KR20210012518A - A method of saving and using OTP backup codes or temporal user OTP codes by using multi-dimensional barcode - Google Patents

Abstract

The present invention relates to a temporary backup OTP storage method based on a multi-dimensional barcode, which comprises the steps of: (a) generating, by an authentication server, a unique ID and a secret key to register the same in an OTP device list, and transmitting OTP device information including the unique ID and the secret key to an OTP client to set a new OTP device in the OTP client; (b1) generating, by the authentication server, an emergency one-time password (OTP), and storing the generated emergency OTP in the OTP device list; (b2) generating, by the authentication server, a multi-dimensional barcode including the emergency OTP; and (b3) transmitting, by the authentication server, the multi-dimensional barcode to the OTP client. According to the present invention, a backup code or a temporary OTP can be prevented from being easily exposed to the outside by being output in a plain text.

Description

Temporary backup OTP storage method based on multi-dimensional barcode {A method of saving and using OTP backup codes or temporal user OTP codes by using multi-dimensional barcode}

The present invention is a temporary one-time password (OTP) or one-time backup password (or backup code) in order to update the OTP device or create a new OTP device when the OTP device is lost due to replacement, loss, or oblivion of a smart terminal. It relates to a multidimensional barcode-based temporary backup OTP storage method for generating and storing emergency OTP as a multidimensional barcode.

In general, OTP (One Time Password) is an authentication method using a one-time password, and is a kind of ownership-based authentication method. The OTP system includes an OTP device carried by a user, a personal computer (PC) serving as a means for a user to access an OTP server through an Internet network or a wired/wireless telephone network, and the OTP number of the OTP device based on the current time input from the connected PC. It is composed of an OTP server that authenticates when the server authentication number generated by it matches the current time.

The method of using OTP is a method using an OTP dongle a long time ago, and nowadays, a smart OTP implemented in a smart terminal such as a smartphone is used. In particular, the smart OTP use method has increased security by using a mobile security device [Patent Document 1, 2]. In addition, the number of users using smart OTP is increasing, and the range of using OTP is also increasing.

In the case of using such a smart OTP, the smart OTP itself can be used only if you have a smart terminal such as a smartphone. When a smart terminal such as a mobile device is lost or changed, or when a smart terminal such as a mobile device is forgotten and left at home, there is no way for a user to receive authentication for smart OTP. That is, in the smart OTP usage method, there are cases in which the user may not possess the OTP device due to replacement, loss, or oblivion of the smart terminal. In this case, in order to update the corresponding OTP device or create a new OTP device, authentication is required, but there is a problem that authentication by OTP cannot be obtained.

In preparation for such a case, in order to register a new authentication tool, authentication may be performed through a backup code, or may be authenticated using a temporary issued OTP number. That is, when registering an OTP device, a user backup code is issued and used for temporary user authentication. That is, the user can be authenticated through the output temporary user authentication method.

However, conventionally, such a backup code or a code for temporary authentication is output in plain text, which poses a problem. That is, conventionally, since the backup code or the temporary authentication code is output in plain text, there is a possibility of hacking. In addition, it is not possible to know whether another user acquired it illegally or whether it was used by a legitimate user. In addition, unauthorized authentication may be attempted using an illegally acquired backup code or a temporary authentication code.

Korean Patent Application Publication No. 10-2016-0081255 (published on March 12, 2019) Korean Patent Publication No. 10-1580291 (announced on December 24, 2015)

An object of the present invention is to solve the above-described problems, and in the case of loss of an OTP device due to replacement or loss of a smart terminal, or oblivion, in order to update the corresponding OTP device or create a new OTP device, temporary disposable It is to provide a multi-dimensional barcode-based temporary backup OTP storage method that generates and stores unused OTPs such as password (OTP) or one-time password (or backup code) for backup as a multi-dimensional barcode.

In addition, an object of the present invention is to provide a multidimensional barcode-based temporary backup OTP storage method that generates and stores a temporary one-time password (OTP) or one-time backup password as a multidimensional barcode, and encrypts the barcode authentication number by putting the barcode authentication number in the multidimensional barcode. .

In addition, through the present invention, not only provides a method of authenticating when a user device is lost, changed, or missing, but also strengthens user authentication by allowing the user to authenticate once more when using it in an emergency situation. There is a purpose.

In order to achieve the above object, the present invention relates to a multidimensional barcode-based temporary backup OTP storage method in which an OTP client installed in a user terminal, a service server, and an authentication server are connected through a network, and (a) the authentication server Generating a unique ID and a secret key, registering it in an OTP device list, transmitting OTP device information including the unique ID and secret key to the OTP client, and causing the OTP client to set a new OTP device; And, (b1) the authentication server generating an emergency one-time password (OTP), and storing the generated emergency OTP in the OTP device list; (b2) the authentication server generating a multidimensional barcode including the emergency OTP; And, (b3) The authentication server is characterized in that it comprises the step of transmitting the multi-dimensional barcode to the OTP client.

