WO2012128478A2

WO2012128478A2 - System and method for image-based authentication

Info

Publication number: WO2012128478A2
Application number: PCT/KR2012/001249
Authority: WO
Inventors: 정영석; 한형덕; 황재연
Original assignee: (주)잉카인터넷
Priority date: 2011-03-21
Filing date: 2012-02-20
Publication date: 2012-09-27
Also published as: KR20120107175A; KR101257761B1; WO2012128478A3

Abstract

The present invention relates to a system and method for image-based authentication, wherein user authentication is performed by the preregistered mobile communication terminal of a user transmitting, to an authentication server, an authentication key corresponding to an authentication image. In the image-based authentication system according to the present invention, a system for authenticating an end entity comprises a computer device for performing a first authentication through communication with an online service system and a mobile communication terminal for performing a second authentication, and includes: a unit for registering a mobile communication terminal, which registers the end entity information needed for the second authentication, and a mobile communication terminal matching the end entity information; a unit for generating an authentication key, which generates a second authentication key issued to the end entity in which the first authentication is completed; a unit for generating an authentication image, which generates an authentication image corresponding to the generated second authentication key and provides the authentication image for display on the computer device of the end entity in which the first authentication is completed through the online service system; and a unit for verifying authentication, which verifies the second authentication key received from the activated mobile communication terminal after activating the mobile communication terminal registered in the end entity in which the first authentication is completed.

Description

Image based authentication system and method

The present invention relates to an authentication system and method, and more particularly, an image-based authentication system and method for allowing a user to be authenticated by transmitting a authentication key corresponding to an image for authentication to an authentication server. It is about.

Today, thanks to the development of the Internet, various kinds of online services are provided. Most online service systems authenticate whether client computer devices that access the system through the Internet are entitled to use the online service.

The most commonly used user authentication method is an authentication method using a user ID and password. When a user joins an online service system as a member, the user ID and password are registered, and when the user later tries to access the system, Enter the registered user ID and password to verify the identity of the user.

However, the authentication method using the ID and password is easy to steal or hack authentication information (user ID and password), there is a problem that can not block malicious access attempts when the authentication information is exposed.

Various personal information is managed in the online service system, and as intangible assets (for example, items in online games, cyber money, etc.) through the online service system have recently increased, more powerful identity authentication methods are required.

According to such a request, various secondary authentication schemes after first authentication based on the above-described user ID and password have been tried. In particular, a one-time authentication key-based secondary authentication scheme using a user's mobile communication terminal has been widely used. This one-time authentication key-based authentication method usually proceeds with the following procedure. First, the online service system performs a first authentication procedure (for example, checking a user ID and a password), and after the first authentication, requests the second authentication to the second authentication server. The secondary authentication server sends a text message (SMS) including a one-time authentication key to the user's mobile communication terminal. The online service system receives the one-time authentication key through the user's computer device and delivers it to the secondary authentication server. The secondary authentication server then verifies that the one-time authentication key sent to the user's mobile terminal and the one-time authentication key input through the online service system are the same,

Although the one-time authentication key-based secondary authentication method can strengthen the security strength of the user authentication to some extent, there are still vulnerabilities due to the following long-range hacking or short-range hacking.

In other words, as a remote hacking technique, when a user sends a one-time authentication key to an online service system, the hacker intercepts the one-time authentication key through network spoofing, or the hacker installs a key logger on the user's computer device in advance and remotely sets the user's computer. The authentication key may be extorted by monitoring and removing the one-time authentication key input to the device, or inducing a user to access a phishing site rather than an online service system and extorting the one-time authentication key input to the phishing site. For example, in July 2006, a US bank infiltrated a bank account with an authentication key stolen through a phishing site, a remote hacking technique.

In addition, as a short-range hacking technique, a one-time authentication key transmitted to a user's mobile communication terminal may be identified and stolen through a technique such as shoulder surfing or social engineering near the user.

Therefore, as a second authentication method using a one-time authentication key, even if a one-time authentication key is extorted by a hacker by a long-range hacking technique or a short-range hacking technique, a stronger personal authentication technique capable of resisting this is needed.

An object of the present invention devised to meet the needs of the prior art described above is to receive an image-based authentication key from a pre-registered mobile communication terminal corresponding to a computer device for which primary authentication is completed, and compare it with a previously registered authentication key. By authenticating the user, it is to provide an image-based authentication system and method that can resist the extinction of single-use authentication key through a remote hacking technique or a short-range hacking technique.

An image-based authentication system according to a first embodiment of the present invention for achieving the above object, a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication A system for authenticating an end entity comprising: a mobile communication terminal registration unit for registering end entity information required for secondary authentication and a mobile communication terminal matching the end entity information; An authentication key generation unit for generating a second authentication key to be issued to the primary entity having completed primary authentication; An authentication image generation unit for generating an authentication image corresponding to the generated second authentication key and displaying the authentication image on a computer device of the primary authenticated terminal entity through the online service system; And an authentication key verification unit for activating the mobile communication terminal registered in the primary authentication-completed end entity and then verifying the secondary authentication key received from the activated mobile communication terminal.

