KR20210116407A - Cross authentication method and system between online service server and client - Google Patents

Abstract

The present invention provides a cross-authentication method between an online service server and a client to prevent unnecessary re-input of an authentication number and a system thereof. According to the present invention, a computer-implemented method for performing cross-authentication between an online service server and a service user comprises: (a) a step of generating, by an authentication server, a simple authentication number in response to a simple authentication number generation request, which includes user account information of a service user accessing the online server, received from the online server; (b) a step of transmitting, by the authentication server, a generation condition used to generate the simple authentication number to a simple authenticator of a user corresponding to the user account information; (c) a step of generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number by using the generation condition of the simple authentication number; and (d) a step of generating, by the authentication server, a corresponding verification value in response to an additional verification value transmitted from the simple authenticator as verification of the online service server through the simple authentication number and the verification number for verification is completed and checking whether the additional verification value and the corresponding verification value match to perform authentication for the corresponding service user.

Description

Method and system for mutual authentication between online service server and client {CROSS AUTHENTICATION METHOD AND SYSTEM BETWEEN ONLINE SERVICE SERVER AND CLIENT}

* The present invention relates to an authentication method and system, and more particularly, to a mutual authentication method and system between an online service server and a client.

In order to safely utilize convenient electronic financial services or important online services, a separate authentication method is configured in addition to the ID and password used in the online service to enhance the safety of user authentication. Representatively, OTP dongle, one-time password via SMS, one-time password via ARS, and mobile app-based biometric authentication are used to strengthen identity authentication according to ID password theft.

However, conventional additional authentication means require a complicated input from the user, such as allowing a user to directly input a one-time password generated between an online service and an authentication medium, or inputting separate biometric information. In particular, if a 4-6 digit temporary password has to be re-entered with a mobile phone, it is difficult not only to understand the number confirmed through the mobile phone screen, but also to enter it.

In order to eliminate the temporary password input, when a user logs on to the service with an ID and password, push information is sent to the mobile phone. There is a service that automatically logs you in to an online service if you are correct by having to enter it into the app, but this also causes the complexity of entering biometric information.

Another simple authentication method is to minimize user input by installing an access control app that determines whether to approve access to the user's designated mobile phone in advance, and when the user enters an ID and password into the online service, mobile push There was also a connection confirmation method that notifies the user of access through a message and approves or rejects whether to access the online service when the user runs the access approval app. However, in this method, if the service accessed by the user is a pharming hacker's site, the hacker reversely uses the ID and password entered by the user and transmits it to the actual online service. When it arrives, a problem arises in which it is mistaken for the user's access and grants the corresponding access. In addition, if a hacker who knows the user's ID and password accesses the user's ID and password as soon as the actual user accesses it, the user misunderstands the last connection that arrived on his/her smartphone as his and prevents the access. You may be able to approve it.

Therefore, there is a need for an improved method and technology that can determine whether the site is normal or not, and even check whether or not the user is accessing the site without the hassle of re-entering the temporary password.

In the present invention, when performing two-factor authentication (ie, mutual authentication according to service authentication and user authentication) for safe use of online services, the user can check whether the service is correct without entering a separate one-time password or biometric information. A method and system for simple authentication that allows convenient access after confirmation are provided.

According to one aspect of the present invention, as a computer implemented method for performing mutual authentication between an online service server and a service user,

(a) generating, by the authentication server, a simple authentication number in response to a simple authentication number generation request including user account information of a service user accessing the online server from the online server;

(b) transmitting, by the authentication server, a generation condition used to generate the simple authentication number to a simple authenticator of a user corresponding to the user account information;

(c) generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number by using the generation condition of the simple authentication number; and

(d) the authentication server generates a corresponding verification value in response to the additional verification value transmitted from the simple authenticator as verification of the online service server through the simple authentication number and the verification number for verification is completed; , and performing authentication for a corresponding service user by comparing whether the additional verification value and the corresponding verification value match.

In an embodiment, the request for generating the simple authentication number may include, when the user account information input by the service user to an online site provided by the online service server matches the pre-registered account information of the corresponding user, the online service may be transmitted from the server to the authentication server.

In one embodiment, in the step (b), the generation condition of the simple authentication number is the user's mobile device corresponding to the user account information from the authentication server through a push message or socket data communication, or the mobile device installed in the mobile device. It can be sent to a simple authenticator.

