 30 may manage a list (hereinafter, referred to as an OTP device list) by using a unique ID, a secret key, and an offset as one mapping pair.

More preferably, the authentication server 30 may manage by adding a period in addition to the unique ID, secret key, and offset. Period refers to the time interval for generating a one-time password. That is, the one-time password is generated using a combination of the secret key and the time seed value, and the period means the time unit of the time seed value. Therefore, the one-time password is changed every time of the cycle. For example, if the period is 30 seconds, the generated one-time password is changed every 30 seconds.

Meanwhile, the offset is set in cycle units. That is, if the period is 30 seconds, the offset is set in units of 30 seconds, such as 30 seconds, 1 minute, 1 minute 30 seconds, 2 minutes, 2 minutes and 30 seconds.

In addition, the authentication server 30 receives a user ID or service ID (or ID of the service server 50) from the OTP client 20 or the service server 50, and generates a unique ID. The unique ID may be set in advance, set randomly, or generated using a temporal element. Hereinafter, for convenience of explanation, a method of using temporal elements will be mainly described.

Preferably, the authentication server 30 may generate a unique ID by adding a parameter that is a temporal element such as a timestamp. That is, as shown in Equation 1 below, the authentication server 30 generates a unique ID using a user ID, a service ID, and a parameter (or timestamp).

[Equation 1]

UniqueID = GenerateUniqueID (CompanyID, UserID, TimeStamp)

Here, UniqueID is a unique ID, CompanyID is a service ID, UserID is a user ID, and TimeStamp is a timestamp and is a parameter. GenerateUniqueID is an arbitrary mapping function, preferably, a one-to-one mapping function or a one-way function.

In addition, the authentication server 30 generates a secret key. The generated secret key is shared with the OTP client 20. In this case, a method of directly transmitting the secret key to the OTP client 20 or a method of transmitting only a parameter capable of generating a secret key may be used. Hereinafter, for convenience of explanation, the latter method will be mainly described.

Preferably, the authentication server 30 may generate a secret key by applying the unique ID and parameters to the random number generator. That is, if the unique ID, parameter, and random number generator are the same, the same secret key can be generated.

Specifically, as shown in the following equation, the authentication server 30 extracts the number of occurrences of a random number using a parameter. That is, the number of occurrences of the random number is extracted through the generation of the random number, but the parameter is used as a seed.

[Equation 2]

SequenceID = RNG(PREDEFINEDVAL, TimeSTamp)

Here, SequenceID represents the number of occurrences of a random number, and RNG represents a random number generator or a random number generation function. In addition, TimeSTamp represents a parameter. And PREDEFINEDVAL is a constant determined in advance.

Then, the authentication server 30 generates a secret key Secret by the following equation.

[Equation 3]

For (i=0; i<SequenceID; Secret = RNG(UniqueID), i++);

Equation 3 is a pseudo code that generates a secret key. A random number is generated by a random number generator (RNG) using a unique ID (ID) as a seed, but is repeated as many times as the number of random numbers (SequenceID). Occurs.

Meanwhile, the authentication server 30 may set parameters such as a time stamp to generate a unique ID or secret key as described above. The parameter is a parameter by a temporal factor, preferably a time stamp. That is, the parameters are set differently each time the secret key is generated (or when the OTP device is registered).

In addition, the authentication server 30 receives and sets or updates an offset or an offset seed directly from the OTP client 20 or through the service server 50. Preferably, the authentication server 30 may set the offset to a default value (eg, 0) if offset information (offset or offset seed) is not received when registering the OTP device. In addition, after the OTP device is registered, the authentication server 30 may update the offset according to the request of the OTP client 20.

Preferably, as shown in the following equation, the authentication server 30 generates an offset by generating a random number with the random number generator (RNG) using the offset seed as a seed.

[Equation 4]

Server_Offset = RNG(Offset_Seed)

Here, Server_Offset represents an offset generated by the server, and Offset_Seed represents an offset seed.

Meanwhile, the authentication server 30 may obtain a hash value of the generated secret key and use the hash value as a verification value of the secret key.