In addition, the image-based authentication method according to the first embodiment of the present invention, the terminal entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication A method for authenticating the information, the method comprising: a mobile communication terminal registration step of registering, by a secondary authentication system, terminal entity information necessary for secondary authentication and a mobile communication terminal matching the terminal entity information; An authentication key generation step of generating, by the second authentication system, a second authentication key to be issued to an end entity that has been first authenticated when the second authentication of the end entity is requested from the online service system; An authentication image generation step of generating, by the secondary authentication system, an authentication image corresponding to the generated second authentication key and displaying the image on the computer device of the first authenticated end entity through the online service system; And an authentication key verification step in which the secondary authentication system activates a mobile communication terminal registered in the primary authentication-completed end entity after the authentication image generation step and verifies a secondary authentication key received from the activated mobile communication terminal. It is characterized by.

In addition, the image-based authentication system according to a second embodiment of the present invention, the terminal entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication A system for authenticating the information, comprising: a mobile communication terminal registration unit for registering end entity information necessary for secondary authentication and a mobile communication terminal matching the end entity information; An authentication image receiver configured to receive an authentication image through the mobile communication terminal registered in the mobile communication terminal registration unit; An authentication key generation issue unit for generating and storing a second authentication key from the received authentication image and issuing and storing the secondary authentication key to the mobile communication terminal; And an authentication key verification unit for activating the mobile communication terminal registered in the terminal entity having the primary authentication and receiving and verifying a second stored authentication key from the activated mobile communication terminal.

In addition, the image-based authentication method according to a second embodiment of the present invention, the terminal entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication A method for authenticating the information, the method comprising: a mobile communication terminal registration step of registering, by a secondary authentication system, terminal entity information necessary for secondary authentication and a mobile communication terminal matching the terminal entity information; An authentication image receiving step of receiving, by the secondary authentication system, an authentication image through the mobile communication terminal registered in the mobile communication terminal registration unit; An authentication key generation issuing step for the secondary authentication system to generate and store a secondary authentication key from the received authentication image and to issue and store the secondary authentication key to the mobile communication terminal; When the second authentication of the end entity is requested from the on-line service system, the second authentication system activates a mobile communication terminal registered in the terminal entity for which primary authentication has been completed, and the second authentication key previously stored from the activated mobile communication terminal. Characterized in that it comprises an authentication key verification step of receiving and verifying.

As described above, according to the present invention, since the second authentication for the user is performed by receiving an image-based authentication key from a pre-registered mobile communication terminal that matches the computer device in which the first authentication is completed, authentication security is further enhanced. .

1 is a schematic structural block diagram of an image-based authentication system according to the present invention.

2 is a detailed block diagram of an image-based authentication system according to a first embodiment of the present invention.

3 is a flowchart illustrating an operation of a mobile communication terminal of the image-based authentication system according to the first embodiment of the present invention.

4 is an operation flowchart showing the operation of the secondary authentication system of the image-based authentication system according to a first embodiment of the present invention.

5 is a detailed block diagram of an image-based authentication system according to a second embodiment of the present invention.

6 is a flowchart illustrating a process of registering and issuing a secondary authentication key in an image-based authentication system mobile communication terminal according to a second embodiment of the present invention.

7 is a flowchart illustrating a process of registering and issuing a secondary authentication key in a secondary authentication system based on an image based authentication system according to a second embodiment of the present invention.

8 is an operation flowchart illustrating a second authentication process in an image-based authentication system mobile communication terminal according to a second embodiment of the present invention.

9 is an operation flowchart illustrating a second authentication process in the second authentication system based on the image-based authentication system according to the second embodiment of the present invention.

[Description of the code]

110: terminal entity 111: computer device

112: mobile communication terminal 120: online service system

130: push server 140: secondary authentication system

141: transmission and reception processing unit 142: encryption and decryption processing unit

143: mobile terminal registration unit 144: authentication processing unit

145: database 146: memory

Hereinafter, with reference to the accompanying drawings will be described in more detail the image-based authentication system and method according to the present invention.

The end entity 110 is an end user using the authentication procedure through this invention. The end entity 110 uses the authentication procedure according to the present invention to receive the online service from the online service system 120 through the communication network 100. The end entity 110 receives the on-line service of the on-line service system 120 and performs the first authentication through communication with the on-line service system 120, and performs the second authentication according to the present invention. It includes a mobile communication terminal 112 for performing. The computer device 111 includes various computer environments such as a desktop and a notebook. The mobile communication terminal 112 is preferably a smartphone that is equipped with an operating system (OS) and capable of installing and driving various applications (applications). Detailed configuration of the computer device 111 and the mobile communication terminal 112 for implementing the present invention will be described later.

