TWI569168B - Mobile device application authentication system and method - Google Patents

Description

Mobile device application authentication system and method

The present invention relates to an authentication system and method, and more particularly to an application authentication system and method for dual authentication through a one-time password and a mobile device.

One Time Password (OTP) is a protection mechanism widely used in network security. It is often found in the process of online shopping. It is a method for verifying user identity. Most of them are issued through the OTP certification center system. A one-time password (OTP) to the mobile device of the user with the correct or bound identity to complete the identity confirmation to further confirm the transaction, thereby achieving a secure verification mechanism.

In the past, the authentication mode of directly using the account password to log in has the risk of the password being stolen, so the one-time password mechanism came into being, because the one-time password will be invalidated after being used once or for a certain period of time, so as to reduce the risk of password theft. There are many ways to use one-time password authentication, such as using a telephone voice system to obtain a password, and using a telephone text message to obtain a password. However, with the widespread use of smart phones and the advancement of network technology, one-time passwords are still in the process of transmission. There is a possibility of being stolen, or someone with a heart can use other means to preempt or impersonate the user to use a one-time password for authentication. Therefore, even if a one-time password is stolen, a person who is interested in the original user cannot make it. It is indeed necessary to use this one-time password to verify the security mechanisms and methods.

The invention provides a mobile device application authentication system and method, which mainly acquires user identification information through technology in a short message transmission process, and then combines user identification information with an application on a mobile device to provide an authentication mechanism, and through such double authentication. The method solves the problem that the past one-time password (OTP) short message has a security vulnerability, and the invention is not limited to the user of a specific telecommunication company, and can provide cross-network authentication.

The mobile device application authentication system of the present invention mainly includes an authentication server, the authentication server is connected to an application terminal through a network, and the application terminal is installed on a mobile device, and the authentication server receives the authentication server. A request for opening a request and an authentication request from the application end, and correspondingly generating a first dynamic password and a second dynamic password, the dynamic password is a one-time password (OTP).

The mobile device application authentication system of the present invention further includes a message delivery gateway server that interfaces with the Signaling System Number 7, SS7 and transmits the MAP (Mobile Application). Sending a message, the message delivery gateway server is also interfaced with the authentication server, and the authentication server transmits the generated first dynamic password to the gateway through the message delivery gateway server. The application side responds to the opening request from the application end, and the message delivery gateway server parses and obtains the international action of the mobile device of the application side of the application to send the short message according to the sending of the opening short message. User Mobile Identity (IMSI) and The device is transmitted to the authentication server for storage, and the identity server (MSISDN/IMSI) of the mobile device of the application terminal is stored in the authentication server.

After the application receives the opening short message and obtains the first dynamic password, the application end parses the international mobile subscriber identity (IMSI) or mobile device international action in the SIM card of the mobile device of the application terminal. An International Mobile Equipment Identity (IMEI), and encrypting the IMEI or IMSI with the received first dynamic password to generate the authentication request, and the application end transmits the authentication request to the authentication server, the authentication The server receives the authentication request and compares it with the internally stored international mobile subscriber identifier and the first generated dynamic password. After the authentication succeeds, the authentication server generates the second dynamic password and transmits the The application server, which stores the international mobile subscriber identity code or the international mobile device identifier in the SIM card of the mobile device of the application.

Wherein, the application terminal immediately obtains the second dynamic password, and the second dynamic password is used for one-time security authentication of the time limit of the business website, or the application terminal is connected to the authentication in the future. The server is used to encrypt its IMSI or IMEI to generate another authentication request.

According to the above system architecture, the mobile device application authentication method of the present invention comprises the following steps: 1. An application terminal transmits a provisioning request to an authentication server through a network; and an authentication server receives the network through the network. One of the application terminals opens the request; 2. The authentication server generates a first dynamic password; 3. The authentication server transmits the first dynamic password to the application through a message delivery gateway server end; 4. The message delivery gateway server obtains an international mobile subscriber identity of the mobile device of the application terminal during the sending of the short message transmission; 5. the message delivery gateway server transmits the mobile device of the application terminal The international mobile subscriber ID is sent to the authentication server; 6. the authentication server stores the international mobile subscriber identity of the mobile device of the application; 7. the application receives the opening short message; 8. the application terminal The first dynamic password encrypts an international mobile subscriber identity code or an international mobile device identifier in the mobile device SIM card of the application to generate an authentication request; 9. the application transmits the authentication request to the authentication server 10. The authentication server receives the authentication request; 11. the authentication server compares the authentication request with the internally stored international mobile subscriber identity and the first dynamic password for authentication; 12. the authentication server is authenticated Generating a second dynamic password and transmitting it to the application terminal; 13. the application terminal secures the business website with the second dynamic password; and 14. The second end of the app dynamic password used for international mobile subscriber identity or International mobile Equipment Identity SIM card encryption to generate another authentication request.

