KR101568851B1 - Security authentication system - Google Patents

Abstract

The present invention relates to a security authentication system for safely protecting user authentication information from external hacking, and an authentication system according to the present invention includes a database for storing a plurality of secret entities set by a user; Extracting a plurality of secret entities set by the user from the database, generating virtual codes for each of the plurality of secret objects and the camouflage entities, generating virtual data for the user including the virtual codes of the respective entities A security authentication server; And a service for receiving the user-specific virtual data from the security authentication server when receiving a login request from the user's communication device and transmitting the virtual data to the user's communication device and outputting the object selection interface to the communication device Server. In addition, the service server receives authentication information including location information for each virtual code from the communication device, analyzes the authentication information, and determines whether or not the virtual code appearing in each secret object has the promised location information And authenticates the user.

Description

Security authentication system

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security authentication technology, and more particularly, to a security authentication system for securely protecting a user's authentication information from external hacking.

As a universal method for user authentication, a password authentication method is used. The password authentication method stores passwords initially input from the user, compares the passwords input by the user with the previously stored passwords whenever necessary, and judges that the password authentication is successful if they match. In addition, a technique for authenticating a user using a touch pattern set by a user is further disclosed in the existing password authentication method. The following patent document discloses a mobile terminal for authenticating a user using a pattern and a method for locking and unlocking the same.

However, passwords have various exposure possibilities. For example, a third party can watch the password input process of the user and find out the password. Further, the hacking program can hack the password input from the user terminal to find out the password.

Therefore, an authentication method is required to prevent the third party from using the obtained password even if the password of the user is exposed to the third party. In addition, a password input method for protecting the user's password from a peeking attack or the like is needed.

Korean Patent Publication No. 10-2009-0013432

SUMMARY OF THE INVENTION It is an object of the present invention to provide a security authentication system that securely protects user authentication information from peeking attacks, hacking by malicious codes, and the like.

Other objects and advantages of the present invention will become apparent from the following description, and it will be understood by those skilled in the art that the present invention is not limited thereto. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

According to an aspect of the present invention, there is provided a security authentication system including: a database for storing a plurality of secret objects set by a user; Extracting a plurality of secret entities set by the user from the database, generating virtual codes for each of the plurality of secret objects and the camouflage entities, generating virtual data for the user including the virtual codes of the respective entities A security authentication server; And a service for receiving the user-specific virtual data from the security authentication server when receiving a login request from the user's communication device and transmitting the virtual data to the user's communication device and outputting the object selection interface to the communication device Wherein the service server receives authentication information including location information for each virtual code from the communication device and analyzes the authentication information to determine whether the virtual code appearing in each secret object has the promised location information And authenticates the user.

In one embodiment, the service server can authenticate the user by checking whether the virtual code representing the secret entity has successive location information in the authentication information.

In another embodiment, the security authentication server transmits location information of each secret entity set by the user to the service server, and the service server generates a virtual code indicating each secret entity in the authentication information, And verifies whether or not the location information of each virtual code thus confirmed matches the location information of each secret object received from the security authentication server for each secret object to authenticate the user.

In another embodiment, the service server confirms the destination of the message set by the user, generates location information for each secret object that specifies the location of each secret object, and transmits the generated location information for each secret object to the identified message The virtual code indicating each secret object and the location information of the virtual code are checked in the authentication information, and whether or not the location information of each virtual code thus confirmed matches the location information of the generated secret object, So that the user can be authenticated.

Preferably, the security authentication server generates a virtual URL for each of the secret object and the spoofed object, and transmits the virtual URL to the service server by including a virtual URL for each object in the virtual data, And transmits the virtual data including the star virtual URL to the user's communication device.

More preferably, the user's communication device accesses the virtual URL for each entity included in the virtual data to obtain a plurality of objects, and the object selection interface And generates one or more pieces of authentication information including location information and virtual codes of each entity disposed in the entity selection interface and transmits the generated authentication information to the service server when the location of the entity is determined by the user.

Meanwhile, the security authentication server preferably communicates with the service server using a dedicated network.

The service server receives a plurality of pieces of authentication information proportional to the number of secret entities from the communication device, checks the order in which the plurality of pieces of authentication information are generated and the order of the secret entities set by the user, It is possible to check the virtual code of the secret entity in the authentication information having the same order as the setting order of the secret entity and to confirm whether or not each confirmed virtual code has the promised location information.

When each object is sorted in the object selection interface, since the user is authenticated through whether the secret object set by the user is located at the appointed position, the authentication data of the user is protected from external attacks such as peeking attack There is an advantage to protect.

In addition, the present invention generates object-related data based on a uniform resource locator (URL) and a one-time virtual code randomly generated at every authentication, and generates one-time authentication information based on the object location in the object selection interface By authenticating the user on the basis, it is possible not only to prevent the user's main data (e.g., a password, etc.) from being exposed on the public network, but also to prevent reuse of the entity related data.

The present invention also provides a method and system for providing a virtual home network in which when a user selects a variable sorting method by a secret object sorting method, virtual data is provided to a specific communication device and position information, There is an effect of performing authentication.

In addition, the present invention has an advantage of enhancing the security of secret entity information, which is a basis for authenticating a user, by connecting the security authentication server and the service server via a dedicated network.

