WO2016039568A1

WO2016039568A1 - Device and method for user authentication

Info

Publication number: WO2016039568A1
Application number: PCT/KR2015/009523
Authority: WO
Inventors: 임용훈
Original assignee: 임용훈
Priority date: 2014-09-11
Filing date: 2015-09-10
Publication date: 2016-03-17

Abstract

A device for performing authentication by communicating with an authentication server comprises: a device authentication key generation module for collecting intrinsic information of the device, and generating a device authentication key by using the intrinsic information; a program authentication key generation module for generating a secret hash value by applying a hash function to a password inputted from a user, generating a time stamp, and generating a program authentication key by using the secret hash value, the time stamp, and the device authentication key; a user authentication key generation module for generating a user authentication key by using a personal identification number inputted from the user and the secret hash value; and a management module for transmitting, to the authentication server, authentication information including user identification information inputted from the user, the device authentication key, the program authentication key, and the user authentication key.

Description

Apparatus and method for user authentication

TECHNICAL FIELD The present invention relates to user authentication, and more particularly, to an apparatus for user authentication that realizes dual security using a hash function.

The present application is filed on September 11, 2014, Korea Patent Application 2014-0120165, Korea Patent Application 2015-0052631, filed April 14, 2015, Korea Patent Application 2015-0064749, filed May 08, 2015 And claims based on Korean Patent Application No. 2015-0127141, filed on September 08, 2015, and all the contents disclosed in the specification and drawings of that application are incorporated in this application.

While communication networks around the world are interconnected and the exchange of information through the Internet is becoming more common, the search, storage, and extraction of information is becoming more and more active.However, the technique of recognizing users who use a specific server is still used. As such, dysfunction such as leakage of personal information, hacking of computer network, etc. is also a serious social problem. Representative hacking behaviors in Korea have mainly been simple intrusions, user ID information theft, data truncation, data tampering and destruction, and foreign hacking conditions are more serious than in Korea.

In the conventional general user authentication scheme, if a user provides his or her ID and password to the server side, the server stores a hash function for all the user's passwords. Takes a value, compares the two values, and verifies that the user is a legitimate user. For reference, a hash function is a function that can be calculated quickly and easily in one direction, but cannot be calculated in the reverse direction.

However, such a conventional user authentication technique may expose personal information when the user identification information and the password are exposed, and thus, the security is weak, and personal information may also be leaked when the authentication program is copied or used. There is this. In addition, there is a problem that security is weak due to one-dimensional authentication by ID and password.

The present invention has been proposed to solve the above problems, and an object thereof is to provide a user authentication method and a device for preventing the duplication of the authentication program and strengthening the security by using a double safety means.

An apparatus for performing authentication by communicating with an authentication server according to an aspect of the present invention for achieving the above object, a device authentication key generation module for collecting the unique information of the device and generating a device authentication key using the unique information ; A program authentication key for generating a secret hash value by applying a hash function to a secret divisor input from a user, generating a time stamp, and generating a program authentication key using the secret hash value, the time stamp, and the device authentication key. Generation module; A user authentication key generation module for generating a user authentication key using a personal password input from a user and the secret hash value; And a management module for transmitting authentication information including the user identification information, the device authentication key, the program authentication key, and the user authentication key input from the user to the authentication server.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for performing authentication by communicating with a user device comprises: a subscription information management module for receiving and storing subscription information including user identification information from the user device; An authentication information management module for receiving and storing authentication information including user identification information, device authentication key, program authentication key, and user authentication key from the user device; And upon receipt of an approval request from an approval requester, transmits a notification message to the user device, and receives user identification information, a device authentication key, a program authentication key, and a user authentication key from the user device in response thereto. And an authentication processing module which compares the usage information with each other and transmits an approval response to the approval requester if all the information is matched.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for authenticating a user by communicating with a server generates a secret hash value by inputting a secret divisor input from the user into a hash function as a seed value. A secret hash value generation module for storing and registering the secret hash value with the server; A one-time secret password input module for receiving a one-time secret password; And generating a user authentication key by inputting the one-time secret password and the secret hash value received from the one-time secret password input module into the hash function as a seed value, and transmitting the user authentication key to the server. And a user authentication key generation module for receiving a comparison result of the user authentication key generated at the server from the server, wherein the user authentication key generated at the server is generated at the server and a secret hash value registered at the server. Generated by entering a one-time secret password into the hash function as a seed value.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for authenticating a user by communicating with a user apparatus includes a secret hash value generated by inputting a secret divisor input from a user into a hash function as a seed value; A secret hash value registration module for receiving and registering from the user device; A one time secret password generation module for generating a one time secret password; And receiving the user authentication key from the user device, comparing the received user authentication key with the user authentication key generated by inputting the registered secret hash value and the generated one-time secret password as a seed value to a hash function. And an authentication processing module for authenticating the user.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for communicating with an authentication server comprises: at least one processor; Memory; And a program stored in the memory and configured to be executed by the one or more processors, wherein the program generates a secret hash value by inputting a secret divisor input from a user into a hash function as a seed value. A secret hash value generation module for storing and transmitting the secret hash value to the authentication server; A user authentication key generation module for generating a user authentication key by inputting a personal password inputted from a user and the secret hash value into a hash function as a seed value, and transmitting and registering the user authentication key to the authentication server; A one-time secret password input module for receiving a one-time secret password issued by the authentication server; And generating a one-time authentication key by inputting the one-time secret password and the user authentication key inputted from the one-time secret password input module as a seed value to a hash function and transmitting the one-time authentication key to the authentication server. And a one-time authentication key generation module configured to receive a comparison result of the key and the one-time authentication key generated by the authentication server from the authentication server.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for communicating with a user device comprises: at least one processor; Memory; And a program stored in the memory and configured to be executed by the one or more processors, wherein the program includes a secret hash value generated by inputting a secret divisor input from a user into a hash function as a seed value. A secret hash value registration module for receiving and registering from the user device; A user authentication key registration module for receiving and registering a user authentication key generated by inputting a user's personal password and the secret hash value into a hash function as a seed value from the user device; A one-time secret password generation module for generating a one-time secret password and transmitting it to the user; And receiving the one-time authentication key from the user device, comparing the received one-time authentication key with the one-time authentication key generated by inputting the registered user authentication key and the one-time secret password into a hash function as a seed value. It includes a; one-time authentication key comparison module for transmitting a comparison result to the user device.

In accordance with another aspect of the present invention for achieving the above object, an apparatus for communicating with a master server and a service server, one or more processors; Memory; And a master program and a service program stored in the memory and configured to be executed by the one or more processors, wherein the master program includes a plurality of different service secret hashes using different service secret divisors input from a user. A value is generated and stored, and the service program generates a service user authentication key using a selected service secret hash value among the plurality of service secret hash values and a personal password, and uses the service user authentication key as authentication information. The master program transfers and registers the unique code received from the service program to the selected service secret hash value among the plurality of service secret hash values.

In the present invention, when the authentication program is copied and executed, the device authentication key is different so that the authentication program is automatically deleted, thereby preventing the copy of the authentication program.

In addition, the present invention enhances security by receiving a secret divisor and a personal password from the user and generating a program authentication key and a user authentication key, respectively, and performing double authentication for use in authentication.

In addition, according to the present invention, authentication information can be registered differently for a plurality of authentication servers, thereby preventing a series of security incidents.

1 is a view showing an authentication system according to an embodiment of the present invention.

2 is a diagram illustrating a configuration of a user terminal of FIG. 1.

3 is a diagram illustrating a configuration of an authentication program according to an embodiment of the present invention.

4 is a diagram illustrating a configuration of the authentication server of FIG. 1.

5 is a flowchart illustrating a method of generating a device authentication key in a user terminal according to an embodiment of the present invention.

6 is a flowchart illustrating a method of generating a program authentication key according to an embodiment of the present invention.

7 is a flowchart illustrating a server registration process of authentication information according to an embodiment of the present invention.

8 and 9 are flowcharts illustrating a process of registering information for authentication when a terminal is changed according to an embodiment of the present invention.

10 is a flowchart illustrating a process of changing a user authentication key according to an embodiment of the present invention.

11 is a flowchart illustrating a process of changing a secret divisor according to an embodiment of the present invention.

12 and 13 are flowcharts illustrating an online shopping process according to an embodiment of the present invention.

14 is a diagram showing the configuration of an authentication program according to another embodiment of the present invention.

15 is a diagram showing the configuration of an authentication server according to another embodiment of the present invention.

16 is a flowchart illustrating an authentication method using OTP according to the present invention.

17 is a view showing the configuration of a one-time secret password input module according to an embodiment of the present invention.

18 illustrates candidate images according to an embodiment of the present invention.

19 illustrates a circle interface according to an embodiment of the present invention.

20 illustrates three circle interfaces according to an embodiment of the present invention.

21 is a diagram showing the configuration of an authentication program according to another embodiment of the present invention.

22 is a diagram illustrating an authentication system according to another embodiment of the present invention.

23 is a diagram showing the configuration of an authentication program according to another embodiment of the present invention.

24 is a diagram illustrating a configuration of the authentication server of FIG. 22.

25 is a flowchart illustrating a method for authenticating a user when a user registers with a service server according to an embodiment of the present invention.

26 is a diagram illustrating an authentication system according to another embodiment of the present invention.

27 is a flowchart illustrating a process of registering a service secret hash value according to an embodiment of the present invention.

28 is a flowchart illustrating a process of setting authentication information for a specific service server according to an embodiment of the present invention.

29 is a flowchart illustrating a process of logging in to a service server after the setting process of FIG. 28.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing an authentication system according to an embodiment of the present invention, Figure 2 is a view showing the configuration of a user terminal of FIG.

As shown in FIG. 1, the authentication system according to the present embodiment includes a user terminal 100, an authentication server 200, and a communication network 300 connecting the user terminal 100 and the authentication server 200. Include.

The user terminal 100 installs an authentication program and generates a user authentication key, a device authentication key, and a program authentication key using a hash algorithm through the authentication program, and transmits it to the authentication server 220 as authentication information. do.

In this embodiment, only one authentication server 200 is illustrated and described, but there may be a plurality of authentication servers 200, and a user may use the user authentication key, device authentication key, and program authentication key for each authentication server 200. Can be created and registered. Here, the authentication server 200 may be a server of a bank, a card company, a communication company or a general portal site, or may be a server of a payment agency service (PG) company.

The user terminal 100 may be a mobile communication terminal such as a smartphone or a personal computer. As shown in FIG. 2, the user terminal 100 includes a memory 110, a memory controller 121, one or more processors (CPUs) 122, a peripheral interface 123, and an input / output (I / O) subsystem. 130, a display device 141, an input device 142, and an RF circuit 152. These components communicate via one or more communication buses or signal lines. The various components shown in FIG. 2 may be implemented in hardware, software or a combination of both hardware and software, including one or more signal processing and / or application specific integrated circuits.

The memory 110 may include fast random access memory, and may also include one or more magnetic disk storage devices, nonvolatile memory such as flash memory devices, or other nonvolatile semiconductor memory devices. In some embodiments, memory 110 is a storage device located remote from one or more processors 122, such as RF circuitry 152, the Internet, an intranet, a local area network (LAN), and a wide area network (WLAN). It may further comprise a network attached storage device accessed through a communication network (not shown), such as a storage area network (SAN), or the like, or a suitable combination thereof. Access to memory 110 by other components of user terminal 100, such as processor 122 and peripheral interface 123, may be controlled by memory controller 121.

The peripheral interface 123 connects the input / output peripheral device of the user terminal 100 with the processor 122 and the memory 110. One or more processors 122 execute a set of instructions stored in various software programs and / or memory 110 to perform various functions for the device 100 and to process data.

In some embodiments, peripheral interface 123, processor 122, and memory controller 121 may be implemented on a single chip, such as chip 120. In some other embodiments, they may be implemented in separate chips.

The I / O subsystem 130 provides an interface between the input / output peripheral of the user terminal 100, such as the display device 141, the input device 142, and the peripheral interface 123.

The display device 141 may use a liquid crystal display (LCD) technology or a light emitting polymer display (LPD) technology. The display device 141 may be a capacitive, resistive, or infrared touch display. The touch display provides an output interface and an input interface between the terminal and the user. The touch display presents visual output to the user. The visual output may include text, graphics, video, and combinations thereof. Some or all of the visual output may correspond to user interface objects. The touch display forms a touch sensitive surface that accepts user input.

The processor 122 is a processor configured to perform operations associated with the user terminal 100 and to perform instructions, for example, input and output between components of the user terminal 100 using instructions retrieved from the memory 110. Receive and manipulate data can be controlled.

In some embodiments, the software component has an operating system 111, a graphics module (instruction set) 112, and an authentication program (instruction set) 113 mounted (installed) in the memory 110.

The operating system 111 may be, for example, a built-in operating system such as Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, etc., and may be a general system task (eg, memory). Management, storage device control, power management, etc.) and various software components and / or devices that facilitate and manage communication between the various hardware and software components.

Graphics module 112 includes various well-known software components for presenting and displaying graphics on display device 141. The term "graphics" refers to any object that can be displayed to the user, including, without limitation, text, web pages, icons (eg, user interface objects including soft keys), digital images, videos, animations, and the like. Include.

The RF circuit 152 transmits and receives electromagnetic waves. The RF circuit 152 converts an electrical signal into an electromagnetic wave and vice versa, and communicates with a communication network, another mobile gateway, and a communication device through the electromagnetic wave. RF circuitry 152 includes, but is not limited to, for example, antenna systems, RF transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, CODEC chipsets, subscriber identity module (SIM) cards, memory, and the like. It may include known circuitry for performing this function, which is not limited. RF circuitry 152 may comprise the Internet, called the World Wide Web (WWW), intranets and networks, and / or wireless networks such as cellular telephone networks, wireless LANs, and / or metropolitan area networks (MAN), and near field wireless. Communication can be made with other devices. Wireless communications include Global System for Mobile Communication (GSM), Enhanced Data GSM Environment (EDGE), wideband code division multiple access (WCDMA), code division multiple access (CDMA), time division multiple access (TDMA), and voice over Internet Protocol, Wi-MAX, Bluetooth, zigbee, Near Field Communication (NFC), or any other suitable communication protocol including communication protocols not yet developed at the time of filing of this application. Any of a plurality of communication standards, protocols, and technologies that are not limited thereto may be used.

The authentication program 113 may be downloaded and installed from the authentication server 200 or may be downloaded and installed from an app store such as Google Play or Apple Market. The authentication program 113 generates a device authentication key, a program authentication key, and a user authentication key when executed by the user after the initial installation, and transmits them to the authentication server 200 for registration. Then, when the authentication program 113 performs a transaction such as login, financial transaction, or electronic commerce, the authentication program 113 generates a device authentication key, a program authentication key, and a user authentication key and transmits the generated authentication key to the authentication server 200 to perform an authentication process. This will be described in detail with reference to FIG. 3.

As shown in FIG. 3, the authentication program 113 according to the present embodiment includes a device authentication key generation module 210, a program authentication key generation module 230, a user authentication key generation module 250, and a management module 270. ).

The device authentication key generation module 210 collects unique information of the user terminal 100, for example, a MAC address of a network interface card (NIC), a universally unique identifier (UUID), and the like, when the authentication program 113 is first executed. The device authentication key is generated using the collected unique information. Specifically, the device authentication key management module 210 stores a value generated by inputting unique information of the user terminal 100 into a hash function, as a device authentication key.

