KR102211033B1 - Agency service system for accredited certification procedures - Google Patents

Abstract

A proxy service system for electronic authentication procedures is launched that automatically connects to the server of the target institution by proxying the electronic authentication procedure for the target institution, and provides an environment in which information requested by the user can be collected from the server of the target institution. To this end, it is connected to a content provider server that transmits target organization information and electronic authentication information, an organization server in which a plurality of personal information is stored, and the content provider server and the organization server through a communication network, and target organization information through the communication network. And when electronic authentication information is received, a target institution matching the target institution information is selected, the electronic authentication information is processed in a format requested by the target institution to generate personal authentication information, and a target based on the personal authentication information It provides an agency service system for electronic authentication procedures including an operation server that acts on behalf of an institution's institutional server. According to the present invention, since it is possible to lower the technical difficulty for developing an app or program that requires access to a site that requires electronic authentication to collect specific information, the development of a new business model for individual developers, start-up companies, small and medium-sized enterprises, etc. It can alleviate the barriers to entry.

Description

Agency service system for electronic certification procedures {AGENCY SERVICE SYSTEM FOR ACCREDITED CERTIFICATION PROCEDURES}

The present invention relates to an electronic authentication procedure proxy service system that supports automatic login of a website that requires an electronic authentication procedure, and more specifically, automatically accesses the server of the target institution by proxying the electronic authentication procedure for the target institution. And, it relates to an agency service system for electronic authentication procedures that provides an environment in which information requested by users can be collected from a server of a target institution.

The Internet is a worldwide computer network system, and is an open network configured to freely connect and use by applying a common protocol called TCP/IP to the other computer to access anywhere in the world. With the advancement of data compression technology as well as transmission of basic text information, various services such as transmission of large-capacity multimedia files, e-mail, and World Wide Web (WWW) have become available. As such, the Internet is rapidly increasing in importance as a strategic tool for improving efficiency and productivity across all parts of the existing industry as the use of the Internet has rapidly increased both domestically and globally. Moreover, new business opportunities through the Internet are continuously being created, and the area is also expanding, so the number of Internet operators is increasing more and more.

On the other hand, with the development of wireless communication technology, the services provided by mobile communication systems using CDMA (Code Division Multiple Access) are not only voice services, but also multi-units that simultaneously transmit large amounts of data such as packet data and circuit data. It is developing into casting multimedia communication. As large-capacity data transmission becomes possible in mobile communication systems, various information such as financial services, language learning, games, and broadcasting services can be used anytime, anywhere using a mobile communication terminal.

As such, with the early construction of high-speed Internet networks and the increase in the spread of mobile communication terminals, people can easily use various Internet services. However, in the Internet environment where anonymity is guaranteed and information is easy to obtain, social and economic damages are occurring due to hacking and cyber crime.

Therefore, an electronic signature was introduced to verify the identity of a personal computer user or a mobile communication terminal user in an Internet environment, which is a virtual space.

These electronic signatures are data in an electronic form logically combined with the original text data message, and are used for the purpose of verifying the identity of the signer and indicating the user's approval of the contents of the original text data message. Or it means information generated through a computer instead of a pen as an electronic substitute for a seal. Currently, in wired and wireless Internet environments, user authentication methods that standardize digital signatures based on electronic certificates are being used in countries around the world.

Here, the digital signature means a type of electronic signature using a public key encryption method (asymmetric encryption system). Typically, a digital signature technology uses a public key infrastructure (PKI) encryption algorithm. The private key used in the public key infrastructure encryption algorithm becomes the digital signature generation key that generates the digital signature, and the public key becomes the digital signature verification key that verifies the digital signature.

Therefore, the safe operation of the digital signature technology depends on the safe operation of the digital signature generation key (private key) and the digital signature verification key (public key).

Public Key Infrastructure (PKI) is secure by using a pair of public keys and private keys granted by trusted organizations by users of public networks such as the Internet, which are not secured. And secretly exchange data. In the public key infrastructure (PKI) encryption method, the public key and the private key are simultaneously created by the certification authority server using the same algorithm. The private key is given only to the person requesting issuance, and the public key is disclosed as part of the electronic certificate in a public directory accessible to everyone.