Meanwhile, the present invention has an advantage of eliminating the troublesomeness that a user has to remember and manage a login ID and a password for each web site by performing login to a plurality of web sites using one login ID.

In addition, since the present invention authenticates a user based on the one-time authentication information, the present invention can replace the existing OTP (one time password) authentication method.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments of the invention and, together with the description, serve to explain the principles of the invention. And shall not be construed as limited to such matters.
1 is a diagram illustrating a configuration of a security authentication system according to an embodiment of the present invention.
2 is a flowchart illustrating a method of registering a user in a security authentication service in a security authentication system according to an embodiment of the present invention.
3 is a view showing a secret object selection window according to an embodiment of the present invention.
4 is a flowchart illustrating a method of authenticating a user based on a fixed alignment scheme in a security authentication system according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a method for authenticating a user based on a user-specified sorting method in a security authentication system according to an exemplary embodiment of the present invention.
6 is a flow diagram illustrating a method for authenticating a user based on a floating sorting scheme in a secure authentication system, in accordance with an embodiment of the present invention.
7A and 7B are diagrams illustrating various embodiments of an entity selection interface in accordance with the present invention.
8A and 8B are diagrams illustrating virtual codes recorded in an authentication matrix according to an embodiment of the present invention.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Prior to describing the constitution of the present invention, the following terms will be described.

An object is placed in an object selection interface as a kind of key information selectable by the user such as an image, a moving picture, a text, a number, and the like.

A secret object is an entity set by a user for security authentication service among a plurality of entities.

The gastrointestinal object is an object selected to minimize the exposure of the secret object.

A pseudo code is a one-time string corresponding to an object, and is generated randomly at every authentication.

The object selection interface is a graphical user interface in which a plurality of objects are arranged and a position of an object can be moved according to a user's operation. A secret object and a camouflage object are disposed in the object selection interface.

A uniform resource locator (URL) is an object's one-time URL, which is randomly generated every time it is authenticated, just like virtual code.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a security authentication system according to an embodiment of the present invention.

As shown in Fig. 1, includes a safety input device 10, a security authentication server 20, a database 30, and a plurality of service servers 40. [ The safety input device 10 communicates with the security authentication server 20 or the service server 40 via a public network 50 such as a mobile communication network or a public Internet network. In addition, the security authentication server 20 communicates with a plurality of service servers 40 via a dedicated network 60, which is a closed network to which only designated servers can be connected. That is, the communication line between the security authentication server 20 and the service server 40 is formed as a closed dedicated communication line that can be accessed by another unauthorized device.

The safety input device 10 performs the function of generating authentication information protected from hacking attacks such as peeking attacks. Specifically, the safety input device 10 can access the security authentication server 20 by accessing the security authentication server 20 and registering a login ID of the user and a plurality of secret objects set by the user. The security input device 10 can access a plurality of service servers 40 by using a single login ID after registering in the security authentication service.

In addition, the safety input device 10 generates and displays a plurality of secret objects and a plurality of spoof objects randomly arranged and capable of moving objects, using the virtual data received from the service server 40 . When the sorting of the objects is completed on the object selection interface, the safety input device 10 generates authentication information in which the virtual code and the position information of each object arranged on the object selection interface are recorded, and transmits the generated authentication information to the service server 40 Thereby requesting the service server 40 for user authentication. At this time, the safety input device 10 can generate an authentication matrix in which the virtual codes for each entity are arranged according to the positional information as the authentication information, and transmit the authentication matrix to the service server 40.

The safety input device 10 is not limited as long as it is a communication device capable of wireless communication such as a notebook computer, a desktop computer, a tablet computer, a mobile communication terminal and other portable terminals.

The database 30 maps and stores a user's login ID, a plurality of secret objects set by the user, and a secret object sorting method (i.e., a fixed sorting method, a user-specified sorting method, or a variable sorting method). At this time, the database 30 sequentially stores each secret object based on the order set by the user. In addition, when the secret object sorting method is the user sorting method, the database 30 further maps the location information of the secret object set by the user with the login ID of the user. Meanwhile, when the secret object sorting method is a variable sorting method, the database 30 may additionally store the incoming information (e.g., mobile communication telephone number) of the message receiving apparatus designated by the user, by mapping the login ID with the user's login ID. In addition, the database 40 stores pools of objects in which a plurality of objects are registered. Various types of objects such as images, moving images, and text are registered in the object pool.

The security authentication server 20 is a server that provides a security authentication service in cooperation with the service server 40. The security authentication server 20 registers a secret object set by the user in the database 30, (40). Specifically, the security authentication server 20 maps the plurality of secret objects and the sorting method information set by the user to the login ID of the user, and stores the mapping information in the database 30. In addition, the security authentication server 20 generates virtual data so that the unique information (i.e., secret object) of the user is not exposed, and transmits the virtual object data, (40).

When each of the service servers 40 requests the login of the safety input device 10, the service server 40 requests the security authentication server 20 of the user's object information corresponding to the login ID, And authenticates the safety input device 10 by referring to the received entity information. At this time, if the secret object sorting method included in the object information is a variable sorting method, the service server 40 may display a text message in which the location information of the secret object, To induce the secret entity to be aligned at the specified location. Upon receiving the authentication matrix from the safety input device 10, the service server 40 analyzes the authentication matrix and verifies whether or not the virtual codes of the secret objects are arranged at the promised position, thereby authenticating the user. The service server 40 is a server for providing online services such as a financial transaction site, a securities site, and a portal site.