The online service system 120 is a system on the web that provides an online service to a plurality of users through the communication network 100. The online service system 120 performs primary authentication on the end entity 110. Typically, the online service system 120 includes a login processing system 121, and performs the first authentication of the end entity 110 in the login processing system 121. Primary authentication includes all forms of single factor authentication, such as knowledge-based authentication, ownership-based authentication, and entity-based authentication.

The push (PUSH) server 130 is a service provided by the manufacturer of the mobile communication terminal 112 of the end entity 110. When the mobile communication terminal 112 wants to receive a push service for a certain application, first, a device token corresponding to the corresponding application is issued from the push server 130. Then, the push server 130 wakes up the mobile communication terminal 112 by sending a push message to the mobile communication terminal 112 (wakeup), and activates the application (security authentication module in the present invention) corresponding to the corresponding token device Play a role. A detailed description of the mobile terminal 112 issuing a device token from the push server will be described later. As an example of the push server 130, the iOS series uses Apple Push Notification Service (APNs) provided by Apple as a push server, and the Android series uses C2DM (Cloud To Device Messaging) provided by Google as a push server. do.

When the secondary authentication system 140 requests a second authentication from the online service system 120 for the end entity 110 on which the primary authentication is completed, the second authentication system 140 uses the device token of the end entity 110 to pre-register mobile communication. Wake up the terminal 112 to activate the security authentication module installed in the mobile communication terminal 112, and receives the secondary authentication key from the mobile communication terminal 112 and performs a second authentication procedure. In this specification, two embodiments are proposed as a second authentication procedure.

Briefly describing the secondary authentication procedure according to the first embodiment, the secondary authentication system 140 registers the mobile communication terminal 112 of the end entity 110 corresponding to the primary authentication information. When the second authentication is requested from the online service system 120, the second authentication system 140 issues the second authentication key and generates an authentication image corresponding to the issued second authentication key to determine the end entity 110. It is displayed on the computer device 111 and receives a second authentication key based on the authentication image through the mobile terminal 112 registered. The secondary authentication system 140 performs user authentication by comparing the secondary authentication key inputted through the mobile communication terminal 112 with the issued secondary authentication key.

The computer device 111 of the terminal entity 110 according to the present invention includes an input / output unit 111A and a transceiver unit 111B. The input / output unit 111A is a typical keyboard, mouse, monitor, or the like, and performs an interface with a user. The transceiver 111B is connected to the online service system 120 through a wired communication network. The computer device 111 receives the authentication image from the secondary authentication system 140 and outputs it to the screen of the input / output unit 111A.

The mobile communication terminal 112 of the terminal entity 110 according to the present invention includes an input / output unit 112A, a transceiver unit 112B, a camera 112C, and a security authentication module 112D. The input / output unit 112A is a conventional touch pad or the like and performs an interface with a user. The transceiver 112B is connected to the push server 130 and the secondary authentication system 140 through a mobile communication network. The camera 112C acquires image data by capturing an image (image) according to a user of a mobile communication terminal.

The security authentication module 112D is a device register for issuing a device token for communication with the secondary authentication system 140 from the push server 130 and registering the issued device token in the secondary authentication system 140, An authentication key output unit is executed by the push message transmitted from the push server 130 to transmit the secondary authentication key based on the authentication image displayed on the screen of the computer device 111 to the secondary authentication system 140.

In addition, the security authentication module 112D may further include an access key processing unit for accessing the secondary authentication system 140 using an access key delivered with a push message from the push server 130. The processor may further include a function of decrypting the encrypted access key. That is, the secondary authentication system 140 encrypts and transmits the access key along with the push message to the mobile communication terminal 112, and the access key processing unit decrypts the encrypted access key by using the decrypted access key. Access system 140. The secondary authentication system 140 verifies the access authority of the mobile communication terminal 112 attempting the corresponding access by using the access key input from the mobile communication terminal 112.

The authentication key output unit of the security authentication module 112D may output the secondary authentication key directly input through the input / output unit 112A to the secondary authentication system 140. That is, the authentication image is an image including a figure, a number, and a letter, and the name of the figure included in the corresponding authentication image (for example, an animal, a plant, or an object such as an elephant, a sunflower, an umbrella, etc.) by a user using the input / output unit 112A. Name) or numbers and letters included in the authentication image.

In addition, the security authentication module 112D may further include an image analysis unit for automatically extracting the second authentication key by analyzing the authentication image data input through the camera 112C. That is, the authentication image is a two-dimensional bar code, and the image analyzing unit may be a bar code analyzing unit. Two-dimensional barcodes include a QR code (Quick Response Code), PDF417, Data Matrix, Maxi code and the like.