In an embodiment, in the step (a), the authentication server further receives, from the online service server, client connection environment information for the connection terminal of the corresponding service user who has accessed the online service server, wherein the simple authentication number using the client connection information when creating

In step (b), the authentication server may transmit a condition for generating the simple authentication number including the client connection environment information to the simple authenticator.

In one embodiment, the client connection environment information,

Server variables related to the access terminal accessing the online service server, host name, cookie information, previous URL, current access IP address, access IP address one step ahead, client browser information, client language information, system variables of the access terminal, It may be at least one of a server host name, a server IP address, a session ID, and maximum session validity time information of an online service server that provides a service to the access terminal.

In an embodiment, in the step (a), the authentication server uses the client access environment information as a first seed value and at least one pre-specified additional information as a second seed value, but uses time or the number of attempts as the calculation condition. to generate the simple authentication number,

In step (c), the simple authenticator may generate the authentication number for verification by applying the same generation conditions as the simple authentication number.

In one embodiment, when the verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to a pre-specified condition and transmits it to the authentication server do,

The authentication server may generate the corresponding verification value by applying the same condition as the pre-specified condition, and when the additional verification value and the corresponding verification value match, the normal authentication may be notified to the online service server.

In one embodiment, the method further comprising the step of transmitting, by the authentication server, the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

Before the validation effective time of the simple authentication number through the authentication number posting screen elapses or before the verification on the online service server by the service user is completed, using the same account information as the user account information of the service user If a lower priority connection is attempted,

The authentication server maintains the simple authentication number generated according to the priority access as it is during the verification effective time of the simple authentication number or until the verification on the online service server is completed, or a new simple authentication number according to the sub-priority connection creation may be prohibited.

According to another aspect of the present invention, there is provided an authentication system for performing mutual authentication between an online service server and a service user, comprising: an authentication server; and a simple authenticator on the service user side communicating with the authentication server,

The authentication server is

When a simple authentication number generation request including user account information of a service user accessing the online server is received from the online server, a simple authentication number is generated,

Transmitting the generation conditions used to generate the simple authentication number to the simple authenticator corresponding to the user account information so that an authentication number for verification for verification of the simple authentication number can be generated,

As the verification of the online service server through the simple authentication number and the verification number is completed, a corresponding verification value is generated in response to the additional verification value transmitted from the simple authenticator, and the additional verification value and the correspondence An authentication system for mutual authentication is provided that performs authentication for a corresponding service user by comparing whether or not the verification values match.

In one embodiment, the authentication server,

Further receiving, from the online service server, client access environment information on the access terminal of the service user who has accessed the online service server, using the client access information when generating the simple authentication number,

A condition for generating the simple authentication number including the client connection environment information may be transmitted to the simple authenticator.

In one embodiment, the client connection environment information,

Server variables related to the access terminal accessing the online service server, host name, cookie information, previous URL, current access IP address, access IP address one step ahead, client browser information, client language information, system variables of the access terminal, It may be at least one of a server host name, a server IP address, a session ID, and maximum session validity time information of an online service server that provides a service to the access terminal.

In an embodiment, the authentication server generates the simple authentication number by using the client connection environment information as a first seed value and at least one pre-specified additional information as a second seed value, but using time or the number of attempts as a calculation condition. do,

The simple authenticator may generate the authentication number for verification by applying the same generation conditions as the simple authentication number.

In one embodiment, when the verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to a pre-specified condition and transmits it to the authentication server do,

The authentication server may generate the corresponding verification value by applying the same condition as the pre-specified condition, and when the additional verification value and the corresponding verification value match, the normal authentication may be notified to the online service server.

In one embodiment, the authentication server transmits the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

Before the validation effective time of the simple authentication number through the authentication number posting screen elapses or before the verification on the online service server by the service user is completed, using the same account information as the user account information of the service user If a lower priority connection is attempted,

The authentication server maintains the simple authentication number generated according to the priority access as it is during the verification effective time of the simple authentication number or until the verification on the online service server is completed, or a new simple authentication number according to the sub-priority connection creation may be prohibited.

According to an embodiment of the present invention, after the user inputs an ID and password to an online service, for additional authentication, if the simple authentication number provided by the service and the simple authentication number provided by the mobile simple authenticator are the same, the user's service access is approved By doing so, it is possible to eliminate unnecessary re-entry of the authentication number by the user.

