WO2023167568A1

WO2023167568A1 - Server and method for providing service for prevention of sim swapping based on authentication code

Info

Publication number: WO2023167568A1
Application number: PCT/KR2023/002995
Authority: WO
Inventors: 유창훈
Original assignee: 주식회사 센스톤
Priority date: 2022-03-04
Filing date: 2023-03-04
Publication date: 2023-09-07

Abstract

Provided are a server and method for providing a service for prevention of SIM swapping based on an authentication code. The server according to the present disclosure may comprise a communication module and a processor that: when a device authentication request for execution of a client company application is received from a terminal of a user via the communication module, requests at least one hash value corresponding to a phone number of the user from a server of a telecommunication company; performs device authentication for the terminal of the user by using the at least one hash value; and transmits the result of the device authentication to a server of a client company.

Description

Service provision server and method for preventing SIM swapping based on authentication code

The present disclosure relates to a service providing server and method for preventing SIM swapping based on an authentication code.

Code type data is used in many areas. Not only card numbers and account numbers used for payment, but also IPIN numbers and resident registration numbers for user identification are code-type data.

However, in the process of using such code data, many leak accidents occur. In the case of a card number, the actual card number is written on the surface of the card as it is, so it is visually leaked to others, and when paying using a magnetic card, the card number is transmitted to the POS device as it is and leaked.

Many attempts have been made to use virtual codes to prevent actual codes from being leaked as they are, but data for identifying users was needed to search for real codes corresponding to virtual codes.

However, in the case of OTP (One Time Password), a separate OTP generating device is required, which is inconvenient. In particular, in the case of a user terminal, there is a security vulnerability due to the leakage of seed data used for OTP generation.

Therefore, based on card data of cards possessed by many users, generate OTP codes such as generating virtual security codes necessary for user authentication, but do not require a separate OTP generator and at the same time prevent seed data from being leaked. We need a way to increase security.

An object of the present disclosure is to provide a service providing server and method for preventing SIM swapping based on an authentication code.

The problems to be solved by the present disclosure are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

A service providing server for preventing SIM swapping based on an authentication code according to an aspect of the present disclosure for achieving the above-described technical problem is a communication module and a communication module for executing a customer application from a user terminal through the communication module. When a device authentication request is received, at least one hash value corresponding to the user's phone number is requested from the server of the telecommunications company, and the device authentication for the user terminal is performed using the at least one hash value. and a processor for transmitting the device authentication result to the server of the customer company.

The hash value may include a first hash value for the phone number, a second hash value for identification information of the user terminal, and a third hash value for identification information of a SIM card included in the user terminal. can

In addition, the processor performs the authentication by comparing the hash value received from the communication company server and the hash value previously stored for the user, and if the received hash value is different from the previously stored hash value as a result of the authentication, the hash value is different from the previously stored hash value. It is determined that a device change or SIM change of the user terminal has been performed, and the device authentication result notifying that the user terminal is not a normal device may be transmitted to the client company server.

In addition, when the device authentication request is received from the user terminal, the processor transmits a token including a verification URL to the user terminal, and the verification URL received from the user terminal is the same as the verification URL included in the token. Then, the hash value may be requested from the communication company server.

In addition, the service for preventing SIM swapping may be provided to the customer company server based on a cloud method or may be provided to the customer company server in a form in which a server for the service is installed inside the customer company server.

In addition, the processor receives a virtual code for authentication generated from the card when tagging between the card of the user whose registration in the customer company application is completed and the user terminal, and based on the virtual code for authentication, a normal user is assigned to the user. Verification is performed as to whether the customer service is to be used through the terminal, and the virtual code for authentication may be generated using at least one of current time data, the card number of the card, and a unique value of the card.

In addition, when the registration is requested through tagging between the card and the user terminal, the processor may match and store at least one of the card number and the unique value with user information.

In addition, the processor may perform the verification based on user information searched for using the card number or the unique value extracted from the virtual code for authentication.

In addition, when the customer application includes a module for generating a virtual code for authentication, the processor receives the virtual code for final authentication generated by the module, performs verification on the virtual code for final authentication, The final virtual code for authentication may be generated using the user information and the virtual code for authentication.

In addition, a method for providing a service for preventing SIM swapping based on an authentication code according to another aspect of the present disclosure for achieving the above-described technical problem includes receiving a device authentication request from a user's terminal for executing a customer application, Requesting at least one hash value corresponding to the user's phone number from a server, performing the device authentication for the user terminal using the at least one hash value, and displaying the device authentication result It may include a step of forwarding to the server of the customer company.

In addition to this, a computer program stored in a computer readable recording medium for executing a method for implementing the present disclosure may be further provided.