In addition, the present invention provides a dynamic shared secret distribution method of OTP security management, the method comprising: (c1) the authentication server receiving the multidimensional barcode from the OTP client; (c2) the authentication server extracting a unique ID and an emergency OTP (hereinafter referred to as a first emergency OTP) from the multi-dimensional barcode; (c3) the authentication server searching the OTP device list with the extracted unique ID, and detecting an emergency OTP (hereinafter referred to as a second emergency OTP) corresponding to the extracted unique ID; And, (c4), the authentication server comparing the first and second emergency OTPs, and performing authentication instead of OTP authentication (hereinafter, alternative authentication).

In addition, the present invention in the OTP security management method of the dynamic shared secret distribution method, the method, (d) If the alternative authentication is successful, the authentication server to the OTP client, OTP device information corresponding to the extracted unique ID It characterized in that it further comprises the step of transmitting or generating and transmitting a new OTP device for the extracted unique ID.

In addition, the present invention in the OTP security management method of the dynamic shared secret distribution method, the step (a) comprises the steps of: (a1) requesting the authentication server to register an OTP device for a user connected to the service server; (a2) the authentication server generating a unique ID and a secret key and registering it in the OTP device list; (a3) the authentication server transmitting OTP device information including the unique ID and secret key to the OTP client; (a4) the OTP client extracting a unique ID and secret key from the OTP device information; And, (a5) the OTP client setting a new OTP device with the unique ID and secret key.

In addition, the present invention in the OTP security management method of the dynamic shared secret distribution method, in the step (b2), the authentication server receives an authentication number for a barcode (hereinafter, a first authentication number), as the first authentication number. The emergency OTP is encrypted, the encrypted emergency OTP is inserted into the multidimensional barcode, and in step (c2), the authentication server receives an authentication number for a barcode (hereinafter, a second authentication number), and the second authentication number It is characterized in that the emergency OTP is decrypted.

In addition, the present invention in the OTP security management method of the dynamic shared secret distribution method, in the step (c1), the OTP client transmits the stored multidimensional barcode or photographs the multidimensional barcode using the camera of the smart terminal. It characterized in that it delivers the photographed multidimensional barcode.

As described above, according to the multi-dimensional barcode-based temporary backup OTP storage method according to the present invention, a temporary one-time password (OTP) or a backup one-time password (OTP) is generated as a multi-dimensional barcode when generating an OTP device. The one-time password is output in plain text, so that it can be prevented from being easily exposed to the outside. In other words, by printing the existing backup code or temporary OTP in plain text, it is possible to solve the security problem that the user needs to store safely, and the user creates and stores several printed barcodes so that if a problem such as loss occurs, the temporary OTP is used immediately. I can do it.

In addition, according to the multidimensional barcode-based temporary backup OTP storage method according to the present invention, when generating a temporary one-time password (OTP) or backup one-time password (OTP) as a multi-dimensional barcode, the authentication number is put in the multi-dimensional barcode to be encrypted. Even if the temporary one-time password is exposed to the outside, only legitimate users who know the authentication number can use it. In other words, even if it is attached to a public place or stored in a public place, it is verified once more whether it is a legitimate user using the password included in the bar code, so that the bar code used in an emergency is not misused and used in a legitimate place. have.

1 is a block diagram of an entire system for implementing the present invention.
Figure 2 is a block diagram of the configuration of a smart terminal according to an embodiment of the present invention.
3 is an exemplary table for a list of OTP devices according to an embodiment of the present invention.
4 is an exemplary view of a multidimensional barcode according to an embodiment of the present invention.
5 is a flowchart illustrating a method of registering an OTP device according to the first embodiment of the present invention.
6 is a flowchart illustrating an OTP authentication method according to a second embodiment of the present invention.
7 is a flowchart illustrating a method of downloading or updating OTP device information according to a third embodiment of the present invention.

Hereinafter, specific details for the implementation of the present invention will be described with reference to the drawings.

In addition, in describing the present invention, the same parts are denoted by the same reference numerals, and repeated explanations thereof are omitted.

First, a configuration of an entire system according to an embodiment of the present invention will be described with reference to FIG. 1.

As shown in FIG. 1, the entire system according to an embodiment of the present invention performs user authentication by verifying the OTP one-time password and the OTP client 20 installed in the smart terminal 10 to generate an OTP one-time password. It consists of an authentication server (30). In addition, it is configured to further include a service server 50 that provides a service to the user.