In addition, according to an embodiment of the present invention, when another person attempts to access the online service with the user's ID and password, the user with the simple authenticator can be aware of the situation that the access permission request was made by someone other than the user. It is also possible to manage the security of ID and password.

1 is a view for explaining a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention.
2 is a block diagram of an embodiment of an authentication server implementing a mutual authentication method according to an embodiment of the present invention;
3 is a block diagram of an embodiment of a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention.
4 is an example related to a screen in which a simple authentication number is posted on an online service site operated by an online service server.
5 is an example related to a screen on which an authentication number for verification generated by a simple authenticator is displayed.
FIG. 6 is a view for explaining a processing method when an access attempt by a hacker is attempted in an authentication process according to the mutual authentication method of FIG. 1;
FIG. 7 is a diagram illustrating a processing result posted on an online service site operated by an online service server when a hacker attempts to access the same as in FIG. 6 .
8 and 9 are exemplary implementations of a mutual authentication method according to an embodiment of the present invention when an online service server is accessed through a user's mobile device.

Since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

In describing the present invention, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description process of the present specification are only identification symbols for distinguishing one component from other components.

In addition, throughout the specification, when a component is referred to as "connected" or "connected" with another component, the component may be directly connected or directly connected to the other component, but in particular It should be understood that, unless there is a description to the contrary, it may be connected or connected through another element in the middle.

In addition, throughout the specification, when a part "includes" a certain component, this means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented as one or more hardware or software or a combination of hardware and software. .

Also, in the following description, the simple authenticator is mainly described as a software-type authentication device installed in the form of an application program on a mobile device owned by the user, but is not necessarily limited thereto. For example, the simple authenticator may be a hardware authentication device with a communication function. However, hereinafter, for convenience and concentration of the description, an embodiment of the present invention will be described assuming the former case.

In addition, the following description will be made on the assumption that a client terminal, which is an access terminal connecting to the online service server, and a simple authenticator are physically separately configured with reference to FIG. 1 , but the simple authenticator may be implemented integrally with the client terminal. In the latter case, the mobile device shown in FIG. 1 will be omitted. Also, it is obvious that the client terminal itself may be a mobile device.

1 is a view for explaining a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention. In addition, FIG. 2 is a block diagram of an authentication server implementing a mutual authentication method according to an embodiment of the present invention, and FIG. 3 is a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention. It is a block diagram of an embodiment. Hereinafter, a mutual authentication method and system according to an embodiment of the present invention will be described with reference to FIGS. 2 and 3 with a focus on FIG. 1 .

In addition, in the process of describing the embodiment of the present invention, reference is also made to FIGS. 4 to 9 . Here, FIG. 4 is an example related to a screen on which a simple authentication number is posted on an online service site operated by an online service server, and FIG. 5 is an example related to a screen on which an authentication number for verification generated by the simple authenticator is displayed, FIG. 6 is a diagram for explaining a processing method when an access attempt is made by a hacker in the authentication process according to the mutual authentication method of FIG. It is a diagram exemplifying the processing results posted on the service site. 8 and 9 are exemplary implementations of a mutual authentication method according to an embodiment of the present invention when an online service server is accessed through a user's mobile device.

Referring to step S1 of FIG. 1 , when an online service by an online service site provided by the online service server 230 is to be used, the service user requests access to the online service server 230 .

For example, when the online service to be used is an online banking service, the user may access a specific online service server that provides the corresponding online banking service (ie, a specific bank server that provides the online banking service). The connection to the online service server 230 may be via a mobile connection through the mobile device 210 (eg, a smart phone, etc.) owned by the user himself, but in FIG. 1 , the user's own mobile device ( 210) and a separate client terminal 200 (eg, a company PC, etc.) has been exemplified.

Referring to step S2 of FIG. 1 , in response to a request for access to the online service server 230 , the online service server 230 may request a service user who wants to use the online service to input user account information. Here, the user account information refers to identification information of a corresponding user that is stored (registered) in advance in the corresponding online service server 230 through a user registration procedure (or service subscription procedure). Typically, a user ID (Identifier) and password (password) may be utilized as user account information. However, if it is information that can identify a user who uses the online service, various information other than the user account information (eg, the user's email address, phone number, and certificate password on a public key infrastructure (PKI)-based certificate) etc.) can be used as an alternative.

