KR20240023589A - Cross authentication method and system between online service server and client - Google Patents

Abstract

A computer implemented method for performing mutual authentication between an online service server and a service user, wherein (a) the authentication server includes user account information of a service user accessing the online server from the online server; Generating a simple authentication number as a number creation request is received; (b) transmitting, by the authentication server, the generation conditions used to generate the simple authentication number to the user's simple authenticator corresponding to the user account information; (c) generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number using the generation conditions of the simple authentication number; and (d) the authentication server generates a corresponding verification value in response to the additional verification value transmitted from the simple authenticator as verification of the online service server through the simple authentication number and the verification authentication number is completed. A computer-implemented method for mutual authentication is provided, including the step of performing authentication for a corresponding service user by comparing whether the additional verification value matches the corresponding verification value.

Description

Mutual authentication method and system between online service server and client {CROSS AUTHENTICATION METHOD AND SYSTEM BETWEEN ONLINE SERVICE SERVER AND CLIENT}

The present invention relates to an authentication method and system, and more specifically, to a mutual authentication method and system between an online service server and a client.

When you want to use convenient electronic financial services or important online services safely, you are improving the safety of user authentication by configuring a separate authentication method in addition to the ID and password used in online services. Representatively, OTP dongles, one-time passwords through SMS, one-time passwords through ARS, and biometric authentication based on mobile apps are being used to strengthen identity authentication in response to ID password theft.

However, conventional additional authentication methods require complicated input from the user, such as having the user directly enter a one-time password generated between the online service and the authentication medium or entering separate biometric information. In particular, if you have to re-enter a 4 to 6-digit temporary password using a mobile phone, it is not only difficult to understand the number confirmed on the mobile phone screen, but also complicated to enter.

In order to eliminate the need to enter such a temporary password, when a user logs on to the service with an ID and password, push information is sent to the mobile phone, and when the user runs an identity verification app, the user's biometric information (fingerprint, face, iris, etc.) is sent to the mobile phone. There is a service that automatically logs you into an online service by having you enter it into the app, but this also causes the hassle of entering biometric information.

Another simple authentication method is to minimize user input by installing an access control app that determines whether or not to approve access on the user's designated mobile phone in advance, and when the user enters the ID and password for the online service, mobile push There was also a connection confirmation method that notifies the user of access through a message and approves or rejects access to the online service when the user runs the access approval app. However, in this method, if the service accessed by the user is a pharmed hacker's site, the hacker uses the ID and password entered by the user and sends it to the actual online service, and the user is requested to confirm the connection on his/her mobile phone. When you arrive, a problem arises where the connection is misunderstood as your own and the connection is approved. In addition, if a hacker who knows the user's ID and password connects with the user's ID and password as soon as the actual user logs in, the user misunderstands the final access information that arrived on the smartphone as his or her own and blocks the access. You may be able to get it approved.

Therefore, there is a need for improved methods and technologies that allow users to determine whether the site is normal and even check whether they are accessing it or not, without the user having to go through the hassle of re-entering a temporary password.

The present invention allows the user to determine whether the service is correct without entering a separate one-time password or biometric information when performing two-fact authentication (i.e., mutual authentication based on service authentication and user authentication) for safe use of online services. We provide a method and system for simple authentication that allows convenient connection after verification.

According to one aspect of the present invention, a computer implemented method for performing mutual authentication between an online service server and a service user,

(a) the authentication server generating a simple authentication number when a request for generating a simple authentication number containing user account information of a service user accessing the online server is received from the online server;

(b) transmitting, by the authentication server, the generation conditions used to generate the simple authentication number to the user's simple authenticator corresponding to the user account information;

(c) generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number using the generation conditions of the simple authentication number; and

(d) The authentication server generates a corresponding verification value in response to the additional verification value transmitted from the simple authenticator as verification of the online service server through the simple authentication number and the verification authentication number is completed, and , A computer-implemented method for mutual authentication is provided, including the step of performing authentication for the service user by comparing whether the additional verification value matches the corresponding verification value.

In one embodiment, the simple authentication number creation request is made when the user account information entered by the service user on the online site provided by the online service server matches the user's pre-registered account information. It may be transmitted from a server to the authentication server.

