WO2012169752A2

WO2012169752A2 - Authentication system and method for device attempting connection

Info

Publication number: WO2012169752A2
Application number: PCT/KR2012/004388
Authority: WO
Inventors: 김영기; 원현식; 정명재; 유장선; 김인수
Original assignee: (주)잉카인터넷
Priority date: 2011-06-07
Filing date: 2012-06-04
Publication date: 2012-12-13
Also published as: KR101583698B1; KR20140043071A; WO2012169752A3

Abstract

The present invention relates to a system and a method for authenticating a device attempting connection in a PC environment or mobile environment which authenticate whether the device which is presently attempting connection to a web server is a registered device predetermined by a user. According to the present invention, the system for authenticating the device attempting connection, which is within a system for authenticating a device attempting connection while provided in a device connected to a user authentication server, includes: an information collection module which collects hardware environment and software environment information from the device; an authentication control module which performs a registration process for the device when a user requests device registration and performs a verification process for the device attempting connection with respect to the device of an online service request by the user; a first-round authentication eigenvalue production module which produces an eigenvalue for first-round authentication by combining at least two kinds of environment information collected by the information collection module according to an operating system provided in the device, and provides the first-round authentication eigenvalue for the authentication control module; and a second-round authentication eigenvalue production module which produces an eigenvalue for second-round authentication by combining at least two kinds of environment information collected by the information collection module, and provides the second-round authentication eigenvalue for the authentication control module.

Description

Authentication system and method for access attempt

The present invention relates to a system and method for authenticating a device attempting to access an online service. More specifically, the present invention relates to a registered device that a user attempts to access a web server in a PC environment or a mobile environment. A connection attempt device authentication system and method for authenticating authentication.

As the internet communication network is speeded up, various online services such as internet banking, online games, online shopping, etc. are activated using the internet communication network. In general, in order for a user to use the aforementioned online service, the user must pass login authentication by inputting personal authentication information (user ID and password) into a web server providing the online service. Even if you are a party user as well as an impersonator (a person who has obtained the party's personal authentication information), if you log into the web server using the party user's personal authentication information on a device such as a computer or mobile phone, You can use online service of party user provided by web server.

The impersonator may be a person who has stolen the personal authentication information of the party user in an illegal manner against the party user's intention. There are a growing number of victims of illegal use of online services of political party users by illegal hijackers who have stolen personal authentication information of political party users. Therefore, it is urgent to prepare supplementary security measures to block access to online services provided to party users even if a name thief steals user's personal authentication information.

As a complementary security countermeasure, a technology (hereinafter, referred to as a PC designated service technology) has been proposed in which an online service can be used only by a registered PC designated by a user.

Prior arts related to PC designation services include Korean Patent Publication No. 2010-125496 and Korean Patent Registration No. 1023793. These prior arts register a web server by associating a user's user ID with one or more pieces of computer information specified by the customer for online services (Internet banking). When any computer attempts to connect, the web server checks whether the computer attempting the connection is a computer that is pre-registered for the online service, and provides the online service to the computer only if the computer is a pre-registered computer.

In the case of the online game website, NCsoft first applied PC-specific services to the online game Massively Multiplayer Online Role Playing Game (MMORPG) Lineage series in September 2006, and other online game companies (NHN Han Games, Nexon, etc.) It is known that the PC designated service is in service or under service review. In addition, some bank websites provide PC-designated services for Internet banking websites. For example, in the case of a PC designated service applied to KB Kookmin Bank, a user may register up to 10 computers to use Internet banking. Financial transactions, such as transfer services, can be made through 10 registered computers that are registered in advance, but only inquiry services are possible on unregistered computers.