In addition to this, a computer readable recording medium recording a computer program for executing a method for implementing the present disclosure may be further provided.

According to the above-described problem solving means of the present disclosure, a service provider performs an authentication process between a customer such as a financial company and a telecommunications company to prevent SIM swapping hacking, thereby determining whether a user terminal requesting service access from a customer company is being used by a hacker. Or, it can inform whether it is being used by a normal user. Through this, the customer company can not provide the user's personal information or authentication information to the hacker, and the hacker can prevent the hacker from committing a crime of stealing the user's assets by using the user's information.

By blocking SIM swapping hacking in advance, not only customers but also carriers can prevent damage caused by SIM swapping hacking.

In addition, by individually performing authentication using a virtual code for authentication generated in an individual medium such as a card, security can be doubled and the reliability and satisfaction of the user in using the customer's service can be increased.

In addition, user convenience can be increased because SMS authentication can be substituted through authentication of a service provider, which is an intermediary.

The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a diagram schematically illustrating a service system for preventing SIM swapping based on an authentication code according to an embodiment of the present disclosure.

2 is a block diagram of a service providing server for preventing SIM swapping based on an authentication code according to an embodiment of the present disclosure.

3 is a flowchart of a service providing method for preventing SIM swapping based on an authentication code according to an embodiment of the present disclosure.

4A and 4B are diagrams for explaining a conventional SIM swapping hacking method and a service process for preventing it according to an embodiment of the present disclosure.

5 is a diagram for explaining a process of providing a hash value corresponding to a user's phone number according to an embodiment of the present disclosure.

6 is a diagram for explaining user authentication using a virtual code for authentication generated during card tagging according to another embodiment of the present disclosure.

Like reference numbers designate like elements throughout this disclosure. The present disclosure does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the present disclosure belongs is omitted. The term 'unit, module, member, or block' used in the specification may be implemented as software or hardware, and according to embodiments, a plurality of 'units, modules, members, or blocks' may be implemented as one component, It is also possible that one 'part, module, member, block' includes a plurality of components.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case of being directly connected but also the case of being indirectly connected, and indirect connection includes being connected through a wireless communication network. do.

In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

Throughout the specification, when a member is said to be located “on” another member, this includes not only a case where a member is in contact with another member, but also a case where another member exists between the two members.

Terms such as first and second are used to distinguish one component from another, and the components are not limited by the aforementioned terms.

Expressions in the singular number include plural expressions unless the context clearly dictates otherwise.

In each step, the identification code is used for convenience of description, and the identification code does not explain the order of each step, and each step may be performed in a different order from the specified order unless a specific order is clearly described in context. there is.

Hereinafter, the working principle and embodiments of the present disclosure will be described with reference to the accompanying drawings.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

Prior to the description, the meaning of the terms used in this specification will be briefly described. However, it should be noted that the explanation of terms is intended to help the understanding of the present specification, and is not used in the sense of limiting the technical spirit of the present disclosure unless explicitly described as limiting the present disclosure.

In this specification, “device” includes all various devices capable of providing results to users by performing calculation processing. For example, the device may include all of a computer, a server device, and a portable terminal, or may be of any one type.

Here, the computer may include, for example, a laptop computer, a desktop computer, a laptop computer, a tablet PC, a slate PC, and the like equipped with a web browser.

The server device is a server that processes information by communicating with an external device, and may include an application server, a computing server, a database server, a file server, a game server, a mail server, a proxy server, and a web server.

The portable terminal is, for example, a wireless communication device that ensures portability and mobility, and includes a Personal Communication System (PCS), a Global System for Mobile communications (GSM), a Personal Digital Cellular (PDC), a Personal Handyphone System (PHS), and a PDA. (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), WiBro (Wireless Broadband Internet) terminal, smart phone ) and wearable devices such as watches, rings, bracelets, anklets, necklaces, glasses, contact lenses, or head-mounted-devices (HMDs). can include

In this specification, a "character" is a component constituting a code, and includes all or part of uppercase alphabets, lowercase alphabets, numbers, and special characters.

In this specification, "code" means a string in which characters are listed.

In this specification, “virtual code for authentication” may mean a One Time Authentication Code (OTAC) that is temporarily generated for authentication of at least one of a user and a device.

In this specification, a "virtual code generation function" means a function that generates a virtual code for authentication. For example, one time password (OTP), etc. are included, but are not limited thereto.

In this specification, the "detailed code generation function" means a function that generates each of the detailed codes constituting the virtual code for authentication.

In this specification, the "detail code combining function" means a function that generates a virtual code by combining or combining a plurality of detailed codes.

In this specification, a "unit count" is a unit defined as being set at a specific time interval and changed as the time interval elapses. For example, 1 count may be set to a specific time interval (eg, 1.5 seconds) and used.