By the system and method of the present invention, the one-time password is authenticated by the IMSI information recorded in the system, the mobile device can be prevented from being lost and stolen, and the one-time password can be authenticated through the IMEI information recorded in the system, thereby preventing the mobile device from being activated. The situation in which the software backup is stolen.

100‧‧‧Application side

200‧‧‧Authentication Server

300‧‧‧SS7 gateway server

400‧‧‧Home location register

500‧‧‧Exchange Center Server

600‧‧‧E-commerce website

FIG. 1 is a first schematic diagram of a mobile device application authentication method and a system architecture according to the present invention.

2 is a second schematic diagram of a mobile device application authentication method in accordance with the system architecture of the present invention.

The present invention will be further described with reference to the accompanying drawings. First, please refer to FIG. 1 , which is a first schematic diagram of a mobile device application authentication method according to the present invention. The user connects to the e-commerce website 600 through the application terminal 100. Line shopping, at this time, the e-commerce website requires an authentication procedure for one-time password (OTP), and the user transmits the mobile subscriber number (Mobile Subscriber International ISDN number, MSISDN) to the authentication server 200 to request the authentication procedure. After receiving the request, the authentication server 200 generates a set of time-sensitive one-time password OTP1 and transmits an OTP1 Short Message (SM) through the SS7 (Signaling System Number 7) gateway server 300. The server 300 obtains the International Mobile Subscriber Identity (IMSI) information of the user gate number from the home location register 400 using the SRI-SM (Send Routing Information) of the MAP2 (Mobile Application Part 2), and transmits the IMSI information to the authentication. The server 200 stores, the gateway server 300 and the OTP1 through the Mobile Switching Center Server (MSCS) 500. Mobile device 100 is transmitted to the information terminal app.

After receiving the OTP1 newsletter, the user inputs the one-time password of the OTP1 into the application terminal 100, and the application terminal 100 uses the OTP1. The International Mobile Subscriber Identity (IMSI) information of the SIM card obtained from the mobile device and the International Mobile Equipment Identity (IMEI) of the mobile phone are encrypted and transmitted to the authentication server 200 for authentication, and the authentication server 200 has previously obtained the user. The IMSI information of the gate number is used to compare the authentication. If the authentication fails, the authentication server 200 responds to the authentication failure message to the client. If the authentication succeeds, the authentication server 200 generates a second set of one-time password message OTP2 and returns the application to the application. The terminal 100, the authentication server 200 stores the previously acquired IMSI, IMEI, MSISDN for the mobile device for later re-authentication, and the user obtains the second set of one-time password OTP2 from the application terminal 100, one time. The password OTP2 can be used to input the e-commerce website 600 to complete the authentication process, so that the user can purchase the game smoothly and safely.

Please refer to FIG. 2 , which is a second schematic diagram of the mobile device application authentication method and the system architecture of the present invention. The context continues the steps of the present invention according to FIG. 1 , and the application terminal 100 has obtained the second set of one-time password OTP 2 . Thereafter, the second set of one-time password OTP2 can be regarded as a token (Token), and the application terminal 100 can store the OTP2 for subsequent login to the authentication server, and when the authentication needs to be performed again, the application The terminal 100 encrypts the IMSI and IMEI of the mobile device with the OTP2 and transmits it to the authentication server 200. The authentication server 200 performs the comparison authentication with the IMSI, IMEI and OTP2 previously obtained for the mobile device, and the authentication server 200 performs the authentication. Whether or not the authenticated message (Success/Fail) is transmitted back to the application terminal 100.

The detailed description of the preferred embodiments of the present invention is intended to be construed as the invention The patent scope of this case.

The system and method of the present invention are certified by IMSI and MSISDN. The SIM card binding status of the mobile device on the application side can be identified.