The operation of the security authentication system according to the present invention will be described in detail with reference to FIGS. 2 to 8.

2 is a flowchart illustrating a method of registering a user in a security authentication service in a security authentication system according to an embodiment of the present invention.

Referring to FIG. 2, the safety input device 10 accesses the security authentication server 20 and requests membership registration to the security authentication server 20 (S201).

Then, the security authentication server 20 requests user information such as name, sex, date of birth, and mobile communication telephone number to the safety input device 10 (S203). Preferably, the security authentication server 20 requests authentication information (e.g., an authorized certificate, biometric information, and the like) necessary for authentication of the user by the safety input device 10.

Next, the safety input device 10 receives user information such as a name, a sex, a date of birth, a mobile communication telephone number, authentication information, etc., from the user and transmits the user information to the security authentication server 20 (S205) . Then, the security authentication server 20 performs authentication of the user who requested membership registration based on the information included in the user information (S207). Next, when the security authentication server 20 fails to authenticate the user, the security authentication server 20 transmits a message requesting retransmission of the user information to the safety input device 10. On the other hand, if the security authentication server 20 succeeds in authenticating the user's identity, the security authentication server 20 requests the selection of the login ID to the safety input device 10 (S209).

Then, the safety input device 10 receives the login ID from the user and transmits the input login ID to the security authentication server 20 (S211).

Next, the security authentication server 20 verifies whether the login ID received from the safety input device 10 is already in use (S213). Then, if the login ID is already in use by another user, the security authentication server 20 transmits a message requesting the login ID reselection to the safety input device 10. On the other hand, if the login ID is an available ID, the security authentication server 20 transmits a secret object selection window, which can set one or more secret objects among the objects registered in the object pool of the database 30, (S215).

Then, the safety input device 10 displays the secret object selection window received from the security authentication server 20 on the screen.

3 is a view showing a secret object selection window according to an embodiment of the present invention.

Referring to FIG. 3, the security authentication server 20 transmits a secret object selection window as shown in FIG. 3 to a safety input device 10 in which a plurality of objects are arranged and a user can select a secret object. At this time, the security authentication server 20 may include direction keys 300a and 300b for changing a plurality of entities placed in the secret object selection window in the secret object selection window. In this case, the security authentication server 20 transmits a secret object selection window in which only some objects (for example, 16 objects) among the objects registered in the object pool of the database 30 are arranged to the safety input device 10, When the direction keys 300b and 300b are clicked on the input device 10, another plurality of objects are extracted from the object pool of the database 30 and transmitted to the safety input device 10, Can be changed.

Next, the safety input device 10 sequentially selects a plurality of secret objects from among the objects arranged in the secret object selection window (S217). It is preferable that the user sequentially selects a plurality of objects that can be easily memorized in the secret object selection window. For example, the user can sequentially select a plurality of animal image objects constituting the food chain, or can select a plurality of objects having a special meaning to him.

Then, the safety input device 10 sequentially transmits the plurality of secret objects selected by the user through the secret object selection window to the security authentication server 20 according to the selected order (S219).

Then, the security authentication server 20 sequentially receives the plurality of secret objects from the safety input device 10, maps the plurality of secret objects to the login ID of the user according to the received order, and stores them in the database 30 (S221), the secret entity registration of the user is completed.

Next, the security authentication server 20 transmits a secret object sorting method selection window requesting selection of one of a fixed sorting method, a user-specified sorting method, and a variable sorting method to the safety input device 10 (S223).

Then, the safety input device 10 outputs a secret object sorting mode selection window to the screen, and receives either a fixed sorting method, a user specified sorting method, or a variable sorting method from the user. At this time, when the user selects the user-specified sorting method, the safety input device 10 receives the location information of each secret object set by the user from the user. In addition, when the user selects the variable sorting method, the safety input device 10 receives the incoming information (e.g., mobile communication telephone number, IP address, etc.) of the message receiving device from the user.

Next, the safety input device 10 transmits the secret object sorting method selected by the user to the security authentication server 20 (S225). In this case, when the user selects the user-specified sorting method, the safety input device 10 further transmits the location information of each secret object of the user to the security authentication server 20, and when the user selects the variable sorting method, And additionally transmits the reception information of the reception apparatus to the security authentication server 20. [

Then, the security authentication server 20 maps the secret entity sorting method received from the safety input device 10 to the login ID of the user and stores it in the database 30 (S227). In this case, when the user sets the user-specified sorting method as the secret object sorting method, the security authentication server 20 receives the secret information for each secret object from the safety input device 10, And additionally stores it in the database 30. In addition, when the user sets the variable sorting method as the secret object sorting method, the security authentication server 20 receives the incoming information of the message receiving apparatus from the safety input device 10, And further stores it in the database 30 by mapping it with the login ID of the user.

Meanwhile, the user can select a plurality of camouflage objects through the secret object selection window. In this case, the safety input device 10 transmits a plurality of camouflage objects selected by the user to the security authentication server 20, and the security authentication server 20 maps the plurality of camouflage objects with the login ID of the user, (30).

The security authentication server 20 may provide a plurality of web site addresses to the security input device 10 when the registration of the security authentication service is completed. That is, the security authentication server 20 transmits a URL of a plurality of service servers 40, which provide a security authentication service, in cooperation with the security authentication server 20 through the dedicated network 60 to the safety input device 10, And recognizes a plurality of websites that can be provided to the user.

