WO2012121497A2 - Distinct identifier-based authentication system and method - Google Patents

Abstract

A distinct identifier-based authentication system according to the present invention comprises: a device registration unit with which end entity information required for second authentication and a mobile communication terminal matched with the end entity information are registered; a transmission and reception processing unit which communicates with an online service system to receive a distinct identifier of a first-authenticated computer device with the end entity information, a distinct identifier of a second-authentication attempt computer device which attempts a second authentication with the end entity information, and a disposable authentication key inputted from the second-authentication attempt computer device; a distinct identifier verification unit which verifies whether or not the first-authenticated computer device and the second-authentication attempt computer device are identical with each other using the distinct identifier of the first-authenticated computer device and the distinct identifier of the second-authentication attempt computer device; an authentication key issue unit which issues and transmits a disposable authentication key to the mobile communication terminal through the transmission and reception processing unit; and an authentication key verification unit which verifies whether or not the disposable authentication key issued by the authentication key issue unit and the disposable authentication key inputted to the transmission and reception processing unit are identical with each other.

Description

Unique identifier based authentication system and method

The present invention relates to an authentication system and method, and more particularly, a unique identifier-based authentication that compares a unique identifier of a primary authenticated computer device with a unique identifier of a computer device that attempts secondary authentication to perform user authentication. System and method.

Today, thanks to the development of the Internet, various kinds of online services are provided. Most online service systems authenticate whether client computer devices that access the system through the Internet are entitled to use the online service.

The most commonly used user authentication method is an authentication method using a user ID and password. When a user joins an online service system as a member, the user ID and password are registered, and when the user later tries to access the system, Enter the registered user ID and password to verify the identity of the user.

However, the authentication method using the ID and password is easy to steal or hack authentication information (user ID and password), there is a problem that can not block malicious access attempts when the authentication information is exposed.

Various personal information is managed in the online service system, and as intangible assets (for example, items in online games, cyber money, etc.) through the online service system have recently increased, more powerful identity authentication methods are required.

According to such a request, various secondary authentication schemes after first authentication based on the above-described user ID and password have been tried. In particular, a one-time authentication key-based secondary authentication scheme using a user's mobile communication terminal has been widely used. This one-time authentication key-based authentication method usually proceeds with the following procedure. First, the online service system performs a first authentication procedure (for example, checking a user ID and a password), and after the first authentication, requests the second authentication to the second authentication server. The secondary authentication server sends a text message (SMS) including a one-time authentication key to the user's mobile communication terminal. The online service system receives the one-time authentication key through the user's computer device and delivers it to the secondary authentication server. The secondary authentication server then verifies whether the one-time authentication key sent to the user's mobile communication terminal and the one-time authentication key input through the online service system are the same.

Although the one-time authentication key-based secondary authentication method can strengthen the security strength of the user authentication to some extent, there are still vulnerabilities due to the following long-range hacking or short-range hacking.

In other words, as a remote hacking technique, when a user sends a one-time authentication key to an online service system, the hacker intercepts the one-time authentication key through network spoofing, or the hacker installs a key logger on the user's computer device in advance and remotely sets the user's computer. The authentication key may be extorted by monitoring and removing the one-time authentication key input to the device, or inducing a user to access a phishing site rather than an online service system and extorting the one-time authentication key input to the phishing site. For example, in July 2006, a US bank infiltrated a bank account with an authentication key stolen through a phishing site, a remote hacking technique.

In addition, as a short-range hacking technique, a one-time authentication key transmitted to a user's mobile communication terminal may be identified and stolen through a technique such as shoulder surfing or social engineering near the user.

Therefore, as a second authentication method using a one-time authentication key, even if a one-time authentication key is extorted by a hacker by a long-range hacking technique or a short-range hacking technique, a stronger personal authentication technique capable of resisting this is needed.

An object of the present invention, which is designed to solve the problems of the prior art described above, is to remotely hack a user by comparing the unique identifier of the computer device for which primary authentication has been completed with the unique identifier of the computer device that attempts secondary authentication. It is to provide a unique identifier-based authentication system and method that can resist single-use authentication key exploitation through a technique or a near-field hacking technique.