In one embodiment, in step (b), the conditions for generating the simple authentication number are the mobile device of the user corresponding to the user account information from the authentication server through push message or socket data communication, or the device installed on the mobile device. It can be sent to a simple authenticator.

In one embodiment, in step (a), the authentication server further receives client connection environment information about the connection terminal of the service user connected to the online service server from the online service server, wherein the simple authentication number When creating, use the client connection information,

In step (b), the authentication server may transmit the simple authentication number generation conditions including the client connection environment information to the simple authenticator.

In one embodiment, the client connection environment information is,

Server variables related to the connection terminal connected to the online service server, host name, cookie information, previous URL, current connection IP address, one step previous connection IP address, client browser information, client language information, system variables of the connection terminal, It may be at least one of the server host name, server IP address, session ID, and session maximum validity time information of the online service server providing the service to the access terminal.

In one embodiment, in step (a), the authentication server uses the client connection environment information as a first seed value and at least one pre-designated additional information as a second seed value, with time or the number of attempts as the calculation condition. to generate the simple authentication number,

In step (c), the simple authenticator may generate the authentication number for verification by applying the same generation conditions as the simple authentication number.

In one embodiment, when verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to pre-specified conditions and transmits it to the authentication server. do,

The authentication server may generate the corresponding verification value by applying the same conditions as the pre-specified conditions, and if the additional verification value matches the corresponding verification value, it may notify the online service server of normal authentication.

In one embodiment, the authentication server further includes transmitting the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

Before the verification validity time of the simple authentication number through the authentication number posting screen has elapsed or before the verification of the online service server by the service user is completed, using the same account information as the service user's user account information If a low-priority connection is attempted,

The authentication server maintains the simple authentication number generated according to priority access during the verification validity period of the simple authentication number or until verification of the online service server is completed, or creates a new simple authentication number according to secondary access. Creation can be prohibited.

According to another aspect of the present invention, an authentication system that performs mutual authentication between an online service server and a service user, comprising: an authentication server; And a simple authenticator on the service user side that communicates with the authentication server,

The authentication server is,

Generating a simple authentication number as a request for generating a simple authentication number containing user account information of a service user accessing the online server is received from the online server,

Transmitting the generation conditions used to generate the simple authentication number to the simple authenticator corresponding to the user account information so that a verification number for verification of the simple authentication number can be generated,

As verification of the online service server through the simple authentication number and the verification authentication number is completed, a corresponding verification value is generated in response to the additional verification value transmitted from the simple authenticator, and the additional verification value corresponds to the additional verification value. An authentication system for mutual authentication is provided that authenticates the service user by comparing the consistency between verification values.

In one embodiment, the authentication server:

Further receiving client connection environment information about the connection terminal of the service user connected to the online service server from the online service server, using the client connection information when generating the simple authentication number,

The conditions for generating the simple authentication number, including the client connection environment information, can be transmitted to the simple authenticator.

In one embodiment, the client connection environment information is,

Server variables related to the access terminal connected to the online service server, host name, cookie information, previous URL, current access IP address, previous access IP address, client browser information, client language information, system variables of the access terminal, It may be at least one of the server host name, server IP address, session ID, and session maximum validity time information of the online service server providing the service to the access terminal.

In one embodiment, the authentication server generates the simple authentication number using the client connection environment information as a first seed value and at least one pre-designated additional information as a second seed value, with time or the number of attempts as a calculation condition. do,

The simple authenticator may generate the authentication number for verification by applying the same generation conditions as the simple authentication number.

In one embodiment, when verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to pre-specified conditions and transmits it to the authentication server. do,

The authentication server may generate the corresponding verification value by applying the same conditions as the pre-specified conditions, and if the additional verification value matches the corresponding verification value, it may notify the online service server of normal authentication.

In one embodiment, the authentication server transmits the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

Before the verification validity time of the simple authentication number through the authentication number posting screen has elapsed or before the verification of the online service server by the service user is completed, using the same account information as the service user's user account information If a low-priority connection is attempted,

The authentication server maintains the simple authentication number generated according to priority access during the verification validity period of the simple authentication number or until verification of the online service server is completed, or creates a new simple authentication number according to secondary access. Creation can be prohibited.

According to an embodiment of the present invention, after a user enters an ID and password in an online service, if the simple authentication number provided by the service for additional authentication is the same as the simple authentication number provided by the mobile simple authenticator, the user's access to the service is approved. By doing so, the user's unnecessary re-entry of the authentication number can be eliminated.