When sending an electronic document, the sender obtains the recipient's public key from the public directory, encrypts the electronic document using this, and transmits it to the recipient. At this time, the sender encrypts the electronic certificate using his/her private key and sends it together with the encrypted electronic document so that the sender of the electronic document can be identified as the sender. The receiver decrypts the encrypted electronic document transmitted from the sender using his own private key, obtains the sender's public key from the public directory, and decrypts the encrypted electronic certificate.

The core function of this public key infrastructure (PKI) authentication is the confidentiality that allows only the transaction party to know the contents of the e-commerce transaction and does not allow a third party to know it, and the documents exchanged during the e-commerce transaction are forged. And integrity that prevents tampering, authentication that allows the transaction party to be held accountable for the transaction activity, and the contract concluded between the transaction parties, etc. It is possible to guarantee NonRepudiation that proves the fact of e-commerce activities so that it is not denied due to harm.

However, under the public key infrastructure, the private key used as a key to decrypt the encrypted public key is generated by an external digital certification authority (CA) and provided to the user, which is not only exposed to the risk of hacking. In addition, as the user's private key exists in the form of a file in a standardized storage location due to the soft token-based storage method, it is easy to copy and collect the file of the private key, causing financial damage and theft of user information due to private key leakage. It poses risks. For this reason, the electronic certification authority (CA) that provides the generated private key to the user must establish an electronic certificate issuance system equipped with a high-level security system to block hacking as much as possible. Since the operation and maintenance of the certificate issuing system must be performed, there is a problem that a high issuance cost is caused when issuing an electronic certificate.

In addition, when performing a user authentication process through a web browser, an electronic certificate can be used only when ActiveX is installed in advance for separate security purposes. However, since ActiveX can be installed only by lowering the security level of the PC so that it can access resources such as files and registry of a personal computer (hereinafter referred to as a PC), it is possible to install security during the user authentication process through an electronic certificate. Due to ActiveX, which is installed as an essential component, the security level of the user's PC is lowered, so there is also a problem of being exposed to dangerous environments such as hacking.

On the other hand, in recent years, thanks to the rapid development of Internet technology, web sites and applications that provide various information are increasing, and even now, venture companies that collect various personal information from public institutions and provide notification information are increasing.

As described above, web sites and applications provide consulting and information provision services, and some web sites and apps provide services that provide customized information by analyzing information generated by each individual.

However, in order to provide customized information to each member, it is necessary to access a public institution and collect the member's personal information. However, since public institutions require an accredited certificate, collecting personal information from public institutions using the member's accredited certificate is very It is a difficult situation.

Korean Patent Registration No. 10-2001544 (announced on July 18, 2019) Republic of Korea Patent Publication No. 10-2009-0048145 (published on May 13, 2009) Korean Patent Registration No. 10-1852791 (announced on April 27, 2018) Republic of Korea Patent Publication No. 10-2019-0124630 (published on November 5, 2019)

Accordingly, an object of the present invention is to provide a service that provides a log-in procedure to access the website after processing the electronic authentication information in the form required by the target institution for each website of each target institution that requires the electronic authentication procedure. It is to provide an authentication agency service system.

In order to achieve the object of the present invention described above, in one embodiment of the present invention, a content provider server for transmitting target organization information and electronic authentication information, an organization server storing a plurality of personal information, and the content provider server and the organization server When the target organization information and electronic authentication information are received through the communication network, the target organization matching the target organization information is selected, and the electronic authentication information is processed in the form requested by the target organization. Thus, it generates personal authentication information, and provides an agent service system for electronic authentication procedures including an operation server that performs electronic authentication procedures for an agency server of a target institution based on the personal authentication information.

According to the present invention, the technology for performing the electronic authentication procedure of the website using the electronic authentication information provided by the user is a public key/private key-based encryption/decryption knowledge, knowledge of a private key, and variables necessary for login by site. The technical hurdles are high because it requires the recognition of the combination, but the electronic authentication process can be provided on behalf of the company.

