WO2016068570A1

WO2016068570A1 - Method and system for user authentication, using se of mobile terminal

Info

Publication number: WO2016068570A1
Application number: PCT/KR2015/011365
Authority: WO
Inventors: 전미숙
Original assignee: 에스케이 주식회사
Priority date: 2014-10-31
Filing date: 2015-10-27
Publication date: 2016-05-06
Also published as: KR20160050914A

Abstract

Provided are a method and a system for user authentication, using an SE of a mobile terminal. The method for user authentication, according to one embodiment of the present invention, requests and receives authentication information by the SE of the mobile terminal, transmits authentication information-based display information to a user terminal, and refers to the display information displayed on a user terminal so as to perform an authentication procedure for a user on the basis of input information inputted into the mobile terminal by the user. Therefore, the user authentication is performed by using the mobile terminal having the SE, with respect to the service provided through the user terminal, wherein the reliability of the user authentication using a multi-channel is further increased since the authentication procedure is performed by an interaction between the SE and a server.

Description

User authentication method and system using SE of mobile terminal

The present invention relates to user authentication, and more particularly, to a method and system for performing user authentication in the process of providing a service through a user terminal such as a personal computer (PC).

In providing a service to a PC via the Internet, user authentication is often required, and the authentication methods are very diverse. In the past, authentication schemes using passwords have become mainstream.

However, the expansion of mobile terminals has led to the introduction of two-channel authentication method using mobile terminals, and there are also attempts to utilize USIM (Universal Subscriber Identity Module) cards installed in mobile terminals as one time password (OTP) terminals. .

This is to generate OTP by USIM card, not OTP terminal in Internet banking using PC, and the user is evaluated to be advanced in that secure internet banking is possible without carrying OTP terminal.

However, OTP is only generated by the USIM card alone, and there is no interaction between the server side and the USIM card for user authentication, so there is no doubt that the security is weak.

The present invention has been made to solve the above problems, an object of the present invention, after displaying the authentication information generated by the SE (Secure Element) of the mobile terminal to the user terminal, the user inputs through the mobile terminal It is to provide a method and system for performing user authentication.

A user authentication method according to an embodiment of the present invention for achieving the above object, the step of requesting authentication information to the SE (Secure Element) of the mobile terminal; Receiving the authentication information from the SE; Transmitting display information based on the authentication information to a user terminal; And performing an authentication procedure for the user based on the input information input by the user to the mobile terminal with reference to the display information displayed on the user terminal.

The display information is the same as the authentication information, and the mobile terminal may transmit the input information input by the user to the SE.

The requesting step may be performed when authentication of the user is required while providing a service through the user terminal.

In the performing of the authentication procedure, if the input information of the user and the authentication information are the same, the user may be authenticated as a legitimate user.

In addition, the authentication information is generated by the SE, and whether the input information and the authentication information is the same, the SE determines, and the user authentication method according to an embodiment of the present invention, the user authentication from the SE Receiving a result; may further include.

After the SE transmits the authentication information, the SE may request the mobile terminal to receive the display information from the user.

The display information may be authentication information reproduced from the authentication information.

The performing of the authentication procedure may include: receiving the input information of the user; And authenticating the user as a legitimate user if the input information and the regenerated authentication information are the same.

On the other hand, according to another embodiment of the present invention, the server, the communication unit for communicating with the SE and the user terminal of the mobile terminal; And requesting and receiving authentication information from the SE through the communication unit, and transmitting display information based on the authentication information to the user terminal, and inputting the user to the mobile terminal with reference to the display information displayed on the user terminal. It includes; an authentication processing unit for performing an authentication procedure for the user based on the input information.

On the other hand, user authentication method according to another embodiment of the present invention, the SE of the mobile terminal, generating the authentication information; Transmitting, by the SE, the generated authentication information to a server; Receiving, by the SE, the input information input by the user to the mobile terminal from the mobile terminal; And performing, by the SE, an authentication procedure for the user based on the input information, wherein the input information includes the display displayed on a user terminal receiving display information based on the authentication information from the server. The information may be information input by the user to the mobile terminal.

