KR101247521B1 - Security apparatus for mobile device - Google Patents

Abstract

The mobile device security device authenticates the user through at least one of a security token and a one time password (OTP) generation function, and allows the authenticated user access to the secure memory unit.

Description

Mobile device security device {SECURITY APPARATUS FOR MOBILE DEVICE}

The present invention relates to a mobile device security device.

As the mobile market expands further with the launch of smartphones and tablets, new mobile services such as mobile banking, mobile communication, mobile TV, and mobile movies, mobile marketing, and mobile e-government will emerge.

But behind this convenience, there is a negative element of personal information leakage. The biggest threat to smartphones is the leakage of personal information and financial losses. In particular, smart phones are more vulnerable to malware activity because they are connected to a wireless network. That is, in the current mobile device, the authentication certificate is stored in the internal memory of the device, and the existing mobile OTP is driven by a software method so that personal information can be leaked at any time by a malicious app. This may lead to the loss of account information due to the loss of public certificates, personal files, etc., leaks of personal files such as security cards, etc. in the mobile device. In addition to individuals, the leakage of personal information due to smartphone loss can lead to the leakage of corporate information beyond personal damage.

As the popularity of mobile devices, including smartphones, is expected to proceed at a faster pace, the necessity of preventing the leakage of data stored in mobile devices is increasing.

On the other hand, in the related art, if a user wants to authenticate by using an OTP number in both a financial server and a non-financial server (eg, a game, a portal, a company), a user has to carry a plurality of one-time password generators.

In order to use one one-time password generator in multiple organizations, it is possible to establish an authentication server in each institution by sharing an authentication server that authenticates the OTP number or by sharing a key file with the one-time password generator that will be shared. However, if a problem occurs due to an accident such as hacking in one institution, the problem of hacking may spread to other organizations in common use and may cause a serious problem.

As a method for solving the problem, Korean Patent No. 10-0972152 has a time-synchronous one-time password operating in dual mode to generate and display a number of OTP numbers that can be used independently of different institutions (financial institutions, non-financial institutions). A generator has been proposed.

The registered patent is provided with a first power key and a second power key for selecting a different operation mode, respectively, and can be used in different financial server or non-financial server according to the input of the first power key or the second power key Generate OTP and output it to the display.

However, according to the registered patent, two power keys must be provided to generate different OTPs, and a user has many inconveniences such as remembering which type of engine each power key is used for. have.

The problem to be solved by the present invention is to provide a safe use of the mobile device, and to the purpose of several OTP that can be used independently of different institutions (financial institutions, non-financial institutions) without a separate power supply or selection means. It is to provide a mobile device security device that can generate and display a suitable OTP.

According to an embodiment of the present invention, a secure memory unit for storing encrypted data,

A security token module that performs user authentication using a stored password, a public certificate, and a digital certificate digital signature key, and stores different seed values so that different one-time passwords are generated according to an authentication target authority. Smart card chip comprising an OTP generation module for generating an OTP value for authentication of the authentication target authority using the time information as an input value of the encryption algorithm, and sending it to the authentication server to perform user authentication, and connected with the mobile device Controlling the secure memory unit, the security token module, and the smart card to communicate with each other and performing user authentication. In secure memory authentication, data of a user authenticated by the smart card chip is encrypted and stored in the secure memory unit. Decrypt the encrypted data stored in the secure memory unit Control to provide the authenticated user, and in the security token authentication, the user authentication is controlled using the password, the public certificate and the electronic certificate electronic signature key, and in the OTP authentication, the authentication process is analyzed and authenticated. And extracting the type of the target authority and controlling the OTP value to be generated using a seed value corresponding to the type of the target certification authority.

According to an embodiment of the present invention, by securely implementing the secure token, OTP and secure memory functions in the micro SD memory used as an external storage device in the mobile device, secure authentication certificate storage and OTP authentication in the mobile device without additional devices It provides a secure memory function to prevent the leakage of personal information or corporate information, rather than the memory for general data storage. This may enable the safe use of mobile devices.

1A is a diagram schematically illustrating a mobile device security apparatus according to an embodiment of the present invention, and FIG. 1B is a detailed configuration diagram of an OTP generation module.
2 is a diagram illustrating an example of a mobile device security apparatus according to an embodiment of the present invention.
3 is a diagram schematically illustrating a user authentication method of a controller according to an exemplary embodiment of the present invention.
4 is a diagram illustrating a single password authentication method according to an embodiment of the present invention.
5 is a diagram illustrating a mixed authentication method according to an embodiment of the present invention.
6 is a diagram illustrating a single OTP authentication method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification and claims, when a section is referred to as "including " an element, it is understood that it does not exclude other elements, but may include other elements, unless specifically stated otherwise.