A brief description will be given of a PC specific service technology according to the above-mentioned prior arts. When a PC designation service is requested from a user and a new PC registration is requested, the web server calculates an authentication unique value from the hardware information of the requested PC and registers it with the user's personal authentication information (user ID) and registers it in advance. Thereafter, the web server calculates the authentication unique value of the connection attempt PC from the hardware information of the PC attempting to access the web server using the personal authentication information (user ID) of the user. Of course, it is preferable that the method of calculating the authentication unique value of the registered PC and the method of calculating the authentication unique value of the connection attempt PC are the same. Next, the web server compares the calculated authentication unique value of the access attempted PC with the authentication unique value of the registered PC matched with the user's personal authentication information, and determines whether to grant or reject the corresponding online service to the access attempted PC. .

These prior arts have the advantage that the web server checks the user's personal authentication information and checks whether the connection attempt PC is a pre-registered PC, and then grants the online service to the access attempt PC, thereby enhancing security compared to the prior art. have.

However, the authentication intrinsic value of the access attempted PC transmitted to the network can be easily hacked and tampered by hackers. Therefore, even if the impersonator attempts to access the web server using a non-registered PC instead of a registered user's PC, the unregistered PC The authentication unique value of may be modified into the authentication unique value of the registered PC. In this case, there is a problem that the web server does not recognize this and allows the user to use the online service on a connection attempt unregistered PC used by the name impersonator.

In addition, since the prior art calculates the authentication unique value of the PC from the same hardware information regardless of the system configuration state of the registration PC and the connection attempt PC, the authority of the user account of the CMOS setting of the PC or the operating system (OS). In some cases, some PCs may not be able to collect the information needed to calculate the unique value of authentication. However, if the authentication unique value (for example, the MAC address mainly used in the PC designated service of the website) is calculated based on the limited hardware information that all PCs have, the authentication unique value has a vulnerability that is easy to be tampered with. have. In addition, the conventional technology has a problem that the convenience of the user is reduced because the device registered by the user to access the web server is limited to the PC.

As such, the prior arts are difficult to apply to a variety of hardware devices (PCs, mobile phones, tablet PCs), multiplatform environments (Windows, Linux, Mac, iOS, Android, Windows Mobile, etc.) and multi-browser environments. In addition, because there are many security vulnerabilities, it is difficult to cope with current hacking technology and financial and online accidents.

An object of the present invention devised to solve the above-described problems of the related art is to first authenticate whether a connection attempt device is a registered device by itself, and to determine whether the web server is a registered device only for a first attempted connection attempt device. The present invention provides a system and a method for authenticating an attempted device for second authentication, and allowing a user to use an online service to an access attempted device in which both first and second authentications are successful.

In the connection attempt device authentication system according to the present invention for achieving the above object, in the connection attempt device authentication system installed in the device connected to the user authentication server,

An information collection module for collecting at least two environmental information of a hardware environment and a software environment installed in the device;

An authentication control module that performs a device registration procedure for the device when a user requests a device registration, and performs a device verification procedure for an attempt to access the device when the user requests an online service;

A first authentication unique value is calculated by combining at least two or more environmental information collected by the information collecting module according to the type of the device and the type of operating system installed in the device, and providing the authentication control module with the first authentication unique value. Contains modules,

The authentication control module stores the first authentication unique value for registration input from the first authentication unique value calculation module during the device registration procedure in a storage unit of the device and transmits the stored to the user authentication server. In the trial device verification procedure, the primary authentication unique value for verification inputted from the primary authentication unique value calculation module is compared with the primary authentication unique value for registration, and then verified and transmitted to the user authentication server. do.

In addition, the connection attempt device authentication method according to the present invention, in the connection attempt device authentication method of the connection attempt device authentication system installed in the device connected to the user authentication server,

A first step of identifying, by the access attempted device authentication system, a device type and an operating system of the access attempted device, when the verification of the attempted access device to the device is requested;

A second step of collecting, by the connection attempt device authentication system, at least two or more pieces of environment information among hardware and software environment information that can be collected for each device type and operating system of the connection attempt device;

A third step of the connection attempt device authentication system combining at least two or more environmental information from the connection attempt device to calculate a primary authentication unique value for verification;