In addition, the authentication server 30 transmits a unique ID and parameter, or a verification value (hereinafter, a parameter, etc.) to the OTP client 20 together. At this time, preferably, the authentication server 30 may convert and transmit a parameter or the like into a two-dimensional code (QR code, voice-eye code, etc.). As an example, a parameter or the like is converted into a QR code and generated, and the QR code is displayed on the display. Then, the user recognizes the QR code using the camera of the user terminal 10 and extracts parameters, etc. from the QR code.

On the other hand, when the authentication server 30 receives the verification request (authentication request) for the one-time password of the secret key (or OTP device) from the service server 50, the authentication server 30 verifies (or authenticates) the one-time password (OTP) of the secret key. Then, the result (or verification result, authentication result) is returned.

That is, when the authentication server 40 receives the unique ID and one-time password (OTP) from the service server 50, the authentication server 40 searches for a secret key (or OTP device) corresponding to the unique ID. In particular, a unique ID is searched from the OTP device list, and a secret key, offset, etc. mapped to the searched unique ID is searched.

A one-time password (OTP) is created with the retrieved secret key, offset, etc., and the one-time password is verified (or authenticated) by comparing the generated one-time password (OTP) with the received one-time password (OTP). That is, if it is the same, it is determined that it is verified.

Meanwhile, although the authentication server 30 and the service server 50 have been described as independent servers, these servers may be implemented as one system or one server.

Next, the service server 50, as a server providing a service, processes user authentication for a user of the service, and provides a service to the user when the user authentication passes.

The service server 50 performs user authentication. In this case, one-factor authentication or two-factor authentication may be performed. In particular, the service server 50 performs authentication using OTP as an authentication means. Alternatively, as another embodiment, it may be performed alone with a one-time password method.

The service server 50 requests OTP authentication from the authentication server 30. At this time, the service server 50 receives the unique ID and one-time password from the OTP client 20, and transmits the received unique ID and one-time password to the authentication server 30.

Meanwhile, the service server 50 may relay or provide an OTP device registration or offset update operation to the user terminal 10 or the OTP client 20. That is, the service server 50 may be interlocked with the authentication server 50 to provide an interface for OTP device management of the authentication server 50. Accordingly, the user terminal 10 or the OTP client 20 may access the service server 50 to register an OTP device or perform an offset update operation. However, the actual OTP device registration service or offset update service is provided by the authentication server 30.

In particular, the service server 50 provides a service ID (the ID of the service server) to the authentication server 30 when registering an OTP device.

Next, the database 40 includes a service DB 41 that stores information on a service server, and a device DB 42 that stores a list of unique IDs, secret keys, and offsets of each OTP device. However, the configuration of the database 40 is only a preferred embodiment, and may be configured in a different structure according to the database construction theory in consideration of ease and efficiency of access and search in developing a specific device.

Next, a method of registering an OTP device using a unique time method through an active time offset window for each client according to the first embodiment of the present invention will be described with reference to FIG. 5.

As shown in FIG. 5, first, the smart terminal 10 or the OTP client 20 accesses the service server 50 (S11). At this time, the service server 50 receives a user ID from the user terminal 10. Also, preferably, the service server 50 may perform primary user authentication based on an ID and a password. The service server 50 may acquire a user ID while performing primary authentication. In addition, the user terminal 10 or the OTP client 20 may obtain an ID or service ID of the service server 50.

Next, the service server 50 requests the authentication server 30 to register the OTP device (S12). At this time, the service server 50 transmits a user ID (ID) and its own ID (or service server ID, service ID) to the authentication server 30.

Meanwhile, as another embodiment, the OTP client 20 may directly access the authentication server 30 to request registration of the OTP device. In this case, without relaying from the service server 50, the OTP client 20 directly performs the registration operation using the interface of the authentication server 30.

Next, the authentication server 30 registers the OTP device by generating a unique ID and a secret key. In this case, the authentication server 30 may directly generate a unique ID and a secret key, or may generate a parameter first and then use them to generate a unique ID and a secret key. Hereinafter, the latter case will be described in more detail.

That is, the authentication server 30 sets parameters. The parameter is a parameter by a temporal factor, preferably set to a time stamp. Since the parameter is generated when there is a request from the OTP device, each request has a different value.