Referring to step S3 of FIG. 1 , in response to a request for input of user account information, a service user inputs user account information into a corresponding online service site. Referring to step S4 of FIG. 1 , when user account information is input from a service user, the online service server 230 checks whether an account matching the user account information input by the user exists. The account DB 240 as shown in FIG. 1 may be utilized to check the account information. Account information about users (ie, members) who can receive online service through the online service server 230 is stored in the account DB 240 . Although the case where the account DB 240 is provided separately from the online service server 230 is illustrated in FIG. 1 , it goes without saying that the account DB 240 may be integrated with the online service server 230 . In addition, depending on the system implementation method, the account DB 240 may be implemented by being integrated with the authentication server 250 .

Referring to step S5 of FIG. 1 , when the input user account information matches the user account stored in the account DB 240 , the online service server 230 requests the authentication server 250 to generate a simple authentication number. do. Here, the simple authentication number is used as a purpose for enabling the user to determine whether the online service site currently accessed by the user is provided by a true online service provider.

In step S5 of FIG. 1 , when the online service server 230 requests generation of a simple authentication number from the authentication server 250 , the online service server 230 transmits the user account information of the corresponding service user together with the authentication server 250 . ) can be transmitted. For example, the online service server 230 may transmit a simple authentication number generation request including the user ID of the corresponding user as user account information to the authentication server 250 .

Also, according to an embodiment, the online service server 230 may additionally transmit the client connection environment information to the authentication server 250 through step S5 of FIG. 1 (or through a separate step). Here, the client connection environment information refers to information that can directly or indirectly indicate the connection environment regarding the connection terminal of the corresponding service user who has accessed the online service server 230 . Such client access environment information may vary depending on the service server.

For example, taking a standard web server as an example, various server variables (Server Variables; host name (REMOTE_HOST)), cookie information (HTTP_COOKIE), previous URL (HTTP_PEFERER), IP address (HTTP_X_FORWARDED_FOR), current IP address (REMOTE_ADDR), client browser (HTTP_USER_AGENT), client language (HTTP_ACCEPT_LANGUAGE)) session maximum validity time, etc.). As another example, if the accessing client is not a standard web browser but its own client program, various system variables (Mac Address, HDD UUID, etc.) of the client terminal can be used as client connection environment information within the range allowed by the operating system (OS). will be.

The request for generating the simple authentication number as described above is received (received) through the communication interface unit 251 of the authentication server 250, and the user account information and/or client connection environment information transmitted together is the It can be used as a seed value for generation.

Referring to step S6 of FIG. 1 , in response to a request for generating a simple authentication number from the online service server 230 , the authentication server 250 generates a simple authentication number. In this case, the generation of the simple authentication number may be performed by the simple authentication number generating unit 253 of the authentication server 250 .

At this time, it has been described above that the simple authentication number can be generated using the client access environment information transmitted from the online service server 230. Together, other embodiments that can be used as an additional seed value for generating the simple authentication number will be described in detail.

In an embodiment of the present invention, a fixed key registered in advance corresponding to user account information of a service user may be used as a seed value for generating a simple authentication number.

For example, the fixed key corresponding to the user account information may be any one or a combination of at least two of various user identification information such as the aforementioned user ID, password, user's email address, phone number, and certificate password is pre-registered and used. can As another example, the fixed key corresponding to the user account information may include a phone number, a product serial number, a USIM card number, a MAC address, etc. of a mobile device (eg, a smart phone, etc.) owned by the user. Any one or a combination of at least two identifiers may be pre-registered and used. As another example, as the fixed key corresponding to the user account information, a private key that the user selects and registers when registering for the simple authentication service or is assigned during the simple authentication service registration may be used.

In another embodiment of the present invention, as a seed value for generating an authentication number, a dynamic allocation key dynamically allocated when a user accesses a corresponding online service server may be used.

For example, as the dynamic allocation key, connection terminal connection information of a service user who accesses a corresponding online service server may be used. In this case, the connection terminal connection information includes session information (eg, session ID) or socket information (eg, socket) allocated to the connection terminal of the service user by the corresponding online service server when the service user connects. A handle (Socket handle, etc.) may be used.