First, the smart terminal 10 is a mobile terminal used by a user, and is a smart terminal having ordinary computing functions such as a smart phone, phablet, and tablet PC. In particular, the smart terminal 10 is a terminal in which an application or a mobile application (or an app, an application) can be installed and executed. Hereinafter, a description of a task performed by a user means a task performed through the smart terminal 10 or a program (or app) installed in the smart terminal 10.

As shown in FIG. 2, the smart terminal 10 includes a camera 11 capable of capturing an image, a display 12 capable of displaying an output such as an image or image, an input device 13 such as a touch screen, and a gyroscope. It consists of a motion sensor 14 that detects rotation or movement of the terminal, a communication unit 15 that communicates with the outside, and a central processing unit 18 that can install and execute an application.

Next, the OTP client 20 is a mobile application (or app, application) installed and executed on the smart terminal 10, a program system that generates a one-time password (OTP, one-time password) according to a user's command to be.

The OTP client 20 registers the OTP device with the authentication server 30, and receives a secret key and a unique ID (ID) of the corresponding OTP device. In addition, when registering the OTP device, the OTP client 20 receives and stores a multidimensional barcode (emergency multidimensional barcode) including the emergency OTP of the OTP device from the authentication server 30.

The OTP device is an object that acts as a device that creates a one-time password. The OTP client 20 may register and manage a plurality of OTP devices. As an example, in the OTP device, each user may be created for each service server 50. As another embodiment, when the OTP client 20 is limited to register only one OTP device, the OTP client itself may serve as an OTP device.

Each OTP device has a unique secret key and is identified by a unique ID. The secret key is a key distributed and shared by the OTP client 20 and the authentication server 30, and is used as a seed for generating a one-time password. The secret key is set differently for each OTP client or OTP device.

In addition, the unique ID is a secret key or identification information for identifying the OTP device. Preferably, a unique ID is generated using a user ID or an ID of the user ID and the service server (hereinafter, service ID).

In addition, the OTP client 20 generates a password for the corresponding OTP device according to a user request. In this case, the OTP client 20 generates a one-time password (OTP) using the generated secret key and time information (or time seed value). At this time, preferably, the time information is set to the current time.

The generated one-time password (OTP) is transmitted to the authentication server 30 along with the unique ID, and verification of the one-time password is performed by the authentication server 30. If the verification for OTP is successful, it is considered that the user authentication by OTP has passed.

On the other hand, the emergency one-time password (OTP) is a backup code or a temporary one-time password, and is authentication information used instead of OTP authentication when it is difficult to generate and authenticate normal OTP due to loss of the OTP device.

The emergency one-time password (OTP) is converted into a multidimensional barcode and transmitted as a multidimensional barcode image. That is, the OTP client 20 is connected online to download an image of an emergency multi-dimensional barcode, or output on the screen of the authentication server 30 and photographed and transmitted by the OTP client 20 or the smart terminal 10 Can be.

In addition, when the OTP device is unavailable, the OTP client 20 may be authenticated to the authentication server 30 using an emergency one-time password (OTP). In particular, the OTP client 20 may be authenticated through an emergency one-time password (OTP) and then download the corresponding OTP device information again, or may create and register a new OTP device.

At this time, the OTP client 20 transmits a multidimensional barcode including an emergency one-time password (OTP) to the authentication server 30 to receive authentication. That is, the OTP client 20 transmits the stored multidimensional barcode, or captures an image of the multidimensional barcode through the smart terminal 10 and transmits the captured image.

Next, the authentication server 30 registers the secret key or OTP device, and verifies the OTP (one time password, one-time password) according to the request of the service server 50.

The authentication server 30 maps a unique ID and a secret key into one set, and registers it as an OTP device. As described above, the unique ID is a secret key or identification information for identifying an OTP device. In addition, the secret key is a key shared by the OTP client 20 and the authentication server 30. A one-time password is generated by using a combination of the secret key and the time seed value (or the current time) as a seed.

Preferably, as shown in FIG. 3, the authentication server 30 may manage a list (hereinafter, referred to as an OTP device list) by using a unique ID and a secret key as one mapping pair. More preferably, the authentication server 30 may be managed by adding a period in addition to the unique ID and secret key. Period refers to the time interval for generating a one-time password. That is, the one-time password is generated using a combination of the secret key and the time seed value, and the period means the time unit of the time seed value. Therefore, the one-time password is changed every time of the cycle. For example, if the period is 30 seconds, the generated one-time password is changed every 30 seconds.

In addition, as shown in FIG. 3, the authentication server 30 also stores an emergency OTP (temporary OTP or backup code) for emergency authentication of each secret key in the OTP device list. In this case, the emergency OTP may be stored as an emergency OTP value itself or a hash value of an emergency OTP. In FIG. 3, one emergency OTP is recorded for each OTP device, but a plurality of emergency OTPs may be recorded. That is, one or two or more emergency OTPs may be stored for each device.