The online service system 120 according to the present invention stores the information necessary for the first authentication of the end entity 110, and the second authentication to the second authentication system 140 for the end entity 110 in which the first authentication is completed. Request, receives the authentication image from the secondary authentication system 140, and provides the web page including the authentication image to the computer device 111 of the end entity 110.

The secondary authentication system 140 according to the present invention encrypts or decrypts data transmitted and received with the transmission and reception processing unit 141 for data transmission and reception between the end entity 110, the online service system 120, and the push server 130. The encryption / decryption processing unit 142, the mobile communication terminal registration unit 143 for matching and registering the device information of the terminal entity 110 and the device token of the mobile communication terminal 112, and the terminal entity 110 that has been primarily authenticated. Generate the secondary authentication key and generate an authentication image corresponding to the secondary authentication key to provide to the computer device 111 of the end entity 110 through the online service system 120 and the primary end authentication 110 is completed An authentication processing unit 144 for receiving and verifying a second authentication key corresponding to the authentication image from the mobile communication terminal 112, and a database 145 for storing end entity information, device token information, and settings for each end entity. ), And authentication The memory unit 146 stores secondary authentication key information and processing procedure information issued by the unit 144.

Here, the transmission and reception processing unit 141 includes a wired processing unit communicating with the online service system 120 and the push server 130 through a wired communication network, and a wireless processing unit communicating with the mobile communication terminal 112 through a wireless communication network.

The mobile communication terminal registration unit 143 includes a device registration processing unit for processing device registration for each mobile communication terminal 112, and a device number issuer for issuing a number for the registered mobile communication terminal.

The authentication processing unit 144 generates an authentication key generation unit for generating a second authentication key to be issued to the terminal entity 110 that has been firstly authenticated, and generates an authentication image corresponding to the second authentication key. An authentication image generation unit configured to display on the computer device 111 of the primary authentication-completed end entity 110 and from the pre-registered mobile communication terminal 112 of the primary authentication-completed end entity 110. And an authentication key verification unit for comparing and verifying the inputted secondary authentication key and the secondary authentication key generated by the authentication key generator. In addition, the authentication processing unit 144 issues an access key to the pre-registered mobile communication terminal 112 of the terminal entity 110, the primary authentication is completed, and the access key and the access issued from the mobile communication terminal 112. The apparatus further includes an access key issuing / verifying unit for verifying the mobile communication terminal 112 by comparing the keys, and the memory unit 146 further stores the issued access key information issued to the mobile communication terminal 112.

The security authentication module 112D of the mobile communication terminal 112 is an application program (application) that is manufactured based on an operating system mounted on the mobile communication terminal 112 and performs an authentication procedure according to the present invention.

First, the security authentication module 112D is installed in the mobile communication terminal 112 of the end entity (S301). The security authentication module 112D transmits the end entity information (user ID for accessing the online service system, system information of the mobile communication terminal, etc.) for performing authentication to the secondary authentication system 140, thereby performing secondary authentication. The system 140 collects end entity information through the mobile communication terminal 112 (S302).

The secondary authentication system 140 confirms the collected end entity information, performs real name authentication and self authentication for the mobile communication terminal itself, and transmits the result to the mobile communication terminal 112. When the real name authentication and identity authentication failure results are received from the secondary authentication system 140 (S303), the security authentication module 112D of the mobile communication terminal recognizes that the device registration failed and ends (S304).

On the other hand, when the real name authentication and identity authentication success results for the mobile communication terminal 112 is received from the secondary authentication system 140 (S303), the security authentication module 112D of the mobile communication terminal is connected to the push server 130. By transmitting the certificate of the security authentication module and the unique information of the mobile communication terminal to the push server and requests the device token issuance (S305).

When the device token is issued from the push server 130 (S306), the security authentication module 112D of the mobile communication terminal transfers the issued device token to the secondary authentication system (S307). Then, the secondary authentication system 140 registers the device token of the mobile communication terminal 112 together with the corresponding terminal entity information in the database.

In this environment, when a push message is received from the push server (S308), the mobile communication terminal wakes up and activates the security authentication module 112D (S309). When the encrypted access key is received (S310), the security authentication module 112D of the mobile communication terminal decrypts the encrypted access key (S311). When the second authentication information is input from the user (S312), the security authentication module 112D extracts the second authentication key from the second authentication information (S313), and accesses the second authentication system with the access key decrypted in step S311. The secondary authentication key is transmitted to the secondary authentication system (S314).

The second authentication information may be authentication image data obtained by photographing an authentication image displayed on the screen of the computer device of the end entity, and the security authentication module 112D interprets the authentication image data to extract the second authentication key. In particular, the authentication image is a two-dimensional barcode. Alternatively, the secondary authentication information is a value directly input through the input / output unit of the mobile communication terminal, and the security authentication module 112D extracts the secondary authentication key from the input value.