Unique identifier-based authentication system according to the present invention for achieving the above object, the device registration unit for registering the end entity information necessary for the second authentication and the mobile communication terminal matching the end entity information; A second authentication attempt for communicating with an online service system and attempting to perform second authentication with the terminal entity information with the unique identifier of the primary authentication computer device with the end entity information from the unique identifier of the computer device with the second authentication attempt computer device A transmission / reception processing unit for receiving a one-time authentication key input; A unique identifier verification unit for verifying whether the first authenticated computer device and the second authentication attempt computer device are identical by using the unique identifier of the first authenticated computer device and the unique identifier of the second authentication attempt computer device; ; An authentication key issuing unit for issuing a one-time authentication key to the mobile communication terminal and transmitting it through the transmission / reception processing unit; And an authentication key verification unit for verifying whether the one-time authentication key issued by the authentication key issuing unit and the one-time authentication key input to the transmission / reception processing unit are the same.

In addition, the unique identifier-based authentication method according to the present invention includes a device registration step of registering the terminal entity information necessary for secondary authentication and the mobile communication terminal matching the terminal entity information in the secondary authentication system; When receiving the unique identifier and the second authentication request of the computer device primary authentication with the terminal entity information by communicating with the online service system, the secondary authentication system issuing an authentication key issuing a one-time authentication key to the mobile communication terminal Wow; The second authentication system communicates with the online service system to receive a unique identifier of the second authentication attempt computer device that attempts second authentication with the end entity information and a one-time authentication key input from the second authentication attempt computer device. Second authentication attempt step; The secondary authentication system verifies whether the primary authenticated computer device and the secondary authentication attempt computer device are the same by using a unique identifier of the first authenticated computer device and a unique identifier of the second authentication attempt computer device. Verifying a unique identifier; The second authentication system includes an authentication key verification step of verifying whether the one-time authentication key issued in the authentication key issuing step and the one-time authentication key input in the second authentication attempt step are the same.

In addition, the unique identifier-based authentication method according to the present invention, the mobile communication terminal comprises a first step of installing a security authentication module; A second step of connecting, by the mobile communication terminal to the secondary authentication system, terminal entity information required for the second authentication and system information of the mobile communication terminal; A third step of the mobile communication terminal accessing a push server to transmit a certificate of the security authentication module and unique information of the mobile communication terminal and request issuance of a device token; Transmitting, by the mobile communication terminal, the issued device token to the secondary authentication system when the device token is issued from the push server; When the push message is input from the push server, the mobile communication terminal is characterized in that it comprises a fifth step of receiving a one-time authentication key from the secondary authentication system by communicating with the secondary authentication system and outputs on the screen.

In addition, the unique identifier-based authentication method according to the present invention, if the terminal entity information for the primary authentication is input from the user, the computer device comprises a first step of generating a unique identifier of the computer device; A second step of the computer device transmitting a unique identifier of the computer device generated in the first step and end entity information for the first authentication to an online service system; A third step of generating, by the computer device, a unique identifier of the computer device when a one-time authentication key for second authentication is input from a user; And the fourth step of the computer device transmitting the unique identifier of the computer device generated in the third step and the one-time authentication key for the second authentication to the online service system.

As described above, according to the present invention, since the user authentication is performed only when the unique identifier of the computer device in which the primary authentication is completed and the unique identifier of the computer device attempting the second authentication is the same, authentication security is further enhanced.

1 is a schematic block diagram of a unique identifier based authentication system according to the present invention.

2 is a detailed block diagram of a unique identifier based authentication system according to the present invention.

3 is an operation flowchart illustrating an operation of a mobile communication terminal according to an embodiment of the present invention.

4 is a flowchart illustrating an operation of collecting a unique identifier of the computer device by the security authentication module of the computer device according to the present invention.

5 is an operation flowchart showing the operation of the secondary authentication system according to the present invention.

6 is an operation flowchart illustrating a process of renewing and issuing a one-time authentication key to an end entity by the secondary authentication system according to the present invention.

[Description of the code]

110: terminal entity 111: computer device

112: mobile communication terminal 120: online service system

130: push server 140: second authentication system

141: transmission and reception processing unit 142: encryption and decryption processing unit

143: device registration unit 144: one-time authentication processing unit

145: database 146: memory

Hereinafter, with reference to the accompanying drawings will be described in more detail the unique identifier-based authentication system and method according to the present invention.

Recently, the online service system provides online services to users who have passed both primary authentication based on ID and password and secondary authentication based on one-time authentication key. Is also evolving.

Many of these online service identity theft hacks are conducted in PC rooms with multiple computer devices. Hackers install hacking programs such as spyware or keyloggers on computer devices (hereinafter referred to as hacking target computer devices) to be used by normal users. Thereafter, the nearby computer device (hereinafter referred to as hacking computer device) is hacked to the hacking target computer device.