Next, the authentication server 30 generates a unique ID using a user ID, a service ID, and a parameter. A unique ID is created using Equation 1 above. In this case, when the OTP client 20 directly accesses the authentication server 30 without passing through the service server 50, a unique ID may be generated using a user ID without a service ID.

Next, the authentication server 30 generates a secret key using a unique ID and parameters, and generates a verification value for the secret key. That is, as shown in Equation 2 above, a random number is generated by using a parameter as a seed to generate the number of random number generation. And, as shown in Equation 3 above, a random number is generated by using a unique ID as a seed, but by generating the number of times the random number is generated, a secret key is obtained. Then, the hash value of the generated secret key is obtained and used as a verification value.

Next, the authentication server 30 associates the unique ID with the secret key and registers it in the OTP device list (S22). Preferably, it is possible to set a period in the list. Period refers to the time interval for generating a one-time password. In particular, a one-time password is created by combining the secret key and the current time, and the unit of the current time is the cycle. If the secret key and the current time are the same, the one-time password is the same, so if the current time is different, the one-time password will be different. Therefore, the one-time password is changed by stock price.

Further, the authentication server 30 sets the offset to a default value (eg, 0).

As a result, as shown in FIG. 4, the OTP device information is composed of a unique ID, a secret key, an offset, and a period.

Next, the authentication server 30 transmits OTP device information or parameters to the service server 50 or the OTP client 20 (S23). Preferably, the authentication server 30 may also transmit a period. In particular, the service server 50 receives parameters and the like and transmits them to the user terminal 10.

In this case, the authentication server 30 may directly transmit a unique ID and secret key as OTP device information, or may transmit only a parameter capable of generating a unique ID and secret key. In the following, the latter case of sending parameters will be described.

In addition, the authentication server 30 may transmit OTP device information or parameters through a network directly with the OTP client 20 or the smart terminal 10, or may indirectly transmit it through a two-dimensional code.

That is, the authentication server 30 may convert a parameter or the like into a two-dimensional code (QR code, voice-eye code, etc.) and transmit a two-dimensional code or a two-dimensional code image. The two-dimensional code is a code formed in two dimensions, such as a bar code, and is a QR code and a voiceye code. In particular, the authentication server 30 may convert the encrypted data into a two-dimensional code by encrypting parameters and the like when converting a two-dimensional code.

Also, preferably, the service server 50 receives a two-dimensional code such as a parameter from the authentication server 30 and displays the two-dimensional code on the screen. The user photographs a corresponding 2D code with a camera (not shown) of the smart terminal 10, and extracts OTP device information or parameters from the captured 2D code. At this time, if the contents of the 2D code are encrypted, the OTP device information or parameters are extracted after decryption.

Next, upon receiving OTP device information or parameters, the OTP client 20 extracts a unique ID and a secret key (S31). When a unique ID and secret key are directly received, the unique ID and secret key can be extracted immediately by decoding the corresponding 2D code.

In addition, when only parameters are transmitted, the OTP client 20 generates a unique ID using the user ID, service ID, and parameters. The unique ID generation method is the same as the method performed in the authentication server 30 above.

In addition, the OTP client 20 generates a secret key using the generated unique ID and the received parameter. That is, the OTP client 20 generates the number of random number generation as a parameter as shown in Equations 2 and 3 above, and generates a random number by using the unique ID as a seed, but generates as many times as the number of random number generation, and the secret key Get The secret key generation method is the same as the method performed by the authentication server 30 above.

Also, when receiving the verification value of the secret key, the OTP client 20 obtains a hash value by applying a hash function to the generated secret key. And by comparing the obtained hash value and the received verification value, the secret key is verified.

[Equation 5]

Result = Compare(HashValue,HashValue_Server)

Here, Result is a comparison result or verification result, HashValue is an acquired hash value, and HashValue_Server is a verification value received from the server. Compare is a function that determines whether they are the same. In the same case, the secret key is verified with the correct key.

Next, the OTP client 20 generates an offset seed (S32). The offset seed recognizes a gesture based on a motion of a terminal or a touch input, and extracts the gesture value as a seed value. Preferably, the shaking of the terminal or the flicking touch of the touch screen may be recognized as one gesture, and the number of times the gesture is recognized may be set as an offset seed.