First, when the mobile communication terminal installed with the security authentication module performs step S302 of Figure 3, the secondary authentication system is the terminal entity information (for example, the user ID for accessing the online service system and the mobile terminal) System information, etc.), confirm the collected terminal entity information, perform real-name authentication and self-authentication on the mobile communication terminal itself, and transmit the result (authentication success / failure) to the mobile communication terminal, and verify successful mobile communication. It registers his device token from the terminal.

In this environment, when the end entity computer device accesses the online service system, the online service system performs primary authentication on the end entity computer device. At this time, the computer device transmits the terminal entity information necessary for authentication to the online service system. If the first authentication is successful, the online service system sends the end entity information to the second authentication system and requests the second authentication.

If the secondary authentication system requests secondary authentication while terminating actual information is input from the online service system (S401), the secondary authentication system checks whether the mobile communication terminal is registered in response to the received end entity information (S402).

If the mobile communication terminal is registered (S403), the secondary authentication system generates and stores the secondary authentication key, generates an authentication image corresponding to the generated secondary authentication key, and completes the primary authentication through the online service system. It displays on the terminal entity computer device (S404). At this time, the authentication image corresponding to the secondary authentication key may be a two-dimensional barcode image including the secondary authentication key information. The secondary authentication key generates a timestamp based on the Universal Time Clock (UTC) and prevents the issuance, and generates the timestamp and the end entity information as seed values.

The secondary authentication system generates, stores and encrypts an access key (S405).

The secondary authentication system activates the security authentication module 112D of the mobile communication terminal by using the device token of the mobile communication terminal that is registered in the terminal entity that successfully authenticates the first authentication, and issues an encrypted access key to the mobile communication terminal. Deliver the message to the push server (S406).

The push server identifies the mobile communication terminal that will deliver the message from the device token received from the secondary authentication system, delivers the push message to the mobile communication terminal to activate the security authentication module, and sends the encrypted access key to the security authentication module. To pass.

Then, the mobile communication terminal decrypts the encrypted access key and prepares to receive the second authentication information from the user, receives the second authentication information from the user, extracts the second authentication key therefrom, and decrypts the access key. Send the secondary authentication key to the secondary authentication system. Thus, the secondary authentication system receives the access key and the secondary authentication key from the mobile communication terminal (S407). The secondary authentication system compares the access key received in step S407 with the access key generated in step S405 and issued to the mobile communication terminal (S408). If the two access keys match as a result of the comparison in step S408, the secondary authentication system compares the secondary authentication key received in step S407 with the secondary authentication key stored in step S404 (S409). If the result of the comparison of step S409 matches the two secondary authentication keys, the secondary authentication system approves the authentication (S410) and transmits the result to the online service system (S411).

On the other hand, if the two access keys do not match as a result of the comparison of step S408, or if the two secondary authentication keys do not match as a result of the comparison of step S409, the secondary authentication system fails to authenticate (S412), and the result is sent to the online service system. It transmits (S411). On the other hand, if the mobile communication terminal is not registered in step S403, it is processed by the unregistered mobile communication terminal (S413), and the result of the processing is notified to the online service system (S411).

Briefly describing the secondary authentication procedure according to the second embodiment, the secondary authentication system 140 registers the mobile communication terminal 112 of the terminal entity 110 corresponding to the primary authentication information. A secondary authentication key is generated and stored from an arbitrary image input from the terminal 112 and issued to the mobile communication terminal 112. The mobile communication terminal 112 receives an authentication keyer equipment password (pin number) from the user and encrypts and stores the second authentication key issued from the secondary authentication system 140. After that, when the second authentication is requested from the online service system 120, the mobile communication terminal 112 receives the authentication keyer password from the user, decrypts the encrypted second stored authentication key, and then the second authentication system 140. The secondary authentication system 140 performs user authentication by comparing the secondary authentication key input from the mobile communication terminal 112 and the pre-stored secondary authentication key when the second authentication request is made.

The computer head, the online service system, and the push server of the end entity constituting the image-based authentication system according to the second embodiment are the computer devices, the online service system, and the push server of the end entity constituting the image-based authentication system according to the first embodiment. Are the same as However, after the on-line service system of the first embodiment requests the secondary authentication system for the second authentication of the end entity, the online service system receives the authentication image from the second authentication system and displays it on the computer device of the end entity. In the example, this process is omitted. In addition, the secondary authentication key issued by the secondary authentication system of the first embodiment is stored in the memory unit because of the strong nature of the one-time authentication key, but the secondary authentication key issued by the secondary authentication system of the second embodiment is continuously Since it is a usable authentication key, it is preferably stored as an item of end entity information of the database. The image-based authentication system according to the first embodiment and the image-based authentication system according to the second embodiment have a difference in the internal configuration of the security authentication module of the mobile communication terminal of the end entity and the authentication processing unit of the secondary authentication system. The difference will be explained mainly.