Additionally, according to an embodiment of the present invention, when another person attempts to access an online service with the user's ID and password, a user with a simple authenticator can be aware of the situation that a request for access permission has been made by someone other than the user. Security management of IDs and passwords is also possible.

1 is a diagram illustrating a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention.
Figure 2 is a block diagram of an embodiment of an authentication server implementing a mutual authentication method according to an embodiment of the present invention.
3 is a block diagram of an embodiment of a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention.
Figure 4 is an example related to a screen where a simple authentication number is posted on an online service site operated by an online service server.
Figure 5 is an example of a screen on which a verification authentication number generated by a simple authenticator is displayed.
FIG. 6 is a diagram illustrating a method for processing a connection attempt by a hacker during the authentication process according to the mutual authentication method of FIG. 1.
FIG. 7 is a diagram illustrating processing results posted on an online service site operated by an online service server upon an access attempt by a hacker as shown in FIG. 6.
8 and 9 are examples of implementation of a mutual authentication method according to an embodiment of the present invention when accessing an online service server through a user's mobile device.

Since the present invention can be modified in various ways and can have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all transformations, equivalents, and substitutes included in the spirit and technical scope of the present invention.

In describing the present invention, if it is determined that a detailed description of related known technologies may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of this specification are merely identifiers to distinguish one component from another component.

In addition, throughout the specification, when a component is referred to as "connected" or "connected" to another component, the component may be directly connected or directly connected to the other component, but in particular Unless there is a contrary description, it should be understood that it may be connected or connected through another component in the middle.

In addition, throughout the specification, when a part "includes" a certain element, this means that it may further include other elements rather than excluding other elements, unless specifically stated to the contrary. In addition, terms such as “unit” and “module” used in the specification mean a unit that processes at least one function or operation, which means that it can be implemented with one or more hardware or software or a combination of hardware and software. .

In addition, in the following description, the simple authenticator will be explained focusing on the case where the simple authenticator is a software-type authentication device installed in the form of an application program on the user's mobile device, but it is of course not limited to this. For example, a simple authenticator may be a hardware authentication device with communication capabilities. However, hereinafter, for convenience and focus of explanation, an embodiment of the present invention will be described assuming the former case.

In addition, the description below assumes that the client terminal, which is a connection terminal connecting to the online service server, and the simple authenticator are physically configured separately based on FIG. 1, but the simple authenticator may be implemented integrally with the client terminal. In the latter case, the mobile device shown in Figure 1 will be omitted. Additionally, it is obvious that the client terminal itself may be a mobile device.

1 is a diagram for explaining a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention. In addition, Figure 2 is a block diagram of an embodiment of an authentication server implementing a mutual authentication method according to an embodiment of the present invention, and Figure 3 is a block diagram of a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention. This is a block diagram of the embodiment. Hereinafter, a mutual authentication method and system according to an embodiment of the present invention will be described with reference to FIG. 1 and FIG. 2 and FIG. 3.

Additionally, in the description of the embodiment of the present invention, FIGS. 4 to 9 are also referred to. Here, Figure 4 is an example related to a screen in which a simple authentication number is posted on an online service site operated by an online service server, and Figure 5 is an example related to a screen in which a verification authentication number generated by a simple authenticator is displayed, Figure 6 is a diagram for explaining a processing method when a hacker attempts to connect in the authentication process according to the mutual authentication method of Figure 1, and Figure 7 is an online service server operated by an online service server when a hacker attempts to connect as shown in Figure 6. This diagram illustrates the processing results posted on the service site. Additionally, Figures 8 and 9 are examples of implementation of a mutual authentication method according to an embodiment of the present invention when accessing an online service server through a user's mobile device.

Referring to step S1 of FIG. 1, when wanting to use an online service provided by an online service site provided by the online service server 230, the service user requests access to the online service server 230.

For example, if the online service to be used is an online banking service, the user can access a specific online service server that provides the online banking service (i.e., a specific bank server that provides the online banking service). Of course, access to the online service server 230 can be done through a mobile connection through a mobile device 210 (for example, a smartphone, etc.) owned by the user, but in FIG. 1, a mobile device owned by the user ( A case of connection through a client terminal 200 (for example, a company PC, etc.) that is separate from the terminal 210 is illustrated.