A fourth step of the connection attempt device authentication system comparing the primary authentication unique value for verification and the registration primary authentication unique value stored in a storage unit of the connection attempt device;

If the verification first authentication unique value and the registration first authentication unique value are the same as the result of the comparison in the fourth step, the connection attempting device authentication system transmits the verification first authentication unique value to the user authentication server. The fifth step,

A sixth step of allowing the connection attempting device authentication system to provide an online service to the connection attempting device if authentication from the user authentication server is successful after the fifth step;

When the connection attempt device authentication system compares the fourth step with the verification first authentication unique value and the registration first authentication unique value, the authentication from the user authentication server fails after the fifth step. And a seventh step of blocking an online service to the access attempt device.

In addition, in the computer-readable recording medium according to the present invention, in a computer-readable recording medium for executing a device authentication method for connecting to a device connected to the user authentication server,

The connection attempt device authentication method may include: a first step of identifying, by the connection attempt device authentication system, a device type and an operating system of the connection attempt device when a request for verification of a connection attempt device for the device is requested;

As described above, according to the present invention, the registered device calculates the first authentication unique value and the second authentication unique value based on the software and / or hardware environment information, and performs the second authentication through the web server after the first authentication. Therefore, there is an effect that can enhance the security against network packet hacking. In addition, according to the present invention, since the authentication unique value is calculated by combining the information that can be collected according to the type of the registered device and the connection attempt device (PC, mobile phone, tablet PC) and the operating system (OS) installed in the device. For example, it is difficult to tamper with the authentication intrinsic value, thereby enhancing security.

1 is a block diagram showing a connection attempt device authentication system according to the present invention.

2 and 3 are flowcharts illustrating a method for authenticating a connection attempt device according to the present invention.

* Explanation of Codes *

110: computer user device 111: storage unit

112: communication unit 120: communication network

130: user authentication server 131: server database

140: connection attempt device authentication system 141: information collection module

142: second authentication unique value calculation module 143: second authentication unique value calculation module

144: authentication control module

Hereinafter, a system and method for authenticating a connection attempt according to the present invention will be described in detail with reference to the accompanying drawings.

The device 110 is connected to the user authentication server 130 through the communication network 120. The user authentication server 130 may be physically used together with a typical web server that provides various online services to the device 110. The user authentication server 130 is connected with the server database 131 and provides a device designation service to the device 110. The server database 131 stores authentication unique values for each registered device that are matched with user identification information (user ID) and designated by the user. When a plurality of registered devices are matched and stored in one user identification information, the server database 131 may also store unique identification names for each registered device. Here, the device designation service refers to a procedure in which a user designates or cancels an arbitrary device as a registered device for using an online service on the user authentication server 130, or a device that attempts to access a web server with an arbitrary user ID. And a procedure for verifying whether the registered device is based on the user ID.

The device 110 includes a connection attempt device authentication system 140 according to the present invention. The connection attempt device authentication system 140 is made of software, installed in the device 110, and executed using hardware equipment of the device 110. This software may be downloaded and installed on the device 110 through the user authentication server 130 or other software supply server. In order to use the online service (eg, electronic banking service, electronic bidding, online games, online sales, etc.) through the web server, the device 110 must install the access attempt device authentication system 140.

The connection attempt device authentication system 140 includes an information collection module 141, a first authentication unique value calculation module 142, a second authentication unique value calculation module 143, and an authentication control module 144. do.

The information collection module 141 collects hardware environment and software environment information installed in the device 110, which includes a hardware serial number, a universally unique ID (UUID), a hard disk serial number (HDD serial number), and a hard disk volume. Serial number (HDD volumn serial number), HDD model name (HDD model name), operating system (OS), OS installation ID (ID), and subscriber identification number (IMSI: Internatioal Mobile) stored on the Universal Subscriber Identity Module (USIM) card Subscriber Identity, Network Session Key, and International Mobile Equipment Identity (IMEI). The information collection module 141 is a type of device, whether it is a mobile phone, a PC, or a tablet PC, and whether the operating system (OS) installed in the device is Windows, Windows, Linux, iOS, Android, or Windows. Collect different environmental information depending on whether it is mobile.