In addition, the authentication server 30 receives a user ID or service ID (or ID of the service server 50) from the OTP client 20 or the service server 50, and generates a unique ID. The unique ID may be set in advance, set randomly, or generated using a temporal element. Hereinafter, for convenience of explanation, a method of using temporal elements will be mainly described.

Preferably, the authentication server 30 may generate a unique ID by adding a parameter that is a temporal element such as a timestamp. That is, as shown in Equation 1 below, the authentication server 30 generates a unique ID using a user ID, a service ID, and a parameter (or timestamp).

[Equation 1]

UniqueID = GenerateUniqueID (CompanyID, UserID, TimeStamp)

Here, UniqueID is a unique ID, CompanyID is a service ID, UserID is a user ID, and TimeStamp is a timestamp and is a parameter. GenerateUniqueID is an arbitrary mapping function, preferably, a one-to-one mapping function or a one-way function.

In addition, the authentication server 30 generates a secret key. The generated secret key is shared with the OTP client 20. In this case, a method of directly transmitting the secret key to the OTP client 20 or a method of transmitting only a parameter capable of generating a secret key may be used. Hereinafter, for convenience of explanation, the latter method will be mainly described.

Preferably, the authentication server 30 may generate a secret key by applying the unique ID and parameters to the random number generator. That is, if the unique ID, parameter, and random number generator are the same, the same secret key can be generated.

Specifically, as shown in the following equation, the authentication server 30 extracts the number of occurrences of a random number using a parameter. That is, the number of occurrences of the random number is extracted through the generation of the random number, but the parameter is used as a seed.

[Equation 2]

SequenceID = RNG(PREDEFINEDVAL, TimeSTamp)

Here, SequenceID represents the number of occurrences of a random number, and RNG represents a random number generator or a random number generation function. In addition, TimeSTamp represents a parameter. And PREDEFINEDVAL is a constant determined in advance.

Then, the authentication server 30 generates a secret key Secret by the following equation.

[Equation 3]

For (i=0; i<SequenceID; Secret = RNG(UniqueID), i++);

Equation 3 is a pseudo code that generates a secret key. A random number is generated by a random number generator (RNG) using a unique ID (ID) as a seed, but is repeated as many times as the number of random numbers (SequenceID). Occurs.

Meanwhile, the authentication server 30 may set parameters such as a time stamp to generate a unique ID or secret key as described above. The parameter is a parameter by a temporal factor, preferably a time stamp. That is, the parameters are set differently each time the secret key is generated (or when the OTP device is registered).

Meanwhile, the authentication server 30 may obtain a hash value of the generated secret key and use the hash value as a verification value of the secret key.

In addition, the authentication server 30 transmits a unique ID, a secret key or parameter, a verification value, and the like (hereinafter, OTP device information) to the OTP client 20 together. At this time, preferably, the authentication server 30 may convert and transmit the OTP device information into a multidimensional barcode (QR code, voiceeye code, etc.) such as a two-dimensional code. As an example, OTP device information is converted into a QR code and generated, and the QR code is displayed on the display. Then, the user recognizes the QR code using the camera of the user terminal 10, and extracts OTP device information from the QR code.

In particular, the authentication server 30 transmits OTP device information including the secret key in the case of an embodiment in which the secret key is directly distributed, and transmits OTP device information including the parameter when distributing through a parameter.

In addition, when the secret key is distributed (or the secret key is distributed by a parameter), the authentication server 30 generates an emergency one-time password (OTP), and a multi-dimensional barcode (or emergency multi-dimensional barcode) such as a two-dimensional barcode including the same Create

At this time, the authentication server 30 receives an authentication number for a code from a user, encrypts an emergency one-time password with the received authentication number, and includes the encrypted one-time emergency password in the multidimensional barcode.

Multidimensional barcodes are information that codes for an emergency one-time password (or encrypted one-time password for emergency use), a unique ID, and whether the emergency one-time password is encrypted. The unique ID is the unique ID of the corresponding OTP device.

As shown in FIG. 4, the multidimensional barcode may use a barcode of two or more dimensions such as a QR code, a voice eye code, and a color code.

The generated multidimensional barcode is transmitted to the OTP client 20. In this case, the image of the multi-dimensional barcode may be directly transmitted to the OTP client 20 or output on a screen and photographed and transmitted by the OTP client 20 or the smart terminal 10.

An emergency one-time password (OTP) is a backup code or a temporary one-time password (OTP). The emergency one-time password (OTP) is authentication information used instead of OTP authentication when it is difficult to generate and authenticate normally OTP due to loss of the OTP device or the like.

In addition, the authentication server 30 may generate at least one or two or more emergency one-time passwords to generate multidimensional barcodes for each emergency one-time password, respectively. That is, one emergency one-time password and one multi-dimensional barcode become one-to-one.