In this specification, “storage location” means a point (count) on a track corresponding to the time when user registration is requested.

A SIM swapping accident refers to a crime in which a specific person's subscriber identity module (SIM) card is copied or replaced without permission, and then the person's mobile phone authentication is passed to steal another person's financial assets. Sim-swapping criminals use stolen personal information to open a new SIM chip and insert it into a mobile phone that is in an airborne state to receive text messages and phone calls from victims instead.

The telecommunication company only reports that the received personal information is normal information (because it is impossible to know that the person who sent the personal information is a criminal) and completes the opening process of the corresponding mobile phone, and when the customer company requests an authentication code for service use from the opened mobile phone It only sees that the cell phone is normally opened (because it is impossible to know that the person using the cell phone is a criminal) and provides the authentication code to the cell phone. Through this sim swapping, the criminal uses the customer company's service to steal the user's assets.

Accordingly, in the present disclosure, a service provider cooperates with a customer company and a telecommunications company to prevent a SIM swapping accident by performing authentication for service use access in the middle.

Hereinafter, with reference to FIG. 1, a service system for preventing SIM swapping based on an authentication code will be described.

Referring to FIG. 1, a service system (hereinafter, a system) for preventing SIM swapping based on an authentication code includes a service providing server 10, a user terminal 20, a customer company server 30, a communication company server 40, and a card (40) may be included.

However, in some embodiments, the system may include fewer or more components than those shown in FIG. 1 .

The service providing server 10 may refer to a server device of a company or company that provides a service for preventing SIM swapping.

The service providing server 10 performs authentication to determine whether the user terminal 20 requesting service use of the customer company is a normal device or the person requesting service use through the user terminal 20 is a normal user. can

The user terminal 20 may refer to a terminal device of a person who uses a service provided by a customer company (eg, a financial service or a payment service). The user terminal 20 may be installed with a service program including a smart phone application or a mobile web for using a service of a customer company. A user may use all services provided by the service providing server 10 through a service program.

The client company server 30 may refer to a server device of a company, institution, or company that uses the SIM swapping prevention service provided by the service providing server 10 . For example, the client company server 30 may be a server device of a financial institution, a government institution, a financial company, a credit card company, or the like, but is not limited thereto.

The communication company server 40 may refer to a communication company server device to which the user terminal 20 subscribes.

The communication company server 40 may provide data or information about the user terminal 20 required for authentication to the service providing server 10 .

The card 50 may refer to a physical card registered in a customer company application by a user in order to use a service of the customer company.

The card 50 includes a module (applet) for generating a virtual code for authentication, and when the card 50 is tagged with the user terminal 20, the received from the user terminal 20 is received using the applet. Virtual code for authentication can be generated based on data or embedded data.

Hereinafter, referring to FIG. 2 , a service providing server for preventing SIM swapping based on an authentication code will be described.

Referring to FIG. 2 , a service providing server for preventing SIM swapping based on an authentication code (hereinafter referred to as a service providing server) 10 may include a communication module 11 , a memory 12 , and a processor 13 . The processor 13 may include a hash value authentication module 131 and an OTAC authentication module 132 .

However, in some embodiments, the service providing server 10 and the processor 13 may include fewer or more components than those shown in FIG. 2 .

The communication module 11 is between the service providing server 10 and the user terminal 20, between the service providing server 10 and the client company server 30, and between the service providing server 10 and the communication company server 40. , It may include one or more modules enabling wireless or wired communication between the service providing server 10 and the communication network. For example, it may include at least one of a wired communication module, a wireless communication module, a short-distance communication module, and a location information module.

Various types of communication networks may be used as the communication network, for example, wireless communication methods such as WLAN (Wireless LAN), Wi-Fi, Wibro, Wimax, and HSDPA (High Speed Downlink Packet Access) Alternatively, a wired communication method such as Ethernet, xDSL (ADSL, VDSL), HFC (Hybrid Fiber Coax), FTTC (Fiber to The Curb), FTTH (Fiber To The Home) may be used.

On the other hand, the communication network is not limited to the communication methods presented above, and may include all other types of communication methods that are widely known or will be developed in the future in addition to the above communication methods.

Wired communication modules include not only various wired communication modules such as Local Area Network (LAN) modules, Wide Area Network (WAN) modules, or Value Added Network (VAN) modules, but also USB (Universal Serial Bus) ), high definition multimedia interface (HDMI), digital visual interface (DVI), recommended standard 232 (RS-232), power line communication, or plain old telephone service (POTS).