The device authentication key generation module 210 generates a device authentication key every time the authentication program 113 is executed and compares the device authentication key with the previously stored device authentication key. The device authentication key generation module 210 automatically deletes the authentication program 113 when the device authentication key does not match as a result of the comparison. For example, when the authentication program 113 installed in the user terminal 100 is duplicated and transferred to another device and executed, the previously stored device authentication key and the device authentication key generated at the time of execution do not coincide with each other. The authentication program 113 duplicated in the device is automatically deleted.

The program authentication key generation module 230 generates and stores a program authentication key using a device authentication key, a time stamp, and a secret hash value generated by the device authentication key generation module 210. The program authentication key may be stored in the authentication program 113 as a binary file. In this case, the time stamp is a string indicating a time point at which a program authentication key is generated. The secret hash value is a value generated by inputting a secret divisor input from a user into a hash function.

In detail, the program authentication key generation module 230 receives a secret divisor from a user through an input device. The secret divisor may be any one of a long string, an image file, a sound file, or a video file. The program authentication key generation module 230 sets a result of inputting the secret divisor into a hash function as the secret hash value. The secret hash value may be stored in the authentication program 113 as a binary file.

The user authentication key generation module 250 generates a user authentication key using the secret hash value generated by the program authentication key generation module 230 and a personal password input from the user through an input device. Specifically, the user authentication key generation module 250 uses the secret hash value and the input personal password as a hash authentication function as the user authentication key.

The personal password may be, for example, a six digit number. However, the present invention is not limited thereto and may be a combination of numbers and letters. Compared with the secret divisor input from the user at the time of generating the program authentication key, the secret divisor is a long string, an image file, or the like, and the personal password input from the user at the time of generating the user authentication key is a certain number of digits. The personal password may be set differently for each authentication server 200 when there are a plurality of authentication servers 200.

In the above description, although the device authentication key and the program authentication key has been described as being stored in the authentication program 113, the user authentication key is not stored in the authentication program 113, but is transmitted and stored only in the authentication server 200. desirable.

The management module 270 controls operations of the device authentication key generation module 210, the program authentication key generation module 230, and the user authentication key generation module 250 according to a user's input through an input device. The management module 270 manages the registration of the information of the authentication server 200 in the authentication program 113, manages the membership of the user with the authentication server 200, and also the authentication of the generated authentication keys. Manage registration and change to the server 200.

In detail, the management module 270 receives and stores the address and profile information of the authentication server 200 from a user through an input device. Here, the profile information is a nickname of the authentication server 200, so that the user can easily manage and select the authentication server 200 in the authentication program 200.

The management module 270 opens a member registration page when the user does not become a member in the authentication server 200 and enters personal information of the user, for example, ID, name, date of birth, gender, etc. The personal information of the transmission to the authentication server 200 to register.

In addition, the management module 270 transmits the device authentication key, the program authentication key, the user authentication key, and the ID registered by the user at the time of membership registration to the authentication server 200 as authentication information. In this case, the management module 270 transmits the authentication information to the authentication server 200 before registering and using the one-time password issued by the operator operating the authentication certificate or the operator operating the authentication server 200. You can authenticate.

When the management module 270 receives an input regarding a change of the user terminal 100 from a user through an input device, the device authentication key generation module 210, the program authentication key generation module 230, and the user authentication. The key generation module 250 is controlled to generate a device authentication key, a program authentication key, and a user authentication key for use in the user terminal after the change, and the generated device authentication key, program authentication key, and user authentication key and inputted from the user. The device change request including the ID is transmitted to the authentication server 200 and registered.

At this time, since the user terminal is changed, the device authentication key and the program authentication key is different from the device authentication key and the program authentication key generated in the previous user terminal, the user authentication key is the same. That is, since the unique information of the user terminal is changed, the device authentication key is changed, and since the time stamp is changed, the program authentication key is changed. However, since the personal password and secret divisor entered by the user are the same, the user authentication key is the same.

The change of the user terminal 100 may be performed for each of the plurality of authentication servers 200.

In addition, the management module 270 may receive an input regarding a change of a personal password for a specific authentication server from a user through an input device. The management module 270 controls the user authentication key generation module 250 to generate a new user authentication key, and inputs a new user authentication key, a previous user authentication key, a device authentication key, a program authentication key, and a user. The personal password change request including the generated ID is transmitted to the specific authentication server.

In addition, the management module 270 may receive an input regarding a change of the secret divisor for the specific authentication server from the user through the input device. The management module 270 controls the program authentication key generation module 230 and the user authentication key generation module 250 to generate a new program authentication key and a new user authentication key. A secret divisor change request including a user authentication key, a previous program authentication key, a previous user authentication key, a device authentication key, and an ID input from a user is transmitted to the authentication server 200.

The management module 270 supports the user to register the authentication information for each individual authentication server. That is, the device authentication key is registered the same for all authentication servers, but the program authentication key and the user authentication key may be different for each authentication server. In order to change the program authentication key and the user authentication key for each authentication server, the secret divisor may be different for each authentication server with the same personal password, or the personal password may be different for each authentication server with the same secret divisor. Also, the time stamp of the program authentication key for each authentication server is different. Alternatively, the program authentication key may be the same and the user authentication key may be different. In this case, the secret divisor must be the same and the personal passwords must be different. The management module 270 provides a selection interface and controls each module so that a program authentication key and a user authentication key can be registered differently for each authentication server.

4 is a diagram illustrating a configuration of the authentication server of FIG. 1. As illustrated in FIG. 4, the authentication server 200 includes a program transmission module 310, a subscription information management module 320, and an authentication information management module 330. ) And an authentication processing module 340. Authentication server 200 comprises a memory, a memory controller, one or more processors (CPUs), peripheral interfaces, input / output (I / O) subsystems, and RF circuitry. These components communicate via one or more communication buses or signal lines. Such components may be implemented in hardware, software or a combination of both hardware and software, including one or more signal processing and / or application specific integrated circuits.

The memory may include fast random access memory, and may also include one or more magnetic disk storage devices, nonvolatile memory such as flash memory devices, or other nonvolatile semiconductor memory devices. In some embodiments, the memory may include storage devices located remotely from one or more processors. Access to memory by other components such as processors and peripheral interfaces may be controlled by the memory controller.

The peripheral interface connects the input and output peripherals with the processor and memory. One or more processors execute various sets of software programs and / or instructions stored in memory to perform various functions and process data for the authentication server 200.

The I / O subsystem provides the interface between the input and output peripherals and the peripheral interface.

The processor is a processor configured to perform operations associated with the authentication server 200 and to perform instructions, for example, using instructions retrieved from a memory, to receive and manipulate input and output data between components of the authentication server 200. Can be controlled. In some embodiments, the software component is an operating system, graphics module (instruction set) is mounted (installed) in the memory.

The operating system may be, for example, a built-in operating system such as Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, etc., and may be a general system task (e.g., memory management, storage Various software components and / or devices that control and manage device control, power management, etc.), and facilitate communication between various hardware and software components.

The program transmission module 310 transmits an authentication program to the user terminal 100 at the request of the user terminal 100.

The subscription information management module 320 receives and stores personal information of the user from the user terminal 100, for example, personal information such as ID, name, date of birth, and gender.

The authentication information management module 330 receives an ID, a device authentication key, a program authentication key, and a user authentication key of the user from the user terminal 100, and authenticates the device based on the identification information of the user, that is, the ID of the user. The key, program authentication key, and user authentication key are stored as authentication information.

When changing the user user terminal 100, the authentication information management module 330 receives a device change request including a device authentication key, a program authentication key, a user authentication key, and an ID of a user to be used in the user terminal after the change. can do. The authentication information management module 330 searches for authentication information previously stored and registered by using the user ID included in the device change request. The authentication information management module 330 compares the user authentication key among the retrieved authentication information with the user authentication key included in the device change request, and if it matches, the device authentication key and the program authentication key of the corresponding user, which are previously stored. To a device authentication key and a program authentication key included in the device change request, and transmits a completion response to the user terminal 110.

In addition, the authentication information management module 330 may receive a personal password change request including a new user authentication key, a previous user authentication key, a device authentication key, a program authentication key, and a user ID from the user terminal 100. . The authentication information management module 330 searches for authentication information previously stored and registered using the user ID included in the personal password change request. The authentication information management module 330 compares the retrieved authentication information with the previous user authentication key, device authentication key, and program authentication key included in the personal password change request, and matches the previously stored user authentication key. The new user authentication key included in the personal password change request is modified, and the completion response is transmitted to the user terminal 110.

In addition, the authentication information management module 330 may request a secret divisor change request including a new program authentication key, a new user authentication key, a previous program authentication key, a previous user authentication key, a device authentication key, and a user ID. Can be received from. The authentication information management module 330 searches for authentication information previously stored and registered using the user ID included in the secret divisor change request. The authentication information management module 330 compares the retrieved authentication information with the previous user authentication key, the previous program authentication key, and the device authentication key included in the secret divisor change request, and if all matched, the previously stored user authentication key and The program authentication key is modified with the new user authentication key and the new program authentication key included in the secret divisor change request, and the completion response is transmitted to the user terminal 110.

When a payment approval request including a user ID is received from an online shopping mall, the authentication processing module 340 identifies the user using the user ID and pushes a notification message to the user terminal 100. The authentication processing module 340 receives a payment approval request including a user ID, a device authentication key, a program authentication key, and a user authentication key from the user terminal, and is stored in advance using a user ID included in the payment approval request. The device authentication key, the program authentication key, and the user authentication key are searched and compared with the information included in the payment approval request. The authentication processing module 340 approves the normal payment processing when all comparison results match. In this case, the authentication processing module 340 may receive payment means information from the user terminal 100 and perform payment processing using the payment means information. The authentication processing module 340 transmits the payment approval response to the seller such as an online shopping mall and to the user terminal 100.

Referring to FIG. 5, the user terminal 100 accesses the authentication server 200 through the communication network 300 and downloads the authentication program (S401). The user terminal 100 executes the authentication program according to the user's input (S403), and the authentication program checks whether the device authentication key is stored (S405). When the device authentication key is stored, the process of FIG. 5 is performed. 5 will be described later.

If the device authentication key is not stored, the authentication program collects unique information of the user terminal 100, for example, the MAC address or UUID of the network interface card (S407). The authentication program generates and stores a device authentication key using the unique information (S409, S411). The authentication program sets the value generated by inputting the unique information into the hash function as the device authentication key.

Subsequently, the authentication program automatically executes again (S413), and displays a pop-up window asking the user whether to change the terminal, that is, whether the device is changed or used for the first time, and receives an input related thereto (415). In the case of device change, the process of FIG. 8 is performed. 7 will be described later. On the other hand, when using the authentication program for the first time, the process of FIG.

Referring to FIG. 6, the authentication program generates a device authentication key (S501). That is, the authentication program collects unique information of the user terminal 100, for example, a MAC address or UUID of the network interface card, and generates a device authentication key using the unique information.

The authentication program compares the device authentication key generated in step S501 with the device authentication key previously stored (S503). If the result of the comparison does not match, the authentication program is automatically deleted (S505). For example, if an authentication program is copied and installed in another user terminal, the authentication program is automatically deleted.

On the other hand, as a result of the comparison in step S503, if it matches, the authentication program checks whether a secret hash value exists (S507), and if there is no secret hash value, performs a process of generating a secret hash value. That is, the authentication program receives a secret divisor from the user (S509), and generates and stores a secret hash value using the secret divisor (S511, S513). The authentication program generates a secret hash value by entering the secret divisor into the hash function. The secret divisor may be any one of a long string, an image file, a sound file, or a video file.

After generating the secret hash value, or if there is a secret hash value as a result of the check in step S507 but the program authentication key does not exist as a result of checking in step S521, a program authentication key generation process is performed. That is, the authentication program generates a time stamp (S515), and inputs the time stamp, the device authentication key, and the secret hash value into a hash function to generate and store a program authentication key (S517, S519).

After generating the program authentication key as described above, the authentication program asks the user whether the server for authentication information is registered with the authentication server 200 (S523), and when the user receives an input that does not agree to the server registration, the operation ends. When receiving an input for agreeing to register the server, the process of FIG. 7 is performed.

Referring to FIG. 7, the authentication program receives an address input of an authentication server from a user (S601). The authentication program receives a profile input of the authentication server from the user (S603). Here, the profile is information such as the name of the authentication server so that the user can easily recognize and manage the authentication server.

Next, the authentication program receives subscription information input from the user (S605). Here, the subscription information includes information such as ID, name, date of birth, and gender. The authentication program then receives a personal password input from the user (S607). Before receiving the personal password input, the authentication program can be authenticated by using a one-time password issued from a company operating the authentication server, or the authentication server 200, a public certificate. The personal password may be, for example, a six digit number.

The authentication program generates a user authentication key by inputting the secret hash value and the personal password into the hash function (S609).

The authentication program transmits authentication information including the user ID, the device authentication key, the program authentication key, and the user authentication key to the authentication server 200 (S611). Therefore, the authentication server 200 stores the device authentication key, the program authentication key and the user authentication key based on the user ID to use in online payment.

Referring to FIG. 8, the authentication program generates a device authentication key (S701). That is, the authentication program collects unique information of the user terminal 100, for example, a MAC address or UUID of the network interface card, and generates a device authentication key using the unique information.

The authentication program compares the device authentication key generated in step S701 with the device authentication key previously stored (S703). If the result of the comparison does not match, the authentication program is automatically deleted (S705). For example, if an authentication program is copied and installed in another user terminal, the authentication program is automatically deleted.

On the other hand, if the comparison result of the above step S703, the authentication program receives a secret divisor from the user (S709). In the case of first installing the authentication program by changing the terminal, since the device authentication key is stored in advance through the process of FIG. 5, the device authentication key matches in the comparison result of step S703.

The authentication program generates and stores a secret hash value using the secret divisor (S711, S713). The authentication program generates a secret hash value by entering the secret divisor into the hash function. The secret divisor may be any one of a long string, an image file, a sound file, or a video file.

After generating the secret hash value, the program authentication key is generated. That is, the authentication program generates a time stamp (S715), and inputs the time stamp, the device authentication key, and the secret hash value into a hash function to generate and store a program authentication key (S717, S719).

After generating the program authentication key in this manner, as shown in FIG. 9, the authentication program receives an address input of the authentication server from the user (S801). The authentication program receives a profile input of the authentication server from the user (S803). The authentication program receives an input of a personal password from the user (S805). Since the user has already subscribed to the authentication server 200 before changing the terminal, the membership registration process is not necessary in this process.

The authentication program generates a user authentication key by inputting the secret hash value and the personal password into the hash function (S807). The authentication program transmits authentication information including the user ID, the device authentication key, the program authentication key, and the user authentication key to the authentication server 200 (S809).

The authentication server 200 searches for a previously stored user authentication key by using the user ID included in the authentication information, compares the searched user authentication key with the user authentication key included in the authentication information, and authenticates the user authentication key. Verification is performed (S813).

If the user authentication key does not match, the authentication server 200 notifies the verification failure to the user terminal (S815), and if the user authentication key is matched, the previously stored device authentication key and program authentication key included in the authentication information. The device authentication key and the program authentication key are modified (S817). The authentication server 200 notifies the user terminal of the completion of the terminal change (S819).

After the authentication program displays the terminal change completion, the user checks whether there are more servers to change the terminal (S821) and terminates when there are no more servers to change. Repeat again.

Referring to FIG. 10, the authentication program of the user terminal 100 receives an existing personal password input from the user (S901). The authentication program receives a new personal password input from the user (S903).