The mobile communication terminal according to the second embodiment includes a typical input / output unit, a transceiver unit, a camera, a storage unit, and a security authentication module 510 for performing image-based authentication according to the present invention. The storage unit may be a universal subscriber identity module card (USIM card) or internal memory that is typically mounted in the mobile communication terminal.

The security authentication module 510 receives a device token for communication with the secondary authentication system from the push server, registers the issued device token in the secondary authentication system, and registers any authentication image captured by the camera in the secondary authentication system. An authentication key inputted from a user by a device registration unit 511 for receiving a second authentication key corresponding to the authentication image from the secondary authentication system and a second authentication key issued by the device registration unit 511 after being transmitted to the user; An encryption key storage device password that is encrypted by a storage password and stored in the storage in the encrypted secondary authentication key and executed by a push message transmitted from a push server to read the encrypted secondary authentication key from the storage unit and input from a user. Decryption to include an authentication key processing unit 512 for transmitting to the secondary authentication system.

In addition, the security authentication module 510 may further include an access key processing unit 513 for accessing the secondary authentication system using an access key delivered with a push message from a push server, and the access key processing unit 513. ) May further include a function of decrypting the encrypted access key. That is, the secondary authentication system issues an encrypted access key to the mobile communication terminal, and the access key processing unit 513 decrypts the encrypted access key and then accesses the secondary authentication system using the decrypted access key.

The authentication processing unit 520 of the secondary authentication system according to the second embodiment of the present invention generates an authentication image receiving unit 521 for receiving an authentication image from a mobile communication terminal and a second authentication key from the received authentication image. Authentication key generation issuer 522, which stores and issues to the mobile communication terminal, a second authentication key input from a pre-registered mobile communication terminal of the terminal entity that has been first authenticated, and a second authentication key issued to the mobile communication terminal. The authentication key verification unit 523 compares and verifies. In addition, the authentication processing unit 520 issues an encrypted access key to a pre-registered mobile communication terminal of the first-end terminal is completed by comparing the access key input from the mobile communication terminal and the issued access key. It further includes an access key issuance / verification unit 524 to verify the.

That is, in the authentication technology according to the second embodiment, the secondary authentication system generates and stores a secondary authentication key from authentication image data photographed by the user using the camera of the mobile communication terminal in the process of registering the mobile communication terminal. And issue it to the mobile communication terminal. The mobile communication terminal receives the authentication key device password from the user, encrypts the second authentication key with the input authentication key device password, and stores the encrypted second authentication key in the storage unit. After that, whenever the user performs the second authentication to use the online service system, the mobile communication terminal receives the authentication keyer password again from the user, decrypts the encrypted second authentication key, and provides it to the second authentication system. .

According to this second embodiment, since the secondary authentication key is generated and issued from the authentication image data photographed by the user, it is possible to prevent duplicate issuance of the secondary authentication key. In addition, every second authentication does not require issuing a one-time secondary authentication key to an online service system or a mobile communication terminal.

6 is an operation flowchart illustrating a registration and secondary authentication key issuing process in an image-based authentication system mobile communication terminal according to a second embodiment of the present invention, and FIG. 7 is an image-based authentication method according to a second embodiment of the present invention. Authentication System Operation flow chart illustrating the registration and secondary authentication key issuing process in the secondary authentication system.

Referring to Figure 6 and Figure 7 looks at the device registration and secondary authentication key issuance process through the mobile communication terminal and the secondary authentication system.

First, the security authentication module 510 is installed in the mobile communication terminal of the end entity (S601). The security authentication module 510 transmits the terminal entity information (user ID for accessing the online service system, system information of the mobile communication terminal, etc.) for performing authentication to the secondary authentication system (S602).

When the secondary authentication system receives terminal entity information (user ID for accessing the online service system, system information of the mobile communication terminal, etc.) for performing authentication from the mobile communication terminal (S701), the real name of the mobile communication terminal itself is received. Perform authentication and identity verification (S702), and transmits the result to the mobile communication terminal (S703).

If the real name authentication and identity authentication failure results are received from the secondary authentication system (S603), the mobile communication terminal recognizes the device registration failure and ends (S604).

When real name authentication and identity authentication success result is received from the secondary authentication system (S603), the security authentication module of the mobile communication terminal accesses the push server to push the certificate of the security authentication module and the unique information of the mobile communication terminal. The device token is requested while transmitting to the server (S605).

When the device token is issued from the push server (S606), the security authentication module 510 of the mobile communication terminal transfers the issued device token to the secondary authentication system (S607). If the second authentication system receives the device token from the mobile communication terminal (S704), it registers the device token of the mobile communication terminal with the corresponding terminal entity information in the database (S705).