Referring to step S2 of FIG. 1, in response to a connection request to the online service server 230, the online service server 230 may request the service user who wishes to use the online service to input user account information. Here, the user account information refers to the user's identification information that is previously stored (registered) in the online service server 230 through a user registration procedure (or service subscription procedure). Typically, a user ID (Identifier) and password may be used as user account information. However, if it is information that can identify the user using the relevant online service, various information (e.g., the user's email address, phone number, certificate password on the PKI (Public Key Infrastructure)-based certificate) is included in addition to the user account information. Of course, etc.) can be used as an alternative.

Referring to step S3 of FIG. 1, in response to a request to input user account information, the service user enters user account information into the corresponding online service site. Referring to step S4 of FIG. 1, when user account information is input from a service user, the online service server 230 checks whether an account matching the user account information input from the user exists. To confirm such account information, the account DB 240 as shown in FIG. 1 can be used. The account DB 240 stores account information about users (i.e., members) who can receive online services through the corresponding online service server 230. Although FIG. 1 illustrates the case where the account DB 240 is provided separately from the online service server 230, it goes without saying that the account DB 240 may be implemented integrated with the online service server 230. Additionally, depending on how the system is implemented, the account DB 240 may be implemented integrated with the authentication server 250.

Referring to step S5 of FIG. 1, if the input user account information matches the user account stored in the account DB 240, the online service server 230 requests the authentication server 250 to generate a simple authentication number. do. Here, the simple authentication number is used to enable the user to determine whether the online service site the user is currently accessing is provided by a true online service provider.

In step S5 of FIG. 1, when the online service server 230 requests the authentication server 250 to generate a simple authentication number, the online service server 230 sends the user account information of the service user to the authentication server 250. ) can be transmitted. For example, the online service server 230 may transmit a request for generating a simple authentication number including the user ID of the user as user account information to the authentication server 250.

Additionally, according to one embodiment, the online service server 230 may additionally transmit client connection environment information to the authentication server 250 through step S5 of FIG. 1 (or through a separate step). Here, client connection environment information refers to information that can directly or indirectly indicate the connection environment of the connection terminal of the service user connected to the online service server 230. This client connection environment information may vary depending on the service server.

For example, taking a standard web server as an example, various server variables (Server Variables) that can extract the value of the connected client terminal; host name (REMOTE_HOST), cookie information (HTTP_COOKIE), previous URL (HTTP_PEFERER), one step previous IP address (HTTP_X_FORWARDED_FOR), current IP address (REMOTE_ADDR), client browser (HTTP_USER_AGENT), client language (HTTP_ACCEPT_LANGUAGE)), or variables of the service server that provides services to the client terminal (server host name, server IP, session ID value, session maximum validity time, etc.). As another example, if the connecting client is not a standard web browser but its own client program, various system variables (Mac Address, HDD UUID, etc.) of the client terminal can be used as client connection environment information within the range permitted by the operating system (OS). will be.

The request for generating a simple authentication number as described above is received (received) through the communication interface unit 251 of the authentication server 250, and the user account information or/and client connection environment information transmitted together is the simple authentication number. It can be used as a seed value for generation.

Referring to step S6 of FIG. 1, in response to a request for generating a simple authentication number from the online service server 230, the authentication server 250 generates a simple authentication number. At this time, generation of the simple authentication number may be performed by the simple authentication number generator 253 of the authentication server 250.

At this time, as previously explained, the simple authentication number can be generated using the client connection environment information transmitted from the online service server 230. Hereinafter, it is used in place of this client connection environment information or is used in conjunction with the client connection environment information. Together, other embodiments that can be used as additional seed values for generating the simple authentication number will be described in detail.

In one embodiment of the present invention, a pre-registered fixed key corresponding to the user account information of the service user may be used as a seed value for generating a simple authentication number.

As an example, the fixed key corresponding to the user account information may be used by pre-registering any one or a combination of at least two of various user identification information such as the above-described user ID, password, user email address, phone number, certificate password, etc. You can. As another example, the fixed key corresponding to the user account information is the phone number of the user's mobile device (e.g., smartphone, etc.), product serial number, USIM card number, MAC address, etc. Any one or a combination of at least two identifiers may be pre-registered and used. As another example, the fixed key corresponding to the user account information may be a private key that the user directly selects and registers when registering for the simple authentication service or a private key granted when registering for the simple authentication service.