At this time, if a normal user first authenticates by entering an ID and password into an online service system using a hacking target computer device where a hacking program is installed, and receives a one-time authentication key from his mobile communication terminal, and attempts second authentication, The hacker can steal information entered during all this process through the hacking computer device. When the normal user completes the first authentication by entering the ID and password into the hacked computer device, the hacker completes the first authentication by entering the corresponding ID and password into the hacking computer device (duplicate login using the ID and password is performed. If the normal user inputs the one-time authentication key for the second authentication into the hacking target computer device, the hacker also steals the one-time authentication key and inputs it to the hacking computer device.

However, the one-time authentication key input by the normal user through the hacking target computer device is blocked in the process of being delivered to the online service system, and instead, the one-time authentication key input by the hacker through the hacking computer device is transmitted to the online service system. As a result, the hacking target computer device which is being used by the normal user cannot be connected to the online service system, and the hacker computer device being used by the hacker is connected to the online service system. That is, the first authentication is performed at the hacking computer device, but the second authentication is performed at the hacking computer device and the hacking computer device is connected to the online service system. The present invention proposes a method of performing stronger identity authentication in such a situation.

1 is a schematic block diagram of a unique identifier based authentication system according to the present invention.

The end entity 110 is an end user using the authentication procedure through this invention. The end entity 110 uses the authentication procedure according to the present invention to receive the online service from the online service system 120 through the communication network 100. The terminal entity 110 is provided with an on-line service of the on-line service system 120 and a computer device 111 for performing first and second authentication according to the present invention through communication with the on-line service system 120; And a mobile communication terminal 112 for performing secondary authentication.

The computer device 111 includes various computer environments such as a desktop and a notebook. The computer device 111 includes a security authentication module according to the present invention. The security authentication module extracts unique identifiers of the corresponding computer device 111 during a first authentication process and a second authentication process. To the online service system 120.

The mobile communication terminal 112 includes a smartphone equipped with a general feature phone or an operating system (OS) and capable of installing and driving various applications (applications). Detailed configuration of the computer device 111 and the mobile communication terminal 112 for implementing the present invention, and the process of extracting the unique identifier of the computer device by the security authentication module of the computer device 111 will be described later.

The online service system 120 is a system on the web that provides an online service to a plurality of users through the communication network 100. The online service system 120 performs primary authentication on the end entity 110. Typically, the online service system 120 includes a login processing system 121, and performs the first authentication of the end entity 110 in the login processing system 121. Primary authentication includes all forms of single factor authentication, such as knowledge-based authentication, ownership-based authentication, and entity-based authentication. The online service system 120 transmits a unique identifier of the primary authorized computer device 111 to the secondary authentication system 140 and requests secondary authentication for the primary authenticated end entity. In addition, the online service system 120 transmits the one-time authentication key inputted for the second authentication from the computer device 111 and the unique identifier of the computer device 111 to the second authentication system 140.

When the second authentication system 140 requests a second authentication from the online service system 120 for any computer device on which the first authentication has been performed, the second authentication system 140 receives a unique identifier of the first authorized computer device and receives the first authentication. Issue a one-time authentication key to the mobile communication terminal 112 of the terminated entity. The secondary authentication system 140 receives a unique identifier of the computer device through which the one-time authentication key and the one-time authentication key are input (second authentication attempt) through the online service system 120. The second authentication system 140 verifies whether the first authenticated computer device and the second authentication attempt computer device are the same by using the unique identifier of the first authenticated computer device and the unique identifier of the second authentication attempt computer device, and terminates. The one-time authentication key issued to the mobile communication terminal 112 of the entity 110 and the one-time authentication key input through the one-time authentication key input computer device are verified, and the verification result is notified to the online service system.

If the mobile communication terminal is a general feature phone or a device token for a push service is not registered, the secondary authentication system 140 issues a one-time authentication key to the corresponding mobile communication terminal through an SMS server. . On the other hand, when the mobile communication terminal is a smart phone registered device token for the push service, the secondary authentication system 140 issues a one-time authentication key to the corresponding mobile communication terminal using the push server 130. Since the secondary authentication system 140 issues a one-time authentication key to the mobile communication terminal through the SM server, a detailed description thereof will be omitted. In this specification, the secondary authentication system 140 will be described in detail for the process of issuing a one-time authentication key to the mobile communication terminal using a push server.

Push (PUSH) server is a service provided by the manufacturer of the mobile terminal of the terminal entity, when the mobile terminal wants to receive a push service for any application, first issue a device token corresponding to the application from the push server Receive. Then, the push server wakes up the mobile communication terminal by sending a push message to the mobile communication terminal (wakeup), and serves to activate the application (security authentication module of the mobile communication terminal of the present invention) corresponding to the token device.