Therefore, the present invention can alleviate the technical difficulty of developing an application or program that needs to collect specific information by accessing a site that requires electronic authentication, so that the development of a new business model for individual developers, start-up companies, small and medium-sized enterprises, etc. It can lower the barrier to entry.

1 is a configuration diagram illustrating a service system for an electronic authentication procedure according to the present invention.
2 is a block diagram showing an embodiment of a service interface unit according to the present invention.
3 is a block diagram showing an embodiment of a scraping service unit according to the present invention.
4 is a block diagram showing an embodiment of an encryption protocol processing unit according to the present invention.

Hereinafter, a service system for an electronic authentication procedure (hereinafter, abbreviated as an "electronic authentication agent system") according to exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram for explaining an electronic authentication agency system according to the present invention.

Referring to FIG. 1, the electronic authentication agent system according to the present invention includes a content provider server 100 that applies for an electronic authentication procedure proxy service through a wired/wireless communication network (hereinafter, abbreviated as'communication network'), and a plurality of It includes an institution server 200 in which personal information is stored, and an operation server 300 that accesses the institution server 200 according to a proxy service for electronic authentication procedures requested from the user to perform a preset electronic authentication procedure.

Hereinafter, each component will be described in more detail with reference to the drawings.

The electronic authentication agency system according to the present invention may further include a member terminal (not shown).

The member terminal is a terminal that accesses the content provider server 100 through a communication network and requests the use of content provided by the content provider server 100, and may transmit content request information to the content provider server 100.

In addition, the member terminal may transmit the user's electronic authentication information to the content provider server 100 at the request of the content provider server 100. To this end, a content management app may be installed on the member terminal.

More specifically, the content management app accesses the content provider server 100 through a communication network according to a user's selection signal, encrypts electronic authentication information according to the user's input, and then encrypts the electronic authentication information together with the content request information. 100).

If necessary, the content management app may transmit approval information for consenting to the use of personal data stored in the institution server 200 to the content provider server 100 at the request of the user. In this way, the content provider server 100 receives approval information from a member in advance in order to provide an information providing service using the member's personal data stored in the institution server 200 to the member.

In addition, the member terminal may transmit content request information including a content selection signal for selecting the type of content to be provided to the content provider server 100.

Referring to FIG. 1, the electronic authentication agency system according to the present invention includes a content provider server 100.

The content provider server 100 connects to the operation server 300 through a communication network and transmits target organization information and electronic authentication information, and the personal information about the person matched with the electronic authentication information from the operation server 300 It is provided. Here, the electronic authentication information may include electronic certificate information and an electronic signature.

The content provider server 100 may analyze the content request information transmitted from the member terminal to generate purpose information including target organization information and scraping items. In addition, the content provider server 100 may access the operation server 300 and transmit target organization information and electronic authentication information as well as purpose information.

Such a content provider server 100 is a personal developer or startup that is difficult to develop an application or program that automatically proceeds with the login process through the electronic authentication information provided by the member after accessing a site that requires electronic authentication for login. It is a server owned by a business enterprise or a small business.

In other words, the content provider server 100 receives electronic authentication information from a member in order to provide a service for a new business model, and transmits target organization information and purpose information together with the electronic authentication information to the operation server 300, and , Personal information corresponding to the purpose information is received from the operation server 300 and used for the service of a new business model.

In addition, the content provider server 100 receives individual identification number (ID) information from the user in order to receive an agency service for the electronic authentication procedure, and consents to the use of personal information stored in the institution server 200 Information and electronic authentication information can be transmitted from the member terminal. In this case, the ID information may include one or more of the name of the user or company, the address of the user or company, the phone number of the user or company, and an ID and password for login.

In addition, the content provider server 100 may transmit ID information and approval information to the operation server 300 through a communication network.