4 is a flowchart illustrating a method of authenticating a user based on a fixed alignment scheme in a security authentication system according to an exemplary embodiment of the present invention.

In the description with reference to FIG. 4, it is described that the user sets the secret object sorting method to the fixed sorting method and registers the secret object sorting method in the security authentication server 20.

4, the safety input device 10 receives a login ID from a user, and transmits a login request message including the login ID of the user to the service server 40 (S401). In step S403, the service server 40 transmits an entity information request message including the login ID of the user to the secure authentication server 20 in order to acquire data necessary for the login authentication of the user.

Then, the security authentication server 20 confirms the login ID included in the object information request message, and confirms the plurality of secret objects and the secret entity sorting mapped to the login ID in the database 30 (S405). That is, the security authentication server 20 confirms a plurality of secret objects sequentially set by the user in the database 30, and confirms the secret object sorting method set by the user in the database 30. In the description with reference to FIG. 4, it is explained that the security authentication server 20 confirms in the database 30 that the secret entity sorting method of the user is a fixed sort method.

Then, the security authentication server 20 selects a certain number of camouflaged objects placed in the object selection interface in the object pool of the database 30 (S407). At this time, the security authentication server 20 selects a camouflage entity among a plurality of entities excluding the secret entity. Also, when the user directly sets the camouflage entity, the security authentication server 20 can extract and select a plurality of camouflage entities mapped to the user's login ID from the database 30.

Next, the security authentication server 20 generates a virtual URL for each of the secret object and the camouflage object, and links the corresponding virtual URL and the corresponding object (i.e., camouflage object or secret object) (S409). That is, the security authentication server 20 generates a virtual URL that can be accessed by each entity by one-time, for each entity, and links the generated virtual URL to the corresponding entity. Accordingly, the safety input device 10 can access the virtual URL and acquire each entity linked to each URL.

The security authentication server 20 arbitrarily generates a one-time virtual code for each of the entities, i.e., the secret entity and the camouflage entity (S411). Next, the security authentication server 20 transmits the virtual information in which the virtual URL and the virtual code are mapped on an object basis, and the object information including the secret object sorting method set by the user, to the service server 40 (S413). At this time, the security authentication server 20 displays the secret object flag in the virtual code representing the secret object among the plurality of virtual codes included in the virtual data, thereby allowing the service server 40 to recognize the virtual code of each secret object .

Next, the service server 40 extracts virtual data from the entity information received from the security authentication server 20, and transmits the virtual data to the safety input device 10 (S415).

Then, the safety input device 10 confirms the virtual URL and the virtual code in the virtual data. Then, the safety input device 10 obtains each entity by accessing each of the identified virtual URLs (S417). Then, the safety input device 10 completes generation of the object selection interface by randomly arranging the acquired objects in the object display position implemented in the object selection interface. Next, the safety input device 10 outputs the object selection interface to the screen (S419).

7A and 7B are diagrams illustrating various embodiments of an entity selection interface in accordance with the present invention.

7A and 7B, the safety input device 10 generates an object selection interface in which a plurality of objects are disposed. FIG. 7A shows each object placed in a grid-shaped object selection interface, and FIG. 7B shows a circle-shaped object selection interface in which three circles are combined. Meanwhile, the entity selection interface according to the present invention may be modified into various shapes and generated.

In addition, the position of the object placed in each object selection interface can be changed according to the operation of the user. That is, the user can change the position of the object placed on the object selection interface through an input means such as a mouse, a keyboard, or a touch screen. Preferably, when a specific entity is moved in the entity selection interface, a plurality of entities disposed on the same line as the entity move together, thereby minimizing the exposure of the secret entity to peripheral users. In FIG. 7A, when an object having reference numeral 701a moves to the right one column, the other entities located in the third row are moved together with one right column. 7B, when the object having reference numeral 701b arranged in the outermost circle moves in the clockwise direction, other entities arranged in the outermost circle also rotate in the clockwise direction.

When the object selection interface is thus output to the safety input device 10, the user moves one or more objects so that the secret object is positioned at the appointed position according to the fixed alignment method. That is, the user moves an object in the object selection interface so that each secret object set by the user is sequentially arranged, and then enters an alignment completion menu.

For example, in FIG. 7A, if the objects of 701a, 702a, and 703a are secret objects set by the user, the user can change the position of one or more objects so that these secret objects are sequentially arranged in rows or columns have. That is, the user moves the 702a object to the coordinates of (3, 3) so that the other secret objects are arranged next to the coordinates of 701a arranged at the XY coordinates (2,3) in the object selection interface of FIG. , 3) to the coordinates of 703a. 7B, when the entities of 701b, 702b, and 703b are respectively the secret entities set by the user, the user can change the positions of the entities such that the secret entities 701b, 702b, and 703b are located at the same azimuth angle have. That is, the user can change the position of the object so that the secret entities 701b, 702b, and 703b set by the user in the entity selection interface of FIG. 7B are arranged in a straight line indicating the same number.

The user arranges the secret object at the appointed position, and then inputs the object sort completion menu to the safety input device 10. Then, the safety input device 10 generates an authentication matrix in which the virtual code for each entity is arranged according to the position information (S421). Specifically, the safety input device 10 identifies each entity disposed in the sorted entity selection interface, and generates an authentication matrix in which the virtual codes corresponding to the entity are arranged according to the entity-specific locations.