That is, when the secondary authentication system 140 attempts to issue a one-time authentication key to the mobile communication terminal 111 of the terminal entity 110, the device token of the mobile communication terminal 111 of the secondary authentication system 140 is determined. Push (PUSH) server 130, and then push (PUSH) server 130 outputs a push message to the mobile communication terminal 111, the mobile communication terminal 111 wakes up and the secondary authentication system 140 and Communicate.

A detailed description of the mobile communication terminal issuing the device token from the push server will be described later. As an example of a push server, iOS uses Apple Push Notification Service (APNs) provided by Apple as a push server, while Android uses C2DM (Cloud To Device Messaging) provided by Google as a push server.

The security authentication module installed in the computer device extracts a unique identifier for each computer device. At this time, the unique identifier is generated based on the Universally Unique Identifier (UUID) or the Globally Unique Identifier (GUD) designated as a standard by the Open Software Foundation (OSF), thereby uniquely identifying the computer device. Provides uniqueness for the identifier.

2 is a detailed block diagram of a unique identifier based authentication system according to the present invention.

The computer device 111 of the terminal entity 110 according to the present invention includes an input / output unit 111A, a transceiver unit 111B, and a security authentication module 111C. The input / output unit 111A is a typical keyboard, mouse, monitor, or the like, and performs an interface with a user. The transceiver 111B is connected to the online service system 120 through a wired communication network. The security authentication module 111C is a software installed and operated in the computer device 111, and encrypts the unique identifier collecting unit for collecting the unique identifier of the computer device and the collected unique identifier and outputs it through the transmitting and receiving unit 111B. It includes a processing unit. The unique identifier collection unit generates a unique identifier of the computer device based on a universally unique identifier (UUID) or a globally unique identifier (GUID) designated as a standard by the Open Software Foundation (OSF). do.

The mobile communication terminal 112 of the terminal entity 110 according to the present invention includes an input / output unit 112A, a transceiver unit 112B, and a security authentication module 112C. The input / output unit 112A is a conventional touch pad or the like and performs an interface with a user. The transceiver 112B communicates with the secondary authentication system 140 and the push server 130 according to the present invention through a mobile communication network. The security authentication module 112C receives a device token corresponding to the security authentication module 112C from the push server 130, registers the issued device token in the secondary authentication system 140, and push server 130. If a one-time authentication key is received from the secondary authentication system 140 after the push message is delivered from the second message, the received one-time authentication key is output on the screen of the input / output unit 112A.

The online service system 120 according to the present invention stores the information necessary for the first authentication of the end entity 110, and the second authentication to the second authentication system 140 for the end entity 110 for which the first authentication is completed. Request and receive the result from the secondary authentication system 140. That is, the online service system 120 first authenticates the end entity 110, receives the one-time authentication key for the second authentication from the end entity 110, and delivers the one-time authentication key to the second authentication system 140. In addition, the online service system 120 transmits the unique identifier of the primary authenticated computer device of the end entity and the unique identifier of the secondary authentication attempt computer device to the secondary authentication system 140.

The secondary authentication system 140 according to the present invention encrypts or decrypts data transmitted and received with the transmission and reception processing unit 141 for data transmission and reception between the end entity 110 and the online service system 120 and the push server 130. An encryption / decryption processing unit 142, a device registration unit 143 that matches and registers information of the terminal entity 110 and information of the mobile communication terminal 112 (eg, a phone number, device token issue or device token information); Generate and issue a one-time authentication key to a pre-registered mobile communication terminal of the first authenticated end entity, and perform the second authentication. The unique identifier of the first authorized computer device and the second authentication attempt for the same end entity. Comparing the first authentication computer device and the second authentication attempt computer device with a one-time authentication processing unit 144 for verifying whether or not the same, and stores the terminal entity information, the device token information and the settings for each terminal entity. And a database 145, and a one-time authentication processing section 144, a one-time authentication key and the first unique identifier to the processing procedure information such as a memory portion 146 which stores the order of the authentication computer device issued.