After registering the device token, the security authentication module 510 of the mobile communication terminal makes a request for photographing the authentication image to the user (S608), and when the authentication image data is input (S609), transmits the authentication image data to the secondary authentication system (S609). S610). When the authentication image is received from the mobile communication terminal in which the device token is registered (S706), the second authentication system generates and stores a second authentication key from the received authentication image (S707), and generates the corresponding second authentication key. Is issued to the mobile communication terminal (S708).

When the secondary authentication key is issued from the secondary authentication system (S611), the mobile communication terminal requests the user to input the authentication keyer equipment password (S612). When the authentication keyer device password is input (S613), the security authentication module 510 encrypts the secondary authentication key issued in step S611 with the authentication keyer device password input in step S612 and stores it in the storage unit (S614). .

8 is an operation flowchart illustrating a second authentication process in an image-based authentication system mobile communication terminal according to a second embodiment of the present invention, and FIG. 9 is a second image-based authentication system according to a second embodiment of the present invention. It is an operation flowchart showing the second authentication process in the authentication system.

8 and 9, the second authentication process through the mobile communication terminal and the second authentication system will be described.

The secondary authentication system checks whether the mobile communication terminal is registered in response to the received terminal entity information (S901) when the secondary authentication is requested while the terminal actual information is input from the online service system (S901).

If the mobile communication terminal is registered (S903), the secondary authentication system generates, stores and encrypts the access key (S904). In addition, the secondary authentication system activates the security authentication module of the mobile communication terminal by using the device token of the mobile communication terminal that is registered in the terminal entity that has successfully authenticated the first time, and issues a message for issuing an encrypted access key to the mobile communication terminal. To the push server.

When the push message is received from the push server (S801), the mobile communication terminal wakes up and activates the security authentication module (S802). When the encrypted access key is received (S803), the security authentication module of the mobile communication terminal decrypts the encrypted access key (S804), and requests the user to input the authentication key equipment password (S805). When the authentication keyer device password is input from the user (S806), the security authentication module decrypts the encrypted secondary authentication key stored in the storage unit into the authentication keyer device password (S807). The security authentication module accesses the secondary authentication system with the access key decrypted in step S804 and transmits the second authentication key decrypted in step S807 (S808). Thus, the secondary authentication system receives the access key and the secondary authentication key from the mobile communication terminal (S906). The secondary authentication system compares the access key received in step S906 with the access key issued in step S905 (S907). If the two access keys match as a result of the comparison in step S907, the secondary authentication system compares the secondary authentication key received in step S906 with the previously stored secondary authentication key (S908). If the result of the comparison of step S908 matches the two secondary authentication keys, the secondary authentication system approves the authentication (S909), and transmits the result to the online service system (S910).

On the other hand, if the two access keys do not match as a result of the comparison in step S907, or the two secondary authentication keys do not match as a result of the comparison in step S908, the secondary authentication system fails to authenticate (S911), and the result is sent to the online service system. Transmit (S910). On the other hand, if the mobile communication terminal is not registered in step S903, it is processed by an unregistered mobile communication terminal (S912), and the result of the processing is notified to the online service system (S910).

Claims

In the system for authenticating the end entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication,

A mobile communication terminal registration unit for registering end entity information necessary for secondary authentication and a mobile communication terminal matching the end entity information;

An authentication key generation unit for generating a second authentication key to be issued to the primary entity having completed primary authentication;

An authentication image generation unit for generating an authentication image corresponding to the generated second authentication key and displaying the authentication image on a computer device of the primary authenticated terminal entity through the online service system;

And an authentication key verifying unit for activating a mobile communication terminal registered in the primary authentication-completed end entity and then verifying a secondary authentication key received from the activated mobile communication terminal.
The terminal of claim 1, wherein the mobile communication terminal registration unit registers a device token of the mobile communication terminal that matches the terminal entity information, and the authentication key verification unit uses a device token of the mobile communication terminal that matches the terminal entity information. Activating the mobile communication terminal through a push server and communicating with the mobile communication terminal to receive the secondary authentication key from the mobile communication terminal.
The image-based authentication system of claim 1, wherein the authentication image is a two-dimensional barcode.
The image-based authentication system of claim 1, wherein the authentication image is an image including at least one of a picture, a letter, and a number corresponding to the two-dimensional authentication key.
2. The method of claim 1, wherein the access terminal issues an access key to a mobile communication terminal registered in the primary-authenticated terminal entity and compares the access key received from the mobile communication terminal with the issued access key to verify the mobile communication terminal. Image-based authentication system further comprises a key issuance / verification unit.
The image-based authentication system of claim 5, wherein the access key issuing / verifying unit encrypts the access key, issues it to the mobile communication terminal, and receives the decrypted access key from the mobile communication terminal.
In the method for authenticating an end entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication,

A mobile communication terminal registration step of registering, by the secondary authentication system, terminal entity information necessary for secondary authentication and a mobile communication terminal matching the terminal entity information;