On the other hand, according to another embodiment of the present invention, the SE, an interface for communicating with the mobile terminal; And generating authentication information and transmitting the authentication information to a server through the mobile terminal, receiving input information input by the user through the interface through the interface, and authenticating the user based on the authentication information and the input information. And a processor configured to perform the operation, wherein the input information may be information input by the user to the mobile terminal with reference to the display information displayed on the user terminal receiving display information based on the authentication information from the server. .

As described above, according to the embodiments of the present invention, after displaying the authentication information generated by the SE of the mobile terminal on the user terminal, the user can be input through the mobile terminal, so that user authentication can be performed. . Since user authentication is performed based on information generated by SE, the world's most secure medium, user authentication is highly reliable.

In addition, although the user authentication for the service provided through the user terminal such as a PC is performed using the mobile terminal provided with the SE, the authentication process is performed by the interaction between the SE and the server. The credibility of the authentication becomes higher.

In addition, by strengthening the security of the authentication information transmitted from the server to the user terminal, there is an advantage that the overall security is very excellent.

1 and 2 are views provided in a conceptual description of embodiments of the present invention,

3 is a flowchart provided to explain a user authentication method according to an embodiment of the present invention;

4 is a flowchart provided to explain a user authentication method according to another embodiment of the present invention;

5 is a flowchart provided to explain a user authentication method according to another embodiment of the present invention;

6 is a block diagram of a server, and

7 is a block diagram of a USIM card.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

1. User Authentication System

1 and 2 are diagrams provided for illustrating a concept of embodiments of the present invention. In the embodiments of the present invention, as shown in FIG. 1, the server 100 provides a service through the personal computer (PC) 200 of the user, as shown in FIG. 2. The user authentication procedure is performed using the 200 and the mobile terminal 300.

When the service provided in FIG. 1 is an internet banking service, the user authentication performed in FIG. 2 may be one time password (OTP) authentication. In addition, when the service provided in FIG. 1 is internet shopping, the user authentication performed in FIG. 2 may be additional user authentication (for example, authentication such as an assured click) in the online payment process.

However, there is no limitation on the type of service provided in FIG. 1 and the type of user authentication performed in FIG. 2, and the technical spirit of the present invention may be applied to other services / authentications other than the illustrated service / authentication.

The user authentication procedure performed in FIG. 2 is performed by displaying an authentication number on the user's PC 200 and inputting the authentication number displayed on the PC 200 to the user's mobile terminal 300.

The authentication number displayed on the PC 200 is transmitted by the server 100. That is, the PC 200 displays the authentication number received from the server 100 as it is on the monitor screen.

On the other hand, the authentication number is generated by the Universal Subscriber Identity Module (USIM) card 400 mounted on the mobile terminal 300. That is, the server 100 transmits the authentication number generated by the USIM card 400 to the PC 200.

The USIM card 400 compares the authentication number generated by the user with the authentication number input by the user through the mobile terminal 300 to perform user authentication, and transmits the authentication result to the server 100.

For the embodiment of the present invention, the server 100 and the PC 200, as well as the communication connection, as well as the server 100 and the USIM card 400 should be connected by communication, the connection method is different from each other. The connection between the server 100 and the PC 200 is by wired / wireless Internet communication, but the connection between the server 100 and the USIM card 400 is by OTA (Over The Air) communication.

While the USIM card 400 strictly communicates with the server 100 through the mobile terminal 300 to which the USIM card 400 is mounted, the mobile terminal 300 merely functions as a communication medium and the communication subject is the USIM card 400. to be. Therefore, for convenience of understanding and description, in the present specification, the USIM card 400 will be described as directly communicating with the server 100, but it should be noted that the communication is substantially performed through the medium of the mobile terminal 300. do.

2. User Authentication Process by USIM Card

Hereinafter, a process of performing a user authentication procedure while providing the service illustrated in FIGS. 1 and 2 will be described in detail with reference to FIG. 3. 3 is a flowchart provided to explain a user authentication method according to an embodiment of the present invention.

As shown in FIG. 3, in order to perform user authentication accompanying the service providing process, the user is required to subscribe to the service through the PC 200 as well as to subscribe to the user authentication service (S505 and S510).