The authentication program generates an existing user authentication key using the existing personal password (S905). In other words, a secret hash value and an existing personal password are entered into the hash function to generate an existing user authentication key.

In addition, the authentication program generates a new user authentication key using the new personal password (S907). In other words, a new user authentication key is generated by entering a secret hash value and a new personal password into the hash function.

Next, the authentication program transmits a user authentication key change request including the existing user authentication key, the new user authentication key, a user ID, a device authentication key, and a program authentication key to the authentication server 200 (S909).

The authentication server 200 receives the user authentication key change request (S911), and is included in the user authentication key, device authentication key, program authentication key, and the user authentication key change request previously stored using the user ID. The verification is performed by comparing the existing user authentication key, device authentication key, and program authentication key (S913).

As a result of the comparison, if any one does not match, the authentication server 200 transmits a change failure notification to the user terminal 100 (S915), and if the comparison results all match, the authentication server 200 previously stored user authentication. The key is modified to a new user authentication key included in the user authentication key change request (S917). The authentication server 200 transmits a change success notification to the user terminal 100 (S919).

11 is a flowchart illustrating a process of changing a secret divisor according to an embodiment of the present invention. The secret divisor is used to generate a secret hash value, and the secret hash value is used to generate a program authentication key and a user authentication key. Therefore, the change of the secret divisor will include the change of the program authentication key and the user authentication key.

Referring to FIG. 11, the authentication program of the user terminal 100 receives a new secret divisor input (S1001). The authentication program generates and stores a new secret hash value using the new secret divisor (S1003, S1005).

The authentication program generates a time stamp and generates and stores a new program authentication key using the time stamp, the new secret hash value, and the device authentication key (S1007, S1009, and S1011).

The authentication program receives a server selection input for changing the secret divisor from the user (S1013). The user can select one server, or select multiple servers, or select all servers. In this embodiment, it is assumed that one authentication server 200 is selected.

The authentication program receives an ID and a personal password input from the user (S1015). The authentication program generates a new user authentication key using the secret hash value and the personal password (S1017).

The authentication program transmits a secret divisor change request including a device authentication key, the user ID, the new program authentication key, the new user authentication key, an existing program authentication key, and an existing user authentication key to the authentication server 200 ( S1019).

The authentication server 200 receives the secret divisor change request (S1021), and stores a user authentication key, a device authentication key, a program authentication key, and an existing user authentication included in the secret divisor change request using a user ID. The verification is performed to compare the key, the device authentication key, and the existing program authentication key (S1023).

As a result of the comparison, if any one does not match, the authentication server 200 transmits a change failure notification to the user terminal 100 (S1025), and if all of the comparison results match, the authentication server 200 previously stored user authentication. The key and the program authentication key are modified to the new user authentication key and the new program authentication key included in the secret divisor change request (S1027). The authentication server 200 transmits a change success notification to the user terminal 100 (S1029).

Referring to FIG. 12, a user accesses a shopping server using a user terminal 100, selects a product to purchase, and inputs delivery information such as orderer information and payment means information. At this time, the shopping server presents a payment approval method to the user terminal 100, and the user selects a hash lock payment approval method according to the present invention among various payment approval methods (S1101 and S1103).

Accordingly, the shopping server transmits a hash lock ID request to the user terminal, and the user terminal receives the hash lock ID from the user and transmits the hash lock ID to the shopping server (S1105 and S1107). Here, the hash lock ID is an ID registered at the time of user registration in the authentication server 200.

The shopping server transmits a payment approval request including the received ID and transaction details to the authentication server 200 (S1109). Here, the transaction details include a name, a product name, an amount of money, and a means of payment of the shopping mall.

The authentication server 200 identifies a user by using the ID included in the payment approval request and pushes a notification message including transaction details to the user terminal 100 (S1111).

As the notification message is pushed, the authentication program of the user terminal 100 is executed, and the authentication program displays the notification message and receives payment means identification information from the user (S1113). The payment means identification information may include a withdrawal account number, credit card number, telephone number, and the like.

The authentication program receives an ID and a personal password from the user (S1115). The authentication program generates a user authentication key using a secret hash value and the input personal password (S1117). The authentication program generates a transaction information hash value by inputting the user authentication key, transaction details, and payment means identification information into a hash function (S1119).

The authentication program transmits a payment approval request including a user ID, a device authentication key, a program authentication key, the generated user authentication key, the transaction information hash value, and payment means identification information to the authentication server 200 (S1121). .

Referring to FIG. 13, the authentication server 200 receiving the payment approval request searches for previously stored authentication information using the ID included in the payment approval request, and retrieves the authentication information and the payment approval. The device authentication key, the program authentication key, and the user authentication key included in the request are compared and verified (S1123).

If the verification fails, that is, if any of the comparison results do not match, the authentication server 200 transmits a user authentication failure notification to the user terminal 100 (S1125). On the other hand, if the verification is successful, that is, if all comparison results match, the authentication server 200 generates a transaction information hash value (S1129). That is, a transaction information hash value is generated by inputting a user authentication key extracted from the authentication information, transaction details received from the shopping server in step S1109 and payment means identification information included in the payment approval request to a hash function.

The authentication server 200 compares and validates the transaction information hash value generated as described above with the transaction information hash value included in the payment approval request (S1131). If the transaction information hash values do not match, the authentication server 200 transmits an integrity failure notification to the user terminal 100 (S1127). On the other hand, when the transaction information hash values match, the authentication server 200 executes the settlement, and notifies the shopping server and the user terminal 100 of the results (S1133, S1135, and S1137).

12 and 13 illustrate an example of purchasing and paying for a product in an online shopping mall. The present invention is not limited thereto, and may be applied to all transactions requiring a conventional authentication process such as bank account transfer and mobile communication fee payment.

OTP ( One Time Password Day of certification Example

The user terminal 100 may communicate with the authentication server 200 through the authentication program 113 to perform one time password (OTP) authentication using a hash algorithm. The authentication server 200 communicates with the user terminal 100 to perform OTP authentication. To this end, the authentication server 200 stores and registers a secret hash value when it is received from the user terminal 100. That is, the authentication server 200 shares a secret hash value with the user terminal 100.

When the authentication server 200 receives an OTP authentication request from the user terminal 100, the authentication server 200 generates a one-time secret password and transmits it to the user terminal 100, and includes the one-time secret password from the user terminal 100. When the user-side user authentication key is received, a server-side user authentication key is generated using the secret hash value stored by the user and the one-time secret password and compared with the user-side user authentication key. The authentication server 200 processes authentication success when the user authentication key is the same, and fails authentication if it is not the same. Here, the authentication server 200 may be a server of a bank, a card company, a communication company or a general portal site, or may be a server of a payment agency service (PG) company. In this embodiment, only the authentication server is described. The authentication server may communicate with the service server and return the authentication result of the user according to the request of the service server. It can be understood that the authentication server of the present embodiment includes a service server.

As shown in FIG. 14, the authentication program 113 according to the present embodiment includes a secret hash value generation module 1410, a one-time secret password input module 1420, and a user authentication key generation module 1430.

The secret hash value generation module 1410 receives a secret divisor from a user through an input device. The secret divisor may be any one of a long string, an image file, a sound file, or a video file, but is not limited thereto.

The secret hash value generation module 1410 sets the secret divisor as a seed value to the hash function as a secret hash value. The secret hash value may be stored as a binary file. The secret hash value generation module 1410 registers the secret hash value by transmitting the secret hash value to the authentication server 200. The secret hash value generated by the secret hash value generation module 1410 may be stored in the user terminal 100 or may be stored in a separate storage medium such as an NFC card through the RF circuit 152. When the secret hash value is stored in a separate storage medium such as an NFC card, the user terminal 100 does not store the secret hash value.

The one-time secret password input module 1420 receives the one-time secret password generated by the authentication server 200 and received by the user-specified destination. The destination designated by the user may be the user terminal 100, or may be a wearable device carried by a separate user, or may be an email address. But it is not limited here. The one-time secret password may be received in the form of a short message (SMS) or a push message. The one-time secret password input module 1420 may receive the one-time secret password through a keypad or may be input through an image. A method of receiving input through an image will be described later.

The user authentication key generation module 1430 inputs the one-time secret password input by the one-time secret password input module 320 and the secret hash value generated by the secret hash value generation module 310 as a seed value to the hash function. To create a user authentication key. That is, the user authentication key here is a result obtained by inputting the one-time secret password and the secret hash value into a hash function as a seed value. If the secret hash value is stored in a separate storage medium, such as an NFC card, the user authentication key generation module 1430 is a short-range communication such as Bluetooth communication or NFC communication from a storage medium such as an NFC card through the RF circuit 152. You can read the secret hash value by running

The user authentication key generation module 1430 transmits the user authentication key to the authentication server 200 and receives an authentication result from the authentication server 200. Herein, the authentication result is an authentication success response or an authentication failure response, and the authentication success response or failure response is a response based on a comparison result of the user authentication key.

15 is a diagram illustrating a configuration of an authentication server according to another embodiment of the present invention. As shown in FIG. 15, the authentication server 200 includes a secret hash value registration module 1510 and a one-time secret password generation module 1520. ) And an authentication processing module 1530. These may be implemented in software installed in memory, or in a combination of hardware and software.

The secret hash value registration module 1510 receives and registers the secret hash value generated by the user terminal 100 from the user terminal 100. In this case, the registration may mean mapping and storing identification information of the user, for example, an ID and the secret hash value. The authentication server 200 may receive account information (ID and password) from the user and register to process membership, and the secret hash value registration module 410 may receive the secret hash value after the user logs in.

The one time secret password generation module 1520 generates a one time secret password for authentication of the user. The one-time secret password can be generated with a random function. The one-time secret password generation module 1520 may generate a one-time secret password when receiving an OTP authentication request from the user terminal 100, specifically, from the authentication program 113. At this time, the one-time secret password generation module 1520 may generate the one-time secret password by inputting the registered secret hash value and time stamp as a seed value to the random number function.

The one-time secret password generation module 1520 transmits the generated one-time secret password to a destination designated by the user. The one-time secret password may be transmitted in the form of a text message (SMS) or push message or email or an Automatic Response Service (ARS). To this end, the one-time secret password generation module 1520 may receive a telephone number or e-mail address from the user.

The authentication processing module 1530 receives a user authentication key from the user terminal 100. The authentication processing module 1530 inputs the one-time secret password generated by the one-time secret password generation module 1520 and the secret hash value of the user registered by the secret hash value registration module 1510 as a seed value in a hash function to authenticate the user. Create a key. The authentication processing module 1530 compares the generated user authentication key with the user authentication key received from the user terminal 100 and transmits an authentication success response to the user terminal 100 if they match, and does not match. The authentication failure response is transmitted to the user terminal 100.

The one-time secret password generation module 1520 and the authentication processing module 1530 use a user terminal using an IP address of the logged in user terminal 100 or session information (including ID information) maintained with the user terminal 100. 100) can be identified. That is, when the user authentication key is received from the user terminal 100, the one-time secret password transmitted to the user terminal 100 using the IP address or session information of the user terminal 100 and the registered secret hash value of the user Can be identified.

16 is a flowchart illustrating an authentication method using OTP according to the present invention. In the present embodiment with reference to FIG. 16, the secret server value is received and registered in advance in the authentication server 200 from the user terminal 100.

Referring to FIG. 16, the user accesses the authentication server 200 using the user terminal 100 and requests the OTP authentication to the authentication server 200 (S1601). The authentication server 200 generates a one-time secret password OTP (S1603). The one-time secret password can be generated with a random function. At this time, the authentication server 200 may generate the one-time secret password by inputting the registered secret hash value and time stamp as a seed value to the random number function.

The authentication server 200 transmits the generated one-time secret password to the user terminal 100 (S1605). The authentication server 200 may receive the telephone number from the user terminal 100 and transmit the disposable secret password in a text message to the user terminal 100 using the telephone number as the incoming telephone number. Alternatively, the authentication server 200 may transmit a call to the user terminal 100 and transmit a one-time secret password to an ARS (Automatic Response Service). In the present exemplary embodiment, the one-time secret password is transmitted to the user terminal 100, but the present invention is not limited thereto and may be transmitted to another device such as a wearable device of the user.

When the user receives the one-time secret password from the authentication server 200, the user inputs the received one-time secret password to the user terminal 100 (S1607). The user terminal 100 generates a user authentication key by inputting the one-time secret password and the secret hash value stored in the user terminal 100 as a seed value to the hash function (S1609). When the secret hash value is stored in a separate storage medium such as an NFC card, the user terminal 100 performs short range communication such as Bluetooth communication or NFC communication from a storage medium such as an NFC card through the RF circuit 152. You can read the secret hash value. The user terminal 100 transmits the generated user authentication key to the authentication server 200 (S1611).

Upon receiving the user authentication key from the user terminal 100, the authentication server 200 seeds the one-time secret password generated in step S1603 and the secret hash value previously received and registered from the user terminal 100 in the hash function. In operation S1613, a user authentication key is generated. The authentication server 200 compares whether the user authentication key received from the user terminal 100 in step S1611 and the user authentication key generated in step S1613 are the same (S1615).

If the comparison result, the user authentication key is not the same, the authentication server 200 determines that the authentication failure and transmits an authentication failure response to the user terminal 100 (S1617). On the other hand, if the user authentication key is the same, the authentication server 200 determines that the authentication is successful and transmits an authentication success response to the user terminal 100 (S1619).

Entering a one-time secret password (OTP)

Referring to FIG. 17, the one time secret password input module 1420 may include an image registration module 1710, an image input module 1720, and a one time secret password extraction module 1730.

The image registration module 1710 communicates with the authentication server 200, receives candidate images and codes thereof from the authentication server 200, displays the candidate images on the screen, and selects a key image and a fake image from the user. Here, the camouflage image means an image that is displayed together with the key image so that the key image is not exposed to others. To this end, the authentication processing module 1530 of the authentication server 200 stores the candidate images and their codes and transmits the candidate images and their codes to the user terminal 100 when the user terminal 100 is connected.

18 illustrates candidate images according to an embodiment of the present invention. The image registration module 1710 displays candidate images as shown in FIG. 18 after receiving the candidate images and their codes from the authentication server 200. The user selects a key image and a fake image from among the candidate images shown in FIG. 18. For example, select three key images and nine camouflage images.

The image registration module 1710 transmits a code of a key image selected from a user and a code of a fake image to the authentication server 200. At this time, the image registration module 1710 does not transmit the information for distinguishing the code of the key image and the code of the camouflage image. Therefore, the authentication server 200 does not know which code is the key image designated by the user even if the code of the image is received. The authentication processing module 1530 of the authentication server 200 maps and stores the codes of the received images to identification information (eg, ID) of the user.

The image registration module 1710 stores the code of the key image among the key image and the camouflage image and the selection order information of the key image of the user in the user terminal 100, and does not store the code of the camouflage image in the user terminal 100. . That is, only the code and the order information of the key image are stored in the user terminal 100, and the code of the key image and the fake image is stored in the authentication server 200. However, the authentication server 200 does not store the distinguishing information of the key image and the camouflage image.

The image input module 1720 displays an interface for allowing a user to input a one-time secret password received from the authentication server 200 as an image. Image input module 1720 displays two concentric circle interfaces. To this end, the authentication processing module 1530 of the authentication server 200 transmits the key image and the camouflage image set by the user and their codes to the image input module 1720.