An authentication key generation step of generating, by the second authentication system, a second authentication key to be issued to an end entity that has been first authenticated when the second authentication of the end entity is requested from the online service system;

An authentication image generation step of generating, by the secondary authentication system, an authentication image corresponding to the generated second authentication key and displaying the image on the computer device of the first authenticated end entity through the online service system;

And an authentication key verification step in which the secondary authentication system activates a mobile communication terminal registered in the primary authentication-completed end entity after the authentication image generation step and verifies a secondary authentication key received from the activated mobile communication terminal. Image-based authentication method characterized in that.
8. The method of claim 7, wherein the registering of the mobile communication terminal is a step of registering a device token of the mobile communication terminal that matches the terminal entity information, and wherein the authentication key verification step is a device of the mobile communication terminal that matches the terminal entity information. Activating the mobile communication terminal through a push server using a token and communicating with the mobile communication terminal to receive the secondary authentication key from the mobile communication terminal.
8. The method of claim 7, wherein the authentication image is a two-dimensional barcode.
The image-based authentication method of claim 7, wherein the authentication image is an image including at least one of a picture, a letter, and a number corresponding to the two-dimensional authentication key.
8. The method of claim 7, wherein the secondary authentication system issues an access key to a mobile communication terminal registered in the primary authentication-completed end entity during the authentication key generation step or the authentication key verification step, and the mobile communication terminal. And an access key issuing / verifying step for verifying the mobile communication terminal by comparing the access key received from the access key received from the access key.
The image-based authentication method of claim 11, wherein the issuing / verifying the access key encrypts the access key, issues it to the mobile communication terminal, and receives the decrypted access key from the mobile communication terminal.
In the system for authenticating the end entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication,

A mobile communication terminal registration unit for registering end entity information necessary for secondary authentication and a mobile communication terminal matching the end entity information;

An authentication image receiver configured to receive an authentication image through the mobile communication terminal registered in the mobile communication terminal registration unit;

An authentication key generation issue unit for generating and storing a second authentication key from the received authentication image and issuing and storing the secondary authentication key to the mobile communication terminal;

And an authentication key verification unit for activating the mobile communication terminal registered to the terminal entity having the primary authentication and receiving and verifying a second stored authentication key from the activated mobile communication terminal.
The terminal of claim 13, wherein the mobile communication terminal registration unit registers a device token of the mobile communication terminal that matches the terminal entity information, and the authentication key verification unit uses a device token of the mobile communication terminal that matches the terminal entity information. And activating the mobile communication terminal through a push server and communicating with the mobile communication terminal to receive the secondary authentication key from the mobile communication terminal.
15. The method of claim 13, wherein the access terminal issues an access key to a mobile communication terminal registered to the terminal entity that has been first authenticated, and compares the access key received from the mobile communication terminal with the issued access key to verify the mobile communication terminal. Image-based authentication system further comprises a key issuance / verification unit.
The image-based authentication system of claim 15, wherein the access key issuing / verifying unit encrypts the access key, issues it to the mobile communication terminal, and receives the decrypted access key from the mobile communication terminal.
In the method for authenticating an end entity including a computer device for performing the first authentication through communication with the online service system, and a mobile communication terminal for performing the second authentication,

A mobile communication terminal registration step of registering, by the secondary authentication system, terminal entity information necessary for secondary authentication and a mobile communication terminal matching the terminal entity information;

An authentication image receiving step of receiving, by the secondary authentication system, an authentication image through the mobile communication terminal registered in the mobile communication terminal registration unit;

An authentication key generation issuing step for the secondary authentication system to generate and store a secondary authentication key from the received authentication image and to issue and store the secondary authentication key to the mobile communication terminal;

When the second authentication of the end entity is requested from the on-line service system, the second authentication system activates a mobile communication terminal registered in the terminal entity for which primary authentication has been completed, and the second authentication key previously stored from the activated mobile communication terminal. Image-based authentication method comprising the authentication key verification step of receiving and verifying.
18. The apparatus of claim 17, wherein the registering of the mobile communication terminal registers a device token of the mobile communication terminal that matches the terminal entity information, and wherein the authentication key verification step comprises registering a device token of the mobile communication terminal that matches the terminal entity information. And activating the mobile communication terminal through a push server to communicate with the mobile communication terminal to receive the secondary authentication key from the mobile communication terminal.
18. The method of claim 17, wherein the secondary authentication system issues an access key to a mobile communication terminal registered in the primary authentication-completed end entity during the authentication key verification step, and receives an access key received from the mobile communication terminal. And an access key issuing / verifying step for verifying the mobile communication terminal by comparing the issued access key.
20. The method of claim 19, wherein the issuing / verifying the access key encrypts the access key and issues it to the mobile communication terminal, and receives the decrypted access key from the mobile communication terminal.