Here, the transmission and reception processing unit 141 is a wired processing unit for communicating with the online service system 120 and the push server 130 and the SMS server (not shown) through a wired communication network, and a mobile communication terminal 110 through a wireless communication network. It includes a wireless processing unit for communicating with). The device registration unit 143 includes a device registration processing unit for processing device registration for each mobile communication terminal, and a device number issuer for issuing a number for the registered mobile communication terminal. The one-time authentication processing unit 144 stores a unique identifier of the computer device that has been firstly authenticated in a memory unit and a unique identifier verification unit that verifies the unique identifier of the computer device that attempts the second authentication, and an authentication key for generating a one-time authentication key. A generation unit, an authentication key issuing unit for issuing the one-time authentication key to a mobile communication terminal matched to the terminal entity that has been firstly authenticated, and a one-time authentication key input to the second authentication attempt computer device are received through an online service system. And an authentication key verification unit for comparing and verifying the issued one-time authentication key and the input one-time authentication key.

Here, the authentication key generation unit may generate a one-time authentication key based on the unique identifier of the computer device that has been firstly authenticated.

The one-time authentication key is generated in the authentication key generation unit, is activated in the authentication key issuing unit, is verified in the authentication key verification unit, and is destroyed when the second authentication is requested for the first authenticated end entity. Conventionally, even when the secondary authentication is requested and the secondary authentication is requested again even before the one-time authentication key is generated and is normally destroyed, a new one-time authentication key is repeatedly issued. However, in this case, a malicious hacker may intervene in the security certification procedure of the legitimate end entity and prevent the legitimate end entity from passing the second authentication. For this reason, the present invention in principle allows the one-time authentication processing unit 144 to proceed sequentially until the one-time authentication key generation, activation, and extinction, so that the one-time authentication key is not repeatedly issued for the same end entity. On the other hand, if the one-time authentication key of the legitimate end entity for a specific reason needs to be renewed, the one-time-issued one that is issued when the same is compared with the terminal entity computer device that requested the initial one-time authentication key and the terminal entity computer device that requested the renewal of the authentication key. You can discard the authentication key and generate and activate a new one-time authentication key.

3 is an operation flowchart illustrating an operation of a mobile communication terminal according to an embodiment of the present invention.

The security authentication module 112C of the mobile communication terminal 112 is an application program (application) that is manufactured based on an operating system mounted on the mobile communication terminal 112 and performs an authentication procedure according to the present invention. 3 is a procedure required for a mobile communication terminal to receive a device token from a push server and receive a one-time authentication key using the device token.

First, the security authentication module 112C is installed in the mobile communication terminal of the end entity (S301). The security authentication module 112C transmits the end entity information (user ID for accessing the online service system, system information of the mobile communication terminal, etc.) to perform the authentication to the secondary authentication system, whereby the secondary authentication system transmits the mobile communication. The terminal entity information is collected through the terminal (S302).

Next, the secondary authentication system checks the collected terminal entity information, performs real name authentication and identity authentication for the mobile communication terminal itself, and transmits the result to the mobile communication terminal, real name authentication and identity from the secondary authentication system. If an authentication failure result is received (S303), it is recognized as a device registration failure and ends (S304).

On the other hand, when the real name authentication and identity authentication success results for the mobile communication terminal is received from the secondary authentication system (S303), the security authentication module of the mobile communication terminal is connected to the push server certificate and the unique information of the mobile communication terminal Requests to issue the device token while transmitting to the push server (S305).

When the device token is issued from the push server (S306), the security authentication module of the mobile communication terminal delivers the issued device token to the secondary authentication system (S307). The secondary authentication system then registers the device token of the mobile communication terminal in the database along with the corresponding end entity information.

Thereafter, when a push message is received from the push server (S308), the security authentication module of the mobile communication terminal is activated to communicate with the secondary authentication system (S309). Next, when the one-time authentication key is received from the secondary authentication system (S310), the one-time authentication key is output on the screen of the input / output unit (S311).

4 is a flowchart illustrating an operation of collecting a unique identifier of the computer device by the security authentication module of the computer device according to the present invention. The security authentication module of the computer device according to the present invention is an application program installed and driven in a computer device connected to an online service system.

Unique identifiers for computer devices are generated based on Universally Unique Identifiers (UUIDs) or Globally Unique Identifiers (GUIDs) as standardized by the Open Software Foundation (OSF). The purpose of the universally unique identifier is to uniquely identify each computer device in a distributed system. Thus, a universally unique identifier created for identification of an entity (computer device) is rarely the same as a universally unique identifier created for identification of another entity (computer device). Of course, there may be very rare cases of the same case, but the uniqueness of the UUID-based unique identifier is almost impossible because the UUID of the first authorized computer device and the UUID of the hacker computer device attempting the second authentication are almost the same. Can be. In this invention, this UUID is applied and used according to the objective of this invention.