The system and method of the present invention can be authenticated by IMEI and MSISDN to identify the binding status of the mobile device on the application side.

The mobile device application authentication system and method of the present invention provides a secure one-time password (OTP) dual authentication mechanism, and at the same time, the user's mobile device identity and one-time password authentication can reliably solve the security of one-time password theft. problem.

In summary, the present invention is innovative in terms of technical ideas, and also has various functions that are not in the prior art, and has fully complied with the statutory invention patent requirements of novelty and progressiveness, and has filed a patent application according to law, and invites you to approve the invention. The patent application was inspired to invent, and it was a matter of feeling.

100‧‧‧Application side

200‧‧‧Authentication Server

300‧‧‧SS7 gateway server

400‧‧‧Home location register

500‧‧‧Exchange Center Server

600‧‧‧E-commerce website

Claims (7)

A mobile device application authentication system includes: an authentication server that receives an activation request from an application terminal and an authentication request through a network, the authentication server generates a first dynamic password and a a second dynamic password; a message delivery gateway server, the message delivery gateway server is interfaced with the authentication server, and the authentication server uses the message delivery gateway server to open the first dynamic password to a text message Transmitting to the application end to respond to the opening request, the message delivery gateway server obtains the international mobile subscriber identity of the mobile device of the application according to the sending of the opening short message and transmits it to the authentication server for storage; The application end generates and transmits the authentication request according to an international mobile subscriber identity code or an international mobile device identifier in the mobile device SIM card of the application terminal, and the authentication server receives the authentication request. The authentication request and the internally stored international mobile subscriber identifier and the first dynamic password ratio In authentication, the authentication server stores the authentication information of the request, the authentication server generates and transmits the second dynamic password to the application side. The mobile device application authentication system according to claim 1, wherein the second dynamic password is used by the application for secure authentication of a business website, or for the application to be used for encryption to generate another Authentication request. A mobile device application authentication method includes the following steps: an authentication server receives a request for opening from an application terminal through a network; The authentication server generates a first dynamic password; the authentication server transmits the first dynamic password to the application by using a message delivery gateway server; the message delivery gateway server is opened Obtaining an international mobile subscriber identity code of the mobile device of the application terminal during the sending of the short message; the message delivery gateway server transmits an international mobile subscriber identity of the mobile device of the application terminal to the authentication server; the authentication servo The international mobile subscriber identity of the mobile device of the application is stored; the authentication server receives an authentication request, and the authentication request is that the application terminal uses the first dynamic password to apply the mobile device SIM card of the application terminal The international mobile subscriber identity code or the international mobile device identifier is encrypted; the authentication server compares the authentication request with the internally stored international mobile subscriber identity and the first dynamic password for authentication; the authentication server stores the The international mobile subscriber ID or country in the SIM card of the mobile device of the application in the authentication request Mobile device identification code; and generating a second authentication server after authentication and dynamic password transmitted to the terminal application. The mobile device application authentication method according to claim 3, wherein the step further comprises: the authentication server receiving another authentication request, the another authentication request is to use the second dynamic password to the application end The international mobile subscriber identity code or the international mobile device identity code in the mobile device SIM card is encrypted; and the authentication server authenticates the authentication request with the internally stored international mobile user The identification code and the first dynamic password are compared for authentication. A mobile device application authentication method includes the following steps: an application terminal transmits a provisioning request to an authentication server over a network; and the application terminal receives a provisioning briefing message, wherein the opening of the communication message is performed by the authentication server through a message The gateway server transmits a first dynamic password to the short message; the application end encrypts the international mobile subscriber identity code or the international mobile device identifier in the SIM card of the mobile device of the application terminal by using the first dynamic password. To generate an authentication request; the application end transmits the authentication request to the authentication server; the application terminal receives a second dynamic password, and the second dynamic password is an international mobile user in the authentication request The identification code or the international mobile device identification code is generated by the international mobile subscriber identity authentication authentication of the mobile device obtained by the message delivery gateway server during the transmission of the instant messaging message. The method for authenticating a mobile device application according to claim 5, wherein the step further comprises: the application end uses the second dynamic password to securely authenticate the business website. The mobile device application authentication method according to claim 5, wherein the step further comprises: the application side uses the second dynamic password to encrypt and generate another authentication request.