Here, the session ID is a value given by the server to manage continuous data transmission and reception between the server and the access terminal, and the socket handle information is used to manage the socket, which is a unit for transmitting and receiving data between the server and the access terminal through the network. A random connection unique value assigned by the server itself. Such session ID or socket handle information is not only dynamically allocated, but also is a value that is given by the server itself, and since it is difficult to be hijacked by a hacker from outside the server, there is an advantageous effect in terms of security when using the session ID or socket handle information.

As another example, as the dynamic allocation key, a mobile IP address (which may be all or part of an IP address) dynamically allocated by a mobile communication company to a mobile device owned by a service user may be used. For example, assuming that a service user accesses a corresponding online service server through his/her mobile device, a mobile IP address dynamically allocated by a mobile communication company may be used as a seed value at this time.

Also, in the above description, a case in which a specific value is used as a seed value has been mainly described, but as a seed value for generating a simple authentication number, a random value randomly generated by the authentication server 250 itself may be used. .

Accordingly, the simple authentication number generator 253 of the authentication server 250 uses at least one of the seed values as described above, but uses the time or the number of attempts (that is, the number of attempts to issue the simplified authentication number) as a calculation condition. You can create a simple authentication number. For example, the simple authentication number generator 253 may generate a value obtained by multiplying the above-described at least one seed value by the time or the number of attempts as an encrypted value according to a specific hash function. Accordingly, the simple authentication number may be generated as a one-time value.

Also, here, the time OTP method is a method of generating an OTP using a generation time as an operation condition. In this way, the OTP may be generated as a value obtained by multiplying the determined specific OTP generation key by the generation time, which is an operation condition, as an encrypted value according to a specific hash function.

As described above, when the simple authentication number is generated, the authentication server 250 transmits the simple authentication number generated through the previous step S6 to the online service server 230 through the communication interface unit 251 . The transmitted simple authentication number is posted so that the user can check it through the screen of the online service site operated by the online service server 230 according to step S9 of FIG. 1 . An example of this is shown in FIG. 4 . Referring to FIG. 4 , it can be confirmed that the simple authentication number (refer to reference numeral 30A in FIG. 4 ) is posted through the authentication number posting screen on the right side of the online banking site. After the simple authentication number is posted on the screen, the waiting state for approval may continue until confirmation from the user is completed (see step S10 of FIG. 1 ).

In addition, referring to step S8 of FIG. 1 , the authentication server 250 transmits the simple authentication number generation condition through the communication interface unit 251 to the simple authenticator 220 installed in the mobile device 110 owned by the service user. to be sent

In FIG. 1 , the transmission of the simple authentication number generation condition of step S8 is exemplified as being performed through the push server 260 , but it is not necessarily the same, and the authentication server 250 is directly transmitted to the simple authenticator 220 . Of course it could be. In addition, although FIG. 1 shows the case of transmitting the simple authentication number generation condition through a push message, the simple authentication number generation condition may be transmitted by a transmission method using socket data communication.

When transmitting the simple authentication number generation condition through the push server 260, the authentication server 250 transmits the generation condition to the push server 260, and in this case, the push server 260 sends the simple authentication number through a push message. The generation condition may be transmitted to the simple authenticator 220 . Here, the push message may be a message service provided for each app in a specific mobile operating system. However, it is self-evident that the simple authentication number generation condition is not necessarily transmitted by a push message, and may be based on various commercial messaging services such as SMS, MMS, or a specific communication protocol. In other exemplary cases in which the simple authentication number generation condition is not transmitted by a push message, the aforementioned push server 260 may be substituted for its function as a general communication server.

In addition, although the description has been focused on the case in which the simple authentication number generation condition is directly transmitted to the simple authenticator 220 in FIG. 1 , it is not necessarily the case. For example, it is self-evident that the simple authentication number generation condition is transmitted to the mobile device 210 through a push message or the like, and the simple authenticator 220 reads it and receives (acquires) the simple authentication number generation condition. . Reception of such a simple authentication number generation condition may be made by the communication interface unit 221 of the simple authenticator 220 .

The conditions for generating a simple authentication number to be transmitted through step S8 of FIG. 1 described above may be all of the seed value and calculation conditions used for generation of the simple authentication number in step S6 of FIG. 1 , but may be a part thereof. For example, if the authentication server 250 and the simple authenticator 220 store in advance some of the seed values and calculation conditions used for generating the simple authentication number, respectively, and use them in common, the dictionary storage as such. This is because there is no need to transmit the specified conditions separately.