In addition to the WiFi module and the WiBro module, wireless communication modules include global system for mobile communication (GSM), code division multiple access (CDMA), wideband code division multiple access (WCDMA), and universal mobile telecommunications system (UMTS). ), time division multiple access (TDMA), long term evolution (LTE), and a wireless communication module supporting various wireless communication schemes such as 4G, 5G, and 6G.

The short-range communication module is for short-range communication, and includes Bluetooth™, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, and Near Field Communication (NFC). Communication), Wi-Fi (Wireless-Fidelity), Wi-Fi Direct, and wireless USB (Wireless Universal Serial Bus) technologies may be used to support short-distance communication.

The memory 12 may store at least one process for providing a service for preventing SIM swapping based on an authentication code.

The memory 12 may store data supporting various functions of the service providing server 10 and programs for operation of the processor 13, and input/output data (eg, music files, stop images, videos, etc.), a plurality of application programs (applications) running in the service providing server 10, data for the operation of the service providing server 10, and instructions. can be saved At least some of these application programs may be downloaded from an external server through wireless communication.

The memory 12 is a flash memory type, a hard disk type, a solid state disk type, a silicon disk drive type, and a multimedia card micro type. micro type), card type memory (eg SD or XD memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable EEPROM (EEPROM) It may include a storage medium of at least one type of a programmable read-only memory (PROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, and an optical disk. In addition, the memory 12 is separated from the service providing server 10, but may be a database connected by wire or wirelessly.

The processor 13 may perform the above-described operations using a memory for storing data for an algorithm or a program for reproducing the algorithm for controlling the operation of components in the service providing server 10, and the data stored in the memory. can At this time, the memory 12 and the processor 13 may be implemented as separate chips. Alternatively, the memory 12 and the processor 13 may be implemented as a single chip.

The hash value authentication module 131 of the processor 13 may perform authentication based on the hash value provided from the communication company server 30 according to the device authentication request for the user terminal 20 to execute the customer company application. A detailed description of this will be given later.

The OTAC authentication module 132 of the processor 13 allows a user who intends to use the customer service through the user terminal 20 to use the virtual code for authentication generated through tagging between the card 50 and the user terminal 20 as normal. Authentication of whether a user is a user can be performed. A detailed description of this will be given later.

In addition, the processor 13 is configured to implement any one or a plurality of the components described above in order to implement various embodiments according to the present disclosure described in FIGS. 3 to 6 below on the service providing server 10. You can control it.

Referring to FIGS. 4A, 4B, and 5 below, the service providing server 10 responds to a device authentication request for the user terminal 20 to execute a customer application, based on the hash value provided from the communication company server 30. Let us explain how to perform authentication.

For convenience of description, each step is described as being performed by the processor 13 or the service providing server 10, but each step is performed by the hash value authentication module 131 included in the processor 13 and not shown in FIG. It can be understood as being performed by any one of the modules.

Referring to FIG. 3 , the processor 13 of the service providing server 10 may receive a device authentication request for executing a customer company application from the user's terminal 20 (S310).

The processor 13 of the service providing server 10 may request at least one hash value corresponding to the user's phone number from the server 40 of the communication company (S320).

The processor 13 of the service providing server 10 may perform authentication of the user terminal 20 using at least one hash value (S330).

The processor 13 of the service providing server 10 may transmit the authentication result to the server 30 of the customer company (S340).

Referring to FIG. 4A, in the past, a hacker steals a user's personal information, receives a reissue or duplicates a SIM for reasons such as device change, lost phone number transfer, etc. Upon request, the communication company server 40 may complete the opening process after performing authentication using the received personal information. As a result, the normal user's mobile phone communication is cut off, and the hacker installs a new activated SIM in the air-type mobile phone. Then, the hacker requests an authentication code to the customer terminal 30 after installing the customer company app (customer company application) on the mobile phone equipped with the new USIM. The customer terminal 30 transmits the authentication code to the hacker's mobile phone, and the hacker uses the received authentication code to reset the password of the customer's app or issue a new OTP to steal the normal user's assets.

Hereinafter, with reference to FIGS. 4B and 5 for steps S310 to S340, the present disclosure places the service providing server 10 between the client company server 30 and the telecommunications company server 40 and performs authentication to prevent SIM swapping. Please explain what you are doing.

※ Description of steps S310 to S330

Referring to FIG. 4A , in order for the user to use the customer company application through the user terminal 20, the user terminal 20 may transmit a device authentication request for executing the customer company application to the customer company server 30 (S401). . The customer terminal 30 may transmit the received device authentication request to the service providing server 10 (S402).

When the processor 13 of the service providing server 10 requests at least one hash value corresponding to the user's phone number from the communication company server 40 (S403), the communication company server 40 sends a first hash value for the phone number. At least one of a hash value, a second hash value for identification information of the user terminal 20, and a third hash value for identification information of a SIM card included in the user terminal 20 is transmitted to the service providing server 10. It can be provided (S404).