In another embodiment of the present invention, a dynamic allocation key that is dynamically assigned when a user accesses the online service server may be used as a seed value for generating an authentication number.

As an example, the dynamic allocation key may be the connection information of the service user's access terminal connecting to the corresponding online service server. At this time, the connection terminal connection information includes session information (e.g., session ID, etc.) or socket information (e.g., socket information) assigned to the service user's connection terminal by the relevant online service server when the service user connects. A handle (Socket handle, etc.) may be used.

Here, the session ID is a value given by the server to manage continuous data transmission and reception between the server and the connected terminal, and the socket handle information is used to manage the socket, which is a unit of data transmission and reception through the network between the server and the connected terminal. This is a random connection-specific value assigned by the server itself. This session ID or socket handle information is not only dynamically allocated, but is also a value given by the server itself, and is difficult to steal by hackers from outside the server, so using it has an advantageous security effect.

As another example, the dynamic allocation key may be a mobile IP address (which may be the entire IP address or a portion of the IP address) dynamically assigned by the mobile carrier to the mobile device owned by the service user. For example, assuming that a service user connects to the online service server through his or her mobile device, the mobile IP address dynamically assigned by the mobile carrier may be used as a seed value.

In addition, the above description focuses on the case where a specific value is used as the seed value, but of course, a random value randomly generated by the authentication server 250 itself can be used as the seed value for generating a simple authentication number. .

Accordingly, the simple authentication number generator 253 of the authentication server 250 uses at least one seed value as described above, but uses time or the number of attempts (i.e., the number of attempts to issue a simple authentication number) as a calculation condition. You can create a simple authentication number. For example, the simple authentication number generator 253 may generate a value obtained by multiplying at least one seed value described above by the time or number of attempts and encrypting it according to a specific hash function. Accordingly, the simple authentication number can be generated as a one-time value.

Also, here, the time OTP method is a method of generating an OTP using the generation time as a calculation condition. Accordingly, the OTP can be generated as a value obtained by multiplying the determined specific OTP generation key by the generation time, which is an operation condition, and encrypting it according to a specific hash function.

As described above, when the simple authentication number is generated, the authentication server 250 transmits the simple authentication number generated through the previous step S6 to the online service server 230 through the communication interface unit 251. The delivered simple authentication number is posted so that the user can check it through the screen of the online service site operated by the online service server 230 in step S9 of FIG. 1. An example of this is shown in FIG. 4. Referring to Figure 4, it can be seen that the simple authentication number (see reference numeral 30A in Figure 4) is being posted through the authentication number posting screen on the right side of the online banking site. After the simple authentication number is posted on the screen, the approval waiting state may continue until confirmation from the user is completed [see step S10 in FIG. 1].

In addition, referring to step S8 of FIG. 1, the authentication server 250 sends the simple authentication number generation conditions to the simple authenticator 220 installed on the mobile device 110 owned by the service user through the communication interface unit 251. Let it be transmitted.

In Figure 1, the transmission of the simple authentication number generation conditions in step S8 is illustrated as being performed through the push server 260, but this does not necessarily need to be the case, and is transmitted directly from the authentication server 250 to the simple authenticator 220. Of course it could happen. In addition, although FIG. 1 focuses on the case of transmitting the simple authentication number generation conditions through a push message, the simple authentication number generation conditions may be transmitted through socket data communication.

When transmitting the simple authentication number creation conditions through the push server 260, the authentication server 250 transmits the creation conditions to the push server 260, and at this time, the push server 260 sends the simple authentication number through a push message. The creation conditions can be transmitted to the simple authenticator 220. Here, the push message may be a message service provided for each app in a specific mobile operating system. However, it is obvious that the conditions for generating a simple authentication number do not necessarily have to be transmitted through a push message, and may be transmitted through various commercial messaging services such as SMS or MMS, or through a specific communication protocol. In other exemplary cases where the simple authentication number creation conditions are not transmitted through a push message, the above-described push server 260 can be replaced as a general communication server.