Accordingly, the simple authenticator 220 may generate an authentication number for verification for verification of the simple authentication number displayed through the online service site screen of the online service server 230 using the received generation conditions [Fig. See step S11 of 1]. The generation of the verification number for verification may be performed by the verification verification number generating unit 223 of the simple authenticator 220 .

The authentication number for verification generated in this way may be displayed on the app screen of the mobile device 210 through the authentication number display unit 227 of the simple authenticator 220 . At this time, an example in which an authentication number for verification (refer to reference numeral 30B in FIG. 5 ) is expressed through the app screen is shown in FIG. 5 .

Steps S7 to S11 described above are not necessarily limited to the order shown in FIG. 1 , and may be performed differently or at the same time.

When the verification number for verification is expressed through the app screen through the above process, the user compares the verification number expressed in this way with the simple verification number expressed through the online service site screen, so that the online service server is a true service. It is possible to determine whether it is a server (that is, the authenticity of the service server).

As a result of the comparison, if the simple authentication number and the authentication number for verification match, the user selects the approval button on the app screen shown in FIG. verification completion processing) can be performed (refer to step S12 of FIG. 1 ).

5 exemplifies a case in which an approval button capable of processing approval for a corresponding service is provided at the bottom of the verification number displayed on the app screen, but of course, various modifications are possible in addition to this. For example, approval or cancellation processing for a corresponding service may be based on a specific gesture of the user. For example, if the user takes a touch gesture to push up the app screen of the mobile device in an upward direction, approval may be processed, and if the user takes a touch gesture to slide downward, it may be implemented to be canceled.

As described above, when approval for the corresponding service is made, the additional verification value generating unit 225 of the simple authenticator 220 generates an additional verification value, and the authentication server 250 through the communication interface unit 221 . ) (see steps S12 and S13 in FIG. 1).

Here, the additional verification value is used for user authentication. That is, in the embodiment of the present invention, after verifying the authenticity of the corresponding service through verification of the simple authentication number, a method of confirming whether the user who wants to use the corresponding service is a legitimate user through an additional verification value is used. . The peculiar point is that, according to the embodiment of the present invention, the additional verification value for user authentication is automatically generated by the simple authenticator 220 at the same time as the approval process through the verification of the previous simple authentication number is completed and authenticated immediately. The point is that it is transmitted to the server 250 . Accordingly, it is possible to eliminate the inconvenience of the user having to directly input the user authentication value to the online service server during the user authentication process.

In this case, the additional verification value may be generated in various ways. Since the method of generating the additional verification value will not be essentially different from the method of generating the simple authentication number described above, a detailed description thereof will be omitted. Of course, the generation of the additional verification value does not need to follow the simple authentication number generation method described above, and may be generated according to a pre-specified condition defined by the system. The generation method will be equally applied to the generation of the verification value for verification in the authentication server 250 (that is, the verification value generated corresponding to the above additional verification value), which will be described later. Accordingly, when information not stored in the authentication server 250 is utilized in the process of generating the additional verification value, the information also needs to be transmitted to the authentication server 250 through step S13 of FIG. 1 .

In addition, although it is shown in FIG. 1 that the transmission of the additional verification value according to step S13 is performed via the push server 260 , it is not necessarily required and may be transmitted directly to the authentication server 250 . do.

Accordingly, the verification value generating unit 255 for verification of the authentication server 250 generates a verification value for verification for verifying the transmitted additional verification value, and the authentication processing unit 257 of the authentication server 250 generates the generated verification value. By comparing whether the verification value for verification and the transmitted additional verification value match, user authentication for the corresponding service user may be performed (refer to step S14 of FIG. 1 ). At this time, the authentication result is notified to the online service server 230 (refer to step S15 of FIG. 1 ), and when the authentication is normally performed, the online service server 230 may initiate the corresponding service to the corresponding service user (see FIG. 1 ). See step S16].

According to the embodiment of the present invention as described above, the service user only needs to verify the service through the simple authentication number and the subsequent user authentication process is automatically performed, so that the user authentication number input process can be omitted, so the entire authentication process has the effect of being concise and convenient.

In the above description, the case in which the corresponding service is normally approved through step S12 of FIG. 1 has been mainly described. However, if the corresponding service is disapproved by the user through step S12 of FIG. 1 , the simple authenticator 220 may notify the approval disapproval through step S13 of FIG. 1 .