The authentication control module 144 performs a device registration procedure and a connection attempt device verification procedure according to the present invention. In the specification of the present invention, even if the registration device and the connection attempt device are the same device, in the device registration procedure designated by the user as the registration device, the user attempts to connect to the web server and use the online service by naming it as the registration device. In the device verification procedure, it is called a connection attempt device.

In the device registration procedure, the authentication control module 144 converts the registration primary authentication unique value calculated by the primary authentication unique value calculation module 142 into a hash value and stores it as a file in the storage unit 111. Then, the storage unit 111 stores the first authentication unique value file and records the first authentication unique value file generation time. Next, the authentication control module 144 converts the second authentication unique value for registration calculated by the second authentication unique value calculation module 143 into a hash value and transmits the user authentication server through the communication unit 112 together with the user identification information. 130). In this case, the unique identification name for identifying the registered device may be transmitted together. Then, the user authentication server 130 stores the user identification information, the secondary authentication unique value for registration of the registered device, and the unique identification name in the server database 131. The second authentication unique value calculation module 143 may be omitted. In this case, the first authentication unique value for registration calculated by the first authentication unique value calculation module 142 may be used as the second authentication unique value for registration.

In the connection attempt device verification procedure, the authentication control module 144 converts the primary authentication unique value for verification calculated by the primary authentication unique value calculation module 142 into a hash value for registration stored as a file in the registration device registration procedure. The primary authentication is made as to whether the connection attempting device is a registered device compared with the primary authentication unique value. When the first authentication passes, the authentication control module 144 converts the second authentication unique value for verification calculated by the second authentication unique value calculation module 143 into a hash value to convert the communication unit 112 together with the user identification information. Transfer to the user authentication server 130 through. Then, the user authentication server 130 compares the received second authentication unique value for verification with the registration second authentication unique value stored in the server database 131 to secondly authenticate whether or not the connection attempting device is a registered device. When the second authentication unique value calculation module 143 is omitted, the first authentication unique value for verification and the second authentication unique value for verification are the same.

If the registration device and the connection attempt device are the same and the hardware and software environment has not changed, the first authentication unique value for registration and the first authentication unique value for verification are the same, the second authentication unique value for registration and second verification for verification are the same. Since the eigenvalues are the same, the connection attempting device can succeed in both the first authentication and the second authentication to use the online service. However, if the registration device and the connection attempt device are different, the primary authentication unique value (authentication unique value stored in the registered device) and the verification primary authentication unique value cannot be the same. Even if the first authentication passes, the second authentication unique value for registration (the authentication unique value stored in the user authentication server) and the second authentication unique value for verification (or the first authentication unique value for verification) are not the same. You will not be able to pass Secondary Authentication. If the attempted device does not succeed in the first or second authentication, the web server's online service cannot be used.

Since the authentication control module 144 combines various hardware environment and software environment information of the registration device and the connection attempt device to generate an authentication unique value, when the hardware or software of the registration device is changed (for example, replacing a hard disk or an operating system). Reinstallation, file change), and the authentication control module 144 determines that the registration device and the connection attempt device are not the same. In this case, the authentication control module 144 recognizes the registered device whose hardware and software environment has been changed as a new device, and guides the user to proceed with the new device registration procedure.

The first authentication unique value calculation module 142 performs first authentication using information that can be collected according to an operating system (OS) installed in the device among hardware and software environment information of the device 110 collected by the information collection module 141. Calculate the eigenvalues, convert them to hash values, and create them as files.

Here, the first authentication unique value is generated by combining different device identification information according to the type of device and the type of operating system installed in the device.