Here, the identification information of the user terminal 20 may be unique information capable of identifying the user terminal 20 that has requested device authentication. For example, the identification information of the user terminal 20 may be IMEI (International Mobile Equipment Identity), but is not limited thereto.

In addition, the identification information of the SIM card included in the user terminal 20 may be unique information capable of identifying the SIM card (sim card) installed in the user terminal 20 . For example, the identification information of the SIM card included in the user terminal 20 may be an Integrated Circuit Card Identifier (IMEI), but is not limited thereto.

The processor 13 of the service providing server 10 may perform device authentication based on the received hash value (S405).

In more detail, the processor 13 performs the authentication by comparing the hash value received from the communication company server 40 and the hash value pre-stored for the user (or user terminal 10) in the service providing server 10. and, as a result of the authentication, if the received hash value is different from the pre-stored hash value, it may be determined that a device change or a SIM change of the user terminal 20 has been performed.

Referring to FIG. 5 , when receiving the device authentication request from the user terminal 20, the processor 13 receives the mobile directory number (MDN) of the user (or the user terminal 10) together (S501, S502).

The processor 13 may generate a token and a check URL (S503), and provide the token including the check URL to the user terminal 20 through the customer server 30 (S504 and S505). The reason for transmitting the confirmation URL in this way is that the user-provided server 10 makes a direct connection to the user terminal 20 and the mobile network without going through the client company server 30 .

When the connection from the in-app to the mobile network is established through the verification URL, the service providing server 10 confirms that the received token has returned normally (if the received verification URL is the same as the verification URL included in the token) (S506, S507) , It is determined that the connection between the two is established, and a confirmation request for whether the phone number is matched to correspond to the token and a hash value request can be transmitted while forwarding the received phone number (MDN) to the communication company server 40 ( S508).

When the phone number matching is confirmed, the communication company server 40 determines the first hash value (MDN shown in FIG. 5), the second hash value (IMEI shown in FIG. 5), and the third hash value (shown in FIG. 5). At least one of the illustrated ICCIDs) may be generated, and the generated hash value may be transmitted to the service providing server 10 (S509 and S510).

Depending on the embodiment, the communication company server 40 generates one hash value (first hash value to third hash value) for each of the three pieces of information (MDN, IMEI, ICCID), and sets them to the service providing server 10. Only one of them may be delivered, only two of three may be delivered to the service providing server 10, or all three may be delivered to the service providing server 10.

For example, the communication company server 40 may transmit only the second hash value among the first to third hash values, or may transmit the second hash value and the third hash value among the first to third hash values, or All of the first to third hash values may be transmitted.

Depending on the embodiment, the telecommunication company server 40 may generate information (data) obtained by combining two of the three pieces of information (MDN, IMEI, and ICCID) as one hash value and transmit it to the service providing server 10.

For example, the communication company server 40 may generate IMEI+ICCID value as one hash value, or may generate IMEI+MDN value as one hash value, or may generate ICCID+MDN value as one hash value. It can also be created with a single hash value.

Depending on the embodiment, the telecommunication company server 40 may generate information (data) obtained by combining all three pieces of information (MDN, IMEI, and ICCID) as one hash value and transmit it to the service providing server 10. For example, the communication company server 40 may generate a value of IMEI+ICCID+MDN as one hash value.

The service providing server 10 may check whether a device has been changed or a sim has been changed by comparing the received hash value with a pre-stored hash value (S511).

More specifically, when a user (or user terminal 10) subscribes to the communication company server 30, the communication company server 30 may generate an initial hash value for the user and provide it to the user terminal 10. The user terminal 10 stores the initial hash value and compares it with the hash value received later to check whether a device has been changed or a SIM has been changed.

The initial hash value generation method is the same as the above-described hash value generation method, and as described above, the hash value can be generated differently according to the combination of three pieces of information (MND, IMEI, ICCID, IMEI+ICCID, IMEI+MDN, ICCID+MDN, IMEI+ICCID+MDN).

Depending on the embodiment, the service providing server 10 may determine that a device change has occurred in the user terminal when the IMEs are different as a result of comparing the two values.

Depending on the embodiment, the service providing server 10 may determine that a SIM change has occurred in the user terminal when the ICCIDs are different as a result of comparing the two values.

※ Description of step S340

Referring to FIG. 4A , when it is determined that a device change or SIM change has occurred in a user terminal, the service providing server 10 sends a device authentication result to the client company server 30 notifying that the user terminal 20 is not a normal device. It can be delivered (S406, S512 in FIG. 5).