More preferably, the OTP client 20 displays a gesture request message on the screen through the user terminal 10, such as "Please shake the terminal vigorously" and "Please press and hold the terminal screen randomly three times." At this time, when the user performs a gesture operation using the user terminal 10, the recognition value of the gesture recognized by the user terminal 10 becomes an offset seed.

Preferably, the OTP client 20 requests a method for generating an offset seed (eg, shaking the terminal or inputting a touch) from the user through the smart terminal 10 and inputting through the smart terminal 10 The number of gestures made is detected.

Next, the OTP client 20 generates an offset as an offset seed (S33).

Preferably, as shown in the following equation, the OTP client 20 generates an offset by generating a random number with the random number generator (RNG) using the offset seed as a seed.

[Equation 6]

Client_Offset = RNG(Offset_Seed)

Here, Client_Offset represents an offset generated by the client, and Offset_Seed represents an offset seed.

Next, the OTP client 20 transmits the generated offset or offset seed to the authentication server 30 (S34).

Next, the authentication server 30 generates an offset by receiving the offset seed (S41). Using Equation 4 above, the offset seed is used as a seed to generate a random number by a random number generator (RNG) to generate an offset.

Next, preferably, the authentication server 30 verifies the offset (S42).

The offset verification step S42 is divided into two embodiments.

First, the embodiment 1-1 is applied when the authentication server 30 and the OTP client 20 are connected online. That is, the authentication server 30 requests the one-time password from the OTP client 20 and receives the one-time password from the OTP client 20. In addition, the authentication server 30 calculates a one-time password by using the offset generated by itself, and verifies the calculated password and the received password. That is, if it is the same, it is determined that the verification has passed.

Next, the 1-2 embodiment can be applied even when the authentication server 30 and the OTP client 20 are offline. That is, the authentication server 30 generates a one-time password using the offset generated by it. In addition, the authentication server 30 displays the generated one-time password on a screen (eg, a screen on the web, etc.), and determines whether the one-time password displayed on the screen and the one-time password generated by the OTP client 20 are the same. Ask for confirmation. That is, the user generates a one-time password through the OTP client 20, compares the generated one-time password with the on-screen password, and inputs whether the same or not on the screen. If the authentication server 30 is input as the same, it determines that the offset has been verified.

Next, the OTP client 20 adds and stores the offset to the OTP device information (S35). At this time, the OTP client 20 receives the verification result from the authentication server 30, and only when the verification passes, adds an offset and stores it.

In addition, when the verification is passed, the authentication server 30 also adds the corresponding offset as the OTP device information in the OTP device list.

Next, an OTP authentication method using a unique time method through an active time offset window for each client according to a second embodiment of the present invention will be described with reference to FIG. 6.

6, the user terminal 10 or the OTP client 20 connects to the service server 50 (S51). At this time, when performing two-step authentication, the service server 50 may perform primary user authentication using a user ID and password (S52).

Next, the service server 50 starts OTP authentication with the authentication server 50 for OTP authentication (S61). In this case, the service server 50 may use an interface for OTP authentication of the authentication server 50. Then, the service server 50 or the authentication server 50 requests a one-time password from the user or the user terminal 10 or the OTP client 20 (S62).

Next, the smart terminal 10 executes the OTP client 20, or the OTP client 20 directly generates a one-time password (S71) and transmits it to the service server 50 or the authentication server 30. (S72).

At this time, as shown in Equation 7, the OTP client 20 calculates a time seed value by adding an offset to the current time, and generates a one-time password OTP using the secret key and the time seed value. That is, if the secret key and the time seed value are the same, the same one-time password can be obtained.

[Equation 7]

OTP_Client = GenerateOTP(Secret, GetCurrentTime()+Client_Offset)

OTP_Client is a one-time password generated by the client (hereinafter, the first password), GetCurrentTime() is a function that gets the current time, and Client_Offset is an offset stored in the OTP client. Also, GenerateOTP() is a one-way function or one-to-one correspondence function, and outputs the same output value for the same input value.

Transmission of the first password may be directly input by the user. That is, the OTP client 20 only outputs the first password on the screen, and the user can directly input it to the input interface of the service server 50 or the authentication server 30. Alternatively, if the OTP client 20 can perform data communication with the service server 50 or the authentication server 30, it can transmit a first password (or a first password and a unique ID) through data communication.