Now, a mobile device security apparatus according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1A is a diagram schematically illustrating a mobile device security device according to an embodiment of the present invention, FIG. 1B is a detailed configuration diagram of an OTP generation module, and FIG. 2 is an example of a mobile device security device according to an embodiment of the present invention. The figure which shows.

Referring to FIG. 1A, the mobile device security apparatus 100 may include a smart card chip 110, a secure memory unit 120, and a controller 130.

The smart card chip 110 is a security chip that actually performs a security function, and includes a security token module 112 and an OTP generation module 114. The security token module 112 stores a password, a public certificate and a public certificate electronic signature key for safe storage and use of a public certificate on a mobile device, and has an encryption function, a digital signature key generation function, an electronic signature function, and a password, User authentication is performed using the public certificate and the digital certificate key. The OTP generation module 114 generates an OTP value by using any random number or time as an input value of the encryption algorithm, and sends it to the authentication server to authenticate the user. Different seed values are stored for each type of certification authority to be generated, and the OTP values for authentication of the certification authority are used by using the corresponding seed value and time information according to the type of certification authority. It is characteristic to produce. Here, the types of certification subjects may be classified into various types according to users, and may be classified into financial institutions and non-financial institutions (game sites, portal sites, corporate sites, etc.).

Referring to FIG. 1B, an embodiment in which a type of an authentication target institution is classified into two types, a financial institution and a non-financial institution, is described in detail with reference to FIG. 1B. The first memory 114-1 and the second memory 114- on the basis of the control signal of the second memory 114-2 and the control unit 130 in which the seed value corresponding to the non-financial institution is stored. 2) a memory selector 114-3 which selects any one of them, and an OTP generator 114-4 which generates an OTP using a seed value stored in the memory selected by the memory selector 114-3. Can be configured.

The secure memory unit 120 allows access of an authenticated user and stores data of the authenticated user.

The controller 130 performs communication with the mobile device and controls the smart card chip 110 and the secure memory unit 120. In the present invention, the controller 130 provides all of the secure memory authentication function, the security token authentication function, and the OTP authentication function by using a single processor.

For the secure memory authentication function, the controller 130 encrypts and stores the data of the authenticated user and decrypts the encrypted data according to the request of the authenticated user. The controller 130 may encrypt data selectively or forcibly when data is stored, copied, and moved, and may support a two-stage structure of password designation and data encryption.

The mobile device security device 100 may be implemented in the micro SD memory 300 used as an external storage device in the mobile device 200 as shown in FIG. 2.

3 is a diagram illustrating an operation of a controller for user authentication according to an exemplary embodiment of the present invention.

Referring to FIG. 3, the controller 130 displays authentication mode information through the screen of the mobile device 200 (S310).

The authentication mode may include a single password authentication method for authenticating a user with a password, a hybrid authentication method for authenticating a user with a password and a public certificate, and a single OTP authentication method for authenticating a user with an OTP.

The user authentication of these methods may be performed by the smart card chip 110, and in addition, there may be other authentication methods in the form of a combination of password authentication, public certificate authentication, and OTP authentication method.

In the case of a single password authentication method, the smart card chip 110 compares the password entered by the user with the password stored in the smart card chip 110 and authenticates the user when the password is matched.

In the case of a mixed authentication method, the smart card chip 110 authenticates a user by performing authentication using a public certificate for the user who has passed the password authentication. In the case of a single OTP authentication scheme, the smart card chip 110 generates an OTP value for the user to authenticate the user.

When the user selects an authentication mode to use (S320), the controller 130 controls the smart card chip 110 to perform user authentication according to the user's authentication mode selection (S330).

Such user authentication may be performed when a user attempts to access the secure memory unit 120.

In addition, when the encrypted data is stored in the secure memory unit 120, a password must be input in order to decrypt the encrypted data, and the controller 130 may provide a single password authentication method or a single OTP authentication method. If a single password authentication method or a single OTP authentication method is selected, the security token module 112 may authenticate the user with the corresponding authentication method.

4 is a diagram illustrating a single password authentication method according to an embodiment of the present invention.

Referring to FIG. 4, when the security token module 112 is generated in the mobile device security device 100, a password is input from the user through the mobile device 200 and stored in the internal space of the security token module 112. (S410).

Thereafter, when the user accesses (logs in) the mobile device security apparatus 100 (S420), the security token module 112 requests a password input from the user (S430).

The password entered by the user is transmitted to the security token module 112 through the controller 130.

When the security token module 112 receives a password from the user through the mobile device 200 (S440), whether the password received from the user and the password stored in the internal space of the smart card chip 110 match. Compare (S450), and if they match with each other to authenticate the user (S460).