On the other hand, when the authentication server 30 receives the verification request (authentication request) for the one-time password of the secret key (or OTP device) from the service server 50, the authentication server 30 verifies (or authenticates) the one-time password (OTP) of the secret key. Then, the result (or verification result, authentication result) is returned.

That is, when the authentication server 40 receives the unique ID and one-time password (OTP) from the service server 50, the authentication server 40 searches for a secret key (or OTP device) corresponding to the unique ID. In particular, a unique ID is searched in the OTP device list, and a secret key mapped to the searched unique ID is searched.

A one-time password (OTP) is generated using the retrieved secret key, and the one-time password is verified (or authenticated) by comparing the generated one-time password (OTP) and the received one-time password (OTP). That is, if it is the same, it is determined that it is verified.

Meanwhile, although the authentication server 30 and the service server 50 have been described as independent servers, these servers may be implemented as one system or one server.

Next, the service server 50, as a server providing a service, processes user authentication for a user of the service, and provides a service to the user when the user authentication passes.

The service server 50 performs user authentication. At this time, one-factor authentication or two-factor authentication may be performed. In particular, the service server 50 performs authentication using OTP as an authentication means. Alternatively, as another embodiment, it may be performed alone with a one-time password method.

The service server 50 requests OTP authentication from the authentication server 30. At this time, the service server 50 receives the unique ID and one-time password from the OTP client 20, and transmits the received unique ID and one-time password to the authentication server 30.

Meanwhile, the service server 50 may relay or provide an OTP device registration, re-download, or update operation to the user terminal 10 or the OTP client 20. That is, the service server 50 may be interlocked with the authentication server 30 to provide an interface for OTP device management of the authentication server 30. Accordingly, the user terminal 10 or the OTP client 20 may access the service server 50 to register an OTP device, perform an update operation, or a re-download operation. However, the registration service, update, and download service of the actual OTP device is provided by the authentication server 30.

In particular, the service server 50 may provide a service ID (ID of a service server) to the authentication server 30 when registering an OTP device.

Next, the database 40 includes a service DB 41 that stores information on a service server, and a device DB 42 that stores a list of unique IDs and secret keys of each OTP device. However, the configuration of the database 40 is only a preferred embodiment, and may be configured in a different structure according to the database construction theory in consideration of ease and efficiency of access and search in developing a specific device.

Next, an OTP device registration method according to the first embodiment of the present invention will be described with reference to FIG. 5.

As shown in FIG. 5, first, the smart terminal 10 or the OTP client 20 accesses the service server 50 (S11). At this time, the service server 50 receives a user ID from the user terminal 10. Also, preferably, the service server 50 may perform primary user authentication based on an ID and a password. The service server 50 may acquire a user ID while performing primary authentication. In addition, the user terminal 10 or the OTP client 20 may obtain an ID or service ID of the service server 50.

Next, the service server 50 requests the authentication server 30 to register the OTP device (S12). At this time, the service server 50 transmits a user ID (ID) and its own ID (or service server ID, service ID) to the authentication server 30.

Meanwhile, as another embodiment, the OTP client 20 may directly access the authentication server 30 to request registration of the OTP device. In this case, without relaying from the service server 50, the OTP client 20 directly performs the registration operation using the interface of the authentication server 30.

Next, the authentication server 30 generates a secret key (S21), and registers the OTP device (S22). In this case, the authentication server 30 may directly generate the secret key, or generate a parameter first and then use it to generate the secret key. In addition, the authentication server 30 may directly generate the unique ID of the corresponding secret key or may generate it using a parameter. Hereinafter, the case of using the parameter will be described in more detail.

That is, the authentication server 30 sets parameters. The parameter is a parameter by a temporal factor, preferably set to a time stamp. Since the parameter is generated when there is a request from the OTP device, each request has a different value.

In addition, the authentication server 30 generates a unique ID using a user ID, a service ID, and a parameter. A unique ID is created using Equation 1 above. In this case, when the OTP client 20 directly accesses the authentication server 30 without passing through the service server 50, a unique ID may be generated using a user ID without a service ID.

In addition, the authentication server 30 generates a secret key using a unique ID and parameters, and generates a verification value for the secret key. That is, as shown in Equation 2 above, a random number is generated by using a parameter as a seed to generate the number of random number generation. And, as shown in Equation 3 above, a random number is generated by using a unique ID as a seed, but by generating the number of times the random number is generated, a secret key is obtained. Then, the hash value of the generated secret key is obtained and used as a verification value.