8A and 8B are diagrams illustrating virtual codes recorded in an authentication matrix according to an embodiment of the present invention.

8A and 8B, the safety input device 10 identifies an entity placed at the XY coordinate in the interface of FIG. 7A, and arranges the virtual code corresponding to the entity and the position information And generates an authentication matrix. In FIG. 7A, the entities 701a, 702a, and 703a correspond to the virtual codes "S2C3", "S35C", and "S4C2" in FIG. That is, when the user places the secret object in the coordinates (2,3), (3,3), and (4,3), the virtual code for the secret object is generated in the third row, .

In Fig. 7B, the entities 701b, 702b and 703b correspond to the virtual codes "S9C1 "," S2C2 ", and "S5C3" in Fig. 8B, respectively. That is, when the user aligns each of the secret objects 701b, 702b, and 703b in the direction of 5 o'clock azimuth in the object selection interface of FIG. 7B, the virtual code for the secret object shown in FIG. .

Next, the safety input device 10 transmits the generated authentication matrix to the security authentication server 20 (S423).

Then, the service server 40 analyzes the authentication matrix received from the safety input device 10 and performs user authentication. Specifically, the service server 40 confirms that the object sorting method included in the object information received from the security authentication server 20 is a fixed sorting method, and verifies the virtual code of each secret object in the object information. At this time, the service server 40 confirms that the virtual code indicated by the secret object flag among the plurality of virtual codes included in the object information is the virtual code representing the secret object. Next, the service server 40 authenticates the user by checking whether or not the virtual code of the verified secret entity is sequenced in the authentication matrix (S425). That is, the service server 40 sets the fixed sorting method according to the secret object sorting method by the user of the safety input device 10, and determines whether or not the virtual codes of the secret objects are arranged in the columns or rows of the authentication matrix By verifying, the user is authenticated.

Then, if the virtual codes of the respective secret entities of the user are not arranged in the authentication matrix, the service server 40 fails the user authentication and transmits an authentication failure notification message to the safety input device 10 (S427 ). On the other hand, if the virtual code of each secret entity is arranged in the column or row of the authentication matrix, the service server 40 successively processes the user authentication and transmits an authentication success notification message to the safety input device 10 (S429), and provides the service requested by the user. On the other hand, when the user authentication is completed, the service server 40 deletes the entity information received from the security authentication server 20.

Preferably, when the authentication of the user is unsuccessful, the service server 40 retransmits the entity information request message to the security authentication server 20. Then, the security authentication server 20 regenerates the virtual code and the virtual URL for the secret object set by the user and the camouflage object, and generates new virtual data in which the regenerated virtual code and the virtual URL are mapped for each object, And transmits the object information including the object sorting method to the service server 40. Then, the service server 40 again performs authentication of the safety input device 10 based on the new entity information received from the security authentication server 20. [ That is, when the user fails to perform the login authentication, the virtual code and the virtual URL for each object are regenerated in the security authentication server 20, and the service server 40 registers the user's login authentication on the basis of the virtual code Thereby preventing reuse of the virtual code and the virtual URL included in the virtual data.

5 is a flowchart illustrating a method for authenticating a user based on a user-specified sorting method in a security authentication system according to an exemplary embodiment of the present invention.

In the description with reference to FIG. 5, it is explained that the user sets a custom sorting method by a secret object sorting method and registers the location information of each secret object in the security authentication server 20 in advance. In the description with reference to FIG. 5, a portion overlapping with FIG. 4 is compressed and summarized.

Referring to FIG. 5, the safety input device 10 transmits a login request message including a login ID of a user to the service server 40 (S501). In order to perform enhanced security authentication, the service server 40 transmits an entity information request message including the login ID of the user to the service server 40 (S503).

In step S505, the security authentication server 20 confirms a plurality of secret objects and secret entity sorting mapped to the login ID in the database 30. In the description with reference to FIG. 5, the security authentication server 20 confirms that the secret object sorting method of the user is the user sorting method in the database 30, and stores the location information of each secret object mapped with the login ID of the user in the database 30).

Then, the security authentication server 20 selects a certain number of camouflage entities from the object pool of the database 30 or extracts a plurality of camouflage entities mapped with the user's login ID from the database 30 (S507). Next, the security authentication server 20 generates a virtual URL for each of the secret object and the camouflage object, and links the corresponding virtual URL to the corresponding object (S509). Then, the security authentication server 20 generates a virtual code for each object (S511). Then, the security authentication server 20 transmits the virtual information including the virtual data in which the virtual URL and the virtual code are mapped by the object, and the object information including the secret object sorting method set by the user, (Step S513). At this time, the security authentication server 20 includes the location information in which each virtual code indicating the secret entity should be located, and transmits the location information to the service server 40. That is, as the secret object sorting method set by the user is a user-specified sorting method, the security authentication server 20 confirms the location information for each secret object in the database 30 and, based on the location information for each secret object, The location information for each secret object virtual code in which each virtual code is to be located is included in the object information.

Next, the service server 40 transmits the virtual data included in the entity information to the safety input device 10 (S515).

Then, the safety input device 10 acquires a plurality of entities through the virtual URL included in the virtual data (S517), randomly arranges the acquired entities in the entity selection interface, On the screen (S519).