Among the two circle interfaces, the first circle interface has a candidate secret password such as numbers, special characters, or alphabets displayed along the perimeter, and the second circle interface has a key image and a camouflage image along the perimeter. The first circle interface may not rotate, and the second circle interface may rotate according to a user input. However, on the contrary, the first circle interface may rotate, and the second circle interface may not rotate. Alternatively, both the first and second circle interfaces may rotate. In the present embodiment, only the second circle interface is described as rotating.

The image input module 1720 receives the key image and the camouflage image and their codes registered by the user from the authentication processing module 1530 of the authentication server 200 and stores the received key image and the camouflage image. 2 Circle the perimeter on the interface. The image input module 1720 may also receive candidate secret ciphers and their codes of the first circle interface from the authentication server 200 and list the received candidate secret ciphers along the perimeter of the first circle interface. Of course the candidate secret ciphers and their code of the first circle interface may be stored in the terminal itself.

19 illustrates a circle interface according to an embodiment of the present invention. As shown in FIG. 19, numbers 1 through 12 are listed along the circumference of the circle in the first circle interface 1910 of the circle interface, and the first circle interface 1910 in the second circle interface 1920. The key image and the camouflage image that surrounds the outside of the user and registered in the authentication server 200 are received from the authentication server 200 and are randomly arranged along the circumference of the circle.

The image input module 1720 receives a rotation input for the second circle interface from the user to rotate the second circle interface. The rotational input may be touch and drop or may be mouse or button input.

The one-time secret password extraction module 1730 is the first position that is located in the same orientation as the key image of the first order among the key images stored in the user terminal 100 when the user presses the complete input after rotating the second circle interface Extract candidate secret password of circle interface. The one-time secret password extraction module 1730 performs this process by the number of key images stored in the user terminal 100 by the user, and thus extracts the one-time secret password.

Extraction of the one-time secret password using the above-described key image may be performed through matrix operation. The user presses the Done input after rotating the second circle interface. The user presses the completion input when the one-time secret password among the candidate secret passwords listed in the first circle interface and the key image among the images listed in the second circle interface are located in the same orientation. When the complete input is pressed, the one time secret password extraction module 1730 extracts a matrix of codes of images of the second circle interface according to certain criteria. For example, starting at 12 o'clock, the code of the images listed in the second circle interface is extracted in a clockwise direction to generate a 1 × 12 matrix. This 1 × 12 matrix is created by the number of key images. That is, according to the number of key images among the images listed in the second circle interface and the order of the key images set by the user, the user inputs rotation and completion of the second circle interface, and the one-time secret password extraction module 730 is completed. Each time there is an input, the code of the images listed in the second circle interface is extracted to produce a 1 × 12 matrix. If the number of key images is n, an n × 12 matrix is created.

For example, if the one-time secret password received from the authentication server 200 is (1, 2, 7) and the key image is (soccer ball, baseball, rugby ball), the user rotates the second circle interface to Position the soccer ball image so that it has an orientation equal to the number '1' of the first circle interface and enter Done. The one-time secret password extraction module 1730 extracts the codes of the images of the second circle interface in the clockwise order with respect to the 12 o'clock direction to generate a first 1 × 12 matrix. Next, the user rotates the second circle interface again so that the baseball image is in the same orientation as the number '2' of the first circle interface and inputs completion. The one-time secret password extraction module 1730 extracts the codes of the images of the second circle interface in the clockwise order with respect to the 12 o'clock direction to generate a second 1 × 12 matrix. Finally, the user rotates the second circle interface again so that the rugby ball image is in the same orientation as the number '7' of the first circle interface and enters a complete. The one-time secret password extraction module 1730 extracts the codes of the images of the second circle interface in the clockwise order with respect to the 12 o'clock position to generate a third 1 × 12 matrix. Thus, a 3x12 matrix is finally extracted.

The one-time secret password extraction module 1730 extracts the coded coordinates of the key image from the extracted matrix based on the key image set by the user and the order thereof, and extracts the one-time secret password based on the extracted coordinates. In the above-described example, the one-time secret password extraction module 1730 is a soccer ball in the first row of the 3 × 12 matrix because the key image and the order set by the user are (soccer ball, baseball ball, rugby ball). Check the coordinate with the code of, and extract the number '1' of the first circle interface corresponding to the coordinate. Next, in the second row of the 3x12 matrix, the coordinates of the baseball ball are identified, and the number '2' of the first circle interface corresponding to the coordinates is extracted. Finally, in the third row of the 3x12 matrix, the coordinates of the rugby ball code are identified, and the number '7' of the first circle interface corresponding to the coordinates is extracted. Thus, the one-time secret password of (1, 2, 7) is finally extracted.

In the above embodiment, the user registers and uses at least two or more key images. But not limited to this, the user can register and use a single key image. In this case, the order of the key images need not be considered, and the user may repeatedly use one key image. In the above example, the user first places one key image in the same orientation as the number '1' on the first circle interface, then enters a completion, then places it in the same orientation as the number '2', then enters a completion. Finally, put it in the same direction as the number '7' and then enter Done. Then, (1, 2, 7) is extracted as a one-time secret password.

In addition, the embodiment referring to FIG. 19 describes two circle interfaces. However, the present invention is not limited thereto, and three circle interfaces may be used. For example, if the authentication server 200 issues a one-time secret password for 6 digits and the user has registered three key images, the one-time secret password in the user terminal 100 using three circle interfaces. Can be entered.

20 illustrates three circle interfaces according to an embodiment of the present invention. As shown in FIG. 20, candidate secret passwords such as numbers and special characters are listed along the circumference of a circle in the first circle interface 2010 among three circle interfaces, and a first circle interface 2020 is located in the first circle interface 2020. Surrounding the outside of the circle interface 2010, the same candidate secret ciphers as the first circle interface 2010 are listed along the circumference of the circle. In the third circle interface 2030, the key image and the camouflage image are randomly arranged along the circumference of the circle. At this time, all of the first to third circle interfaces may rotate, or only two circle interfaces may rotate. In the present embodiment, a case in which the second and third circle interfaces rotate.

For example, if the one-time secret password received from the authentication server 200 is a six-digit number of 100207 and the key image is (soccer ball, baseball, rugby ball), the user may access the second and third circle interfaces. Rotate so that the number '1' of the first circle interface, the number '0' of the second circle interface, and the 'soccer ball' image of the third circle interface are located in the same orientation, and enter complete. Next, the user rotates the second and third circle interfaces again so that the number '0' of the first circle interface, the number '2' of the second circle interface and the 'baseball ball' image of the third circle interface are located in the same orientation. And complete. Finally, the user rotates the second and third circle interfaces again so that the number '0' of the first circle interface, the number '7' of the second circle interface and the 'rugby ball' image of the third circle interface are located in the same orientation. And complete. When three operations are performed in this manner, candidate secret passwords, that is, numbers, of the first and second circle interfaces located in the same orientation as the key image can be extracted in each order. In the above example, '10' can be extracted from the first operation, '02' can be extracted from the second operation, and '07' can be extracted from the third operation.

Extraction of a one-time secret password using a key image in the three circle interfaces described with reference to FIG. 20 may be performed through matrix operations like the two circle interfaces. Each of the first and second circle interfaces is mapped with candidate secret ciphers and their code, and the third circle interface is mapped with images and the code of the images. Each circle interface is made one row according to certain criteria. In this case, the constant criterion is, for example, when a circle interface is first displayed, the candidate row includes a list of candidate secret passwords or images clockwise around 12 o'clock, and when the circle interface is rotated, the row value is shifted by that rotation. After the shift, you can identify the value of each column in each row. When the user presses Done after rotating the third circle interface, the coordinates of the key image are extracted from the matrix values of the third circle interface, and the matrix values of the first and second circle interfaces of the same coordinates are extracted as the one-time secret password.

In the above embodiment, the key image and the camouflage image set by the user is stored in the authentication server 200, but the identification information of the key image and the camouflage image is not stored, so the authentication server 200 determines which image is the key image. Unknown, the authentication server 200 only transmits the key image and the camouflage image set by the user and their codes to the user terminal 100. The division information of the key image is stored and used in the user terminal 100.

As another embodiment, the identification image of the key image may be stored together with the key image and the camouflage image set by the user in the authentication server 200, and the authentication server 200 may store the key image and When the interface data such as the camouflage image is transmitted to the user terminal 100, the identification information of the key image may be transmitted together. In this case, the user terminal 100 does not need to store the information of the key image, and receives only the identification information of the key image from the authentication server 200 only at the time of authentication and temporarily stores it and deletes it after the authentication is completed. To this end, the image registration module 1710 transmits information for distinguishing the code of the key image and the code of the camouflage image to the authentication server 200.

Meanwhile, in the above-described embodiment, the user terminal 100 extracts the one-time secret password through the circle interface and then transfers the extracted one-time secret password to the authentication server 200. But it is not limited here.

In another embodiment, the authentication server 200 stores the key image and the camouflage image set by the user, and also stores the identification information of the key image. The user terminal 100 does not directly extract the one-time secret password from the circle interface, but when the user operates the circle interface to input the one-time secret password, the matrix extracted from the circle interface (for example, the circle interface of FIG. 19). If a 2 × 12 matrix extracted from the first and second circle interfaces, and FIG. 20 shows a 3 × 12 matrix, a user authentication key is generated and transmitted to the authentication server 200. Since the authentication server 200 stores the identification information of the key image and knows the one-time secret password, the authentication server 200 may generate a user authentication key by itself in the same manner as in the user terminal 100, and generate the user by itself. The authentication is performed by comparing the authentication key with the user authentication key received from the user terminal 100.

To this end, the user authentication key generation module 1430 may convert the matrix generated by the circle interface in the one time secret password input module 1420 and the secret hash value generated in the secret hash value generation module 1410 into a hash function. Create a user authentication key by entering the seed value. The authentication processing module 1530 of the authentication server 200 generates a matrix using a circle interface using a key image and a camouflage image registered by the user and a one-time secret password issued by the server, and the matrix and the user register. A user authentication key is generated using the secret hash value, and the user authentication key received from the user terminal 100 is compared. At this time, the authentication server 200 transmits the code of the key image and the camouflage image to the user terminal 100 to the user terminal 100 to implement a circle interface, the code of the key image and camouflage image is a one-time virtual code Can be. The authentication server 200 may issue and use a one-time virtual code as a code of a key image and a camouflage image each time authentication is performed. Therefore, even if the matrix is hacked at the network end by the hacker, since the code of the image is changed at the next authentication, secure authentication is possible.

Referring to FIG. 21, in comparison with FIG. 14, the authentication program 113 according to the present embodiment further includes a device authentication key generation module 2110 and a program authentication key generation module 2120.

The device authentication key generation module 2110 collects unique information of the user terminal 100, for example, a MAC address of a network interface card (NIC), and uses the collected unique information when the authentication program 113 is first executed. To generate a device authentication key. Specifically, the device authentication key management module 2110 stores the value generated by inputting the unique information of the user terminal 100 as a seed value to the hash function as a device authentication key, and transmits the secret to the authentication server 200. It registers with the authentication server 200 similarly to a hash value. The secret hash value registration module 1510 of the authentication server 200 stores the secret hash value of the user and the device authentication key together.

The device authentication key generation module 2110 may transmit the device authentication key previously stored every time to the authentication server 200 and receive an authentication result. The authentication processing module 1530 of the authentication server 200 compares a device authentication key that has been registered with the device authentication key received from the device authentication key generation module 2110 every time it is authenticated. Return the authentication result. That is, if authentication is attempted at another terminal instead of the predetermined user terminal 100, the authentication is failed.

In addition, the device authentication key generation module 2110 may generate a device authentication key every time the authentication program 113 is executed and compare the device authentication key with the previously stored device authentication key. The device authentication key generation module 2110 automatically deletes the authentication program 113 when the device authentication key does not match as a result of the comparison. For example, when the authentication program 113 installed in the user terminal 100 is duplicated and transferred to another device and executed, the previously stored device authentication key and the device authentication key generated at the time of execution do not coincide with each other. The authentication program 113 duplicated in the device is automatically deleted.

The program authentication key generation module 2120 generates and stores a program authentication key by using the device authentication key, the time stamp, and the secret hash value generated by the device authentication key generation module 2110, and stores the program authentication key. Send it to the authentication server 200 to register with the secret hash value. The secret hash value registration module 1510 of the authentication server 200 stores the secret hash value of the user and the program authentication key together. The program authentication key may be stored in the authentication program 113 as a binary file. In this case, the time stamp is a string indicating the time at which the program authentication key is generated.

The program authentication key generation module 2120 may transmit the program authentication key to the authentication server 200 every time authentication and receive an authentication result. The authentication processing module 1530 of the authentication server 200 compares a previously registered program authentication key with a program authentication key received from the program authentication key generation module 2120 every time the authentication is not matched. And return the result. That is, in addition to the case where authentication is attempted at another terminal instead of the predetermined user terminal 100, when the authentication program 113 is reinstalled or duplicated, the timestamp value is changed and authentication fails.

In the present invention described above, when a user inputs a one-time secret password issued by the authentication server 200 to the user terminal 100, the one-time secret password is encrypted with a hash algorithm along with a secret hash value to the authentication server 200. Because of the transmission, hacking of the one-time secret password is impossible.

In addition, when inputting the one-time secret password in the user terminal 100, by inputting the one-time secret password using the circle interface, even if someone peeks you can not know the one-time secret password at all. Therefore, it is possible to strengthen the security when entering the one-time secret password.

In addition, the present invention, by using the device authentication key and the program authentication key to the additional device authentication and program authentication, it is possible to ensure a one-person program. That is, even if an authentication program (for example, an application) is copied and executed on another user terminal, the authentication of the device authentication key fails and the authentication fails. In addition, if the program is reinstalled after deleting the same terminal, the program authentication key is changed and authentication also fails. Therefore, it is possible to block hacking of personal information by uninstalling and reinstalling the program.

Meanwhile, in the above-described embodiment, it will be described that the authentication server 200 generates a one-time secret password and transmits it to a destination designated by the user. The authentication server 200 may not transmit the one-time secret password. That is, the user carries the portable disposable secret password generator, and the portable disposable secret password generator stores the same secret hash value as the secret hash value stored in the user terminal 100. The portable one-time secret password generator generates a one-time secret password using the same algorithm as the authentication server 200. The portable one-time secret password generator generates and displays a one-time secret password by inputting a secret hash value and a timestamp into the random number function as a seed value. The user inputs the one-time secret password displayed on the portable one-time secret password generator to the user terminal 100 to transmit the user authentication key to the authentication server 200. In this case, the input may be the image input method described above, or may be a text input. The authentication server 200 generates a one-time secret password by inputting the same timestamp and the already registered secret hash value as a seed value to the random number function as a portable one-time secret password generator. The authentication server 200 generates the user authentication key by inputting the generated one-time secret password and the secret hash value into the hash function as a seed value, and then compares the user authentication key received from the user terminal 100.

In the above example, the portable one-time secret password generator is described as storing a secret hash value. However, the portable one-time secret password generator does not store the secret hash value, and like a conventional one-time secret password generator, it is possible to generate a one-time secret password using a timestamp and device serial number, and the user can use the key image to generate the secret password. The one-time secret password may be input, and the user terminal 100 may generate the user authentication key by inputting the one-time secret password and the secret hash value as a seed value to the hash function and transmit the generated authentication key to the authentication server 200. That is, the authentication of the user is performed by the existing hardware-based one-time secret password authentication method, the user terminal 100 receives the one-time secret password using the image, hash-encrypting the one-time secret password using the secret hash value It may be transmitted to the authentication server 200.

OTP ( One Time Password ) Other of certification Example

22 is a diagram illustrating an authentication system according to another embodiment of the present invention. As shown in FIG. 22, the authentication system according to the present embodiment includes a user terminal 100, an authentication server 200, a communication network 300, and a service server 400.