Next, the authentication server 30 associates the unique ID with the secret key and registers it in the OTP device list (S22). Preferably, it is possible to set a period in the list. Period refers to the time interval for generating a one-time password. In particular, a one-time password is created by combining the secret key and the current time, and the unit of the current time is the cycle. If the secret key and the current time are the same, the one-time password is the same, so if the current time is different, the one-time password will be different. Therefore, the one-time password is changed by stock price. As a result, as shown in FIG. 3, the OTP device information is composed of a unique ID, a secret key, and a period.

Next, the authentication server 30 transmits OTP device information or parameters to the service server 50 or the OTP client 20 (S23). Preferably, the authentication server 30 may also transmit a period. In particular, the service server 50 receives parameters and the like and transmits them to the user terminal 10.

In this case, the authentication server 30 may directly transmit a unique ID and a secret key as OTP device information, or may transmit a parameter capable of generating a secret key instead of the secret key. Hereinafter, a case of sending a parameter will be described.

In addition, the authentication server 30 may transmit OTP device information or parameters through a network directly with the OTP client 20 or the smart terminal 10, or may indirectly transmit it through a two-dimensional code or a multi-dimensional code.

That is, the authentication server 30 may convert a secret key or parameter into a two-dimensional code or a multi-dimensional barcode (QR code, voice-eye code, color code, etc.) and transmit a multi-dimensional barcode or a multi-dimensional barcode image. Multidimensional barcodes are codes formed in two dimensions, such as barcodes, and are QR codes, voiceye codes, and color codes. In particular, the authentication server 30 may convert the encrypted data into a multidimensional barcode by encrypting a secret key or parameter when converting a multidimensional barcode.

Further, preferably, the service server 50 receives a multidimensional barcode such as a secret key or parameter from the authentication server 30 and displays the multidimensional barcode on the screen. The user photographs a corresponding multi-dimensional barcode with a camera (not shown) of the smart terminal 10, and extracts OTP device information or parameters from the photographed multi-dimensional barcode. At this time, if the contents of the multi-dimensional barcode are encrypted, the OTP device information or parameters are extracted after decryption.

Next, upon receiving OTP device information or parameters, the OTP client 20 extracts a unique ID and a secret key (S31). When receiving a unique ID and secret key directly, the unique ID and secret key can be extracted immediately by decoding the multidimensional barcode.

In addition, when a parameter is transmitted, the OTP client 20 generates a secret key using the received parameter. That is, the OTP client 20 generates the number of random number generation as a parameter as shown in Equations 2 and 3 above, and generates a random number by using the unique ID as a seed, but generates as many times as the number of random number generation, and the secret key Get The secret key generation method is the same as the method performed by the authentication server 30 above.

Meanwhile, when only a parameter is transmitted and a unique ID is not transmitted, the OTP client 20 may also generate a unique ID using a user ID, a service ID, and a parameter. The unique ID generation method is the same as the method performed in the authentication server 30 above.

Also, when receiving the verification value of the secret key, the OTP client 20 obtains a hash value by applying a hash function to the generated secret key. And by comparing the obtained hash value and the received verification value, the secret key is verified.

[Equation 5]

Result = Compare(HashValue,HashValue_Server)

Here, Result is a comparison result or verification result, HashValue is an acquired hash value, and HashValue_Server is a verification value received from the server. Compare is a function that determines whether they are the same. In the same case, the secret key is verified with the correct key.

Next, the OTP client 20 registers and stores the OTP device information (S32), and transmits the registration result to the authentication server 30 (S33).

Next, when the OTP device is registered, the authentication server 30 generates an emergency OTP for the OTP device (S41).

An emergency one-time password (OTP) is an arbitrary code or password, and is used as a backup code or a temporary one-time password (OTP). The emergency one-time password (OTP) is authentication information used instead of OTP authentication when it is difficult to generate and authenticate normally OTP due to loss of the OTP device or the like.

In addition, the authentication server 30 may generate one emergency OTP, or may generate a plurality of them.

Meanwhile, the authentication server 30 may receive an authentication number for a barcode from the OTP client 20 or a user, and encrypt an emergency OTP with the authentication number. Preferably, a plurality of emergency OTPs are all encrypted with one authentication number.

Next, the authentication server 30 generates a multi-dimensional barcode including an emergency OTP (S42). That is, in addition to the emergency OTP, the authentication server 30 may generate a multidimensional barcode by coding contents such as whether to encrypt a unique ID and an emergency one-time password. In addition, if the emergency one-time password is encrypted, the encrypted emergency one-time password is included in the multidimensional barcode.

Next, the authentication server 30 transmits a multidimensional barcode or a multidimensional barcode image to the OTP client 20 (S43). In this case, the authentication server 30 may transmit a multidimensional barcode through the service server 50.