As a first embodiment, the content provider server 100 according to the present invention may have an electronic authentication management app or an electronic authentication management program installed. More specifically, the electronic authentication management program connects to the operation server 300 through a communication network and transmits approval information to the operation server 300 as a request from a content provider is input or content request information is collected from a member terminal. And, the electronic authentication information is encrypted and then provided to the operation server 300.

In addition, when the electronic authentication management app or the electronic authentication management program receives personal information corresponding to the purpose information from the operation server 300 through a communication network, it generates service information based on the personal information, and stores the service information as a member. Send to the terminal.

As a second embodiment, the content provider server 100 according to the present invention accesses the first website provided by the operation server 300 through a communication network and transmits electronic authentication information and approval information to the first website. I can. This first website may perform the same role as an electronic authentication management app or an electronic authentication management program.

2 is a block diagram showing an embodiment of a service interface unit according to the present invention. Referring to FIG. 2, the content provider server 100 may install various programs such as a Windows application program, a Linux application program, a Mac application program, an Android program, an IOS program, and a web program.

In this way, the content provider server 100 may use an electronic authentication agency service by selecting any one of an electronic authentication management app, an electronic authentication management program, and a website. In addition, the content provider server 100 may encrypt electronic authentication information through an electronic authentication management app, an electronic authentication management program, a website, and the like, and then transmit the encrypted electronic authentication information to the operation server 300.

The content provider server 100 may be a personal computer (PC) based on a Windows operating system (OS), but is not limited thereto, and a computer based on Linux or OS X, Mobile computing devices such as smartphones based on mobile OS such as IOS and Android, notebook computers, personal digital assistants (PDAs), tablet PCs, set-top boxes or other arbitrary devices for IPTV (Internet Protocol Television), etc. Can be

Meanwhile, the content provider server 100 may generate content information based on personal information provided from the operation server 300 and provide the content information to a member terminal connected to the content provider server 100.

In other words, when the content provider server 100 receives personal information corresponding to the purpose information from the operation server 300 through a communication network, the content management program installed in the content provider server 100 is based on the personal information. And transmits the content information to the member terminal.

If necessary, the content management program installed in the content provider server 100 may be implemented as an electronic authentication management program and a single program.

Referring to Figure 1, the electronic authentication agency system according to the present invention includes an institution server 200.

The institutional server 200 is a server operated by an organization targeted for information collection by the operation server 300, and a plurality of personal information may be stored. In this case, a plurality of organizations capable of collecting information by the electronic authentication agency system according to the present invention may be applied.

The institutional server 200 supports login using an electronic certificate, and a server operated by a government office or a government-designated organization or private company for managing personal information may be used. Here, personal information includes personal medical information, personal financial information, personal administration information, and the like.

For example, personal medical information includes the name and location of the medical institution, treatment start date, treatment type (hospitalization, general outpatient/dental outpatient, prescription filling), visit (hospitalization) days, prescription days, medication days, and information on payroll medical expenses and copayments May be included.

In addition, personal financial information may include account balance, account transaction details, card approval details, card billing details, card limit, securities balance, insurance subscription details, and the like.

In addition, personal administrative information includes proof of income from the National Tax Service, business registration certificate, business closure information, tax payment facts, VAT standard certificate, standard financial statement certificate, health insurance qualification certificate, health insurance qualification certificate, employment insurance premium personal inquiry details, national It may include details of pension payments, civil petition 24 identification card authenticity information, etc.

The institutional server 200 may be a public institution, a financial institution such as a bank, a securities company, a credit card company, or an insurance company, or an institution that provides real information, but is not limited to a specific organization.

For example, the institution server 200 may be a server that manages websites such as Homtex, Civil Service 24, National Police Agency Transportation Civil Service 24, National Pension Service website, National Health Insurance Service website, university home page, automobile 365, etc., and electronic certificate Personal information related to the member is provided at the request of the member who has passed the login procedure with.

When the operation server 300 requests personal information while providing customized authentication information including electronic authentication information, the institution server 200 provides the personal information to the operation server 300 in the form of a web page. To this end, the institution server 200 may be installed with a web server program 210 that provides the member's personal information to the member's communication terminal in the form of a web page at the request of a member who has accessed through login.