By subscribing to the user authentication service, the server 100 issues a user authentication applet 450 to the USIM card 400 (S515), and the USIM card 400 installs it (S520). The user authentication applet 450 is an applet that generates the aforementioned authentication number and includes a random number generator.

When subscribing to the user authentication service, phone number entry is required, and the server 100 may issue a user authentication applet 450 to the corresponding USIM card 400 through the entered phone number.

Steps S505 to S520 are preliminary procedures for performing user authentication in a service providing process. After step S505 to step S520, the user may receive a service from the server 100 through the PC 200 (S525). The service provided in step S525 refers to the aforementioned internet banking, internet shopping, and the like.

If user authentication is required while providing a service (S530), the server 100 requests an authentication number from the user authentication applet 450 issued / installed on the USIM card 400 (S535). User authentication in step S530 is an additional authentication procedure.

That is, in the case of Internet banking, password input and public certificate authentication are included in the service range of step S525, and OTP authentication corresponds to user authentication required in step S530. Similarly, in the case of Internet shopping, the card number, expiration date and CVC number input are included in the service range of step S525, and additional authentication by additional authentication numbers such as secure click corresponds to user authentication required in step S530. .

In operation S535, the user authentication applet 450 that has received the authentication number generates an authentication number (S540). In generating the authentication number in step S540, a random number generator included in the user authentication applet 450 is used. The random number generator generates a random number based on a key shared with the server 100, and the generated random number becomes an authentication number.

The user authentication applet 450 transmits the authentication number generated in step S540 to the server 100 (S545). Then, the server 100 transmits the authentication number received in step S545 to the PC 200 (S550), and the PC 200 displays the authentication number received in step S550 on the monitor screen (S555).

Meanwhile, the user authentication applet 450 which transmits the authentication number to the server 100 in step S545 requests the display of the authentication number input window from the mobile terminal 300 (S560). The authentication number input window is a window displayed on the screen of the mobile terminal 300 to input the authentication number displayed on the PC 200 as shown in FIG.

In response to the request in step S560, the mobile terminal 300 displays the authentication number input window (S565). Then, when the user enters the authentication number displayed on the PC 200 in step S555 through the authentication number input window (S570), the mobile terminal 300 transmits the authentication number entered by the user to the user authentication applet 450. (S575).

Then, the user authentication applet 450 compares the authentication number input by the user received in step S575 and the authentication number generated in step S540, and authenticates whether the user is a legitimate user (S580). The two authentication numbers turn out to be legitimate users if they match, but are not legitimate users if they do not match.

Thereafter, the user authentication applet 450 transmits the authentication result in step S580 to the server 100 (S585). Then, the server 100 provides subsequent services based on the authentication result received in step S585 (S590).

3. User authentication procedure with enhanced security of authentication information

4 is a flowchart provided to explain a user authentication method according to another embodiment of the present invention. The user authentication method illustrated in FIG. 4 is a method of strengthening the security of the authentication number transmitted from the server 100 to the PC 200 in the user authentication method of FIG. 3.

Specifically, in the embodiment of the present invention, the server 100 does not transmit the authentication number received through the step S545 to the PC 200 as it is, but encrypts the user's personal information (S547), the encrypted authentication number To transmit to the PC 200 (S550).

Accordingly, the PC 200 decrypts the encrypted authentication number received in step S550 into user's personal information (S553), and displays the decrypted personal information on the monitor screen (S555).

With the personal information, the user ID set by the user and the user PW (PassWord) can be used. When the server 100 encrypts the authentication number with the user PW, the user must additionally input the user PW to the PC 200 for decryption in step S553.

However, when the server 100 encrypts the authentication number with the user ID, the user does not need to additionally input the user ID through the PC 200 for decryption in step S553. This is because the user ID is stored in the storage area of the PC 200 during the service (that is, the PC 200 knows the user ID).

4. User Authentication Process by Server Side

5 is a flowchart provided to explain a user authentication method according to another embodiment of the present invention. The user authentication method illustrated in FIG. 5 is different from the user authentication method illustrated in FIG. 3 in which the USIM card 400 determines the validity of the user in that the server 100 determines the validity of the user.

Since steps S605 to S645 of FIG. 5 are the same as steps S505 to S545 of FIG. 3, detailed description thereof will be omitted and will be described from step S650.

Receiving the authentication number from the user authentication applet 450, the server 100 regenerates the authentication number from the received authentication number (S650), and transmits the regenerated authentication number to the display number to be displayed on the user's PC 200. (S655).

In the embodiment of the present invention, since the server 100 uses the authentication number regenerated from the authentication number received from the user authentication applet 450 as the display number of the PC 200, the user authentication applet 450 generates the user authentication applet 450. The authentication number and the display number of the PC 200 are not the same.

In this respect, the authentication number generated by the user authentication applet 450 and the display number of the PC 200 are different from the embodiment shown in FIG. 3. In the embodiment of FIG. 3, the server 100 transmits the authentication number received from the user authentication applet 450 to the display number to be displayed on the user's PC 200 without change.

On the other hand, in step S650, there is no restriction on the regeneration scheme of the authentication number. In addition, the authentication number can be regenerated by calculating the hash value of the authentication number, as well as generating a new random number using the authentication number as a seed value and regenerating the authentication number.

The PC 200 displays the regenerated authentication number received in step S655 on the monitor screen (S660). On the other hand, as in the above-described embodiment, the mobile terminal 300 displays the authentication number input window at the request of the user authentication applet 450 (S665 and S670). The mobile terminal 300 transmits the authentication number input by the user through the authentication number input window to the user authentication applet 450 (S675 and S680).

The user authentication applet 450 transmits the input authentication number received in step S680 to the server 100 (S685).

Meanwhile, although the mobile terminal 300 has been described as transmitting the input authentication number to the server 100 through the user authentication applet 450, the mobile terminal 300 directly inputs the authentication number to the server 100. Of course, it can also transmit.

Then, the server 100 compares the authentication number input by the user received in step S685 with the authentication number regenerated in step S650, and authenticates whether the user is a legitimate user (S690). The two authentication numbers turn out to be legitimate users if they match, but are not legitimate users if they do not match.

Thereafter, the server 100 provides subsequent services based on the authentication result in step S690 (S695).

5. Server

6 is a block diagram of the server 100 shown in FIGS. 1 to 5. As shown in FIG. 6, the server 100 includes a communication unit 110, a service processing unit 120, an authentication processing unit 130, and a storage unit 140.

The communication unit 110 establishes and maintains a communication connection with the PC 200, the mobile terminal 300, and the USIM card 400, thereby providing a communication interface between the server 100 and the server 100.

The service processor 120 performs processes necessary for providing a service to the user through the PC 200, and the authentication processor 130 performs a user authentication procedure required in the service providing process.

For the user authentication process, the authentication processing unit 130 issues a user authentication applet 450 to the USIM card 400, requests the authentication number to the issued user authentication applet 450 and transmits it to the PC 200. If necessary, the authentication processing unit 130 may encrypt or regenerate authentication information delivered to the PC 200, and in the latter case may directly determine the legitimacy of the user.

The storage unit 140 is a storage medium that stores programs and data necessary for service provision by the service processor 120 and user authentication by the authentication processor 130.

6. USIM card

FIG. 7 is a block diagram of the USIM card 400 shown in FIGS. 1 to 5. As shown in FIG. 7, the USIM card 400 includes a terminal interface 410, a USIM processor 430, a user authentication applet 450, and a UISM memory 470.

The terminal interface 410 is a means for communication connection between the USIM card 400 and the mobile terminal 300. Ultimately, the USIM card 400 may communicate with the server 100 via the mobile terminal 300. Make sure

The USIM processor 430 controls the overall operation of the USIM card 400. In particular, the USIM processor 430 executes the user authentication applet 450, and processes necessary for the user authentication method shown in FIGS. 3 to 5 (authentication number generation / transmission, authentication number input window display request, user justification determination). Etc.).

The UISM memory 470 is a storage medium that stores programs and data necessary for the operation of the USIM card 400.

7. Modifications

Up to now, the present invention has been described in detail with reference to a preferred embodiment of a method and system for performing user authentication by displaying authentication information generated by the SE of the mobile terminal on the user terminal and then allowing the user to input the information through the mobile terminal.

In the above embodiment, the PC 200 is a kind of user terminal, and of course, may be replaced with another type of user terminal. This also applies to the USIM card 400. The USIM card 400 may also be replaced with another type of SE, such as an embedded Secure Element (SE) or Secure Digital (SD) card.

In addition, in the above embodiments, it is assumed that the request for displaying the authentication number input window to the mobile terminal 300 is performed by the USIM card 400, but may be implemented by the server 100.

In addition, the authentication number may be replaced with authentication information including at least one of numbers, letters, and symbols, and in this case, the technical spirit of the present invention may be applied as it is.

In addition, in the above embodiments, it is assumed that when additional user authentication is required in the service providing process through the PC 200, the mobile terminal 300 and the USIM card 400 intervene to perform a user authentication procedure. For example, situations that require user authentication can be extended to other situations. That is, the user authentication method presented through the embodiments of the present invention may also be applied to user authentication (eg, a login process) during a service start process that is not being provided.

On the other hand, the technical idea of the present invention can be applied to a computer-readable recording medium containing a computer program for performing the functions of the apparatus and method according to the present embodiment. In addition, the technical idea according to various embodiments of the present disclosure may be implemented in the form of computer readable codes recorded on a computer readable recording medium. The computer-readable recording medium can be any data storage device that can be read by a computer and can store data. For example, the computer-readable recording medium may be a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical disk, a hard disk drive, or the like. In addition, the computer-readable code or program stored in the computer-readable recording medium may be transmitted through a network connected between the computers.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the specific embodiments described above, but the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Claims

Requesting authentication information from a secure element (SE) of the mobile terminal;

Receiving the authentication information from the SE;

Transmitting display information based on the authentication information to a user terminal; And

And performing an authentication procedure for the user based on the input information input by the user to the mobile terminal with reference to the display information displayed on the user terminal.
The method according to claim 1,

The display information is the same as the authentication information,

The mobile terminal, the user authentication method, characterized in that for transmitting the input information input by the user to the SE.
The method according to claim 1,

The requesting step,

A method of authenticating a user, characterized in that when the authentication of the user is required while providing a service through the user terminal.
The method according to claim 1,

The performing of the authentication procedure,

And if the input information and the authentication information of the user are the same, authenticating the user as a legitimate user.
The method according to claim 4,

The authentication information is generated by the SE,

The SE determines whether the input information is the same as the authentication information,

And receiving the user authentication result from the SE.
The method according to claim 1,

The SE, after transmitting the authentication information, the user authentication method, characterized in that to request the mobile terminal to receive the display information from the user.
The method according to claim 1.

And the display information is authentication information reproduced from the authentication information.
The method according to claim 7,

The performing of the authentication procedure,

Receiving the input information of the user;

And authenticating the user as a legitimate user if the input information and the regenerated authentication information are the same.
A communication unit communicating with a secure element (SE) and a user terminal of the mobile terminal; And

An input that the user inputs to the mobile terminal by requesting and receiving authentication information from the SE, transmitting the display information based on the authentication information to the user terminal, and referring to the display information displayed on the user terminal through the communication unit; And an authentication processing unit for performing an authentication procedure for the user based on the information.
Generating, by the Secure Element (SE) of the mobile terminal, authentication information;

Transmitting, by the SE, the generated authentication information to a server;

Receiving, by the SE, the input information input by the user to the mobile terminal from the mobile terminal; And

Based on the input information, the SE performing an authentication procedure for the user;

The input information is,

And the user inputs the display information based on the authentication information to the mobile terminal with reference to the display information displayed on the user terminal received from the server.
An interface in communication with the mobile terminal; And

Generate and transmit authentication information to a server through the mobile terminal, receive input information input by the user through the mobile terminal through the interface, and perform an authentication procedure for the user based on the authentication information and the input information. A processor to perform;

The input information is,

Secure element (SE) characterized in that the user inputs to the mobile terminal with reference to the display information displayed on the user terminal received the display information based on the authentication information from the server.