5 is a diagram illustrating a mixed authentication method according to an embodiment of the present invention.

Referring to FIG. 5, when the security token module 112 is generated in the mobile device security device 100, a password is input from the user and stored in the internal space of the security token module 112 (S502).

In addition, the security token module 112 generates a private key and a public key, which are key pairs for digital signature (S504), stores the private key in the internal space of the security token module 112, and sends a certificate request including the public key to the authentication server. In step S506, it is transmitted to (400).

The authentication server 400 generates a certificate (S508), and electronically signs, that is, encrypts the certificate with the received public key and transmits the certificate to the security token module 112 through the mobile device 200 (S510).

The security token module 112 stores the electronically signed certificate in the internal space for security token authentication (S512), receives a public certificate password from the user, and stores it in the internal space of the security token module 112 ( S514).

Thereafter, when the user accesses (logs in) the mobile device security device 100, the user permits access to the security token module 112 in the same manner as the password authentication method described with reference to FIG. 4 (S516).

That is, the security token module 112 requests a password input from the user. The password entered by the user is transmitted to the security token module 112 through the controller 130. The security token module 112 compares the password received from the user with the password stored in the internal space of the smart card chip 110, and if the match is identical, allows the user access to the security token module 112. Otherwise the user's access to the security token module 112 is blocked.

Next, the security token module 112 performs user authentication through the public certificate stored in the internal space for the user is allowed access (S518). That is, the security token module 112 requests the public certificate password from the user, and finally authenticates the user when the public certificate password received from the user matches the public certificate password stored in the internal space. At this time, the security token module 112 has a password authentication and password input error count limit function in order to properly cope with the unauthorized user's access, and if the number exceeds the allowable number of input errors, the security token module 112 has a locking function. Can provide.

6 is a diagram illustrating a single OTP authentication method according to an embodiment of the present invention.

Referring to FIG. 6, when the OTP generation module 114 generates the mobile device security device 100, a unique seed value is assigned to the OTP generation module 114, and the assigned seed value is registered with the authentication server together with the user identifier. (S602).

When the user approaches the mobile device security device 100 (S604), the OTP generation module 114 generates the OTP value by the encryption algorithm with the time and seed value (S606). The OTP generation module 114 transmits the user identifier and the OTP value to the authentication server 500 (S608). In this case, the OTP value may be a value of at least six digits.

The authentication server 500 generates an OTP value by an encryption algorithm having the same time in a time synchronous manner as the seed value corresponding to the user identifier (S610). If the authentication server 500 compares the OTP value generated by the OTP generation module 114 with the OTP value generated by the authentication server 500 (S612), and authenticates the user (S614), the user authentication result. To transmit to the OTP generation module 114 (S616).

On the other hand, the user inputs the query value received from the authentication server in the single OTP authentication method in addition to the time synchronization method in the OTP generation module 114, and transmits the OTP value generated by the encryption algorithm to the authentication server 500. A challenge / response scheme for authenticating a certificate may be used.

In addition, the OTP generation module 114 may be driven after confirming that the user is a legitimate user. That is, a password is input from a user when the OTP generation module 114 is generated and stored in the internal space of the OTP generation module 114. Subsequently, when the user accesses the mobile device security device 100, the OTP generation module 114 requests a password input from the user and is stored in the internal space of the password and the OTP generation module 114 received from the user. If the existing passwords match each other, the OTP generation module 114 may perform an OTP generation function.

At this time, the OTP generation module 114 has a password authentication and password input error count limit function in order to properly cope with the unauthorized user's access, and if the number of times the allowable error is exceeded, the OTP generation module 114 locks the corresponding OTP generation module 114. Can provide.

Also, in order to improve security, the OTP generation module 114 generates a primary OTP value by using a cryptographic algorithm with a time and seed value, and then generates a secondary OTP value by a cryptographic algorithm with a primary OTP value and predetermined identification information. Can be generated. The OTP generation module 114 delivers the user identifier, the predetermined identification information, and the secondary OTP value to the authentication server. Here, the identification information may correspond to an arbitrary sequence of numbers input from the user and may be serial information of the mobile device.

On the other hand, the OTP generation module 114 may generate the secondary OTP value by the encryption algorithm with the primary OTP value and the predetermined identification information, but combines a random number value and an arbitrary number string provided by the authentication server 500 In addition, a secondary OTP value may be generated from the combined value and the primary OTP value.