As a first embodiment, if the device is a computer and the operating system installed in the device is a Windows operating system (Windows OS), the primary authentication unique value calculation module 142 may identify the OS installation ID, hard disk serial number, file creation time, and user identification. The first authentication unique value is generated by combining information and the like. Here, the OS installation ID means a unique installation ID generated based on the product ID and hardware identifier information when installing the Windows OS.

On the other hand, as a second embodiment, if the device is a computer, the operating system installed in the device is a Linux operating system (Linux OS), the first authentication unique value calculation module 142 generates a UUID and HDD model name (HDD model name) The first authentication unique value is generated by combining time and user identification information. Here, the reason why the Linux operating system generates the first authentication unique value by combining the hard disk model names is that the Linux operating system cannot access the hard disk serial number information with general user authority. Finally, if the operating system installed in the device is a Mac operating system (Mac OS), the first authentication unique value is generated by combining the hardware serial number, the hard disk serial number, the creation time, and the user identification information.

As a third embodiment, a method of generating a primary authentication unique value when the device is a mobile phone will be described. In general, a mobile phone can be used by subscribing to a mobile carrier, and according to a communication protocol technology (W-CDMA or GSM) serviced by the mobile carrier, the mobile phone has a Universal Subscriber Identity Module (USIM) card or a Subscriber Identity Module (SIM) card. Is fitted. The USIM card or SIM card stores personal additional contents such as text messages, e-mails, phone books, etc. along with important information such as subscriber identification number (IMSI), network information, authentication information, and the like.

If the device is a mobile phone and the OS is Android, the first authentication unique value calculation module 142 is a subscriber identification number (IMSI), device unique number (IMEI), model number, firmware version, baseband version, kernel version, build number And the like to generate the first authentication unique value. If the device is a mobile phone and the OS is iOS, the first authentication unique value is generated by combining the subscriber identification number (IMSI), the device unique number (IMEI), the iOS version, and the integrated circuit card IDentifier (ICCID). If the device is a mobile phone and the OS is Windows Mobile, a first authentication unique value is generated by combining the subscriber identification number (IMSI), the device unique number (IMEI), and the like. Of course, the second authentication unique value calculation module 143 may also generate the second authentication unique value by extracting hardware information and / or software information from the device as described above.

Upon registration of the device, the primary authentication unique value calculation module 142 calculates the primary authentication unique value for registration based on the time (creation time) at which the primary authentication unique value file for registration is recorded in the storage and converts it into a hash value. In this case, the generation time of the primary authentication unique value file for registration is recorded. Subsequently, when verifying the access attempt device, the first authentication unique value calculation module 142 calculates a first authentication unique value for verification based on the file generation time information recorded in the storage unit and registers the first authentication unique value for registration. Compare. As a result, it is possible to prevent the primary authentication unique value file for registration from being copied and used in the access attempt device. That is, when the primary authentication unique value file for registration stored in the registration device is copied to the access attempt device, the generation time information used when calculating the primary authentication unique value for registration and the generation time recorded in the storage unit of the access attempt device Since the information is different, the primary authentication unique value for registration and the primary authentication unique value for verification are not the same when the access attempt device is verified.

The second authentication unique value calculation module 143 calculates the second authentication unique value based on hardware-specific hardware information of the hardware environment information of the device 110 collected by the information collection module 141. Of course, as described above, the second authentication unique value calculation module 143 may be omitted, and second authentication (communication between the device and the user authentication server using the first authentication unique value generated by the first authentication unique value calculation module) may be omitted. Can also be performed through authentication).

When a device registration system 140 requests a device registration for a current device from a user (S201), the connection attempt device authentication system 140 identifies a device type and an operating system type (S202), and collects hardware and / or software for each device type and operating system. Collect the environment (S203). Here, the hardware and / or software environment that can be collected for each operating system may be set in advance.

Then, the collected first authentication unique value for registration is calculated by combining the collected hardware and / or software environment information, generation time information, and user identification information (S204), and the first authentication unique value for registration is converted into a hash value. In addition, the primary authentication unique value file for registration is stored in the storage unit (S205). At this time, the storage unit records the generation time of the primary authentication unique value file for registration. Here, the generation time information combined to calculate the primary authentication unique value for registration means the generation time of the primary authentication unique value file for registration, so that the file is equal to the time recorded in the storage unit.

Next, the connection attempt device authentication system 140 calculates a second authentication unique value for registration from preset hardware and / or software environment information (S206), and calculates the calculated second authentication unique value for the user authentication server. It transmits (S207). Here, step S206 may be omitted, and the registration primary authentication unique value calculated in step S204 may be set as the registration secondary authentication unique value in step S207 and transmitted to the user authentication server. In this way, the second authentication unique value (which may be the same as or different from the first authentication unique value) of the registered device is registered in the user authentication server.

Next, when the user is requested to verify the access attempt device to access the online service by using any device (hereinafter, referred to as access attempt device) (S208), the access attempt device authentication system 140 determines the device type and operating system of the access attempt device. (S209), collect hardware and / or software environment that can be collected for each device type and operating system (S210). Then, the first authentication unique value for verification is calculated by combining the collected hardware and / or software environment information, the generation time information of the registration first authentication unique value file recorded in the storage unit, and the user identification information (S211). ), And compares the primary authentication unique value for verification with the primary authentication unique value for registration stored in the storage unit (S212).

If the primary authentication unique value for verification and the primary authentication unique value for registration are the same (S213), the secondary authentication unique value for verification is calculated (S214), and the secondary authentication unique value for verification is transmitted to the user authentication server. (S215). The step S214 may be omitted, and the verification first authentication unique value calculated in step S211 may be set as the verification second authentication unique value in step S215 and transmitted to the user authentication server. On the other hand, if the primary authentication unique value for verification and the primary authentication unique value for registration are not the same in step S213 (S213), the online service of the connection attempting device is blocked (S216), and the current connection attempting device is recognized as a new device. And the device registration for the new device guides (S217).

After the step S215, if the second authentication is successful from the user authentication server (S218), since the first and second authentications are successful, the access attempting device provides an online service to the access attempting device (S219). However, if the second authentication from the user authentication server fails (S218), the online service of the attempted device is blocked (S216), the current attempted device is recognized as a new device, and the device registration for the recognized new device is guided. (S217).

Claims

In the connection attempt device authentication system installed in the device connected to the user authentication server,

An information collection module for collecting at least two environmental information of a hardware environment and a software environment installed in the device;

An authentication control module that performs a device registration procedure for the device when a user requests a device registration, and performs a device verification procedure for an attempt to access the device when the user requests an online service;

A first authentication unique value is calculated by combining at least two or more environmental information collected by the information collecting module according to the type of the device and the type of operating system installed in the device, and providing the authentication control module with the first authentication unique value. Contains modules,

The authentication control module stores the first authentication unique value for registration input from the first authentication unique value calculation module during the device registration procedure in a storage unit of the device and transmits the stored to the user authentication server. In the trial device verification procedure, the primary authentication unique value for verification inputted from the primary authentication unique value calculation module is compared with the primary authentication unique value for registration, and then verified and transmitted to the user authentication server. Connection attempt device authentication system.
The method of claim 1, further comprising a second authentication unique value calculation module for calculating a second authentication unique value by combining at least two or more environmental information collected by the information collection module and providing it to the authentication control module,