Referring to Figure 1, the electronic authentication agency system according to the present invention includes an operation server (300).

The operation server 300 provides an electronic authentication proxy service to a user who has applied for an electronic authentication procedure, and is connected to the content provider server 100 and the institution server 200 through a communication network.

Specifically, when the target organization information and electronic authentication information are received through the communication network, the operation server 300 selects a target organization matching the target organization information, and processes the electronic authentication information in the form requested by the target organization. Personal authentication information is generated by processing, and based on the personal authentication information, an electronic authentication procedure is performed for the agency server 200 of the target institution. At this time, the operation server 300 may also receive approval information for consenting to the use of personal information stored in the institution server 200 from the content provider server 100.

In addition, when the operation server 300 receives target organization information, purpose information, and electronic authentication information through a communication network, it decrypts the electronic authentication information. At this time, since the electronic authentication information provided from the content provider server 100 is encrypted to prevent hacking, the operation server 300 performs decryption.

When the organization server 200 provides personal information related to personal authentication information as a web page, the operation server 300 collects the personal information written on the web page using screen scraping, and stores the personal information in a personal information database. Save it. In addition, the operation server 300 transmits the personal information obtained from the institution server 200 to an electronic authentication management app or an electronic authentication management program of the content provider server 100 that provided the electronic authentication information, or the operation server 300 The electronic authentication information is transmitted to the content provider server 100 through a web server associated with the device. To this end, since the operation server 300 provides a web standard interface API, there is an advantage in that it is easy to respond to a request from the content provider server 100.

In this way, the operation server 300 analyzes the target institution information and selects the matching institution server 200, and processes the decrypted electronic authentication information in the authentication method required by the selected institution server 200 to perform personal authentication. Information is generated, the personal authentication information is provided according to a procedure required by the institution server 200, and personal information corresponding to the personal authentication information is collected from the institution server 200.

In other words, the operation server 300 generates encrypted personal authentication information in the form requested by the institution server 200 based on the electronic authentication information, and transmits the encrypted personal authentication information to the institution server 200.

As an embodiment, the operation server 300 according to the present invention transmits personal authentication information and purpose information to the institution server 200 when the institution server 200 of the selected target institution has a function of extracting specific personal information. And, specific personal information corresponding to the scraping item may be provided from the institution server 200.

As another embodiment, the operation server 300 according to the present invention transmits personal authentication information to the institution server 200 when the institution server 200 of the selected target institution does not have a function of extracting specific personal information, and the All personal information of an individual corresponding to personal authentication information is provided from the institution server 200, and specific personal information corresponding to the scraping item can be extracted by analyzing all personal information.

The operation server 300 transmits personal information corresponding to the scraping item to the content provider server 100 that provided the electronic authentication information.

If necessary, the operation server 300 according to the present invention may be provided with an electronic authentication module that performs a customized electronic authentication procedure for each target institution. Accordingly, when target institution information is received from the content provider server 100, the operation server 300 extracts an electronic authentication module matching the target institution information, and the electronic authentication module customized to the target institution through the electronic authentication module Perform authentication procedures.

In addition, the operation server 300 may collect personal information corresponding to the purpose information provided from the content provider server 100 from the institution server 200 and provide it to the content provider server 100.

When the operation server 300 receives approval information and electronic authentication information transmitted from the content provider server 100 through a communication network such as an Internet network, the individual customized to the institution server 200 based on the electronic authentication information After generating authentication information, the personal authentication information is provided to the institution server 200.

On the other hand, the operation server 300 according to the present invention may be configured to include a service interface unit 310 and a scraping service unit 320 as shown in FIG. In other words, the operation server 300 includes first to nth scraping service units for scraping data from the first to nth institutional servers equipped with a web server program through a communication network. That is, the first to nth scraping service units may scrape data from the first to nth institutional servers, respectively.