The user terminal 100 installs an authentication program 113 and generates a secret hash value, a device authentication key, a program authentication key, and a user authentication key by using a hash algorithm through the authentication program 113, and as the authentication information. The registration is transmitted to the authentication server 200. The user terminal 100 also transmits and registers user identification information to the authentication server 200 as authentication information.

The authentication server 200 stores and registers the authentication information. When the user authentication is required, the authentication server 200 compares the device authentication key and the program authentication key received from the user terminal 100 with the device authentication key and the program authentication key of a pre-registered user. If the pre-authentication is successful, the authentication server 200 issues a one-time secret password and transmits it to the user. When the authentication server 200 receives a one-time authentication key using the one-time secret password from the user terminal 100, the user generates a one-time authentication key using a pre-registered user authentication key and the issued one-time secret password to the user. The final authentication is performed by comparing with the one-time authentication key received from the terminal 100.

When the authentication server 200 receives the user identification information from the service server 400, the identification information for the user and the user is identified using the user identification information, the user terminal 100 and the pre-authentication and the final authentication Can be performed. The authentication server 200 returns the authentication result to the service server 400.

The service server 400 may be an internet web server that requires a login or a server of a financial institution that provides Internet banking or a payment server that provides electronic payment, or an agent terminal of an offline consultation window such as an offline kiosk or a financial institution. Connected servers, and so on. The service server 400 transmits the user identification information received from the user to the authentication server 200 when the user authentication is required for the user, and requests the user authentication. The user identification information is user identification information stored in the authentication server 200.

As shown in FIG. 23, the authentication program 113 according to the present embodiment includes a secret hash value generation module 2310, a device authentication key generation module 2320, a program authentication key generation module 2330, and a user authentication key generation. Module 2340, one-time secret password input module 2350, one-time authentication key generation module 2360, pre-authentication request module 2370, and change module 2380.

The secret hash value generation module 2310 receives a secret divisor from a user through an input device. The secret divisor may be any one of a long string, an image file, a sound file, or a video file, but is not limited thereto.

The secret hash value generation module 2310 sets the secret divisor as a seed value to the hash function as a secret hash value. The secret hash value may be stored as a binary file. The secret hash value generation module 2310 registers the secret hash value by transmitting the secret hash value to the authentication server 200. The secret hash value generated by the secret hash value generation module 2310 may be stored in the user terminal 100, or may be stored in a separate storage medium such as an NFC card through the communication circuit 152. When the secret hash value is stored in a separate storage medium such as an NFC card, the user terminal 100 does not store the secret hash value.

The device authentication key generation module 2320 collects the unique information of the user terminal 100, for example, the MAC address or universally unique identifier (UUID) of the network interface card (NIC) when the authentication program 113 is first executed. The device authentication key is generated using the collected unique information. In detail, the device authentication key management module 2320 stores a value generated by inputting unique information of the user terminal 100 as a seed value in a hash function, as a device authentication key. The device authentication key generation module 2320 transmits and registers the device authentication key generated initially to the authentication server 200.

The device authentication key generation module 2320 generates a device authentication key every time the authentication program 113 is executed and compares the device authentication key with the previously stored device authentication key. The device authentication key generation module 2320 automatically deletes the authentication program 113 when the device authentication key does not match as a result of the comparison. For example, when the authentication program 113 installed in the user terminal 100 is duplicated and transferred to another device and executed, the previously stored device authentication key and the device authentication key generated at the time of execution do not coincide with each other. The authentication program 113 duplicated in the device is automatically deleted.

The program authentication key generation module 2330 generates and stores a program authentication key using a device authentication key, a time stamp, and the secret hash value generated by the device authentication key generation module 2320. The program authentication key may be stored in the authentication program 113 as a binary file. In this case, the time stamp is a string indicating a time point at which a program authentication key is generated. The program authentication key generation module 2330 transmits and registers the first generated program authentication key to the authentication server 200. If the secret hash value is stored in a separate storage medium, such as an NFC card, the program authentication key generation module 2330 is a short-range communication such as Bluetooth communication or NFC communication from a storage medium such as an NFC card through a communication circuit 152. You can read the secret hash value by running

The user authentication key generation module 2340 generates a user authentication key using the secret hash value generated by the secret hash value generation module 2310 and a personal password input from a user through an input device. Specifically, the user authentication key generation module 2340 uses the secret hash value and the input personal password as a seed value in a hash function as a user authentication key. The user authentication key generation module 2340 transmits and registers the first generated user authentication key to the authentication server 200. If the secret hash value is stored in a separate storage medium, such as an NFC card, the user authentication key generation module 2340 is a short-range communication such as Bluetooth communication or NFC communication from a storage medium such as an NFC card through a communication circuit 152. You can read the secret hash value by running

In the above description, the device authentication key and the program authentication key has been described as being stored in both the authentication program 113 and the authentication server 200, the user authentication key is not stored in the authentication program 113, authentication server 200 It is desirable to transmit and store only.

The user may register in the authentication server 200 and the secret hash value, the device authentication key, the program authentication key, and the user authentication key are authenticated based on the user identification information (eg, ID) registered at the time of membership registration. It is stored in the server 200 as information for authentication. The authentication server 200 may store not only user identification information, but also personal information such as name, date of birth, and gender.

The one-time secret password input module 2350 receives the one-time secret password generated by the authentication server 200 and received by the user-specified destination. The destination designated by the user may be the user terminal 100, or may be a wearable device carried by a separate user, or may be an email address. But it is not limited here. The one-time secret password may be received in the form of a short message (SMS) or a push message. The one-time secret password input module 2350 may receive the one-time secret password through a keypad or may be input through an image.

The one-time authentication key generation module 2360 may input the one-time secret password input from the one-time secret password input module 2350 and the user authentication key generated by the user authentication key generation module 2340 as a seed value in a hash function. Generate a one-time authentication key and transmit it to the authentication server (200). That is, when a one-time secret password is issued to the user from the authentication server 200, the user enters the personal password and the issued one-time secret password in the user terminal 100. Then, the user authentication key generation module 2340 generates a user authentication key using the personal password, and the one-time authentication key generation module 2360 generates a one-time authentication key using the user authentication key and the one-time secret password.

The pre-authentication request module 2370 may receive a pre-authentication by transmitting a pre-authentication request including user identification information, a device authentication key, and a program authentication key to the authentication server 200 before final authentication using the one-time secret password. The authentication server 200 issues a one-time secret password when the user identification information, the device authentication key, and the program authentication key included in the pre-authentication request are the same as the previously registered user identification information, the device authentication key, and the program authentication key. .

The change module 2380 performs the change of the secret divisor, the change of the personal password, the change of the program authentication key according to the reinstallation of the authentication program, and the change of the device authentication key and the program authentication key according to the change of the user terminal 100. . When the secret divisor is changed, the secret hash value is changed so that the program authentication key and the user authentication key using the secret hash value are changed together. When the personal password is changed, the user authentication key using the same is changed.

Change secret divisor

When the secret divisor change input is received from the user, the change module 2380 transmits a secret divisor change request including the device authentication key and the program authentication key to the authentication server 200. When the device authentication key and the program authentication key included in the secret divisor change request and the device authentication key and the program authentication key previously registered in the authentication server 200 match, the authentication server 200 generates a one-time secret password. Issue to the user. The one-time authentication key generation module 2360 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 2360. When the match response is returned as described above, the change module 2380 controls the secret hash value generation module 2310, the user authentication key generation module 2340, and the program authentication key generation module 2330 to generate a new secret hash value. In addition, a new user authentication key and a new program authentication key are generated. The secret hash value generation module 2310, the user authentication key generation module 2340, and the program authentication key generation module 2330 may generate a newly generated secret hash value, a user authentication key, and a program authentication key from the authentication server 200. The authentication server 200 updates the previously registered secret hash value, user authentication key, and program authentication key with new values. The change module 2380 receives the secret divisor change complete response from the authentication server 200.

Change personal password

When the personal password change input is received from the user, the change module 2380 transmits a personal password change request including the device authentication key and the program authentication key to the authentication server 200. When the device authentication key and the program authentication key included in the personal password change request and the device authentication key and the program authentication key previously registered in the authentication server 200 match, the authentication server 200 generates a one-time secret password. Issue to the user. The one-time authentication key generation module 2360 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 2360. When the match response is returned as described above, the change module 2380 controls the user authentication key generation module 2340 to generate a new user authentication key. The user authentication key generation module 2340 transmits a new user authentication key to the authentication server 200, and the authentication server 200 updates a user authentication key that has been previously registered with the new user authentication key. The change module 2380 receives a personal password change complete response from the authentication server 200.

Reinstallation of Certification Program

Upon reinstallation of the authentication program, the secret hash value generation module 2310 receives the secret divisor from the user and generates and stores the secret hash value. In addition, the device authentication key generation module 2320 and the program authentication key generation module 2330 also generate a new device authentication key and program authentication key. The user authentication key generation module 2340 generates a new user authentication key. When the authentication program is reinstalled, since the user terminal 100 has no change and the secret divisor and the personal password are the same, the device authentication key, the user authentication key, and the secret hash value are the same as before, but the program authentication key is changed. The change module 2380 may generate a user authentication key, a device authentication key, and a program authentication key generated by the user authentication key generation module 2340, the device authentication key generation module 2320, and the program authentication key generation module 2330. The reinstallation registration message is transmitted to the authentication server 200. When the user authentication key and the device authentication key included in the reinstallation registration message match the pre-registered user authentication key and device authentication key, the authentication server 200 issues a one-time secret password to the user. The one-time authentication key generation module 2360 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 2360. The authentication server 200 updates the existing program authentication key with the new program authentication key included in the reinstallation registration message. The change module 2380 receives the reinstallation registration complete response from the authentication server 200.

Change of user terminal

If the user terminal 100 is changed, the authentication program is also reinstalled. The secret hash value generation module 2310 receives a secret divisor from a user and generates and stores a secret hash value. In addition, the device authentication key generation module 2320 and the program authentication key generation module 2330 also generate a new device authentication key and program authentication key. The user authentication key generation module 2340 generates a new user authentication key. If the user terminal 100 is changed, the authentication program is reinstalled, but since the secret divisor and the personal password are the same, the device authentication key and the program authentication key are different from the existing ones, and the user authentication key and the secret hash value are the same as before. The change module 2380 may generate a user authentication key, a device authentication key, and a program authentication key generated by the user authentication key generation module 2340, the device authentication key generation module 2320, and the program authentication key generation module 2330. The device change registration message is transmitted to the authentication server 200. The authentication server 200 issues a one-time secret password to the user when the user authentication key included in the device change registration message matches a user authentication key that is pre-registered. The one-time authentication key generation module 2360 generates a one-time authentication key using the one-time secret password and the user authentication key input from the user and transmits the one-time authentication key to the authentication server 200. When the one-time authentication key received from the user terminal 100 matches the one-time authentication key generated by the authentication server 200, the authentication server 200 returns a matching response to the one-time authentication key generation module 2360. The authentication server 200 updates the device authentication key and the program authentication key registered previously with the new device authentication key and the new program authentication key included in the device change registration message. The change module 2380 receives a device registration complete response from the authentication server 200.

When changing the secret divisor, the personal password, the program authentication key due to the reinstallation of the authentication program, the device authentication key and the program authentication key according to the change of the user terminal 100, the authentication server 200 The user may receive user identification information from the user terminal 100 and check whether the user identification information is matched with previously registered user identification information.

FIG. 24 is a diagram illustrating the configuration of the authentication server of FIG. 22. As shown in FIG. 24, the authentication server 200 includes a secret hash value registration module 2410, a user authentication key registration module 2420, and a one-time secret password. Generation module 2430, one-time authentication key comparison module 2440, device authentication key registration module 2450, program authentication key registration module 2460, pre-authentication request receiving module 2470 and change registration module 2480 do. These may be implemented as programs installed in the memory, or may be implemented as a combination of hardware and software.

The secret hash value registration module 2410 receives and registers a secret hash value from the user terminal 100. The registration here means storing together with the user identification information. The authentication server 200 may register a secret hash value based on the generated user identification information by processing user registration. Since the secret hash value has been described above, a detailed description thereof will be omitted.

The user authentication key registration module 2420 receives and registers a user authentication key from the user terminal 100. Since the user authentication key has been described above, a detailed description thereof will be omitted.

The one-time secret password generation module 2430 may generate a one-time secret password as shown in Equation 1 or 2 below.

(Eq. 1)

ENC_eHPSS = f (eHPSS + TimeStamp),

One-time secret password = f (ENC_eHPSS + TimesTAMP)

(Eq. 2)

One-time secret password = f (eHPSS + TimesTAMP)

In (1) and (2), eHPSS is a secret hash value, and f () is a hash function.

In f (ENC_eHPSS + TimesTAMP) or f (eHPSS + TimesTAMP), timestamps can be replaced with other values, and one-time secret passwords can be created by adding additional data as seed values in addition to the timestamp and secret hash values. . Since the secret hash value is used when generating the one-time secret password, the one-time secret password becomes a personalized one-time secret password.

The one time secret password generation module 2430 transmits the generated one time secret password to a destination designated by the user. The one-time secret password may be transmitted in the form of a text message (SMS) or push message or email or an Automatic Response Service (ARS). To this end, the one-time secret password generation module 2430 may receive a telephone number or e-mail address from the user.

When the one-time authentication key comparison module 2440 receives the one-time authentication key from the user terminal 100, the one-time authentication key comparison module 2440 compares the one-time authentication key generated by the user. Since the method of generating the one-time authentication key in the user terminal 100 has been described above, the description thereof will be omitted. The one-time authentication key comparison module 2440 may seed the one-time secret password issued to the user in the one-time secret password generation module 2430 and the user authentication key of the user registered in the user authentication key registration module 2420 to a hash function. Generate a one-time authentication key, and compare the one-time authentication key with the one-time authentication key from the user terminal 100. The one-time authentication key comparison module 2440 transmits the one-time authentication key comparison result to the user terminal 100.

The device authentication key registration module 2450 receives and registers a device authentication key from the user terminal 100. Since the device authentication key has been described above, a detailed description thereof will be omitted.

The program authentication key registration module 2460 receives and registers a program authentication key from the user terminal 100. Since the program authentication key has been described above, a detailed description thereof will be omitted.

The authentication server 200 may process a user registration and store a secret hash value, a user authentication key, a device authentication key, and a program authentication key based on the generated user identification information.

When the pre-authentication request receiving module 2470 receives user identification information for authenticating the user from the service server 400, the pre-authentication request receiving module 2470 transmits an identity authentication notification message to the corresponding user terminal 100. As the user authentication notification message is received by the user terminal 100, the user terminal 100 transmits a pre-authentication request including user identification information, a device authentication key, and a program authentication key, and the pre-authentication request receiving module 2470 Receive the pre-authentication request.

The one time secret password generation module 2430 searches for a device authentication key and a program authentication key previously registered in the authentication server 200 by using the user identification information included in the pre-authentication request. The one-time secret password generation module 2430 generates a one-time secret password when the matched device authentication key and the program authentication key and the device authentication key and the program authentication key included in the pre-authentication request are matched to the destination designated by the user. To transmit.

When the one-time authentication key comparison module 2440 receives the one-time authentication key from the user terminal 100, the one-time authentication key comparison module 2440 compares the generated one-time authentication key with the self-generated authentication key, and if it matches, transmits the user authentication success response to the service server 400. do. If it does not match, the one-time authentication key comparison module 440 transmits a user authentication failure response to the service server 400.