When the object selection interface is output to the safety input device 10, the user moves each secret object on the object selection interface so that each secret object set by the user is placed at the designated position. That is, the user registers the location information of each secret object, which is the location of each secret object, in the security authentication server 20 in advance, recognizes the registered location information of the secret object, After moving, enter the sort completion menu.

For example, in FIG. 7A, it is assumed that a user has 701a, 702a, 703a, and 701a, 702a, and 703a, respectively, (4,3), the user moves the secret object of 701a to the coordinates of (2,2), moves the secret object of 702a (3,4) and also moves the secret object of 703a, Complete menu can be entered. 7B, when the entities of 701b, 702b and 703b are the secret entities respectively set by the user and the azimuth angles of 701b, 702b and 703b are 360 degrees, 30 degrees and 180 degrees, respectively, Direction, moves the secret object of 702b to the 1 o'clock direction, moves the secret object of 703b to 6 o'clock, and then enters the object sort completion menu.

Next, when the object sorting completion menu is input, the safety input device 10 generates an authentication matrix in which virtual codes for each object are arranged according to position information (S521). That is, the safety input device 10 identifies each entity disposed in the sorted entity selection interface, and generates an authentication matrix of the type shown in FIG. 8 arranged according to the position where the virtual codes corresponding to the entity are aligned. Next, the safety input device 10 transmits the generated authentication matrix to the service server 40 (S523).

Then, the service server 40 confirms the virtual code and the location information for each secret object based on the data recorded in the entity information received from the security authentication server 20 (S527). That is, the service server 40 checks the virtual code for the secret object and the location information for the virtual code of each secret object among the plurality of virtual codes based on the location information of the secret object virtual code included in the object information .

Next, the service server 40 determines whether or not each virtual code indicating the secret entity in the authentication matrix is correctly arranged at a position set by the user on the basis of the identified location information of the secret entity virtual code, (S527). That is, the service server 40 confirms whether the location information of the secret object virtual code recorded in the authentication matrix and the location information of the secret object virtual code identified in the object information coincide with each other, ) Authenticates whether or not the user is a legitimate user.

Then, if none of the secret object virtual codes are arranged at a preset location by the user, the service server 40 fails the user authentication of the safety input device 10, The authentication failure notification message is transmitted (S529).

On the other hand, if all of the secret object virtual codes recorded in the authentication matrix are arranged at the positions preset by the user, the service server 40 successively processes the user authentication for the safety input device 10, Message to the safety input device 10 (S531), and provides the service requested by the user. That is, when both the location information of the secret object virtual code recorded in the authentication matrix and the location information of the secret object virtual code identified in the object information are all identical, the service server 40 successively processes the user authentication, To the safety input device (10). When the user authentication is completed, the service server 40 deletes the security authentication information received from the security authentication server 20.

6 is a flow diagram illustrating a method for authenticating a user based on a floating sorting scheme in a secure authentication system, in accordance with an embodiment of the present invention.

In the description with reference to FIG. 6, it is described that the user sets the variable sorting method as the secret object sorting method and registers it in the security authentication server 20.

Referring to FIG. 6, the safety input device 10 transmits a login request message including a login ID of a user to the service 40 (S601). Then, the service server 40 transmits an entity information request message including the login ID of the user to the security authentication server 20 (S603).

Next, the security authentication server 20 confirms a plurality of secret objects and secret entity sorting mapped to the user's login ID in the database 30 (S605). In the description with reference to FIG. 6, the security authentication server 20 confirms in the database 30 that the secret object sorting method set by the user is a variable sorting method, and the setting sequence of each secret object is additionally confirmed in the database 30 .

Then, the security authentication server 20 selects a certain number of camouflage objects disposed in the object selection interface from the object pool of the database 30, or extracts a plurality of camouflage objects mapped to the user's login ID from the database 30 (S607). Next, the security authentication server 20 generates a virtual URL for each of the secret object and the camouflage object, and links the corresponding virtual URL and the corresponding object (i.e., camouflage object or secret object) in operation S609.

The security authentication server 20 arbitrarily generates a one-time virtual code for each of the entities, i.e., the secret entity and the camouflage entity (S611). Next, the security authentication server 20 transmits virtual information in which the virtual URL and the virtual code are mapped on an object basis, and entity information including a secret object sorting method set by the user, to the service server 40 (S613). At this time, the security authentication server 20 includes the setting order for each secret object virtual code in the entity information, and transmits it to the service server 40. That is, the security authentication server 20 confirms the setting order of each secret object sequentially set by the user in the database 30 in accordance with the secret sorting method of the user, The setting order of each virtual code indicating the secret entity is included in the entity information.

Then, the service server 40 receives the entity information from the security authentication server 20, and confirms that the variable sorting method is included in the entity information. Then, the service server 40 arbitrarily creates location information for each secret object on the object selection interface, which indicates the location where the secret object should be placed (S615). The service server 40 arbitrarily generates location information of each secret entity at every login authentication.

Next, the service server 40 records the generated location information for each secret object in a text message, and sends the text message to a message receiver designated by the user (S617). That is, the service server 40 confirms the incoming information of the message receiving apparatus designated by the user as a destination of the message, and sends out the text message in which the incoming information is set as the destination and the generated location information of the secret entity is recorded. The reception information of the message reception device can be registered by the user in advance in the service server 40 and the service server 40 can receive the reception information from the security authentication server 20. [

The user confirms the text message using the message receiving device and recognizes that each secret object set by the user is to be located on the object selection interface.