In addition, although the explanation in FIG. 1 focuses on the case where the simple authentication number generation conditions are directly transmitted to the simple authenticator 220, this does not necessarily need to be the case. For example, it is obvious that the simple authentication number generation conditions are transmitted to the mobile device 210 through a push message, etc., and the simple authenticator 220 can read them and receive (acquire) the simple authentication number generation conditions. . Reception of these simple authentication number generation conditions can be accomplished by the communication interface unit 221 of the simple authentication device 220.

The simple authentication number generation conditions to be transmitted through step S8 of FIG. 1 described above may be all of the seed value and calculation conditions used to generate the simple authentication number in step S6 of FIG. 1, or may be a part of them. For example, if the authentication server 250 and the simple authenticator 220 each store in advance some of the seed values and calculation conditions used to generate the simple authentication number and use them in common, they are stored in advance as such. This is because there is no need to transmit the specified conditions separately.

Accordingly, the simple authenticator 220 can use the received generation conditions to generate a verification authentication number for verification of the simple authentication number displayed through the online service site screen of the online service server 230 [Figure See step S11 of 1]. Generation of such a verification authentication number can be performed by the verification authentication number generator 223 of the simple authenticator 220.

The verification authentication number generated in this way can be displayed on the app screen of the mobile device 210 through the authentication number display unit 227 of the simple authenticator 220. At this time, an example of the authentication number for verification (see reference numeral 30B in FIG. 5) displayed through the app screen is shown in FIG. 5.

Steps S7 to S11 described above are not necessarily limited to the order shown in FIG. 1, and may be performed in different order or simultaneously.

When the authentication number for verification is displayed through the app screen through the above-mentioned process, the user compares the authentication number for verification displayed in this way and the simple authentication number displayed through the online service site screen to confirm that the online service server is providing the true service. It is possible to determine whether it is a server (i.e., the authenticity of the service server).

As a result of the comparison, if the simple authentication number and the verification authentication number match, the user selects the approval button on the app screen shown in Figure 5 to process approval for the service (i.e., confirms that the online service server is a true service server) Verification completion processing) can be performed [see step S12 in FIG. 1].

Figure 5 illustrates a case in which an approval button for approving the corresponding service is provided at the bottom of the authentication number for verification displayed on the app screen, but of course, various other variations are possible. For example, approval or cancellation processing for the service may be performed by a specific gesture of the user. For example, it may be implemented so that when a user makes a touch gesture that pushes the app screen of a mobile device upward, it is approved, and when a user makes a touch gesture that pushes down the app screen, it is canceled.

As described above, when approval for the service is made, the additional verification value generation unit 225 of the simple authenticator 220 generates an additional verification value, and sends it to the authentication server 250 through the communication interface unit 221. ) (see steps S12 and S13 in FIG. 1).

Here, the additional verification value is used for user authentication. That is, in the embodiment of the present invention, the authenticity of the service is first confirmed through verification of the simple authentication number, and then the authenticity of the service is confirmed through additional verification values to confirm whether the user who wants to use the service is a legitimate user. . What is unique is that, according to the embodiment of the present invention, the additional verification value for user authentication is automatically generated by the simple authenticator 220 at the same time that the approval process through verification of the previous simple authentication number is completed and is immediately authenticated. It is transmitted to the server 250. Accordingly, the inconvenience of having to input the user authentication value directly into the online service server during the user authentication process can be eliminated.

At this time, additional verification values can be generated in various ways. Since the method of generating additional verification values will not be essentially different from the methods of generating simple authentication numbers described above, detailed descriptions thereof will be omitted. Of course, the creation of additional verification values does not need to follow the simple authentication number generation method described above, and may be generated according to pre-specified conditions defined by the system. The generation method will be equally applied to the generation of verification values (i.e., verification values generated to correspond to the above additional verification values) in the authentication server 250, which will be described later. Therefore, when information not stored in the authentication server 250 is used in the process of generating additional verification values, the information also needs to be transmitted to the authentication server 250 through step S13 in FIG. 1.

In addition, in Figure 1, the transmission of the additional verification value according to step S13 is shown as being carried out via the push server 260, but this is not necessarily required, and may be transmitted directly to the authentication server 250. do.