Meanwhile, preferably, when transmitting the first password, the OTP client 20 transmits a unique ID corresponding to the corresponding first password together.

Next, the authentication server 30 receives a first password (or a first password and a unique ID) and generates a second password (S81). The second password is generated using a secret key corresponding to the unique ID. The second password may be generated as follows [Equation 8].

[Equation 8]

OTP_Server = GenerateOTP(Secret, GetCurrentTime()+Server_Offset)

Here, OTP_Server is a second password, which is a one-time password generated by the authentication server 30, and Server_Offset is an offset stored in the authentication server 30.

Next, the authentication server 30 compares the first and second passwords and verifies the received first password (S82). That is, if the first and second passwords are the same, the authentication (or verification) is passed.

Next, the authentication server 30 transmits the verification result or the authentication result to the service server 50 or the OTP client 20 (S83).

Next, a method of updating an offset of a unique time method through an active time offset window for each client according to a third embodiment of the present invention will be described with reference to FIG. 7.

As shown in FIG. 7, first, the smart terminal 10 or the OTP client 20 accesses the service server 50 (S111). At this time, preferably, the service server 50 may perform primary user authentication based on an ID and a password (S112).

Next, the authentication server 30 performs OTP user authentication with respect to the OTP client 20 (S120). At this time, the user authentication process is previously performed by the OTP authentication method. That is, the OTP client 20 calculates a time seed value by adding an offset to the current time, uses a combination of the secret key and the time seed value as a seed, and generates a random number through the random number generator to obtain a one-time password. The OTP client 20 transmits a one-time password to the authentication server 30. The authentication server 30 generates a one-time password using the OTP device information stored therein. At this time, the time seed value is calculated by adding the server offset (stored offset) to the current time. And it performs OTP authentication by comparing the generated password and the received password.

Next, when the OTP authentication passes, the authentication server 30 starts an offset update operation (S131). That is, the authentication server 30 requests an offset seed from the OTP client 20 or the service server 50 (S132).

Next, the OTP client 20 generates an offset seed (S141). The offset seed recognizes a gesture based on a motion of a terminal or a touch input, and extracts the gesture value as a seed value.

Next, the OTP client 20 generates an offset as an offset seed (S142). Preferably, as shown in Equation 6 above, the OTP client 20 generates an offset by generating a random number with the random number generator (RNG) using the offset seed as a seed.

Next, the OTP client 20 transmits the generated offset or offset seed to the authentication server 30 (S143).

Next, the authentication server 30 generates an offset by receiving the offset seed (S151). Using Equation 4 above, the offset seed is used as a seed to generate a random number by a random number generator (RNG) to generate an offset.

Next, preferably, the authentication server 30 verifies the offset (S152).

The offset verification step S152 is divided into two embodiments, as in the offset verification step S42 of the first embodiment. That is, in one embodiment, when connected online, the authentication server 30 requests the OTP client 20 for a one-time password, and determines whether the password is identical to the password generated by the authentication server 30. Another embodiment is applied to offline, and the authentication server 30 generates and displays a one-time password, and receives and verifies whether the same as the one-time password generated by the OTP client 20 is input.

That is, in both embodiments, the offset is verified according to whether the password generated by the OTP client 20 and the password generated by the authentication server 30 are the same. If both the one-time passwords are the same, it is determined that the generated offset is verified.

Next, the OTP client 20 updates the offset in the OTP device information (S144). In this case, the OTP client 20 receives the verification result from the authentication server 30 and updates the offset only when the verification passes.

In addition, when the verification is passed, the authentication server 30 also adds the corresponding offset as the OTP device information in the OTP device list (S153).

Next, a method of downloading OTP device information in a unique time method through an active time offset window for each client according to a fourth embodiment of the present invention will be described with reference to FIG. 8.

As shown in FIG. 8, first, the smart terminal 10 or the OTP client 20 accesses the service server 50 (S211). At this time, preferably, the service server 50 may perform primary user authentication based on an ID and a password (S212).