With respect to position information per object, for example, when the service server 40 has three secret objects set by the user and the object selection interface is the form of a balloon as shown in FIG. 7A, the coordinates of the X axis and the Y axis The message "322444" indicating " 322444 " Here, "322444" indicates that the coordinate of the first secret object is (3, 2), the coordinate of the second secret object is (2,4), and the coordinate of the third secret object is (4, 4). As another example, in the case where the number of secret objects set by the user is three and the object selection interface is in the form of a circle in which three circles are combined (see FIG. 7B), the service server 40 stores positional information Quot; 113520 "can be transmitted to the safety input device 10. Here, "113520" represents the azimuth coordinate when the first secret object is located at 11 o'clock, azimuth coordinates when the second secret object is located at the 35th minute, and the third secret object This indicates the azimuth coordinate when the second hand is positioned at 20 seconds.

Next, the service server 40 extracts virtual data from the entity information received from the security authentication server 20 and transmits the virtual data to the safety input device 10 (S619). Then, the safety input device 10 confirms the virtual URL and the virtual code of each entity in the virtual data, and obtains each entity by accessing each virtual URL (S621). Then, the safety input device 10 creates an object selection interface by randomly arranging the acquired objects in the object display position implemented in the object selection interface, and outputs the object selection interface to the screen (S623).

When the object selection interface is output to the safety input device 10, the user moves each secret object to the designated location based on the location information of each secret object recorded in the text message received through the message reception device. That is, the user confirms the location information of each secret object through the text message, moves each secret object on the object selection interface while recognizing the confirmed location information of the secret object, and inputs the alignment completion menu.

For example, in FIG. 7A, 701a, 702a, and 703a are secret objects sequentially set by the user, and the secret object location information recorded in the text message is (3,2), (2,4), 4,4), the user moves the secret entity of 701a to the coordinates of (3,2), moves the secret entity of 702a to the (2,4) coordinates, and also moves the secret entity of 703a to (4,4) After moving, the object sort completion menu can be entered. In FIG. 7B, when the objects 701b, 702b, and 703b are secret objects set by the user and the secret object location information recorded in the text message is "113520" indicating 11:35:20, The secret object moves to the 11 o'clock position, the secret object of 702b moves to the 7 o'clock position, the secret object of 703b moves to the 4 o'clock position, and then the object sort completion menu is input.

Next, when the object sorting is completed, the safety input device 10 generates an authentication matrix in which object-specific virtual codes are arranged according to positional information (S625). That is, the safety input device 10 identifies each entity in the sorted entity selection interface, and generates an authentication matrix of the type shown in FIG. 8 in which the virtual codes corresponding to the entities are arranged according to the individual entity positions.

Next, the safety input device 10 transmits the generated authentication matrix to the service server 40 (S627). Then, the service server 40 confirms the virtual code for each secret object based on the setting order for each secret object virtual code included in the object information received from the security authentication server 20. [ At this time, the service server 40 recognizes that among the plurality of virtual codes included in the entity information, the virtual code recorded in the setting order is a virtual code representing the secret entity. Next, the service server 40 confirms the location information of each secret entity, which is randomly generated in step S615 (S629).

Next, the service server 40 authenticates the user by checking whether a plurality of secret entity virtual codes recorded in the authentication matrix are correctly arranged at the positions of the randomly generated secret entities (S631). That is, the service server 40 checks the virtual code of each secret entity based on the entity information received from the authentication security server 20, and determines whether the virtual code of the secret entity is arranged in the authentication matrix Thereby confirming the location of the secret object virtual code in the authentication matrix. Then, the service server 40 confirms the location of each confirmed secret object virtual code and whether or not the location information of each secret object generated randomly in step S615 is identical for each secret object, thereby authenticating the user.

Then, if none of the virtual codes of the secret entity is arranged at the designated location, the service server 40 fails the user authentication of the safety input device 10 and notifies the safety input device 10 of the authentication failure notification Message (S633).

On the other hand, if the virtual code for each secret object is correctly arranged at the position specified in step S615 in the authentication matrix, the service server 40 successively processes the user authentication for the safety input device 10, To the safety input device 10 (S635), and provides the service requested by the user. When the authentication of the user is completed, the authentication service server 40 deletes the entity information received from the security authentication server 20.

Meanwhile, in the above-described embodiment, the safety input device 10 transmits one authentication matrix to the service server 40, and the service server 40 transmits a virtual code for each secret object at the appointed position through one authentication matrix The safety input apparatus 10 generates an authentication matrix in proportion to the number of secret entities and transmits the authentication matrix to the service server 40. The service server 40 transmits the authentication matrix The user may be authenticated by analyzing each authentication matrix.

Specifically, when the user moves the first secret object on the object selection interface and then inputs an alignment completion menu for the first secret object, the safety input device 10 determines whether the virtual code for each object is the first Th authentication matrix. When the user inputs a sort completion menu for the second secret object after moving the second object on the object selection interface, the safety input device 10 displays a second authentication matrix . Then, the safety input device 10 requests the service server 40 to authenticate the plurality of authentication matrices generated according to the sorting of each secret entity.