Alternatively, if it is determined that there is no device change or SIM change in the user terminal, the service providing server 10 may transmit a device authentication result indicating that the user terminal 20 is a normal device to the client company server 30.

Accordingly, the customer company server 30 may determine whether or not to provide the requested information to the user terminal 20 (S407).

If the device is normal, the client company server 30 may determine that the request for new subscription or reissuance requested by the user was a normal request, and provide relevant information for new subscription or reissuance.

If it is an abnormal device, the client company server 30 may determine that the request for new subscription or reissuance requested by the user is an abnormal request, and may not provide relevant information for new subscription or reissuance.

Meanwhile, the service for preventing SIM swapping provided by the service providing server 10 according to the present disclosure is provided to the customer company server 30 based on a cloud method, or a service for the service is provided inside the customer company server 30. The server may be provided to the customer company server 30 in a mounted form (on-premise method). A detailed description of this will be given later.

Referring to FIG. 6 below, the service providing server 10 intends to use the customer service through the user terminal 20 based on the virtual code for authentication generated through tagging between the card 50 and the user terminal 20. A method of performing authentication on whether a user is a normal user will be described.

For convenience of description, each step is described as being performed by the processor 13 or the service providing server 10, but each step is performed by the OTAC authentication module 132 included in the processor 13 and a module not shown in FIG. It can be understood as being performed by any one of the modules.

The processor 13 receives a virtual code for authentication generated by the card 50 during tagging between the card 50 of the user whose registration in the customer company application is completed and the user terminal 20, and the virtual code for authentication Based on this, it is possible to verify whether a normal user intends to use the customer company service through the user terminal 10 .

Here, the virtual code for authentication may be generated using at least one of current time data, a card number of the card 50, and a unique value of the card 50. The card number may include an identification code (eg, BIN) of a customer company (eg, a financial company), and a unique value of a card may be a value sequentially assigned to each card manufactured by a card manufacturer. Current time data may be provided from the user terminal 20 to the card 50 during tagging, or may be acquired by the card 50 itself.

When user registration is requested through tagging between the card 50 and the user terminal 20, the processor 13 may match and store at least one of the card number and the unique value with user information. Here, the user information may include a phone number (MDN), a user ID (ID), and a secret key, but is not limited thereto. The secret key may be a value generated by the service providing server 10 and given to the corresponding user terminal 20 when the user terminal 20 requests user registration. The user ID may refer to an ID of a user subscribed to a customer app.

When user registration is completed in this way, a function for generating a virtual code for authentication for the user (or user terminal 10) is initially set in the service providing server 10 and started to operate.

Depending on the embodiment, the processor 13 may manage only one piece of user information for OTAC verification, and the number is not limited to one. Also, according to an embodiment, the processor 13 may utilize only information finally registered in the server as valid information for OTAC verification.

The processor 13 may perform verification using a virtual code for authentication. That is, the verification may be performed based on the user information searched for using the card number extracted from the virtual code for authentication or the unique value.

Referring to FIG. 5 , when tagging is performed between the card 50 and the user terminal 20 (S601), a virtual code for authentication is generated in the card 40 (S602), and the generated virtual code for authentication is the user terminal (20), it is transmitted to the service providing server 10 through the customer company server 30 (S603, S604, S605). The service providing server 10 performs verification of the received virtual code for authentication (OTAC verification) (S606).

Depending on the embodiment, the processor 13 may search for a card number or a unique value from a virtual code for authentication through a search algorithm. The processor 13 may determine whether the user information matched to the card number or unique value found in the corresponding server matches user information most recently registered for the corresponding user (or user terminal 10).

If the two pieces of information match, the processor 13 may determine that the current normal user makes a normal service request using the user terminal 20 of the user. And, this verification result can be provided to the customer company server 30 (S607). Accordingly, the client company server 30 may provide information related to the requested service (new subscription or reissue, etc.) to the user terminal 20 (S608).

If the two pieces of information do not match, the processor 13 may determine that the current abnormal user makes a service request using the user terminal 20 . And, this verification result can be provided to the customer company server 30 (S607). Accordingly, the customer company server 30 may not provide information related to the requested service (new subscription or reissue, etc.) to the user terminal 20 (S608).

Depending on the embodiment, when a module for generating a virtual code for authentication is included in a customer application, the processor 13 receives the virtual code for final authentication generated by the virtual code generation module for authentication, and the virtual code for final authentication. You can perform code verification. Here, the virtual code for final authentication may be generated using the user information and the virtual code for authentication.

That is, the virtual code for final authentication is generated using the virtual code for authentication generated in the card and finally registered user information. Then, the service providing server 10 searches for user information using the card number or the unique value extracted from the virtual code for final authentication, and the searched user information and the finally registered information included in the virtual code for final authentication. OTAC verification can be performed by comparing user information.