Accordingly, the verification value generation unit 255 of the authentication server 250 generates a verification value for verification to verify the transmitted additional verification value, and the authentication processing unit 257 of the authentication server 250 generates the generated verification value. User authentication can be performed for the service user by comparing the match between the confirmation verification value and the transmitted additional verification value [see step S14 in FIG. 1]. At this time, the authentication result is notified to the online service server 230 [see step S15 in FIG. 1], and if authentication is successfully completed, the online service server 230 can initiate the service to the service user [see step S15 in FIG. 1]. See step S16].

According to the embodiment of the present invention according to the above, the service user only needs to verify the service through a simple authentication number, and the subsequent user authentication process is automatically performed, so the user authentication number input process can be omitted, and the entire authentication process It has the effect of being concise and convenient.

The above description focuses on the case where the service is normally approved through step S12 in FIG. 1. However, if the service is disapproved by the user through step S12 of FIG. 1, the simple authenticator 220 may notify of disapproval through step S13 of FIG. 1.

In addition, according to an embodiment of the present invention, the authentication server 250 generates a simple authentication number according to an attempt to connect to the online service server by the service user, and then generates a verification validity time (e.g., verification validity time) for the simple authentication number. The generated simple authentication number can be maintained for 60 seconds) or until service verification by the user is completed. This will be explained with reference to FIG. 6 as follows.

Referring to FIG. 6, after a simple authentication number is generated upon service access by a normal user, when a subsequent access is made by a hacker who has stolen the user's user account information [see step S21 in FIG. 6], the online service Even if an additional request for generating a simple authentication number is received by the server 230 (see step S22 in FIG. 6), the authentication server 250 prohibits regeneration of the authentication number (see step S23 in FIG. 6).

In this way, the authentication server 250 maintains the simple authentication number generated according to priority access during the verification validity period of the simple authentication number or until verification of the online service server is completed, or simple authentication according to secondary access. The creation of new numbers can be prohibited. For such low-priority accessors, a screen (see reference numeral 30C in FIG. 7) informing them that duplicate access is not possible may be displayed through the screen of the online service site, as shown in FIG. 7. According to this, it is possible to prevent illegal user authentication and information theft due to low-priority access by hackers.

The above explanation focuses on the case where the user accesses the online service server through a client terminal separate from the user's own mobile device. However, as previously explained, it is possible to directly access the online service server using a mobile device with a simple authenticator installed. In this case, the simple authentication number and the authentication number for verification may be displayed on the screen of the mobile device as shown in FIGS. 8 and 9. Referring to FIG. 8, the app screen by the simple authenticator 220 is displayed at the upper part 40A of the screen of the mobile device, and the site screen provided by the online service server 230 is displayed at the lower part 40B of the screen of the mobile device. It is expressed in . And a simple authentication number (40C) is displayed at the bottom of the screen (40B). Also, referring to FIG. 9, the authentication number 40D for verification generated by the simple authenticator 220 is displayed at the upper part 40A of the screen. In this way, when directly accessing the online service server using a mobile device with a simple authenticator installed, the app screen by the simple authenticator and the site screen by the online service server may be displayed separately in different screen areas. As an example of this, in particular, Figures 8 and 9 show a case where the app screen is displayed in a floating form at the top of the site screen (i.e., a layered type screen display), but various other screen division methods can be applied. Of course it exists.

The method and device according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. Computer-readable media may include program instructions, data files, data structures, etc., singly or in combination.

Program instructions recorded on a computer-readable medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes magneto-optical media and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described above with reference to embodiments, those skilled in the art can modify the present invention in various ways without departing from the spirit and scope of the present invention as set forth in the claims below. It will be easy to understand that and can be changed.

Claims (1)

As a computer implemented method for performing mutual authentication between an online service server and a service user,
(a) the authentication server generating a simple authentication number when a request for generating a simple authentication number containing user account information of a service user accessing the online server is received from the online server;
(b) transmitting, by the authentication server, the generation conditions used to generate the simple authentication number to the user's simple authenticator corresponding to the user account information;
(c) generating, by the simple authenticator, an authentication number for verification corresponding to the simple authentication number using the generation conditions of the simple authentication number; and
(d) The authentication server generates a corresponding verification value in response to the additional verification value transmitted from the simple authenticator as verification of the online service server through the simple authentication number and the verification authentication number is completed, and , performing authentication for the service user by comparing whether the additional verification value matches the corresponding verification value.
A computer implemented method for mutual authentication comprising: