WO2013009120A2

WO2013009120A2 - Mobile communication terminal and apparatus and method for authenticating applications

Info

Publication number: WO2013009120A2
Application number: PCT/KR2012/005557
Authority: WO
Inventors: 류창화
Original assignee: (주)시루정보
Priority date: 2011-07-13
Filing date: 2012-07-13
Publication date: 2013-01-17
Also published as: WO2013009120A3

Abstract

The present invention relates to a mobile communication terminal and an apparatus and a method for authenticating applications, and more specifically to a mobile communication terminal and an apparatus and a method for authenticating applications which are driven in the mobile communication terminal. The apparatus for authenticating applications according to one embodiment of the present invention comprises: an authentication information generation unit for generating and storing authentication information requested from a web server; a communication unit for receiving the encoded authentication request information including the authentication information through the mobile communication terminal for receiving the authentication information outputted through the web server; a first channel authentication unit for decoding the encoded authentication request information and performing a first authentication process according the decoded state; and a second channel authentication unit for performing a second authentication process by comparing the authentication information included in the decoded authentication request information with the authentication information stored in the authentication information generation unit.

Description

Mobile communication terminal, application authentication apparatus and method

The present invention relates to a mobile communication terminal, an application authentication apparatus and a method, and more particularly, to a mobile communication terminal, an application authentication apparatus and a method for authentication of an application driven in a mobile communication terminal.

Recently, various mobile communication terminals using a mobile communication network have been released. These mobile communication terminals can access the Internet through various wireless communication protocols. In addition, mobile communication terminals have a platform capable of running various application programs.

Mobile phones have a built-in platform that can run mobile application programs such as WIPI and BREW. Smartphones also have various application program driving platforms such as iOS, Windows Mobile, and Android. These mobile applications are produced and distributed by service providers in various fields such as finance and games. In addition, a mobile application can be provided by a company or an individual who can program a service by easily creating and displaying it on the App Store.

With the recent popularization of smartphones, application service providers can easily create and distribute applications for mobile communication terminals, and users can easily download and provide mobile services. However, while there are good service providers, there are those who produce and distribute applications for mobile communication terminals for malicious purposes. These malicious applications cause a lot of social problems because they contain a virus or perform operations such as extracting user's personal information. In particular, applications that pretend as if they were produced by highly recognized companies have emerged. These applications can be used without a doubt by the user and provide financial information and personal information. Therefore, in order to protect well-intentioned users from malicious phishing applications, an authentication means that can verify whether a particular application is produced and distributed by a legitimate specific operator is required.

On the other hand, the application authentication system disclosed in Korean Patent Application Publication No. 2003-0043738 uses the application authentication information of a separate authentication module to perform authentication of an application downloaded to a downloading unit of a terminal to confirm whether or not to confirm or correct a source. Perform a check of whether or not.

However, Korean published patent KR 2003-0043738 authenticates an application by using application authentication information of an authentication module, and thus there is a problem in that corresponding authentication information is not synchronized in real time with respect to all rapidly increasing applications.

In order to solve the above-mentioned problems of the prior art, the present invention provides a mobile communication terminal, an application authentication apparatus and a method in which a user can directly check whether an application downloaded by a user is an authenticated application provided by a legitimate operator.

In addition, the present invention provides a mobile communication terminal, an application authentication apparatus and method for exchanging encryption keys for security at the time of authentication to more securely handle subsequent service interworking, thereby increasing application security.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood from the following description.

In order to achieve the above object, there is provided an application authentication apparatus according to an aspect of the present invention.

Application authentication apparatus according to an embodiment of the present invention is the authentication information generation unit for generating and storing the authentication information requested from the web server, the authentication information by the mobile communication terminal input the authentication information output by the web server And a communication unit for receiving the encrypted authentication request information, a first channel authentication unit for decrypting the encrypted authentication request information, and performing a first channel authentication according to whether or not the authentication information is included in the decrypted authentication request information. It may include a second channel authentication unit for performing a second channel authentication compared to the authentication information stored in the authentication information generation unit.

Provided is a mobile communication terminal according to an aspect of the present invention.

The mobile communication terminal according to an embodiment of the present invention is an input unit for inputting authentication information output from a web server, an authentication request information generation unit for generating authentication request information including the authentication information, and encryption for encrypting the authentication request information. And a communication unit for transmitting the encrypted authentication request information to the application authentication device and receiving first channel authentication result information from the application authentication device.

It provides an application authentication method according to an aspect of the present invention.

Application authentication method according to an embodiment of the present invention comprises the step of generating and storing the authentication information requested from the web server, including the authentication information by the mobile communication terminal input the authentication information output by the web server and encrypted Receiving the encrypted authentication request information, decrypting the encrypted authentication request information, performing first channel authentication according to whether the decryption is performed, and the authentication information included in the decrypted authentication request information is stored in the authentication information generation unit. And performing second channel authentication in comparison with the authentication information.

Application authentication method according to another embodiment of the present invention comprises the steps of inputting the authentication information output from the web server, generating authentication request information including the authentication information, encrypting the authentication request information and encrypted And transmitting the authentication request information to the application authentication apparatus and receiving first channel authentication result information from the application authentication apparatus.

Specific details for achieving the above object will be apparent with reference to the embodiments described below in detail with the accompanying drawings.

However, the present invention is not limited to the embodiments disclosed below, but may be configured in different forms, and the present embodiments are intended to complete the disclosure of the present invention and to provide general knowledge in the technical field to which the present invention belongs. It is provided to fully inform those who have the scope of the invention.

According to the above-described application authentication apparatus and method of the present invention, the user can directly check whether the downloaded application is an authorized application provided by a legitimate operator, thereby preventing the use of malicious applications in advance, exposing personally valuable information or illegal accounts. It can prevent accidents such as performing unwanted actions such as transfer and payment.

In addition, according to the application authentication apparatus and method of the present invention, by exchanging the encryption key for security at the time of application authentication, it is possible to more securely handle the subsequent service interworking to increase the security of the application.

1 is a view for explaining an application authentication system according to an embodiment of the present invention.

2 is a view for explaining a mobile communication terminal according to an embodiment of the present invention.

3 is a view for explaining an application authentication method in a mobile communication terminal according to an embodiment of the present invention.

4 is a view for explaining an application authentication apparatus according to an embodiment of the present invention.

5 is a view for explaining an application authentication method in the application authentication apparatus according to an embodiment of the present invention.

6 to 8 are call processing diagrams for explaining the application authentication method according to an embodiment of the present invention.

9 to 11 are exemplary views of an application authentication method according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

In addition, when a part is said to "include" a certain component, it means that it may further include other components, except to exclude other components unless specifically stated otherwise.

Hereinafter, with reference to the accompanying drawings, it will be described in detail for the practice of the present invention.

Referring to FIG. 1, an application authentication system includes a mobile communication terminal 100, a web server 200, an application authentication device 300, a key management system 400, and an application server 500.

When the mobile communication terminal 100 drives the downloaded application, the mobile communication terminal 100 inputs authentication information about the application output from the web server 200.

The mobile communication terminal 100 transmits the authentication request information including the authentication information to the application authentication apparatus 300, and receives the first channel authentication result information.

The mobile communication terminal 100 transmits the encrypted specialized information for the application service to the application server 500 and receives the corresponding specialized processing result information to perform the application service.

The web server 200 outputs authentication information received from the application authentication apparatus 300 to authenticate whether the application is an application provided by the same operator as the operator operating the web server 200.

The application authentication apparatus 300 generates and transmits authentication information to the web server 200 and performs first channel authentication and second channel authentication by using the encrypted authentication request information.

Here, the first channel authentication is mutual authentication by a predetermined encryption algorithm between the application and the application authentication device 300, and the second channel authentication compares whether the authentication information is authentication information generated by the application authentication device 300, To authenticate whether the application provided by the same operator as the operator operating the server 200.

The key management system 400 generates a key based on the public key and transmits the key identification information and the public key to the application authentication apparatus 300, and when the key identification information is transmitted from the application server 500, the corresponding private key. Read it and transmit it to the application server 500.

The application server 500 receives key identification information and encrypted specialized information from the mobile communication terminal 100.

The application server 500 receives a private key corresponding to the key identification information from the key management system 400, and decrypts the encrypted specialized information using the received private key to process the full text.

Thereafter, the application server 500 generates the professional processing result information and transmits the professional processing result information generated by the mobile communication terminal 100.

Referring to FIG. 2, the mobile communication terminal 100 includes an input unit 110, an authentication request information generating unit 120, an encryption unit 130, a communication unit 140, an output unit 150, and an application execution unit 160. And a storage unit 170.

The input unit 110 inputs authentication information output from the web server 200.

In this case, the input unit 110 may include, for example, a camera, a microphone, a button, a key, a touch sensor, and a proximity sensor that can be recognized through visual, auditory, tactile, and at least one sense to input authentication information. The apparatus may further include a short range communication module that the RF signal can recognize.

The authentication request information generation unit 120 generates authentication request information including authentication information.

The encryption unit 130 encrypts the generated authentication request information by using the application authentication device 300 and a preset encryption method.

In addition, the encryption unit 120 encrypts the full text related to the application service using the public key information received from the application authentication device 300.

The communication unit 140 transmits the encrypted authentication request information to the application authentication apparatus 300 and receives the first channel authentication result information from the application authentication apparatus 300.

In addition, the communication unit 140 may further receive the second channel authentication result information together with the first channel authentication result information.

In addition, the communication unit 140 may further receive key identification information and public key information together with the first channel authentication result information.

The communication unit 140 transmits the key identification information and the encrypted specialized information received together with the public key information to the application server 500.

The communication unit 140 receives the specialized processing result information processed by the application server 500.

The output unit 150 outputs first channel authentication result information.

In addition, the output unit 150 may output second channel authentication result information.

The application execution unit 160 sets and activates the application according to the authentication result, and performs the application service using the specialized processing result information received from the application server 500.

The storage unit 170 stores an authentication program, an encryption program, and an application program.

Referring to FIG. 3, in step S305, the mobile communication terminal 100 drives the downloaded application.

In step S310, the mobile communication terminal 100 inputs the authentication information output from the web server 200.

Here, the authentication information may be recognized through visual, auditory, tactile, and at least one sense, for example, at least one of barcode, QR code, image, voice, and braille, and at least one of RF signal. It may be a form.

The mobile communication terminal 100 may be input corresponding to the output of authentication information from the web server 200.

In step S315, the mobile communication terminal 100 generates authentication request information including authentication information and encrypts it.

Here, the authentication request information may include application identification information, mobile communication terminal 100 identification information, and authentication information.

In step S320, the mobile communication terminal 100 transmits the encrypted authentication request information to the application authentication device 300.

In step S325, the mobile communication terminal 100 receives the first channel authentication result information by the application authentication device 300.

Here, the first channel authentication result information is mutually authenticated result information by an encryption algorithm between the application and the application authentication apparatus 300.

In addition, the mobile communication terminal 100 may further receive the second channel authentication result information together with the first channel authentication result information.

In addition, the mobile communication terminal 100 may further receive key identification information and public key information together with the first channel authentication result information.

In operation S330, the mobile communication terminal 100 outputs first channel authentication result information.

In operation S335, the mobile communication terminal 100 may set and activate an application according to the authentication result.

In step S340, the mobile communication terminal 100 encrypts the full text related to the application service using the received public key information.

In step S345, the mobile communication terminal 100 transmits the key identification information and the encrypted specialized information received together with the public key information to the application server 500.

In operation S350, the mobile communication terminal 100 receives and outputs the specialized processing result information processed by the application server 500 to perform an application service.

Here, the specialized processing result information is decrypted by the application server 500 by using the private key information corresponding to the key identification information from the key management system 400, and the corresponding application service is performed and then moved. It is transmitted to the communication terminal 100.

4 is a view for explaining the application authentication apparatus 300 according to an embodiment of the present invention.

Referring to FIG. 4, the application authentication apparatus 300 includes an authentication information generation unit 310, a communication unit 320, a first channel authentication unit 330, and a second channel authentication unit 340.

The authentication information generation unit 310 generates the authentication information requested from the web server 200 and stores it.

The communication unit 320 transmits the generated authentication information to the web server 200 and receives the encrypted authentication request information including the authentication information from the mobile communication terminal 100 which inputs the authentication information.

The communication unit 320 transmits the first channel authentication result information performed using the authentication request information to the mobile communication terminal 100 and transmits the second channel authentication result information to the web server 200.

In addition, the communication unit 320 may further transmit the second channel authentication result information to the mobile communication terminal 100.

In addition, the communication unit 320 receives the key identification information and public key information to the key management system 400, and transmits to the mobile communication terminal (100).

The first channel authenticator 330 decrypts the authentication request information and performs first channel authentication according to whether or not the decryption is performed.

The second channel authenticator 340 performs second channel authentication by comparing whether the authentication information included in the decrypted authentication request information is the authentication information generated by the application authentication apparatus 300.

5 is a view for explaining an application authentication method in the application authentication apparatus 300 according to an embodiment of the present invention.

Referring to FIG. 5, in step S505, when the application authentication apparatus 300 receives the authentication information from the web server 200, the application authentication apparatus 300 generates and stores the authentication information.

In operation S510, the application authentication apparatus 300 transmits the generated authentication information to the web server 200.

Here, the authentication information may be inactivated after a preset time, for example, one minute from the time generated as the information generated by the application authentication apparatus 300.

In operation S515, the application authentication device 300 receives encrypted authentication request information from the mobile communication terminal 100.

In operation S520, the application authentication apparatus 300 decrypts authentication request information and performs first channel authentication.

In operation S525, the application authentication apparatus 300 compares whether the authentication information included in the authentication request information is authentication information generated by the application authentication apparatus 300 and performs second channel authentication.

Here, the second channel authentication is an application provided by the same operator as the operator operating the web server 200 via the application authentication device 300 in the web server 200 associated with the application in order to prevent the most applications. To authenticate the acknowledgment.

When the authentication information included in the authentication request information corresponds to the authentication information generated by requesting from the web server 200, the application authentication apparatus 300 may be provided by the same operator as the operator operating the web server 200. Judging by the application.

In operation S530, the application authentication device 300 requests the public key to the key management system 400.

In operation S535, the application authentication apparatus 300 transmits key identification information and public key information from the key management system 400.

In operation S540, the application authentication device 300 transmits first channel authentication result information to the mobile communication terminal 100.

The application authentication device 300 may further transmit key identification information and public key information together with the first channel authentication result information.

The application authentication device 300 may further transmit the second channel authentication result information along with the first channel authentication result information to the mobile communication terminal 100.

In operation S545, the application authentication apparatus 300 transmits second channel authentication result information to the web server 200.

6 to 7 are call processing diagrams for explaining an application authentication method according to an embodiment of the present invention.

Referring to FIG. 6, in step S605, the web server 200 requests authentication information from the application authentication apparatus 300 to perform authentication for an application.

In operation S610, when receiving the authentication information, the application authentication device 300 generates the authentication information and stores it.

In operation S615, the application authentication apparatus 300 transmits the generated authentication information to the web server 200.

In step S620, the web server 200 outputs the authentication information.

The authentication information may be in a form recognizable through visual, auditory, tactile and at least one sense, for example, at least one of barcode, QR code, image, voice, and braille, and at least one form of RF signal. Can be.

In step S625, the mobile communication terminal 100 drives the downloaded application.

When the mobile communication terminal 100 drives an application, a guide phrase for authenticating the application may be output, and access information for accessing the web server 200 may be output. When the web server 200 is connected through another communication terminal, the web server 200 may output the authentication information in step S620 described above.

In step S630, the mobile communication terminal 100 inputs the authentication information output from the web server 200.

The mobile communication terminal 100 may be input in correspondence with the output of the authentication information from the web server 200 described above.

In step S635, the mobile communication terminal 100 generates authentication request information including the authentication information and encrypts it.

Here, the authentication request information may include application identification information, mobile terminal identification information and authentication information.

In step S640, the mobile communication terminal 100 transmits the encrypted authentication request information to the application authentication device 300.

In operation S645, the application authentication device 300 decrypts the authentication request information and performs a first channel authentication.

When the application authentication apparatus 300 performs the authentication request more than a predetermined number of times by checking the mobile communication terminal identification information included in the authentication request information, the application authentication apparatus 300 may reject the authentication.

In operation S650, the application authentication apparatus 300 determines that the first channel authentication is performed when decrypting the authentication request information encrypted in a predetermined manner in the application.

Thereafter, in step S655, the application authentication device 300 compares whether the authentication information included in the authentication request information is the authentication information generated by the application authentication device 300 to perform the second channel authentication.

When the authentication information included in the authentication request information corresponds to the authentication information generated by requesting from the web server 200, the application authentication apparatus 300 may be provided by the same service provider as the operator operating the web server 200. Judging by the application.

Then, in step S660, the application authentication device 300 requests the public key to the key management system 400.

In operation S665, the key management system 400 generates a public key based key when the public key is requested from the application authentication apparatus 300.

In operation S670, the key management system 400 transmits the key identification information and the public key information to the application authentication device 300.

In operation S675, the application authentication device 300 transmits first channel authentication result information to the mobile communication terminal 100.

In operation S680, the application authentication apparatus 300 transmits second channel authentication result information to the web server 200.

In step S685, the mobile communication terminal 100 outputs first channel authentication result information.

In step S690, the web server 200 outputs the second channel authentication result information.

The user checks the first channel authentication result information and the second channel authentication result information output from the mobile communication terminal 100 and the web server 200, and provides an authentication provided by a valid operator by the application downloaded from the mobile communication terminal 100. It can be determined whether or not the application.

In operation S695, the mobile communication terminal 100 may set and activate an application according to an authentication result to perform an application service.

8 is a call processing diagram illustrating an application execution method according to an embodiment of the present invention.

In step S810, the mobile communication terminal 100 encrypts the full text related to the application service using the public key information received from the application authentication apparatus 300.

In operation S820, the mobile communication terminal 100 transmits the key identification information and the encrypted specialized information received together with the public key information to the application server 500.

In step S840 and S850, the application server 500 transmits the received key identification information to the key management system 400, and receives the private key information corresponding to the key identification information from the key management system 400.

In operation S860, the application server 500 decrypts the full text related to the received encrypted application service using the received private key information, and performs an application service corresponding to the full text.

In operation S870, the application server 500 transmits the text message processing result information that performs the application service corresponding to the text message to the mobile communication terminal 100.

In step S880, the mobile communication terminal 100 continues to provide an application service by receiving the specialized processing result information.

9 to 11 are exemplary views illustrating an application authentication method according to an embodiment of the present invention.

Referring to FIG. 9, when driving the downloaded application, the mobile communication terminal 100 outputs a guide phrase related to application authentication, and accesses the web server 200 for authentication through another communication terminal. The mobile communication terminal 100 inputs an authentication command to perform two-factor authentication for the application.

The other communication terminal connected to the web server 200 for authentication in S1010 outputs the authentication information for authenticating the application for the mobile communication terminal 100.

In S1020, the authentication information output from the web server 200 is input from the mobile communication terminal 100.

In S1110, the web server 200 uses the authentication information input from the mobile communication terminal 100 by the application authentication apparatus 300 to determine whether the application downloaded from the mobile communication terminal 100 is an authenticated application provided by a legitimate operator. The second channel authentication is determined, and the result information on the second channel authentication is output.

In S1120, the mobile communication terminal 100 performs first channel authentication whether the application is approved by the application authentication device 300, and outputs result information on the first channel authentication.

It is apparent to those skilled in the art that the mobile communication terminal 100 may receive and output the result information for the second channel authentication together with the result information for the first channel authentication.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

The scope of the present invention is shown by the following claims rather than the above description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

Claims

In the application authentication device,

Authentication information generation unit for generating and storing the authentication information requested from the web server;

A communication unit including the authentication information and receiving encrypted authentication request information by a mobile communication terminal which inputs the authentication information output by the web server;

A first channel authentication unit which decrypts the encrypted authentication request information and performs first channel authentication according to whether or not to decrypt the encrypted authentication request information; And

And a second channel authentication unit configured to perform second channel authentication by comparing the authentication information included in the decrypted authentication request information with the authentication information stored in the authentication information generation unit.
The method of claim 1,

The communication unit

And transmitting the first channel authentication result information to the mobile communication terminal and transmitting the second channel authentication result information to the web server.
The method of claim 1,

The communication unit

And at least one of the first channel authentication result information and the second channel authentication result information is transmitted to the mobile communication terminal.
The method of claim 1,

The authentication information generation unit

And the authentication information is deleted after a preset time from the generated time.
In the application authentication method executed in the application authentication device,

Generating and storing authentication information requested from a web server;

Receiving encrypted authentication request information including the authentication information by a mobile communication terminal which inputs the authentication information output by the web server;

Decrypting the encrypted authentication request information and performing first channel authentication according to whether to decrypt the information; And

And performing second channel authentication by comparing the authentication information included in the decrypted authentication request information with the authentication information stored in the authentication information generation unit.
The method of claim 5,

And transmitting at least one of first channel authentication result information and second channel authentication result information to the mobile communication terminal.
The method of claim 5,

And transmitting second channel authentication result information to the web server.
The method of claim 5,

Requesting a public key from a key management system and receiving key identification information and public key information;

Transmitting first channel authentication result information, the key identification information, and the public key information to the mobile communication terminal; And

Application authentication method comprising the step of transmitting the second channel authentication result information to the web server.
The method of claim 5,

The authentication request information includes an application identification information, mobile terminal identification information and authentication information authentication method.
In the mobile communication terminal,

An input unit for inputting authentication information output from a web server;

An authentication request information generation unit for generating authentication request information including the authentication information;

An encryption unit for encrypting the authentication request information; And

And a communication unit which transmits encrypted authentication request information to an application authentication device and receives at least one of first channel authentication result information and second channel authentication result information from the application authentication device.
The method of claim 10,

The input unit

A mobile communication terminal comprising at least one of a camera, a microphone, a button, a key, a touch sensor, a proximity sensor, and a short range communication module for inputting the authentication information.
The method of claim 10,

The communication unit further receives key identification information and public key information,

And the encryption unit encrypts a full text related to an application service using the public key information.
The method of claim 12,

The communication unit is a mobile communication terminal, characterized in that for transmitting the encrypted text to the application server, and receives the corresponding professional processing result information.
In the application authentication method executed in the mobile communication terminal,

Inputting authentication information output from a web server;

Generating authentication request information including the authentication information;

Encrypting the authentication request information; And

Transmitting the encrypted authentication request information to an application authentication device, and receiving at least one of first channel authentication result information and second channel authentication result information from the application authentication device.
The method of claim 14,

Further receiving the key identification information and public key information; And

And encrypting a full text related to an application service using the public key information.
The method of claim 15,

Transmitting the encrypted text to the application server, and receiving the corresponding text processing result information.