Meanwhile, as described above, the service for preventing SIM swapping may be provided to the customer company server 30 in a cloud method or an on-premise method.

The cloud method can be applied so that a third service that does not have a card can also use the SIM swapping prevention service. Depending on the embodiment, when the company's SDK of the third service is loaded on the customer's server and a new card is registered, the corresponding card is also registered in the company's platform server of the third service, and can be used for verification in the service providing server 10 afterwards. can do Depending on the embodiment, an OTAC verification server by card may be placed in the customer company server, and the server of the third service may receive the verification result through API interworking with the customer company server.

In the on-premise method, customers can receive authentication results for device change and SIM change through the service providing server installed inside each customer's server. In this case, theft of personal information can be directly blocked through tagging of the self-issued card.

Hereinafter, a method of generating a virtual code for authentication by the OTAC generation module (virtual code generation module for authentication) included in the card will be described in detail.

The OTAC generation module may generate one or more detailed codes. The detailed code refers to some codes constituting the virtual code for authentication. The virtual code for authentication may consist of only the detailed code, or one or more detailed codes may be combined with the virtual security code generated by the OTP function to obtain a final final result. It may be formed in the form of virtual code (OTAC) for authentication.

The OTAC generation module includes a code generation function that generates a virtual code for authentication, and the code generation function includes a detailed code generation function that generates one or more detailed codes and a detailed code combining function that generates a virtual code by combining the detailed codes. (i.e., rules for combining a plurality of detailed codes).

That is, when the virtual code for authentication includes a plurality of detailed codes, the code generating function generates a plurality of detailed codes using the plurality of detailed codes generating functions, and generates the plurality of detailed codes through the detailed code combining function. By combining in a preset combination, a virtual code for authentication is generated.

A plurality of detailed codes have a correlation used by the OTAC verification server (service providing server 10) to search for a storage location of information capable of identifying a user or device. That is, the OTAC verification server has a search algorithm, and the search algorithm extracts a plurality of detailed codes included in the virtual code for authentication, and calculates the card number or unique value of the card based on the correlation between the plurality of detailed codes. Search the storage location. As an example of the correlation between the plurality of detailed codes, the search algorithm operates based on the correlation between the plurality of detailed codes from a waypoint corresponding to one or more of the plurality of detailed codes, The storage location of the unique value of the card can be searched. At this time, the number of waypoints may be one or plural, and the number and order are not limited.

In addition, as an embodiment of the plurality of detailed codes, the plurality of detailed codes may include first codes and second codes, and the OTAC generating module includes the first function and the second function as detailed code generating functions, A first code and a second code are generated. The first code and the second code have a correlation to search the storage location of the card number or unique value of the card in the OTAC verification server 15, 31, but the OTAC generation module uses the first code to increase security. The first function to generate the second code and the second function to generate the second code may be included as the detailed code generating function, but data on correlation between the first code and the second code may not be included.

As a specific example of the correlation between the first code and the second code, the first code and the second code may play respective roles for searching for a storage location of a card number or a unique value of a card. That is, the first code may include information about the waypoint, and the second code may include information necessary for an operation capable of reaching the storage location of the card number or unique value of the card from the waypoint.

Meanwhile, according to an embodiment of the present disclosure, the first code may be generated based on the first count, and the second code may be generated based on the second count. At this time, the first count is the number of unit counts that have elapsed from the initial point in time when the code generation function is driven in the OTAC generation module or the OTAC verification server to the point in time when the virtual code for authentication is generated, and the second count is the card number or unique card number It may include the number of unit counts that have elapsed since the time the value was stored in the OTAC verification server.

That is, the first function generating the first code is a function providing a specific code value corresponding to the first count, and the second function generating the second code is a function providing a specific code value corresponding to the second count. am.

Hereinafter, a method for the OTAC generating module to verify the virtual code for authentication will be described in detail.

In one embodiment of the present disclosure, when the OTAC verification server receives the virtual code for authentication from the user terminal 20, by comparing the time data of the virtual code for authentication with the time data of the virtual code for authentication The virtual code for authentication may be verified.

Specifically, it is verified whether the virtual code for authentication is normally generated in the OTAC verification server. That is, after receiving the virtual code for authentication, the OTAC verification server checks whether the received virtual code for authentication is normally generated at the present time based on information stored in the OTAC verification server (ie, code generation function and seed data) to determine whether the virtual code for authentication is normal. The OTAC verification server applies the inverse function of the code generation function to the virtual code for authentication to find a count corresponding to the point in time when the virtual code for authentication is generated. The count that the OTAC verification server received the virtual code for authentication due to the difference between the time when the virtual code for authentication was generated due to the transmission time or delay of the virtual code for authentication and the time when the virtual code for authentication was received by the OTAC verification server Since the count of generating the OTP number for authentication may not match, the OTAC verification server allows an error range from the count of receiving the virtual code for authentication.