In addition, according to the embodiment of the present invention, the authentication server 250 generates a simple authentication number according to an attempt to access the online service server by the service user, and then, after the simple authentication number is generated, the verification effective time (eg, 60 seconds) or until service verification by the user is completed, the generated simple authentication number can be maintained as it is. This will be described with reference to FIG. 6 as follows.

Referring to FIG. 6 , after a simple authentication number is generated according to a service connection by a normal user, when a subordinate access is made by a hacker who has stolen the user account information of the user [refer to step S21 in FIG. 6], online service Even if a request for generating a simple authentication number by the server 230 is additionally received (see step S22 of FIG. 6 ), the authentication server 250 prohibits the regeneration of the authentication number (see step S23 of FIG. 6 ).

In this way, the authentication server 250 maintains the simple authentication number generated according to the priority access as it is during the verification effective time of the simple authentication number or until the verification on the online service server is completed, or simple authentication according to the sub-priority connection You can prohibit the creation of new numbers. As shown in FIG. 7 , a screen (refer to reference numeral 30C of FIG. 7 ) guiding that duplicate access is not possible may be displayed for such a lower priority accessor through the screen of the online service site. According to this, it is possible to prevent illegal user authentication and information theft by hackers due to subordinate access.

In the above description, the case in which the user accesses the online service server through a client terminal separate from his/her own mobile device has been mainly described. However, it has been described above that it is possible to directly access the online service server using a mobile device installed with a simple authenticator. In this case, the simple authentication number and the authentication number for verification may be displayed through the screen of the mobile device as shown in FIGS. 8 and 9 . Referring to FIG. 8 , the app screen by the simple authenticator 220 is displayed on the upper screen 40A of the mobile device, and the site screen provided by the online service server 230 is displayed at the lower screen 40B of the mobile device. is being expressed in And the simple authentication number (40C) is expressed on the screen end portion (40B). In addition, referring to FIG. 9 , the verification number 40D generated by the simple authenticator 220 is displayed on the upper part 40A of the screen. In the case of directly accessing the online service server using a mobile device in which the simple authenticator is installed, the app screen by the simple authenticator and the site screen by the online service server may be displayed separately in different screen areas. As such an example, in particular, FIGS. 8 and 9 show a case in which the app screen is displayed in a floating form on the top of the site screen (that is, a screen of a layered type), but as for the screen division method, various methods can be applied in addition to this. of course there is

The method and apparatus according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination.

The program instructions recorded on the computer readable medium may be specially designed and configured for the present invention, or may be known and available to those skilled in the computer software field. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - Includes magneto-optical media and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the above has been described with reference to the embodiments of the present invention, those skilled in the art can variously modify the present invention within the scope without departing from the spirit and scope of the present invention described in the claims below. And it will be readily understood that it can be changed.

Claims (2)

A computer implemented method for performing mutual authentication between an online service server and a service user, comprising:
(a) a simple authentication number in which the authentication server includes user account information of a service user accessing the online service server from the online service server and connection terminal connection information of a service user accessing the online service server generating a simple authentication number as a generation request is received;
(b) sending, by the authentication server, a generation condition used to generate the simple authentication number to a simple authenticator installed in a mobile device of a service user corresponding to the user account information;
(c) generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number by using the generation condition of the simple authentication number;
(d) the simple authenticator, as the verification of the online service server through the simple authentication number and the verification number for verification is completed, generating an additional verification value according to a pre-specified condition and transmitting it to the authentication server ;
(e) the authentication server generates a corresponding verification value in response to the additional verification value transmitted from the simple authenticator, and compares whether the additional verification value and the corresponding verification value match, thereby authenticating the service user A computer-implemented method for mutual authentication, including; performing.
According to claim 1,
Further comprising the step of transmitting, by the authentication server, the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,
Before the valid time for verification of the simple authentication number through the authentication number posting screen elapses or before the verification of the online service server by the service user is completed, using the same account information as the user account information of the service user If a lower priority connection is attempted,
The authentication server maintains the simple authentication number generated according to the priority access as it is during the verification effective time of the simple authentication number or until the verification on the online service server is completed, or a new simple authentication number according to the subordinate access A computer implemented method for mutual authentication that prohibits creation.

Images