The authentication control module transmits the second authentication unique value for registration input from the second authentication unique value calculation module to the user authentication server instead of the first authentication unique value for registration in the device registration procedure, and stores the stored information. Attempt to connect to the user authentication server to verify the second authentication unique value input from the second authentication unique value calculation module instead of the first authentication unique value for verification to the user authentication server during the device verification procedure Device authentication system.
The method of claim 1, wherein the first authentication unique value calculation module further combines a generation time in which the first authentication unique value for registration is generated as a file in the storage unit, and calculates the first authentication unique value for registration. Recording the generation time in a storage unit, and further combining the generation time recorded in the storage unit to calculate the verification first authentication unique value.
The system of claim 2, wherein the authentication control module further transmits a unique identification name together with the registration second authentication unique value and the verification second authentication unique value.
The method of claim 1, wherein the first authentication unique value calculation module is a first authentication unique value by combining environment information including an OS installation ID if the device is a computer and the operating system installed in the device is a Windows operating system. The attempted device authentication system, characterized in that for calculating.
The method of claim 1, wherein the first authentication unique value calculating module is configured to combine environmental information including a hard disk model name if the device is a computer and the operating system installed in the device is a Linux operating system. And attempting to calculate a primary authentication unique value.
The method of claim 1, wherein the first authentication unique value calculation module is a first authentication unique value by combining environmental information including a hardware serial number if the device is a computer and the operating system installed in the device is a Mac OS. The attempted device authentication system, characterized in that for calculating.
The method of claim 1, wherein the first authentication unique value calculation module calculates a first authentication unique value by combining environmental information including a subscriber identification number (IMSI) and a device unique number (IMEI) when the device is a mobile phone. Connection attempt device authentication system, characterized in that.
In the connection attempt device authentication method of the connection attempt device authentication system installed in the device connected to the user authentication server,

A first step of identifying, by the access attempted device authentication system, a device type and an operating system of the access attempted device, when the verification of the attempted access device to the device is requested;

A second step of collecting, by the connection attempt device authentication system, at least two or more pieces of environment information among hardware and software environment information that can be collected for each device type and operating system of the connection attempt device;

A third step of the connection attempt device authentication system combining at least two or more environmental information from the connection attempt device to calculate a primary authentication unique value for verification;

A fourth step of the connection attempt device authentication system comparing the primary authentication unique value for verification and the registration primary authentication unique value stored in a storage unit of the connection attempt device;

If the verification first authentication unique value and the registration first authentication unique value are the same as the result of the comparison in the fourth step, the connection attempting device authentication system transmits the verification first authentication unique value to the user authentication server. The fifth step,

A sixth step of allowing the connection attempting device authentication system to provide an online service to the connection attempting device if authentication from the user authentication server is successful after the fifth step;

When the connection attempt device authentication system compares the fourth step with the verification first authentication unique value and the registration first authentication unique value, the authentication from the user authentication server fails after the fifth step. And a seventh step of blocking an online service to the access attempting device.
10. The method of claim 9, wherein in the fifth step, if the verification primary authentication unique value and the registration primary authentication unique value are the same as the result of the comparison in the fourth step, the connection attempting device authentication system performs verification 2. Calculating a difference authentication unique value and transmitting the verification second authentication unique value to the user authentication server instead of the verification first authentication unique value.
10. The method of claim 9, wherein in the seventh step, the connection attempt device authentication system guides device registration for the connection attempt device.
The method of claim 9, further comprising: an eighth step of, when the registration device registration request for the device is requested before the first step, the connection attempt device authentication system to identify a device type and an operating system of the registered device;

A ninth step of the access attempting device authentication system collecting at least two or more pieces of environment information among hardware and software environment information that can be collected for each operating system of the registered device;

A tenth step in which the connection attempt device authentication system combines at least two or more pieces of environmental information collected according to a device type and an operating system of the registered device to calculate the first authentication unique value for registration;

An eleventh step of storing, by the connection attempting device authentication system, the first authentication unique value for registration in the storage unit;