The change registration module 2480 registers change of secret divisor, change registration of personal password, change registration of program authentication key according to reinstallation of authentication program, device authentication key and program authentication key according to change of user terminal 100. Perform change registration. When the secret divisor is changed, the program authentication key and the user authentication key are changed and registered together. When the personal password is changed, the user authentication key using the same is registered with the change.

Change secret divisor

The change registration module 2480 receives a secret divisor change request including a device authentication key and a program authentication key from the user terminal 100. The change registration module 2480 controls the one-time secret password generation module 2430 when the device authentication key and the program authentication key included in the secret divisor change request and the previously registered device authentication key and the program authentication key match. Issue a one-time secret password to the user. The one-time authentication key comparison module 2440 compares the one-time authentication key and transmits a matching response to the user terminal 100 when it matches. The change registration module 2480 receives the newly generated secret hash value, the user authentication key and the program authentication key from the user terminal 100 to replace the previously registered secret hash value, the user authentication key and the program authentication key. Update

Change personal password

The change registration module 2480 receives a personal password change request including a device authentication key and a program authentication key from the user terminal 100. When the device authentication key and the program authentication key included in the personal password change request and the previously registered device authentication key and the program authentication key match, the change registration module 2480 performs the one-time secret password generation module 2430. Control and issue a one-time secret password to the user. The one-time authentication key comparison module 2440 compares the one-time authentication key and transmits a matching response to the user terminal 100 when it matches. The change registration module 2480 receives a new user authentication key from the user terminal 100 and updates the registered user authentication key by replacing the pre-registered user authentication key.

Reinstallation of Certification Program

The change registration module 2480 receives a reinstallation registration message including a user authentication key, a device authentication key, and a program authentication key from the user terminal 100 as the authentication program is reinstalled in the user terminal 100. When the user authentication key and the device authentication key included in the reinstallation registration message match the pre-registered user authentication key and device authentication key, the change registration module 2480 controls the one-time secret password generation module 2430 for one-time use. Issue a secret password to the user. The one-time authentication key comparison module 2440 compares the one-time authentication key and transmits a matching response to the user terminal 100 when it matches. The change registration module 2480 replaces the previously registered program authentication key with the program authentication key included in the reinstallation registration message and updates the registered program authentication key.

Change of user terminal

The change registration module 2480 receives a device change registration message including a user authentication key, a device authentication key, and a program authentication key from the user terminal 100 after the change as the user terminal 100 changes. When the user authentication key included in the device change registration message matches the pre-registered user authentication key, the change registration module 2480 controls the one-time secret password generation module 2430 to issue a one-time secret password to the user. The one-time authentication key comparison module 2440 compares the one-time authentication key and transmits a matching response to the user terminal 100 when it matches. The change registration module 2480 updates the previously registered device authentication key and program authentication key with the device authentication key and program authentication key included in the device change registration message.

Referring to FIG. 25, the user accesses the service server 400 through the user terminal 100 and applies for membership (S2501). When registering as a user, the user may enter an ID and password, and additionally input a gender, date of birth, telephone number, and social security number. At this time, the ID input by the user is the same as the ID of the user stored in the authentication server 200. The service server 400 receiving the member subscription request transmits an identity authentication request including the ID input by the user to the authentication server 200 (S2503). In this embodiment, the identity authentication request is described as including an ID, but other user identification information, for example, a personal information that can identify the user in the authentication server 200, such as a telephone number, social security number, address, etc. It may be.

The authentication server 200 identifies user authentication information using the ID of the user included in the user authentication request received from the service server 400 and transmits a user authentication notification message to the user terminal 100 (S2505). . The user terminal 100 displays the user authentication notification message pop-up and receives an ID and a user authentication start input from the user (S2507).

The user terminal 100 transmits a pre-authentication request including an ID of the user, a device authentication key, and a program authentication key to the authentication server 200 (S2509). The authentication server 200 compares the ID, device authentication key, and program authentication key included in the pre-authentication request with the ID, device authentication key, and program authentication key of a pre-registered user. (S2511).

The authentication server 200 generates a one-time secret password using a secret hash value of a user that is registered in advance (S2513). The one-time secret password is generated according to (Equation 1) or (Equation 2) described above. The authentication server 200 transmits the one-time secret password to a destination designated by the user. In the present embodiment, it transmits to the user terminal 100 (S2515).

The user terminal 100 receives a one-time secret password issued by the authentication server 200 from the user and receives a personal password from the user (S2517). The user terminal 100 generates a user authentication key using a secret hash value and the input personal password (S2519). The user terminal 100 generates a one-time authentication key using the user authentication key and the one-time secret password input from the user (S2521).

The user terminal 100 transmits the generated one-time authentication key to the authentication server 200 (S2523). The authentication server 200 generates a one-time authentication key using the one-time secret password generated in step S2513 and a user authentication key of a user who is already registered, and generates the one-time authentication key and the user terminal 100 in step S2523. Compare the one-time authentication key received from the (S2525).

As a result of comparing the one-time authentication key, if it matches, the authentication server 200 transmits an authentication success response to the user terminal 100 and the service server 400 (S2527, S2529). On the other hand, when the comparison result of the one-time authentication key, if it does not match, the authentication server 200 transmits an authentication failure response to the user terminal 100 and the service server 400.

This embodiment described with reference to FIG. 25 is a method for authenticating a user when a user joins a service server 400. But it is not limited to this. For example, the identity authentication process described with reference to FIG. 25 is also performed when identity verification is performed offline such as a kiosk or a vending machine. That is, the kiosk or vending machine receives user identification information such as an ID from a user and directly transmits the user identification information to the authentication server 200 or transmits the user identification information to the authentication server 200 via the service server 400. You can make a request for identity verification. In this case, the kiosk or the vending machine may read the user identification information from the user terminal 100 through short-range communication such as NFC, RFID, or Bluetooth.

In addition, the authentication process described with reference to FIG. 25 may be applied when a user consults offline in a financial institution. When the user consults with an agent of a financial institution and requires his / her authentication, the user provides user identification information to the agent, and the agent terminal directly transmits the user identification information input from the agent to the authentication server 200 or the service server 400. The user identification information may be transmitted to the authentication server 200 by transmitting the user identification information. The user may verbally provide the user identification information to the counselor, or present the card storing the user identification information to the counselor, and the counselor may read the card to the reader to obtain the user identification information.

In addition, when the user purchases the goods in the online shopping mall and makes a payment, the user authentication may be performed as described with reference to FIG. 25. In addition, when performing a transaction using a POS terminal in an ATM or an offline store, the identity authentication described above may be performed at the time of identity authentication. In this way, the identity authentication according to the present embodiment can be applied to all services required for identity authentication.

According to the embodiment described above, the authentication server 200 performs a process of comparing the device authentication key and the program authentication key. That is, the authentication server 200 issues a one-time secret password only when the user uses the predetermined authentication program in the predetermined user terminal 100 and. Therefore, in the case of copying the authentication program and using it in another user terminal or using an unregistered authentication program, authentication is not successful and security is enhanced.

In addition, since the one-time secret password is generated using the secret hash value of the user, the one-time secret password cannot be inferred by analogy. In addition, the user terminal 100 does not send only the one-time secret password to the authentication server 200, and sends the user's personal password and one-time secret password encrypted by the hash algorithm, the original protection of the one-time secret password is possible. In addition, the timestamp can be used to create one-time secret passwords for added security.

Secret Hash value Kept separately

As shown in FIG. 26, the authentication system according to the present embodiment includes a user terminal 100, a master server 600, a communication network 300, and a service server 400.

The user terminal 100 includes a master program 2601 and a service program 2603.

The master program 2601 communicates with the master server 600, registers the authentication information after registering as a member with the master server 600, and then authenticates the user with the master server 600 using the authentication information. To perform. At the time of membership registration, identification information such as ID, name, date of birth, address, telephone number, etc. may be stored in the master server 600 as member information. The authentication information includes a master device authentication key, a master program authentication key, and a master user authentication key generated using a hash algorithm. Of these, the master program authentication key and the master user authentication key are generated using the master secret hash value.

The master program 2601 generates at least one service secret hash value that a user can use in the service server 400 and registers the secret secret value in the master server 600 and stores the generated secret hash value therein. At this time, when generating the service secret hash value, the master program 2601 receives a nickname of the service secret hash value from the user and stores the nickname. When the user selects any one of the at least one service secret hash value as the service secret hash value to be used by the service server 400, the master program 2601 selects a unique code of the service program 2603 as the service secret. It is also registered with the master server 600 while being stored with the hash value.

Since the service secret hash value is stored in the master program 2601 and the master server 600 in the same manner, the service secret hash value can be restored even if the user terminal 100 is changed and the master program 2601 is reinstalled.

When the master program 2601 registers or changes the service secret hash value, the master program 2601 authenticates the user by using the master device authentication key, the master program authentication key, and the master user authentication key. Enable registration or change.

The service program 2603 communicates with the service server 400 to provide a service of the service server 400 to a user. The service program 2603 registers authentication information with the service server 400 and then authenticates the user with the service server 400 using the authentication information. Here, the authentication information includes a service device authentication key, a service program authentication key, and a service user authentication key generated using a hash algorithm. Among these, the service program authentication key and the service user authentication key are generated using the service secret hash value. The service secret hash value is selected from at least one service secret hash value managed by the master program 2601.

The master server 600 registers the information for authentication in the database 610. As illustrated in FIG. 26, the master server 600 may include nicknames of at least one service secret hash value and each service secret hash value that the user may use in the service server 400 based on the user's ID. It stores in the database 610, and also stores the authentication information.

When the master server 600 requires user authentication, the master device authentication key of the user who is registered in the database 610 with the master device authentication key, the master program authentication key and the master user authentication key received from the user terminal 100. The authentication is performed by comparing the master program authentication key and the master user authentication key.

Alternatively, the master server 600, when the user authentication is required, the master device authentication key and the master device authentication key and the master device authentication key and the master program authentication key received from the user terminal 100 in the database 610 Pre-authentication is performed compared to the program authentication key. If the pre-authentication is successful, the master server 600 issues a one-time secret password and transmits it to the user. When the master server 600 receives the one-time secret password generated using the one-time secret password and the master user authentication key from the user terminal 100, by using a pre-registered master user authentication key and the issued one-time secret password The final authentication may be performed by generating a one-time authentication key and comparing with the one-time authentication key received from the user terminal 100.

When the master server 600 receives the user identification information from the service server 400, using the user identification information to identify the user authentication information and the user, the user terminal 100 and the pre-authentication and the final authentication Can be performed. The master server 600 returns the authentication result to the service server 400.

The service server 400 may be an internet web server that requires a login or a server of a financial institution that provides Internet banking or a payment server that provides electronic payment, or an agent terminal of an offline consultation window such as an offline kiosk or a financial institution. Connected servers, and so on. When the service server 400 needs to authenticate the user, the service server 400 directly communicates with the service program 2603 of the user terminal 100 to perform a user authentication process, or identify the user received from the user to the master server 600. Send information and request user authentication. The user identification information is user identification information such as an ID stored in the master server 600.

The service server 400 may store the service device authentication key, the service program authentication key, and the service user authentication key received from the user terminal 100 in the database 410 during a user authentication process through direct communication with the service program 2603. The authentication is performed by comparing the service device authentication key, the service program authentication key, and the service user authentication key of the user who is registered.

Alternatively, the service server 400 compares the service device authentication key and the service program authentication key received from the user terminal 100 with the service device authentication key and the service program authentication key of the user who are pre-registered in the database 410. Perform pre-authentication. If the pre-authentication is successful, the service server 400 issues a one-time secret password and transmits it to the user. When the service server 400 receives the one-time authentication key generated by using the service user authentication key and the one-time secret password from the user terminal 100, the service user authentication key and the issued one-time secret password are used. By generating a one-time authentication key compared to the one-time authentication key received from the user terminal 100 may perform a final authentication.

The service server 400 transmits the user identification information received from the user terminal 100 to the master server 600 and receives the authentication result from the master server 600 at the time of user authentication through the master server 600. . At this time, the master server 600 is to communicate with the master program 2601 of the user terminal 100 to authenticate the user and transmit the authentication result to the service server 400 in the manner described above.

The master server 600 and the service server 400 mean an information processing apparatus having at least a processor, a memory, and an input / output interface. The master server 600 and the service server 400 store various data and programs in a memory and execute the same through a processor to process user authentication and service provision.

The secret divisor associated with the master server 600 is the master secret divisor, and the secret divisor associated with the service server 400 is the service secret divisor. The secret hash value associated with the master server 600 is a master secret hash value, and the secret hash value associated with the service server 400 is a service secret hash value.

The master program 2601 uses a master secret hash value when generating the authentication information registered in the master server 600. In addition, the master program 2601 generates and manages at least one secret hash value, that is, a service secret hash value, which can be used when a user uses a service of the service server 400. The service secret hash value is stored in both the master program 2601 and the master server 600, and after performing the authentication process with the master server 600 even if the user terminal 100 is changed, the service from the master server 600. You can restore the secret hash value. When generating the service secret hash value, the master program 2601 receives a nickname of each service secret hash value from the user and maps the service secret hash value to the service secret hash value. Therefore, the user only needs to select a nickname when selecting one of the service secret hash values provided by the master program 2601 in the service program 2603. When the user selects the service secret hash value to be used when the user uses the service of the service server 400, the master program 2601 receives the unique code of the service program 2603 corresponding to the service server 400. The master program 2601 maps the unique code to the corresponding service secret hash value and stores it. Therefore, the mapping information of the service secret hash value / nickname / unique code is stored in the user terminal 100, and the mapping information of the service secret hash value / nickname / unique code is stored in the master server 600 based on the user ID. Is stored.

The master secret hash value and the service secret hash value are different because the seed secret divisors are different. Also, when there are a plurality of service secret hash values, the secret divisor, which is the seed of each service secret hash value, is also different, so that each service secret hash value is different. The service secret hash value is stored in synchronization with the user terminal 100 and the master server 600, but the master secret hash value is not stored in either. That is, the master secret hash value is generated by receiving a secret divisor from the user whenever necessary.

The secret hash value is not stored by itself, but may be stored encrypted. When encrypting, the secret hash value can be encrypted with the device authentication key. Therefore, when the master program 2601 attempts to use the secret hash value, the master program 2601 recovers the encrypted secret hash value and the device authentication key, and then compares the restored device authentication key with a previously stored device authentication key. To perform. If the device authentication key does not match, the subsequent process is automatically stopped.

The device authentication key may also be divided into a master device authentication key and a service device authentication key. Since the master program 2601 and the service program 2603 are installed in the same user terminal 100, the master device authentication key and the service device authentication key are the same.

The program authentication key may be divided into a master program authentication key and a service program authentication key. The master program authentication key is generated from the master device authentication key, time stamp and master secret hash value, and the service program authentication key is generated from the service device authentication key, time stamp and service secret hash value.

The user authentication key may also be divided into a master user authentication key and a service user authentication key. The master user authentication key is generated from the master secret hash value and the personal password, and the service user authentication key is generated from the service secret hash value and the personal password. In this case, the personal password input from the user when generating the master user authentication key and the personal password input when generating the service user authentication key may be different according to the user's selection.

Among the secret hash value, the device authentication key, the program authentication key, and the user authentication key described above, the device authentication key and the program authentication key are both stored in the user terminal 100 and the

servers

600 and 400, and the user authentication key is Only stored on

servers

600 and 400. The master secret hash value is not stored anywhere and is generated every time the user authenticates the master server 600 with the user. The service secret hash value is stored in synchronization with the master program 2601 and the master server 600.