That is, the multidimensional barcode is displayed on the screen by the authentication server 30 or the service server 50. The user photographs a corresponding multidimensional barcode with a camera (not shown) of the smart terminal 10 and acquires the photographed multidimensional barcode image. Alternatively, the OTP client 20 may be connected online to download an image of an emergency multidimensional barcode.

Next, the OTP client 20 or the smart terminal 10, or the multi-dimensional barcode transmitted to the user may be stored as an image or output and stored (S44).

Next, an OTP authentication method according to a second embodiment of the present invention will be described with reference to FIG. 6.

6, the user terminal 10 or the OTP client 20 connects to the service server 50 (S51). At this time, when performing two-step authentication, the service server 50 may perform primary user authentication using a user ID and password (S52).

Next, the service server 50 starts OTP authentication with the authentication server 30 for OTP authentication (S61). In this case, the service server 50 may use an interface for OTP authentication of the authentication server 30. Then, the service server 50 or the authentication server 30 requests a one-time password from the user or the user terminal 10 or the OTP client 20 (S62).

Next, the smart terminal 10 executes the OTP client 20, or the OTP client 20 directly generates a one-time password (S71) and transmits it to the service server 50 or the authentication server 30. (S72).

At this time, as shown in Equation 7, the OTP client 20 sets the current time as a time seed value, and generates a one-time password OTP using the secret key and the time seed value. That is, if the secret key and the time seed value are the same, the same one-time password can be obtained.

[Equation 7]

OTP_Client = GenerateOTP(Secret, GetCurrentTime())

OTP_Client is a one-time password generated by the client (hereinafter, the first password), and GetCurrentTime() is a function that gets the current time. Also, GenerateOTP() is a one-way function or one-to-one correspondence function, and outputs the same output value for the same input value.

Transmission of the first password may be directly input by the user. That is, the OTP client 20 only outputs the first password on the screen, and the user can directly input it to the input interface of the service server 50 or the authentication server 30. Alternatively, if the OTP client 20 can perform data communication with the service server 50 or the authentication server 30, it can transmit a first password (or a first password and a unique ID) through data communication.

Meanwhile, preferably, when transmitting the first password, the OTP client 20 transmits a unique ID corresponding to the corresponding first password together.

Next, the authentication server 30 receives a first password (or a first password and a unique ID), and generates a second password (S81). The second password is generated using a secret key corresponding to the unique ID. The second password may be generated as follows [Equation 8].

[Equation 8]

OTP_Server = GenerateOTP(Secret, GetCurrentTime())

Here, OTP_Server is a second password, and is a one-time password generated by the authentication server 30.

Next, the authentication server 30 compares the first and second passwords and verifies the received first password (S82). That is, if the first and second passwords are the same, the authentication (or verification) is passed.

Next, the authentication server 30 transmits the verification result or the authentication result to the service server 50 or the OTP client 20 (S83).

Next, a method of downloading or updating OTP device information according to a third embodiment of the present invention will be described with reference to FIG. 7.

As shown in FIG. 7, first, the smart terminal 10 or the OTP client 20 accesses the authentication server 30 (S210). At this time, it is possible to access the authentication server 30 through the service server 50. Particularly, preferably, when accessing the service server 50, primary user authentication may be performed using an ID and a password.

Next, the smart terminal 10 or the OTP client 20 transmits an emergency multi-dimensional barcode or emergency multi-dimensional barcode image including an emergency OTP to the authentication server 30 (S221). That is, the OTP client 20 transmits the stored multidimensional barcode, or captures an image of the multidimensional barcode through the smart terminal 10 and transmits the captured image.

Next, the authentication server 30 extracts the unique ID and the emergency OTP (hereinafter, the first emergency OTP) from the emergency multi-dimensional barcode (S222). At this time, preferably, the authentication server 30 determines whether or not the emergency OTP is encrypted. And, in the case of encryption, a barcode authentication number is requested and input from the OTP client 20 or the user. And decrypts the first emergency OTP encrypted with the received authentication number.

Next, the authentication server 30 fetches an emergency OTP (hereinafter referred to as a second emergency OTP) from the OTP device list (S223). At this time, the OTP device list is searched using the unique ID, and a second emergency OTP corresponding to the unique ID is obtained.

Next, the authentication server 30 compares whether the first and second emergency OTPs are the same, and performs alternative authentication (S224). Alternative authentication is user authentication other than OTP authentication. In particular, alternative authentication is authenticated with an emergency one-time password.

Next, if the alternative authentication is successful, the OTP client 20 receives OTP device information from the authentication server 30 or updates the OTP device (S230).

That is, when receiving OTP device information, the OTP client 20 requests OTP device information, and the authentication server 30 delivers the OTP device information.

At this time, the OTP device information is composed of a unique ID, a secret key, and a period.

Also, preferably, the OTP device information is encrypted and transmitted.