The component of the unique identifier of the computer device used in the present invention may be a timestamp providing a one-time unique identifier of the unique identifier, information of a service file providing an identification of an online service system, and a corresponding information of the computer device. It consists of unique information. The unique information of the computer device includes a UUID and may additionally include unique information of the system hardware of the computer device.

When a unique identifier collection request occurs in the security authentication module of the end entity computer device, the unique identifier collection unit generates a time stamp based on Universal Time Clock (UTC) (S401), and a service file provided by the online service system. Collect the information (S402). The service file information includes file information generated and processed, such as a message digest of the file, in addition to the basic file information. After the information collection of the service file provided by the online service system is completed, the unique information of the terminal entity computer device is collected (S403).

The collected unique information of the computer device may be reprocessed according to whether the end entity agrees to provide the information. If the end entity agrees to deliver the collected unique information of the computer device to the secondary authentication system (S404), the timestamp calculated in step S401, the service file information of the online service system collected in step S402, and step S403. By merging the unique information of the terminal entity computer device collected in (S405), and generates a unique identifier (S405), and encrypts the generated unique identifier with a symmetric key encryption algorithm (S406). The encryption key of the symmetric key encryption algorithm is shared with the secondary authentication system through various key sharing algorithms, and the encrypted unique identifier is transmitted to the secondary authentication system via the online service system (S407).

In step 404, if the end entity does not want to provide the secondary authentication system with the unique information of the collected computer device, a hash value (HASH) value, which is a one-way encryption algorithm, is calculated from the unique information of the computer device collected in step S403. (S408), the collected unique information of the computer device is coped with the calculated hash value, and the information is provided to step S405 (S409).

5 is an operation flowchart showing the operation of the secondary authentication system according to the present invention.

When the end entity computer device accesses the online service system, the online service system performs primary authentication on the end entity computer device. At this time, the computer device transmits the terminal entity information necessary for authentication and the unique identifier of the computer device generated through FIG. 4 to the online service system. If the primary authentication is successful, the online service system sends the secondary entity information and the unique identifier of the primary authorized computer device to the secondary authentication system and requests the secondary authentication.

The secondary authentication system inputs the terminal actual information and the unique identifier of the primary authenticated computer device from the online service system. When the secondary authentication is requested (S501), whether the mobile communication terminal corresponding to the received terminal entity information is registered. Check (S502). If the mobile communication terminal is registered (S503), a one-time authentication key is generated (S504), and the generated one-time authentication key is issued to the mobile communication terminal (S505).

At this time, the one-time authentication key of step S504 can be generated based on the unique identifier of the primary authenticated computer device, and other factors such as time / random number besides the primary authenticated unique identifier in order to lower the probability of overlapping the disposable authentication key. Can be generated based on more.

The generated one-time authentication key may be issued to the mobile communication terminal in the form of a text message containing the one-time authentication key through the SMS server in step S505, and the secondary authentication with the mobile communication terminal activated by the push server The system may be issued to the corresponding mobile communication terminal through server / client communication.

In the case of using the push server, the secondary authentication system transmits a message to the push server in communication with the device token of the corresponding mobile communication terminal and the mobile communication terminal. Then, the push server grasps the mobile communication terminal to deliver the push message from the device token received from the second authentication system, and delivers the push message to the mobile communication terminal to activate the mobile communication terminal and the security authentication module of the mobile communication terminal. Let's do it. The activated security authentication module performs server / client communication with the secondary authentication system, and the secondary authentication system issues a one-time authentication key to the security authentication module.

The generated one-time authentication key is transmitted to the mobile communication terminal of the party end entity through the communication network and output to the screen. In this state, when the legitimate end entity or the hacker inputs the one-time authentication key output to the mobile communication terminal into the second authentication attempt computer device, the unique identifier of the second authentication attempt computer device is collected (S506).

In step S506, the one-time authentication key input to the second authentication attempt computer and the unique identifier of the second authentication attempt computer device are transferred to the second authentication system via the online service system (S507).

The secondary authentication system compares the one-time authentication key issued in step S505 with the one-time authentication key received in step S507 (S508) and performs authentication on the one-time authentication key. When the issued one-time authentication key and the received one-time authentication key match (S508), the second authentication attempt computer device compares the unique identifier of the first authorized computer device with the unique identifier of the second authentication attempt computer device (S509). Verify that it is the same as the primary certified computer device. If the two computer devices are the same (S509), the process is processed as an authentication approval (S510), and the result is transmitted to the online service system (S511).