The one-time secret password is a value generated at the master server 600 or the service server 400 at the time of user authentication and received at a destination designated by the user. The destination designated by the user may be the user terminal 100, or may be a wearable device carried by a separate user, or may be an email address. But it is not limited here. The one-time secret password may be received in the form of a short message (SMS) or a push message. The user may enter the one-time secret password through the keypad provided in the master program 2601 or the service program 2603 or may enter the image via an image.

The one-time authentication key is a value generated by inputting the one-time secret password input from the user and the user authentication key as a seed value to the hash function. Specifically, when a one-time secret password is issued from the server (600, 400) is transmitted to the user, the user enters the personal password and the issued one-time secret password in the program (2601, 2063). Then, the programs 2601 and 2063 generate a user authentication key using the personal password, and generate a one time authentication key using the generated user authentication key and one-time secret password. The one-time authentication key generated in this way is transmitted to the

servers

600 and 400, and the

server

600 and 400 compares the received one-time authentication key with the one-time authentication key generated by itself and successfully processes the authentication.

Authentication success can be divided into two types.

First, the programs 2601 and 2063 transmit an authentication request including the user identification information, the device authentication key, the program authentication key, and the user authentication key to the

servers

600 and 400. The

server

600 and 400 may include user identification information, device authentication key, program authentication key, and user authentication key included in the authentication request, user identification information, device authentication key, program authentication key, and user authentication key that are pre-registered. If it is the same, authentication succeeds.

Second, the programs 2601 and 2063 transmit a pre-authentication request including the user identification information, the device authentication key, and the program authentication key to the

servers

600 and 400. When the user identification information, the device authentication key, and the program authentication key included in the pre-authentication request are the same as the pre-registered user identification information, the device authentication key, and the program authentication key, the

servers

600 and 400 may use a one-time secret password. Issue to. The one-time secret password is received at a destination designated by the user. The user enters a one-time secret password via a keypad or image provided by programs 2601 and 2063. The programs 2601 and 2063 generate a one-time secret key input from the user and a user authentication key as a seed value in a hash function, and generate the one-time authentication key, and transmit them to the

servers

600 and 400. The

server

600 or 400 compares the received one-time authentication key with the one-time authentication key generated by itself, and successively authenticates the same. The

servers

600 and 400 generate a one-time authentication key by using the issued one-time secret password and a user authentication key of the user who is stored therein.

In the above description, the authentication of the user using the device authentication key, the program authentication key, and the user authentication key is described. However, the user can be authenticated using only the user authentication key. Can be used for authentication. In the case of using the device authentication key, it is possible to block attempting authentication at another user terminal 100 instead of the determined user terminal 100. In addition, when the program authentication key is used, it is possible to block a case where the program is illegally copied and used for authentication.

Meanwhile, the above-described authentication method can be applied when the user sets a new service secret hash value in the master program 2601 or changes a preset service secret hash value. That is, the master program 2601 can set a new service secret hash value when the user is successfully authenticated through the above-described authentication process with the master server 600, and also change the existing service secret hash value. .

Referring to FIG. 27, a user first executes a master program 2601 in the user terminal 100 and registers as a member of the master server 600 through the master program 2601 (S2701). That is, the user enters an ID, a social security number, a password, an address, and the like to join the master server 600. Next, the user selects the master secret divisor through the input device of the user terminal 100 (S2703). The master secret divisor may be any one of a long text string, an image file, a sound file, or a video file, but is not limited thereto.

The master program 2601 generates a master secret hash value by inputting the selected master secret divisor as a seed value to a hash function (S2705). The master program 2601 generates information for authentication (S2707). The authentication information includes a master device authentication key, a master program authentication key, and a master user authentication key. The master user authentication key is generated by inputting the master secret hash value and the personal password input from the user through the input device as a seed value to the hash function.

The master program 2601 transfers the generated authentication information to the master server 600 and registers it (S2709). The master server 600 stores authentication information based on the ID of the user. The master program 2601 also stores the master program authentication key and the master device authentication key in the user terminal 100 except for the master user authentication key.

Next, a process of generating a service secret hash value selectively used by the various service servers 400 is performed.

The user selects a service secret divisor through the input device of the user terminal 100 (S2711). The master secret divisor and the service secret divisor are chosen to be different. The user inputs a nickname for the selected service secret divisor through the input device of the user terminal 100 (S2713).

The master program 2601 generates a service secret hash value by inputting the selected service secret divisor as a seed value to a hash function (S2715). The master program 2601 transmits mapping information including the generated service secret hash value and the input nickname to the master server 600 (S2719). The master server 600 stores and registers the received mapping information (S2721). The master server 600 registers the mapping information based on the ID of the user.

The master program 2601 asks the user for the completion of the setting of the service secret hash value (S2723). When the setting completion input is received from the user, the master program 2601 ends the setting of the service secret hash value (S2725). On the other hand, when the user further sets the service secret hash value, the process from step S2711 described above is repeated.

In this way, the user can set a plurality of service secret hash values. Each service secret hash value has a different secret divisor so that the value is different. And by different nickname of each service secret hash value, user can easily distinguish each service secret hash value.

Meanwhile, the master program 2601 may encrypt each service secret hash value together with the master device authentication key and store the same in the user terminal 100 and the master server 600. In this case, when the service secret hash value is used, the service secret hash value and the master device authentication key are decrypted together, and then the master device authentication key is compared with the prestored master device authentication key, and only matches. Enable the use of service secret hash values.

28 is a flowchart illustrating a process of setting authentication information for a specific service server according to an embodiment of the present invention. For example, it is an example of setting up login authentication using the authentication information according to the present invention, rather than login authentication through ID / password while registering as a service server 400. As described above, when the login authentication using the authentication information according to the present invention is set, the user does not log in with the ID / password when logging in to the service server 400, and logs in with the authentication information according to the present invention. Can be.

Although not shown in FIG. 28, the user may execute the service program 2603 to proceed with the registration process with the service server 400. You can join by entering ID, password, and personal information.

Referring to FIG. 28, the service program 2603 requests the service secret hash value list from the master program 2601 (S2801). The service program 2603 is equipped with an API-based interworking module that communicates with the master program 2601 and communicates with the master program 2601.

The master program 2601 responds to the service program 2603 with the list of service secret hash values set by the user (S2803). The master program 2601 may transmit nicknames of the plurality of service secret hash values to the service program 2603.

The service program 2603 displays a list of the plurality of service secret hash values received from the master program 2601 (S2805), and receives one of the plurality of service secret hash values from the user (S2807). The service program 2603 transmits selection information of the selected service secret hash value, for example, a nickname and a unique code of the service program 2603, to the master program 2601 (S2809).

The master program 2601 identifies the service secret hash value from the service secret hash value and the nickname mapping information based on the received nickname, and adds the received unique code to the mapping information (S2811). Therefore, the unique code is added to the service secret hash value selected by the user among the plurality of service secret hash values present in the mapping information.

The master program 2601 transmits the service secret hash value confirmed based on the received nickname to the service program 2603 (S2813). The service program 2603 generates authentication information using the received service secret hash value (S2815). Here, the authentication information includes a service device authentication key, a service program authentication key, and a service user authentication key. The service device authentication key is a value generated by inputting unique information of the user terminal 100, for example, a MAC address or universally unique identifier (UUID) of a network interface card (NIC), as a seed value to a hash function. The service program authentication key is a value generated by inputting the service device authentication key, time stamp, and service secret hash value into the hash function as a seed value. The service user authentication key is a value generated by inputting the service secret hash value and the personal password input from the user through the input device as a seed value to the hash function.

The service program 2603 transmits the generated authentication information to the service server 400 (S2817). The service server 400 stores authentication information based on the ID of the user (S2819). The service program 2603 also stores the service program authentication key and the service device authentication key in the user terminal 100 except for the service user authentication key.

FIG. 29 is a flowchart illustrating a process of logging in to the service server 400 after the setting process of FIG. 28.

Referring to FIG. 29, after the user executes the service program 2603 on the user terminal 100, the user makes a login request according to the present invention to the service server 400 (S2901). In this case, the user may input an ID. Therefore, the service server 400 transmits the data of the personal password input window to the service program 2603, and the service program 2603 displays the personal password input window (S2903).

The service program 2603 receives a personal password through an input device of the user terminal 100 (S2905).

The service program 2603 retrieves the service device authentication key and the service program authentication key stored therein (S2907). At this time, the service program 2603 can verify the service device authentication key. That is, the service program 2603 inputs the unique information of the user terminal 100, for example, the MAC address or universally unique identifier (UUID) of the network interface card (NIC) as a seed value to the hash function to authenticate the service device. After the key is generated, it is compared with the service device authentication key pre-stored therein.

The service program 2603 transmits a pre-authentication request including the retrieved service device authentication key and service program authentication key to the service server 400 (S2909). The service server 400 compares the service device authentication key and the service program authentication key included in the pre-authentication request with the service device authentication key and the service program authentication key of a pre-registered user. (S2911). In this case, the service server 400 may search for a service device authentication key and a service program authentication key of a user who are pre-registered using the user ID.

The service server 400 generates a one-time secret password (S2913). A one-time secret password consists of a number of digits. The service server 400 transmits the one-time secret password to a destination designated by a user. In the present embodiment, it transmits to the user terminal 100 (S2915).

The service program 2603 sends a unique code of the service program to the master program 2601 and requests a service secret hash value (S2917). The master program 2601 retrieves a service secret hash value corresponding to the unique code from the mapping information stored therein using the received unique code (S2919). The master program 2601 transmits the retrieved service secret hash value to the service program 2603 (S2921).

The service program 2603 generates a service user authentication key using the received service secret hash value and the personal password input in step S2905 (S2923). That is, the service program 2603 generates the service user authentication key by inputting the received service secret hash value and the personal password input in the step S2905 into the hash function as a seed value.

The service program 2603 receives a one-time secret password received in the step S2915 from the user, inputs the one-time secret password and the service user authentication key generated in the step S2923 as a seed value in a hash function to input the one-time authentication key. It generates (S2925). The service program 2603 transmits the generated one-time authentication key to the service server 400 (S2927).

The service server 400 verifies the one-time authentication key received from the user terminal 100 (S2929). That is, the service server 400 generates a one-time authentication key by inputting the service user authentication key of the user, and the one-time secret password generated in step S2913 into the hash function, and the generated one-time authentication key and the The one-time authentication key received in step S2927 is compared. As a result of the comparison, it is determined that the authentication is successful.

If the service server 400 succeeds in authenticating, the service server 400 transmits an authentication success response to the service program 2603 (S2931).

As described above with reference to FIG. 29, the user does not need to select a secret divisor to log in to the service server 400, but merely inputs a personal password and a one-time secret password issued from the service server 400. You can log in to the service server 400.

In the embodiment with reference to FIG. 29, it will be described that the user is authenticated using a one-time secret password. But you don't have to use a one-time secret password. That is, when a personal password is input from the user in step S2905, the service program 2603 performs steps S2917 to S2921 to receive the service secret hash value from the master program 2601, and then the service device authentication key and service program authentication. The key and the service user authentication key are transmitted to the service server 400. The service server 400 may store a service device authentication key, a service program authentication key, and a service user authentication key of a user, and a service device authentication key, a service program authentication key, and a service user authentication received from the service program 2603. By comparing the keys, if they all match, it can be determined that authentication is successful.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, the features described in the individual embodiments herein can be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment herein can be implemented individually in various embodiments or in combination as appropriate.

Although the operations are described in a particular order in the drawings, they should not be understood as being performed in a particular order as shown, or in a sequence of successive orders, or all described actions being performed to obtain a desired result. . Multitasking and parallel processing may be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be packaged in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

Claims

An apparatus for performing authentication by communicating with an authentication server,

A device authentication key generation module for collecting unique information of the device and generating a device authentication key using the unique information;

A program authentication key for generating a secret hash value by applying a hash function to a secret divisor input from a user, generating a time stamp, and generating a program authentication key using the secret hash value, the time stamp, and the device authentication key. Generation module;

A user authentication key generation module for generating a user authentication key using a personal password input from a user and the secret hash value; And

And a management module configured to transmit authentication information including user identification information input from a user, the device authentication key, the program authentication key, and the user authentication key to the authentication server.
The method of claim 1,

The device authentication key generation module,

A device authentication key is generated every time it is executed, compared with a previously stored device authentication key, and if it does not match, the module is deleted.
The method of claim 1,

The management module,

Upon receiving an input relating to the change of the personal password for the authentication server, the user authentication key generation module is controlled to generate a new user authentication key, the new user authentication key, the previous user authentication key, the device authentication key, and program authentication. And a personal password change request including a key and the user identification information to the authentication server.
The method of claim 1,

The management module,

Upon receiving an input regarding the change of the secret divisor to the authentication server, the program authentication key generation module and the user authentication key generation module are controlled to generate a new program authentication key and a new user authentication key, and a new program authentication key, And transmit a secret divisor change request including a new user authentication key, a previous program authentication key, a previous user authentication key, the device authentication key, and the user identification information to the authentication server.
The method according to any one of claims 1 to 4,

The management module,

The program authentication key generation module and the user authentication key generation module are controlled to differently generate at least one of a program authentication key and a user authentication key for each of a plurality of authentication servers, and for different authentication to each of the plurality of authentication servers. Device for transmitting information.
A device for performing authentication by communicating with a user device,

A subscription information management module for receiving and storing subscription information including user identification information from the user device;

An authentication information management module for receiving and storing authentication information including user identification information, device authentication key, program authentication key, and user authentication key from the user device; And

When receiving the approval request from the approval requester, a notification message is transmitted to the user device, and in response to the user identification information, device authentication key, program authentication key and user authentication key received from the user device for the stored authentication An authentication processing module for comparing the information and sending an approval response to the approval requester if all match.
The method of claim 6,

The authentication information management module,

Receiving a device change request including a device authentication key, a program authentication key, a user authentication key, and user identification information from the user device,

Search for a user authentication key previously stored using the user identification information included in the device change request, compare the user authentication key with the user authentication key included in the device change request; And modifying a program authentication key into a device authentication key and a program authentication key included in the device change request.
The method of claim 6,

The authentication information management module,

Receive a personal password change request including a new user authentication key, a previous user authentication key, a device authentication key, a program authentication key, and user identification information from the user device,

After the user authentication key, the device authentication key, and the program authentication key are previously stored using the user identification information included in the personal password change request, the previous user authentication key, device authentication key, Compared with the program authentication key, and if all match, the previously stored user authentication key is modified with a new user authentication key included in the personal password change request.
The method of claim 6,

The authentication information management module,

Receive a secret divisor change request including a new program authentication key, a new user authentication key, a previous program authentication key, a previous user authentication key, a device authentication key, and user identification information from the user device,

After retrieving the user authentication key, program authentication key and device authentication key previously stored using the user identification information included in the secret divisor change request, the previous user authentication key and the previous program authentication key included in the secret divisor change request And comparing the device authentication keys and, if all of them match, modifying previously stored user authentication keys and program authentication keys into new user authentication keys and new program authentication keys included in the secret divisor change request.
The method according to any one of claims 6 to 9,

The device authentication key,

And generate using the unique information of the user device.
The method of claim 10,

The program authentication key,

And a secret hash value generated by applying a hash function to a secret divisor input from a user, a timestamp, and the device authentication key.
The method of claim 11,

The user authentication key,

And a personal password input from a user and the secret hash value.
A device for authenticating a user by communicating with a server,

A secret hash value generation module for generating and storing a secret hash value by inputting a secret divisor input from a user as a seed value to a hash function, and transmitting and registering the secret hash value to the server;

A one-time secret password input module for receiving a one-time secret password; And

Inputting the one-time secret password and the secret hash value received from the one-time secret password input module to the hash function as a seed value to generate a user authentication key, and transmitting the user authentication key to the server; And a user authentication key generation module configured to receive a comparison result of the user authentication key generated by the server from the server.