When the user moves a specific object, not only the specific object but also all other objects on the interface are moved to the movement distance of the specific object So as to protect the user's secret object from peeking attacks. For example, if an object having reference numeral 701a in FIG. 7A moves to the right one, all other objects move to the right one place. As another example, when an object having the reference numeral 701b arranged in the outermost circle in FIG. 7B is rotated two clockwise, not only the other objects arranged in the outermost circle but also objects arranged in the other two circles Also turns clockwise two turns.

When the service server 40 receives a plurality of authentication matrices from the safety input device 10, the service server 40 analyzes the plurality of authentication matrices and authenticates the user. Specifically, when a plurality of authentication matrices are received from the safety input device 10 and the secret object sorting method is a user-specified sorting method or a variable sorting method, the service server 40 generates a virtual code , It is checked whether or not the virtual code of the first secret object is arranged at the specified position and likewise, whether or not the virtual code of the second secret object is arranged at the designated position in the object-specific virtual code recorded in the second authentication matrix do. If the virtual codes of the secret objects are correctly arranged in each of the plurality of authentication matrices, the service server 40 processes the authentication success of the user.

If the plurality of authentication matrices are received from the safety input device 10 and the secret object sorting method is a fixed sorting method, the service server 40 checks the location of the virtual code of the first secret object in the first authentication matrix, Identify the location of the virtual code of the second secret object in the second authentication matrix. That is, the service server 40 confirms the positions where the virtual codes of the secret objects are arranged in the order of the respective authentication matrices. Then, the service server 40 authenticates the user by checking whether or not the virtual code of the secret entity identified in each authentication matrix has successive positions based on the row or column. For example, if the user has set up three secret entities, the service server 40 receives three sequential authentication matrices from the secure input device 10, and the service server 40 receives the first secret Confirms the location of the virtual code of the object, verifies the second authentication matrix and the virtual code position of the second secret object and the third secret object in the third authentication matrix, respectively. Then, the service server 40 confirms whether or not the positions of the first to third virtual codes are consecutive based on the row or column, thereby authenticating the user.

As described above, in the security authentication system according to the present invention, when each object is sorted in the object selection interface, the security authentication system authenticates the user through whether or not the secret object set by the user is aligned at the appointed position. And protect the user's authentication-related secret data from external attacks such as attacks. In addition, the security authentication system according to the present invention generates object-related data based on randomly generated one-time virtual URLs and one-time virtual codes at every authentication, and generates one-time authentication information (E.g., a password, etc.) from being exposed to the communication network.

Meanwhile, in the above-described embodiment, the safety input device 10 generates the authentication matrix in the form of a matrix as the authentication information of the user and transmits it to the service server 40. However, the present invention is not limited to this, And the data including the virtual code are not limited and can be adopted as the authentication information of the present invention.

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.

Although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed to obtain a sequence of sequential orders, or a desired result . In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

10: Safety input device 20: Security authentication server
30: database 40: service server
50: public network 60: dedicated network

Claims (8)

A database for storing a plurality of secret objects set by the user;
Extracts a plurality of secret entities set by the user from the database, generates one-time virtual codes for each of the plurality of secret entities and the camouflage entities, generates a one-time virtual URL for each of the secret entities and the camouflage entities A security authentication server for generating the user-specific virtual data including the one-time virtual code and the one-time virtual URL for each object; And
A service server for receiving the user-specific virtual data from the security authentication server and transmitting the virtual data to the user's communication device and outputting the object selection interface to the communication device when receiving a login request from the user's communication device; Lt; / RTI >
The communication device of the user,
Accessing the one-time virtual URL for each object included in the virtual data to obtain a plurality of objects, outputting the object selection interface in which each object thus obtained is arranged and the object position can be changed, And generating authentication information including the one-time virtual code and location information corresponding to each entity disposed in the entity selection interface, and transmitting the generated authentication information to the service server,
The service server,
Confirms the one-time virtual code indicating the secret entity in the authentication information, verifies whether the one-time virtual code indicating the secret entity has the promised location information, and authenticates the user. The method according to claim 1,
The service server,
And authenticates the user by confirming whether the one-time virtual code representing the secret entity has successive location information. The method according to claim 1,
Wherein the security authentication server transmits location information of each secret entity set by the user to the service server,
The service server,
The one-time virtual code indicating each secret entity and the location information of the one-time virtual code are checked in the authentication information, and whether or not the location information of each one-time pseudo code thus confirmed matches the location information of each secret object received from the service server And authenticates the user. The method according to claim 1,
The service server,
The location information of each secret object is generated, the location information of each secret object is sent to the identified message recipient, and each secret object is represented The location information of the one-time virtual code and the one-time virtual code is confirmed in the authentication information, and the location information of each one-time virtual code thus confirmed matches the location information of the generated secret entity, And the security authentication system. delete delete 5. The method according to any one of claims 1 to 4,
The security authentication server includes:
And communicates with the service server using a dedicated network. 5. The method according to any one of claims 1 to 4,
The service server,
Receiving a plurality of pieces of authentication information proportional to the number of the secret entities from the communication device, checking the order in which the plurality of pieces of authentication information are generated and the order of the secret entities set by the user, The one-time virtual code indicating the secret object is confirmed in the authentication information having the same generation order, and whether or not each confirmed one-time virtual code has the promised location information is confirmed.

Images