The authentication server 500 generates a primary OTP value by a cryptographic algorithm having the same time in a time synchronous manner with the seed value corresponding to the user identifier, and generates a secondary OTP value by the cryptographic algorithm with the primary OTP value and identification information input from the user. After generating the OTP value, the user may be authenticated by comparing the OTP value generated by the OTP generation module 114 with the OTP value generated by the authentication server 500.

In addition, the OTP generation module 114 may combine an arbitrary random number value and an arbitrary numeric string, and generate a secondary OTP value using the combined value and the primary OTP value, in which case the authentication server may use the same random number value. Can be used to generate secondary OTP. In this case, the random number value may be generated by the OTP generation module 114 and the authentication server 500 in a software manner, or may be generated in the authentication server 500.

On the other hand, the mobile device 200 may install a software-based OTP generation application that performs the same operation as the OTP generation module 114, in the OTP generation application to diagnose the state of the OTP generation module 114 when an error occurs The mobile device 500 may prepare for a failure of the OTP generation module 114 by running the OTP generation application.

And, as described above, the present invention is characterized in that different OTP is generated according to the authentication target authority, for this purpose, the control unit 130 analyzes the authentication process during the OTP authentication to extract the type of the authentication target authority This is then provided to the OTP generation module 114, so that the OTP generation module 114 controls to generate the OTP value using the seed value corresponding to the type of the certification authority. For example, if the controller 130 analyzes the authentication process and determines that the authentication target institution is a financial institution, the controller 130 generates an OTP for the financial institution using the seed value stored in the first memory 114-1.

In this case, the authentication process analysis may be at least one of analysis of website access information, analysis of posting information of the website, and analysis of type information of the authentication process.

In the case of website access information, the type of institution can be easily identified by analyzing the URL information of the website and checking whether the URL is a financial institution server address. Should be

In addition, the website posting information analysis is a method of determining the type information of the corresponding organization by analyzing the text information written on the website. For example, if you analyze the text on the home page of the website you are currently connected to, you can easily determine whether the institution is a financial institution such as a bank.

In addition, the type information analysis of the authentication process analyzes the current authentication process. For example, when the processes for authentication are analyzed for the transfer of money, it is determined that the currently connected institution server is the financial institution server. Can be.

In the present invention, it is possible to find out the type of the certification authority by analyzing the certification process, and use the corresponding seed value and time information according to the type of certification authority to input the authentication algorithm. It is possible to create and provide an OTP value for the user, so the user's convenience is remarkably increased by simply inputting the OTP displayed on the screen of the mobile device without considering the type of the institution to be authenticated. .

In addition, the mobile device security device 100 described above may enable secure storage of authorized certificates and OTP authentication on a mobile device without an additional device, and may improve security of personal information or corporate information. .

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (6)

As implemented in micro SD memory used as an external storage device in mobile devices,
A secure memory unit for storing encrypted data;
A security token module that performs user authentication using a stored password, a public certificate, and a digital certificate digital signature key, and stores different seed values so that different OTPs are generated according to a certification authority, and the seed values and time information are stored. It is used as an input value of the cryptographic algorithm to generate an OTP value for authentication of the corresponding certification authority, and sends it to the authentication server to perform user authentication. It corresponds to the first memory and non-financial institution that stores the seed value corresponding to the financial institution An OTP using a second memory having a seed value stored therein, a memory selecting unit selecting one of the first memory and a second memory based on a control signal of a controller, and a seed value stored in a memory selected by the memory selecting unit Smart card chip comprising an OTP generating module including an OTP generating unit for generating a; And
The secure memory unit, the security token module, and the smart card chip are controlled to communicate with each other and to perform user authentication. In the secure memory authentication, data of a user authenticated by a smart card chip is encrypted to secure the secure device. Control to decrypt the encrypted data stored in the memory unit or stored in the secure memory unit to provide the authenticated user, and in the security token authentication, the user authentication using the password, the public certificate and the public certificate electronic signature key In this case, the OTP authentication analyzes the authentication process process through at least one of analysis of website access information, analysis of posting information of the website, and analysis of type information of the authentication process. On the type of certification authority And a controller for controlling the OTP value to be generated using the corresponding seed value. delete delete In claim 1,
And the controller controls the smart card chip to perform user authentication according to selection of an authentication mode from the user. 5. The method of claim 4,
The authentication mode includes a single password authentication method for authenticating a user with a password, a hybrid authentication method for authenticating a user with a password and a public certificate, and a single OTP authentication method for authenticating a user with an OTP.
The single password authentication method and the mixed authentication method are performed in the security token module, and the single OTP authentication method is performed in the OTP generation module. The method of claim 5,
And the mobile device diagnoses a state of the OTP generating module and operates an OTP generating application that performs the same operation as the OTP generating module when the OTP generating module fails.

Images