On the other hand, in one embodiment of the present disclosure, the OTAC verification server extracts user information by searching for a storage location of a card number or unique value of a card based on the virtual code for authentication, and based on the extracted user information, the user or device authentication can be performed.

Although FIG. 3 is described as sequentially executing steps, this is merely an example of the technical idea of this embodiment, and those skilled in the art to which this embodiment belongs will not deviate from the essential characteristics of this embodiment. Since the order described in FIG. 3 may be changed and executed in a range not specified, or executed in parallel, various modifications and variations may be applied, and FIG.

Meanwhile, in the above description, the steps described in FIG. 3 may be further divided into additional steps or combined into fewer steps according to an embodiment of the present disclosure. Also, some steps may be omitted if necessary, and the order of steps may be changed.

Meanwhile, the disclosed embodiments may be implemented in the form of a recording medium storing instructions executable by a computer. Instructions may be stored in the form of program codes, and when executed by a processor, create program modules to perform operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium.

Computer-readable recording media include all types of recording media in which instructions that can be decoded by a computer are stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like.

As above, the disclosed embodiments have been described with reference to the accompanying drawings. Those skilled in the art to which the present disclosure pertains will understand that the present disclosure may be implemented in a form different from the disclosed embodiments without changing the technical spirit or essential features of the present disclosure. The disclosed embodiments are illustrative and should not be construed as limiting.

Claims

communication module; and

When a device authentication request for executing a client company application is received from the user's terminal through the communication module, at least one hash value corresponding to the user's phone number is requested from a server of the telecommunications company, and the at least one hash value is received. A processor that performs the device authentication for the user terminal using a value and delivers the device authentication result to the server of the customer company;

Service providing server to prevent SIM swapping based on authentication code.
According to claim 1,

The hash value includes a first hash value for the phone number, a second hash value for identification information of the user terminal, and a third hash value for identification information of a SIM card included in the user terminal.

Server providing service to prevent SIM swapping based on authentication code.
According to claim 1,

The processor performs the authentication by comparing the hash value received from the communication company server and the hash value previously stored for the user, and if the received hash value is different from the previously stored hash value as a result of the authentication, the user terminal Determining that a device change or SIM change has been performed, and transmitting the device authentication result indicating that the user terminal is not a normal device to the customer server,

Server providing service to prevent SIM swapping based on authentication code.
According to claim 1,

When the device authentication request is received from the user terminal, the processor transmits a token including a verification URL to the user terminal, and if the verification URL received from the user terminal is the same as the verification URL included in the token, the processor transmits the verification URL to the user terminal. Requesting the hash value from the telecommunication company server,

Server providing service to prevent SIM swapping based on authentication code.
According to claim 1,

The service for preventing SIM swapping is provided to the customer server based on a cloud method or provided to the customer server in the form of a server for the service mounted inside the customer server.

Server providing service to prevent SIM swapping based on authentication code.
According to claim 1,

The processor receives a virtual code for authentication generated from the card when tagging between the card of the user whose registration in the customer company application is completed and the user terminal, and based on the virtual code for authentication, allows a normal user to access the user terminal. Performs verification of whether the customer intends to use the service through

The virtual code for authentication is generated using at least one of current time data, a card number of the card, and a unique value of the card.

Server providing service to prevent SIM swapping based on authentication code.
According to claim 6,

The processor, when the registration is requested through tagging between the card and the user terminal, matching and storing at least one of the card number and the unique value with user information,

Server providing service to prevent SIM swapping based on authentication code.
According to claim 7,

The processor performs the verification based on the user information searched for using the card number or the unique value extracted from the virtual code for authentication.

Server providing service to prevent SIM swapping based on authentication code.
According to claim 7,

If the customer's application includes a module for generating a virtual code for authentication,

The processor receives the virtual code for final authentication generated by the module, performs verification on the virtual code for final authentication,

The final virtual code for authentication is generated using the user information and the virtual code for authentication.

Server providing service to prevent SIM swapping based on authentication code
In the method performed by the service providing server,

Receiving a device authentication request for executing a customer company application from a user's terminal;

requesting at least one hash value corresponding to the user's phone number to a server of a communication company;

performing the device authentication for the user terminal using the at least one hash value; and

Including, transmitting the device authentication result to the server of the customer company;

A method of providing a service to prevent SIM swapping based on an authentication code.