In addition, the authentication server 30 may transmit OTP device information directly with the OTP client 20 or the smart terminal 10 through a network, or may indirectly transmit information through a multidimensional barcode such as a two-dimensional code. That is, the authentication server 30 may convert the encrypted OTP device information into a multidimensional barcode (QR code, voiceeye code, etc.) and transmit a multidimensional barcode or a multidimensional barcode image. For example, the authentication server 30 or the service server 50 displays a multidimensional barcode image on the screen, captures a multidimensional barcode image through the camera of the smart terminal 10, and captures OTP device information from the obtained image. Extract.

In addition, when updating the OTP device, a new OTP device is generated as in the first embodiment of the present invention. That is, steps S21 to S32 or steps S21 to S44 of the first embodiment are performed.

Finally, the present invention is summarized.

When using smart OTP or the like to users, temporary OTP or backup code is provided to the user upon registration. These backup codes were usually provided in a human-readable way. In the present invention, when a user registers a mobile OTP in a server, the backup code or temporary OTP is converted into a multidimensional barcode and stored in order to prevent the user from taking responsibility for storing the backup code in a secure and secret storage. That is, a multidimensional barcode is inputted through a camera, and a password (or a password set by a user) included in the multidimensional barcode must be input to perform user authentication.

That is, the user generates an emergency OTP such as a backup code or a temporary OTP when registering a smart OTP, and asks the user for a password to use when reading the backup code or temporary OTP. In addition, when the server generates the generated backup code or temporary OTP, it generates a multidimensional barcode including a password specified by the user. Therefore, the password specified by the user is plain text, encoded or encrypted and stored in a multidimensional barcode. In addition, when a user reads a barcode for emergency use, before reading a backup code or a temporary OTP stored in it, the scanned device asks for a password specified by the user. In the case of the same password, the multidimensional barcode value is displayed to the user or automatically transmitted to the server.

In the above, the invention made by the present inventors has been described in detail according to the embodiments, but the invention is not limited to the embodiments, and it goes without saying that various modifications can be made without departing from the gist of the invention.

10: smart terminal 20: OTP client
30: authentication server 40: database
50: service server 80: network

Claims (6)

In the multidimensional barcode-based temporary backup OTP storage method in which an OTP client installed in a user terminal, a service server, and an authentication server are connected through a network,
(a) The authentication server generates a unique ID and secret key, registers it in the OTP device list, transmits OTP device information including the unique ID and secret key to the OTP client, and sends a new OTP device to the OTP client. Setting; And,
(b1) the authentication server generating an emergency one-time password (OTP) and storing the generated emergency OTP in the OTP device list;
(b2) the authentication server generating a multi-dimensional barcode including the emergency OTP; And,
(b3) The authentication server, the multidimensional barcode-based temporary backup OTP storage method comprising the step of transmitting the multidimensional barcode to the OTP client.
The method of claim 1, wherein the method comprises:
(c1) the authentication server receiving the multidimensional barcode from the OTP client;
(c2) the authentication server extracting a unique ID and an emergency OTP (hereinafter referred to as a first emergency OTP) from the multi-dimensional barcode;
(c3) the authentication server searching the OTP device list with the extracted unique ID, and detecting an emergency OTP (hereinafter referred to as a second emergency OTP) corresponding to the extracted unique ID; And,
(c4) The authentication server compares the first and second emergency OTPs, and performs authentication instead of OTP authentication (hereinafter, alternative authentication), further comprising: .
The method of claim 2, wherein the method,
(d) If the alternative authentication is successful, the authentication server further comprises the step of transmitting the OTP device information corresponding to the extracted unique ID to the OTP client, or generating and transmitting a new OTP device for the extracted unique ID. Multidimensional barcode-based temporary backup OTP storage method, characterized in that.
The method of claim 1, wherein step (a),
(a1) requesting the authentication server to register an OTP device for a user connected to the service server;
(a2) the authentication server generating a unique ID and a secret key and registering it in the OTP device list;
(a3) the authentication server transmitting OTP device information including the unique ID and secret key to the OTP client;
(a4) the OTP client extracting a unique ID and secret key from the OTP device information; And,
(a5) The OTP client includes the step of setting a new OTP device with the unique ID and secret key.
The method of claim 2,
In step (b2), the authentication server receives an authentication number for a barcode (hereinafter, a first authentication number), encrypts the emergency OTP with the first authentication number, and inserts the encrypted emergency OTP into the multidimensional barcode. ,
In the step (c2), the authentication server receives a barcode authentication number (hereinafter, a second authentication number), and decrypts the emergency OTP with the second authentication number. .
The method of claim 2,
In the step (c1), the OTP client transmits the stored multi-dimensional barcode or photographs the multi-dimensional barcode using the camera of the smart terminal and transmits the photographed multi-dimensional barcode. Way.

Images