The user authentication key generated in the server is a value generated by inputting a secret hash value registered in the server and a one-time secret password generated in the server as a seed value in a hash function.

Device.
The method of claim 13,

The one-time secret password is generated in the server and received at the destination designated by the user,

The one-time secret password input module, characterized in that for receiving a one-time secret password received at the destination from the user.
The method of claim 14,

And the destination designated by the user is either the apparatus or the wearable device of the user.
The method of claim 14,

And the one-time secret password is a value generated by inputting a time stamp and the secret hash value registered in the server as a seed value in a random number function.
The method of claim 13,

The one-time secret password is generated in a portable one-time secret password generator,

The one-time secret password input module, characterized in that for receiving the one-time secret password generated by the portable one-time secret password generator from the user.
The method of claim 17,

The portable disposable secret password generator may store a secret hash value that is the same as the secret hash value generated by the secret hash value generation module,

The disposable secret password,

And a value generated by inputting a secret hash value and a time stamp into the random number function as a seed value in the portable disposable secret password generator.
The method of claim 13,

The secret hash value generated by the secret hash value generating module is stored in the NFC card,

The user authentication key generation module, characterized in that for generating the user authentication key by reading the secret hash value stored in the NFC card from the NFC card.
The method of claim 13,

And a device authentication key generation module for storing a device authentication key generated by inputting unique information of the device as a seed value and transmitting the device authentication key to the server and registering the device authentication key.
The method of claim 20,

The device authentication key generation module,

Each time the authentication is performed, the device authentication key stored in advance is transmitted to the server, and the device receives the comparison result with the device authentication key previously stored in the server.
The method of claim 20,

A program authentication key generation module for storing a program authentication key generated by inputting a time stamp, the device authentication key, and the secret hash value into a hash function as a seed value, and transmitting the program authentication key to the server for registration; Apparatus comprising a.
The method of claim 22,

The program authentication key generation module,

Each time authentication, the program authentication key stored in advance is transmitted to the server, and then the comparison result with the program authentication key previously stored in the server is received from the server.
A device for authenticating a user by communicating with a user device, the device comprising:

A secret hash value registration module configured to receive and register a secret hash value generated by inputting a secret divisor input from a user into a hash function as a seed value from the user device;

A one time secret password generation module for generating a one time secret password; And

Upon receiving a user authentication key from the user device, the received user authentication key is compared with the user authentication key generated by inputting the registered secret hash value and the generated one-time secret password as a seed value to a hash function. An authentication processing module for authenticating the user.
The method of claim 24,

The one-time secret password generation module transmits the generated one-time secret password to a destination designated by the user,

And the authentication processing module receives a user authentication key generated by inputting a one-time secret password transmitted to the destination and a secret hash value stored in the user device as a seed value to a hash function, from the user device. .
The method of claim 25,

The one-time secret password generation module generates the one-time secret password by inputting the registered secret hash value and time stamp as a seed value to a random number function.
The method of claim 24,

The authentication processing module may receive from the user device a user authentication key generated by inputting a one-time secret password generated by a portable one-time secret password generator and a secret hash value stored in the user device as a seed value in a hash function. Device.
The method of claim 27,

The portable disposable secret password generator stores a secret hash value equal to the registered secret hash value,

The one-time secret password generated by the portable one-time secret password generator is generated by inputting a secret hash value and a time stamp stored in the portable one-time secret password generator as a seed value to the random number function,

The one-time secret password generation module generates a one-time secret password by inputting the registered secret hash value and time stamp as a seed value to a random number function.
The method of claim 24,

The authentication processing module,

Receive and register a device authentication key generated by inputting unique information of the user device into a hash function as a seed value from the user device, and compare the device authentication key received from the user device with the registered device authentication key every time authentication is performed. Device characterized in that.
The method of claim 29,

The authentication processing module,

A program authentication key generated by inputting a time stamp, the device authentication key, and the secret hash value into a hash function as a seed value from the user device, and registering the program authentication key received from the user device every time; And compare the registered program authentication key.
A device for communicating with an authentication server,

One or more processors;

Memory; And

A program stored in the memory and configured to be executed by the one or more processors,

The program,

A secret hash value generation module for generating and storing a secret hash value by inputting a secret divisor input from a user into a hash function as a seed value, and transmitting and registering the secret hash value to the authentication server;

A user authentication key generation module for generating a user authentication key by inputting a personal password inputted from a user and the secret hash value into a hash function as a seed value, and transmitting and registering the user authentication key to the authentication server;

A one-time secret password input module for receiving a one-time secret password issued by the authentication server; And

The one-time secret password input from the one-time secret password input module and the user authentication key is input to the hash function as a seed value to generate a one-time authentication key and transmit the one-time authentication key to the authentication server, the one-time authentication key transmitted And a one-time authentication key generation module for receiving a comparison result of the one-time authentication key generated by the authentication server from the authentication server.
The method of claim 31, wherein

A device authentication key generation module which collects the unique information of the device and inputs the unique information as a seed value to the hash function to generate and store a device authentication key, and transmits and registers the device authentication key to the authentication server. Containing device.
33. The method of claim 32,

The device authentication key generation module,

Each time the program is executed, a device authentication key is generated and compared with a previously stored device authentication key, and if it does not match, the device is deleted.
The method of claim 33, wherein

After generating a timestamp, the timestamp, the secret hash value, and the device authentication key are input to the hash function as a seed value to generate and store a program authentication key, and transmit the program authentication key to the authentication server for registration. And a program authentication key generation module.
The method of claim 34, wherein

And a pre-authentication request module for transmitting a pre-authentication request including the device authentication key and the program authentication key to the authentication server in response to receiving the user authentication notification message from the authentication server.

The disposable secret password,

A device authentication key and a program authentication key included in the pre-authentication request and a device authentication key and a program authentication key pre-registered in the authentication server as a result of the comparison, if both match, characterized in that issued by the authentication server .
36. The method of claim 35 wherein

The pre-authentication request module,

The authentication server receives the user authentication notification message from the authentication server as the authentication server receives the identification information of the user from the service server.
The method of claim 34, wherein

And a change module configured to transmit a secret divisor change request including the device authentication key and the program authentication key to the authentication server.

The change module,

The device authentication key and the program authentication key included in the secret divisor change request match the device authentication key and the program authentication key previously registered in the authentication server, and the one-time authentication key generation module generates a matching response of the one-time authentication key. When receiving, the apparatus characterized in that the new secret hash value, a new user authentication key and a new program authentication key is generated by controlling the secret hash value generation module, the user authentication key generation module and the program authentication key generation module. .
The method of claim 34, wherein

And a change module configured to transmit a personal password change request including the device authentication key and the program authentication key to the authentication server.

The change module,

The device authentication key and the program authentication key included in the personal password change request match with the device authentication key and the program authentication key previously registered in the authentication server, and the one-time authentication key generation module matches the one-time authentication key. When receiving, the apparatus characterized in that the new user authentication key is generated by controlling the user authentication key generation module.
The method of claim 34, wherein

When the program is reinstalled, the secret hash value, the user authentication key, the device authentication key, and the program authentication are controlled by the secret hash value generation module, the user authentication key generation module, the device authentication key generation module, and the program authentication key generation module. After the key is generated, a reinstallation registration message including the user authentication key, the device authentication key, and the program authentication key is transmitted to the authentication server, and the user authentication key and the device authentication key included in the reinstallation registration message are the authentication server. A change module that matches a user authentication key and a device authentication key registered in advance, and receives a reinstallation registration completion response from the authentication server when the one-time authentication key generation module receives a matching response of the one-time authentication key. Apparatus comprising a.
The method of claim 34, wherein

When the device is changed, the secret hash value, the user authentication key, the device authentication key and the program authentication are controlled by controlling the secret hash value generation module, the user authentication key generation module, the device authentication key generation module, and the program authentication key generation module. After generating the key, a device change registration message including the user authentication key, the device authentication key, and the program authentication key is transmitted to the authentication server, and the user authentication key included in the device change registration message is written to the authentication server. And a change module that matches the registered user authentication key and receives a device change registration completion response from the authentication server when receiving the matching response of the one time authentication key in the one time authentication key generation module. Device.
The method of claim 31, wherein

The disposable secret password,

And generate the secret hash value in the authentication server.
42. The method of claim 41 wherein

The disposable secret password,

And generate using a timestamp and the secret hash value.
A device for communicating with a user device,

One or more processors;

Memory; And

A program stored in the memory and configured to be executed by the one or more processors,

The program,

A secret hash value registration module configured to receive and register a secret hash value generated by inputting a secret divisor input from a user as a seed value from a user device, from the user device;

A user authentication key registration module for receiving and registering a user authentication key generated by inputting a user's personal password and the secret hash value into a hash function as a seed value from the user device;

A one-time secret password generation module for generating a one-time secret password and transmitting it to the user; And

When the one-time authentication key is received from the user device, the received one-time authentication key is compared with the one-time authentication key generated by inputting the registered user authentication key and the one-time secret password as a seed value to a hash function, and comparing the same. And a one-time authentication key comparison module for transmitting a result to the user device.
The method of claim 43,

And a device authentication key registration module configured to receive and register a device authentication key generated by inputting unique information of the user device into a hash function as a seed value from the user device.
The method of claim 44,

And a program authentication key registration module for receiving and registering a program authentication key generated by generating a timestamp, inputting the timestamp, the secret hash value, and the device authentication key as a seed value to a hash function from the user device. Containing device.
The method of claim 45,

A pre-authentication request receiving module which transmits a user authentication notification message to the user device and receives a pre-authentication request including the device authentication key and the program authentication key from the user device in response thereto;

The one-time secret password generation module,

And comparing the device authentication key and the program authentication key included in the pre-authentication request with the pre-registered device authentication key and the program authentication key and generating the one-time secret password if they all match.
The method of claim 46,

The pre-authentication request receiving module,

And transmitting the identity authentication notification message to the user device in response to receiving the identification information of the user from a service server.
The method of claim 45,

And a change registration module configured to receive a secret divisor change request from the user device including the device authentication key and the program authentication key.

The change registration module,

When the device authentication key and the program authentication key included in the secret divisor change request match the pre-registered device authentication key and the program authentication key, and the result of comparing the one-time authentication key in the one-time authentication key comparison module matches, And receive and update a new secret hash value, a new user authentication key, and a new program authentication key from the user device.
The method of claim 45,

And a change registration module configured to receive a personal password change request from the user device including the device authentication key and the program authentication key.

The change registration module,

When the device authentication key and the program authentication key included in the personal password change request and the pre-registered device authentication key and program authentication key match, and the result of comparing the one-time authentication key in the one-time authentication key comparison module, And receive and update a new user authentication key from the user device.
The method of claim 45,

When the program is reinstalled in the user device, a reinstallation registration message including a secret hash value, a user authentication key, a device authentication key, and a program authentication key generated in the user device is received from the user device, and the message is included in the reinstallation registration message. A change registration module for updating a program authentication key when the user authentication key and the device authentication key match the pre-registered user authentication key and the device authentication key, and when the one-time authentication key comparison module compares the one-time authentication key. The apparatus further comprises.
The method of claim 45,

When the user device is changed, a device change registration message including a secret hash value, a user authentication key, a device authentication key, and a program authentication key is received from the user device after the change, and the user authentication key included in the device change registration message is changed. And a change registration module for updating the device authentication key and the program authentication key when the matching with the user authentication key previously registered in the authentication server and matching with the result of the one-time authentication key comparison in the one-time authentication key comparison module. Device characterized in that.
The method of claim 43,

The one-time secret password generation module,

And generate a one-time secret password using the secret hash value.
The method of claim 52, wherein

The one-time secret password generation module,

And generate a one-time secret password using a timestamp and the secret hash value.
A device for communicating with a master server and a service server,

One or more processors;

Memory; And

A master program and a service program stored in the memory and configured to be executed by the one or more processors,

The master program,

Generate and store a plurality of different service secret hash values using different service secret divisors input from the user,

The service program,

A service user authentication key is generated using a selected service secret hash value among the plurality of service secret hash values and a personal password, and the service user authentication key is transmitted to the service server as authentication information and registered;

The master program,

And store the unique code received from the service program by mapping it to the selected service secret hash value among the plurality of service secret hash values.
The method of claim 54, wherein

The service program, upon authentication of the user,

Input a personal password and a one-time secret password issued by the service server,

Transmitting the unique code to the master program to request a service secret hash value and receiving a service secret hash value corresponding to the unique code from the master program in response thereto;

Generating a service user authentication key using the received service secret hash value and the input personal password, and requesting an authentication request including the service user authentication key and the one-time authentication key generated using the one-time secret password. Transmitting to the service server, and receiving an authentication response according to a result of comparing the one-time authentication key generated by the service server with the one-time authentication key included in the authentication request.
The method of claim 55,

The master program,

Generate a master device authentication key using the unique information of the device and encrypt each of the plurality of service secret hash values together with the master device authentication key,

Upon receipt of a request for a service secret hash value from the service program, decrypting the service secret hash value and the master device authentication key and then verifying the decrypted master device authentication key.
The method of claim 55,

The service program,

Generate and store a service device authentication key using the unique information of the device, generate and store a service program authentication key using the service device authentication key and the selected service secret hash value and time stamp, and authenticate the service device. Transmits and registers a key and the service program authentication key to the service server as authentication information,

Upon authentication of the user,

Transmitting a pre-authentication request including the stored device authentication key and the stored service program authentication key to the service server,

The one-time secret password is issued when the device authentication key and the service program authentication key registered in the service server and the device authentication key and the service program authentication key included in the pre-authentication request match.
The method of claim 54, wherein

The service program, upon authentication of the user,

Transmitting the unique code to the master program and receiving a service secret hash value corresponding to the unique code from the master program in response thereto;

A service user authentication key is generated using the received service secret hash value and a personal password input from a user, and an authentication request including the service user authentication key is transmitted to the service server. And receive an authentication response according to a result of comparing a service user authentication key with a service user authentication key included in the authentication request.
The method of claim 54, wherein

The master program,

Receives and stores nicknames for each of the plurality of service secret hash values,

The service program,

Receiving a service secret hash value based on nicknames received from the master program.
The method of claim 54, wherein

The master program,

A master secret hash value is generated using a master secret divisor input from a user, a master user authentication key is generated using a personal password and the master secret hash value, and the master server is used as authentication information. Register to send to,

When creating or changing a service secret hash value,

And to generate or change a service secret hash value upon successful authentication using the master user authentication key.
The method of claim 60,

When the master program generates or changes a service secret hash value,

And generate or change a service secret hash value upon successful authentication using the master user authentication key and a one-time secret password issued by the master server.
The method of claim 60,

The master program,

Generate and store a master device authentication key using the unique information of the user device, and generate and store a master program authentication key using the master device authentication key, the master secret hash value, and a time stamp, and authenticate the master device. Transmits and registers a key and the master program authentication key to the master server as authentication information,

When creating or changing a service secret hash value,

Performing pre-authentication using the master device authentication key and the master program authentication key, and performing final authentication using the master user authentication key.