On the other hand, if the mobile communication terminal is not registered in step S503 is processed by the unregistered mobile communication terminal (S512), and notifies the online service system that the unregistered mobile communication terminal (S511). In addition, if the one-time authentication key issued in step S508 and the received one-time authentication key do not match or the two computer devices do not match in step S509, authentication failure is processed (S513) and the result is notified to the online service system (S511). ).

6 is an operation flowchart illustrating a process of renewing and issuing a one-time authentication key to an end entity by the secondary authentication system according to the present invention.

The end entity may need to renew the one-time authentication key issued during the second authentication. For example, if the one-time authentication key issued by the secondary authentication system is lost due to the failure of the communication network without being delivered to the mobile communication terminal, or the one-time authentication key issued due to the physical defect of the computer device to attempt the second authentication. If it cannot be entered, the one-time authentication key should be updated to another value.

When an issuance of a one-time authentication key renewal is issued from an end entity through an online service system, the secondary authentication system determines whether the end entity that requested the issuance of a one-time authentication key renewal is a legitimate end entity or an end entity having a malicious purpose involved in the security authentication procedure. It is necessary to determine whether or not. Therefore, the secondary authentication system receives the unique request of the renewal request computer device together with the renewal request of the one-time authentication key via the online service system, and verifies whether the initial request computer device and the renewal request computer device of the one-time authentication key are the same. do. This will be described in detail.

The secondary authentication system receives the terminal entity information, the one-time authentication key update request, and the unique identifier from the update request computer device (S601). It is checked whether a one-time authentication key issued in the mobile communication terminal matching the received end entity information exists (S602). If there is a one-time authentication key issued by the mobile communication terminal (S603), the unique key of the authentication key issuing computer device issued the one-time authentication key is compared with the unique identifier of the update request computer device, and the authentication key issuing computer It is verified whether the device and the update request computer are the same (S604). If the two computer devices are the same (S604), the one-time authentication key is renewed and reissued to the mobile communication terminal matched with the corresponding end entity information (S605), and waits until the corresponding one-time reissued authentication key is received from the online service system ( S606). If the one-time authentication key issued in step S603 does not exist or the two computer devices are not the same in step S604, it is determined that the one-time authentication key update failed and the log is collected (S607).

Claims (28)

1. A device registration unit for registering end entity information required for secondary authentication and a mobile communication terminal matching the end entity information;

   A second authentication attempt for communicating with an online service system and attempting to perform second authentication with the terminal entity information with the unique identifier of the primary authentication computer device with the end entity information from the unique identifier of the computer device with the second authentication attempt computer device A transmission / reception processing unit for receiving a one-time authentication key input;

   A unique identifier verification unit for verifying whether the first authenticated computer device and the second authentication attempt computer device are identical by using the unique identifier of the first authenticated computer device and the unique identifier of the second authentication attempt computer device; ;

   An authentication key issuing unit for issuing a one-time authentication key to the mobile communication terminal and transmitting it through the transmission / reception processing unit;

   A unique identifier-based authentication system comprising an authentication key verification unit for verifying whether the one-time authentication key issued by the authentication key issuing unit and the one-time authentication key input to the transmission and reception processing unit.
2. 2. The unique identifier based authentication system of claim 1, wherein the unique identifier of the computer device comprises a universal unique identifier (UUID).
3. 2. The unique identifier based authentication system of claim 1, wherein the unique identifier of the computer device comprises a globally unique identifier (GUID).
4. The unique identifier-based authentication system of claim 1, wherein the unique identifier of the computer device includes a hash value of a universal unique identifier (UUID).
5. The unique identifier-based authentication system of claim 1, wherein the unique identifier of the computer device includes a hash value of a globally unique identifier (GUID).
6. 6. A unique identifier based authentication system according to any one of claims 2 to 5, wherein said unique identifier of said computer device further comprises a timestamp.
7. The unique identifier-based authentication system according to any one of claims 2 to 5, wherein the unique identifier of the computer device further includes service file information of the online service system.
8. The unique identifier-based authentication system of claim 1, wherein the one-time authentication key issued by the authentication key issuing unit is generated from a unique identifier of the first authenticated computer device.
9. The mobile terminal of claim 1, wherein the device registration unit registers a device token of the mobile communication terminal that matches the terminal entity information, and the authentication key issuing unit uses the device token of the mobile communication terminal that matches the terminal entity information. Unique identifier-based authentication system, characterized in that to issue a one-time authentication key to the mobile communication terminal by communicating with the mobile communication terminal after activating the communication terminal.
10. The unique identifier-based authentication system of claim 1, wherein the authentication key issuing unit issues a one-time authentication key to the mobile communication terminal through an SMS server.
11. A device registration step of registering, by the secondary authentication system, terminal entity information necessary for secondary authentication and a mobile communication terminal that matches the terminal entity information;