And a twelfth step of the connection attempt device authentication system transmitting the registration first authentication unique value to the user authentication server.
13. The method of claim 12, wherein in the twelfth step, the connection attempting device authentication system calculates a second authentication unique value for registration and replaces the second authentication unique value for registration instead of the first authentication unique value for registration. And a connection attempt device authentication method, characterized in that it is transmitted to a server.
The method of claim 12, wherein the tenth step further calculates the first authentication unique value for registration by further combining a generation time at which the first authentication unique value for registration is generated as a file in the storage unit. And recording the generation time in the storage unit, and in the third step, further combining the generation time recorded in the storage unit to calculate the primary authentication unique value for verification.
The method of claim 12 or 13, wherein the fifth step and the twelfth step further transmit a unique identification name of the device to the user authentication server.
The method of claim 12, wherein the third step and the tenth step are performed when the device is a computer and the operating system installed in the device is a Windows operating system. And attempting to authenticate the connection attempt device.
13. The method of claim 12, wherein the third and tenth steps are combined with environment information including a hard disk model name if the device is a computer and the operating system installed in the device is a Linux operating system. And attempting to calculate a primary authentication unique value.
13. The method of claim 12, wherein the third step and the tenth step are performed by combining environmental information including a hardware serial number if the device is a computer and the operating system installed in the device is a Mac OS. And attempting to authenticate the connection attempt device.
The method of claim 12, wherein the third step and the tenth step, when the device is a mobile phone, calculates a first authentication unique value by combining environmental information including a subscriber identification number (IMSI) and a device unique number (IMEI). Connection attempt device authentication method characterized in that.
In a computer-readable recording medium for executing a device authentication method connected to a device connected to a user authentication server,

The connection attempt device authentication method may include: a first step of identifying, by the connection attempt device authentication system, a device type and an operating system of the connection attempt device when a request for verification of a connection attempt device for the device is requested;

A second step of collecting, by the connection attempt device authentication system, at least two or more pieces of environment information among hardware and software environment information that can be collected for each device type and operating system of the connection attempt device;

A third step of the connection attempt device authentication system combining at least two or more environmental information from the connection attempt device to calculate a primary authentication unique value for verification;

A fourth step of the connection attempt device authentication system comparing the primary authentication unique value for verification and the registration primary authentication unique value stored in a storage unit of the connection attempt device;

If the verification first authentication unique value and the registration first authentication unique value are the same as the result of the comparison in the fourth step, the connection attempting device authentication system transmits the verification first authentication unique value to the user authentication server. The fifth step,

A sixth step of allowing the connection attempting device authentication system to provide an online service to the connection attempting device if authentication from the user authentication server is successful after the fifth step;

When the connection attempt device authentication system compares the fourth step with the verification first authentication unique value and the registration first authentication unique value, the authentication from the user authentication server fails after the fifth step. And a seventh step of blocking the on-line service to the access attempting device.
The method of claim 20, further comprising: an eighth step of, when the registration device registration request for the device is requested before the first step, the connection attempt device authentication system to identify a device type and an operating system of the registered device;

A ninth step of the access attempting device authentication system collecting at least two or more pieces of environment information among hardware and software environment information that can be collected for each operating system of the registered device;

A tenth step in which the connection attempt device authentication system combines at least two or more pieces of environmental information collected according to a device type and an operating system of the registered device to calculate the first authentication unique value for registration;

An eleventh step of storing, by the connection attempting device authentication system, the first authentication unique value for registration in the storage unit;

And a twelfth step of transmitting, by the access attempting device authentication system, the unique primary authentication unique value for registration to the user authentication server.
The method of claim 21, wherein the tenth step further calculates the first authentication unique value for registration by further combining a generation time at which the first authentication unique value for registration is generated as a file in the storage unit. The generation time is recorded in the storage unit, and the third step further combines the generation time recorded in the storage unit to calculate the primary authentication unique value for verification. media.
21. The method of claim 20, wherein in the fifth step, if the verification first authentication unique value and the registration first authentication unique value are the same as the result of the comparison in the fourth step, the connection attempting device authentication system performs verification 2. And calculating a second authentication unique value and transmitting the second authentication unique value for verification to the user authentication server instead of the first authentication unique value for verification.
22. The method of claim 21, wherein in the twelfth step, the connection attempting device authentication system calculates a second authentication unique value for registration so that the second authentication unique value for registration is used instead of the first authentication unique value for registration. Computer-readable recording medium, characterized in that for transmitting to the server.