Next, the authentication server 30 performs alternative authentication for the OTP client 20 (S220). Alternative authentication is user authentication other than OTP authentication. For example, alternative authentication is a means for authenticating a user when an OTP device is lost, such as ID and password, authentication using an accredited certificate, or authentication using an email or mobile communication number. Alternative authentication uses conventional authentication means.

Next, when alternative authentication is completed, the OTP client 20 requests OTP device information to the authentication server 30 (S231). At this time, the OTP device information is composed of a unique ID, a secret key, an offset, and a period.

Next, the authentication server 30 transmits the OTP device information to the OTP client 20 (S232). At this time, preferably, the OTP device information is encrypted and transmitted.

In addition, the authentication server 30 may transmit OTP device information through a network directly with the OTP client 20 or the smart terminal 10, or may indirectly transmit it through a two-dimensional code. That is, the authentication server 30 may convert the encrypted OTP device information into a two-dimensional code (QR code, voice-eye code, etc.) and transmit a two-dimensional code or a two-dimensional code image. For example, the authentication server 30 or the service server 50 displays a two-dimensional code image on the screen, captures the two-dimensional code image through the camera of the smart terminal 10, and OTP from the obtained image. Extract device information.

Next, an OTP registration method or an offset update method of a unique time method through an active time offset window for each client according to a fifth embodiment of the present invention will be described.

In the fifth embodiment of the present invention, unlike the first, third, or fourth embodiments, the OTP client 20 or the user terminal 10 directly contacts the authentication server 30 without going through the service server 50. You can connect to register an OTP device, update an OTP offset, or receive OTP device information.

In this case, the unique ID may be generated using only the user ID and parameters without using the service ID.

In particular, in the case where the OTP device is registered according to the fifth embodiment, when attempting to authenticate using the registered OTP device, the OTP client 20 includes the generated one-time password and a unique ID together with the authentication server 30 or service. It transmits to the server 50. Therefore, the authentication server 30 identifies the secret key using the unique ID.

In the above, the invention made by the present inventors has been described in detail according to the embodiments, but the invention is not limited to the embodiments, and it goes without saying that various modifications can be made without departing from the gist of the invention.

10: smart terminal 20: OTP client
30: authentication server 40: database
50: service server 80: network

Claims (5)

In the OTP setting method of a unique time method through an active time offset window for each client, in which an OTP client installed in a user terminal, a service server, and an authentication server are connected through a network,
(a) requesting the authentication server to register an OTP device for a user connected to the service server;
(b) the authentication server generating a unique ID and a secret key and registering it in the OTP device list, setting a time offset as a default value;
(c) the authentication server transmitting OTP device information including the unique ID and secret key to the OTP client;
(d) the OTP client extracting a unique ID and secret key from the OTP device information;
(e) the OTP client generating a first offset seed, and generating a first time offset from the first offset seed;
(f) the OTP client transmitting the first offset seed to the authentication server; And,
(g) the authentication server generating a first time offset using the first offset seed, and setting a corresponding time offset of the OTP device list as the first time offset. OTP setting method of unique visual method through active visual offset window.
The method of claim 1,
In the step (g), the authentication server requests and receives a one-time password from the OTP client, generates a one-time password for the OTP device using the generated time offset, and compares the generated password with the received password. And verifying the time offset. A method of setting OTP of a unique time method through an active time offset window for each client.
The method of claim 1,
The authentication server or the OTP client generates a time seed value by adding the time offset to the current time, sets a seed as a value obtained by combining the secret key and the time seed value, and generates a random number with a random number generator to generate a one-time password. OTP setting method of a unique time method through an active time offset window for each client, characterized in that generating.
The method of claim 1,
The time offset is a random number generated by a random number generator using the offset seed as a seed.
The method of claim 1, wherein the method comprises:
(h1) the OTP client accessing the authentication server;
(h2) the authentication server performing OTP authentication by the OTP device for the OTP client;
(h3) when the OTP authentication passes, the OTP client generates an offset seed (hereinafter referred to as a second offset seed) and transmits the second offset seed to the authentication server;
(h4) the authentication server generating a second time offset by using the second offset seed, and updating a corresponding time offset of the OTP device list with the second time offset. OTP setting method of unique visual method through active visual offset window.

Images