    When receiving the unique identifier and the second authentication request of the computer device primary authentication with the terminal entity information by communicating with the online service system, the secondary authentication system issuing an authentication key issuing a one-time authentication key to the mobile communication terminal Wow;

    The second authentication system communicates with the online service system to receive a unique identifier of a second authentication attempt computer device that attempts second authentication with the end entity information and a one-time authentication key input from the second authentication attempt computer device. Second authentication attempt step;

    The secondary authentication system verifies whether the primary authenticated computer device and the secondary authentication attempt computer device are the same by using a unique identifier of the first authenticated computer device and a unique identifier of the second authentication attempt computer device. Verifying a unique identifier;

    Unique identifier-based authentication, characterized in that the secondary authentication system includes an authentication key verification step of verifying whether the one-time authentication key issued in the authentication key issuing step and the one-time authentication key input in the second authentication attempt step are the same. Way.
12. 12. The method of claim 11, wherein the unique identifier of the computer device comprises a universally unique identifier (UUID).
13. 12. The method of claim 11, wherein the unique identifier of the computer device comprises a globally unique identifier (GUID).
14. 12. The method of claim 11, wherein the unique identifier of the computer device includes a hash value of a universally unique identifier (UUID).
15. 12. The method according to claim 11, wherein the unique identifier of the computer device includes a hash value of a globally unique identifier (GUID).
16. 16. The unique identifier based authentication method according to any one of claims 12 to 15, wherein the unique identifier of the computer device further includes a time stamp.
17. The unique identifier based authentication method according to any one of claims 12 to 15, wherein the unique identifier of the computer device further includes service file information of the online service system.
18. 12. The unique identifier-based authentication method of claim 11, wherein the one-time authentication key issued in the authentication key issuing step is generated from a unique identifier of the first authenticated computer device.
19. 12. The method of claim 11, wherein registering the device registers the device token of the mobile communication terminal that matches the terminal entity information, and issuing the authentication key by using the device token of the mobile communication terminal that matches the terminal entity information. Unique identifier-based authentication method characterized in that for activating the mobile communication terminal and communicating with the mobile communication terminal to issue a one-time authentication key to the mobile communication terminal.
20. The unique identifier-based authentication method of claim 11, wherein the authentication key issuing unit issues a one-time authentication key to the mobile communication terminal through an SMS server.
21. A first step in which the mobile communication terminal installs a security authentication module;

    A second step of transmitting, by the mobile communication terminal to the secondary authentication system, terminal entity information required for the second authentication and system information of the mobile communication terminal;

    A third step of the mobile communication terminal accessing a push server to transmit a certificate of the security authentication module and unique information of the mobile communication terminal and request issuance of a device token;

    A fourth step of the mobile communication terminal transferring the issued device token to the secondary authentication system when the device token is issued from the push server;

    When the push message is input from the push server, the mobile communication terminal comprises a fifth step of communicating with the secondary authentication system to receive a one-time authentication key from the secondary authentication system and outputs on the screen Based Authentication Method.
22. When the terminal entity information for the first authentication is input from the user, the computer apparatus may include a first step of generating a unique identifier of the computer apparatus;

    A second step of the computer device transmitting a unique identifier of the computer device generated in the first step and end entity information for the first authentication to an online service system;

    A third step of generating, by the computer device, a unique identifier of the computer device when a one-time authentication key for second authentication is input from a user;

    And a fourth step of the computer device transmitting the unique identifier of the computer device generated in the third step and the one-time authentication key for the second authentication to the online service system.
23. 23. The method of claim 22, wherein the unique identifier of the computer device comprises a universally unique identifier (UUID).
24. 23. The method of claim 22, wherein the unique identifier of the computer device comprises a globally unique identifier (GUID).
25. 23. The method of claim 22, wherein the unique identifier of the computer device includes a hash value of a universally unique identifier (UUID).
26. 23. The method of claim 22, wherein the unique identifier of the computer device includes a hash value of a globally unique identifier (GUID).
27. 27. The method of any one of claims 23 to 26, wherein the unique identifier of the computer device further comprises a timestamp.
28. 27. The unique identifier based authentication method according to any one of claims 23 to 26, wherein the unique identifier of the computer device further includes service file information of the online service system.

Images