The plurality of scraping service units 320 may be functionally classified scraping modules implemented using one hardware device. For security, in the section between the scraping service unit 320 and the institution server 200, a user is authenticated by system authentication of a public key infrastructure (PKI), and personal authentication information and personal information are SSL (Secure Sockets Layer), etc.

The service interface unit 310 constituting the operation server 300 according to the present invention includes a service distribution unit 312, a web service processing unit 314, an app service processing unit 316, and a key issuing unit as shown in FIG. (318) may be included.

The service distribution unit 312 analyzes a request from the content provider server 100, automatically recognizes whether the request is through a web page or an application route, and distributes the service. For example, the service distribution unit 312 distributes the request of the content provider server 100 to the web service processing unit 314 when an electronic authentication proxy service is requested through a web page, and an electronic authentication proxy service is requested through an app or program. Then, the request of the content provider server 100 is distributed to the app service processing unit 316.

The web service processing unit 314 is a component that connects the operation server 300 to the content provider server 100 so that the content provider server 100 and the operation server 300 accessed through a web page can interact.

The app service processing unit 316 is a component that connects the operation server 300 to the content provider server 100 so that the content provider server 100 and the operation server 300 accessed through an app or program can interact.

The web service processing unit 314 or the app service processing unit 316 records the API key value delivered together with the request of the content provider server 100 in the session database 327 for logging, and the scraping service unit 320 Forward the request to.

The key issuing unit 318 analyzes the operating system of the content provider server 100 connected to the operation server 300, issues an API key suitable for the operating system, and provides it to the content provider server 100. At this time, the content provider server 100 loads the API key value in the header value and transmits it to the operation server 300 together with the electronic authentication information.

3 is a block diagram showing an embodiment of a scraping service unit according to the present invention. The scraping service unit 320 constituting the operation server 300 according to the present invention may include a scraping engine unit independent of a platform. Accordingly, the present invention can perform scraping in any execution environment by the scraping engine unit without the need to separately develop a scraping engine according to the type of device or OS.

In addition, the scraping engine unit stores identification information of the target organization to perform scraping and environmental information including personal authentication information and communication information corresponding to the target organization to perform scraping, and based on the environment information n Scraping data from the institutional server 200. Here, the communication information may include information such as a type of a communication encryption protocol required for secure communication by a target organization or a login session duration.

In this case, each of the first to n-th scraping service units may operate on a Web Application Server (WAS), but is not limited thereto.

In addition, the scraping service unit 320 immediately delivers the scraped material to the content provider server without storing it. In this case, the scraping engine unit extracts personal information corresponding to the scraping item from the web page provided from the institution server 200.

The scraping engine unit includes a login processing unit 324 and an agency-specific data processing unit 325, and the scraping service unit 320 includes a communication unit 321, an electronic authentication processing unit 322, and an encryption protocol processing unit ( 323), a login processing unit 324, and an organization-specific data processing unit 325 may be included. If necessary, the scraping service unit 320 may further include an encryption/decryption processing unit 326, a session database DB, and a billing database DB.

The communication unit 321 is connected to the institution server 200 and the content provider server 100 through a communication network, transmits encrypted personal authentication information to the institution server 200, and encrypts it with the content provider server 100 The personal information is transmitted, and the encrypted personal information is received from the institution server 200.

The electronic authentication processing unit 322 is connected to a login processing unit 324, an organization-specific data processing unit 325, an encryption protocol processing unit 323, and a communication unit 321, and the content provider server 100 through the communication unit 321 When the target institution information and the electronic authentication information are received from, an electronic authentication module matching the target institution information is extracted from among a plurality of electronic authentication modules stored therein. At this time, when the purpose information is provided from the content provider server 100, the electronic authentication processing unit 322 provides the purpose information to the organization-specific data processing unit 325 or to the institution server 200 through the communication unit 321.

The electronic authentication processing unit 322 generates personal authentication information by processing electronic authentication information in a form requested by a target institution through an electronic authentication module, and provides the personal authentication information to the encryption protocol processing unit 323.

The encryption protocol processing unit 323 mainly performs end-to-end communication encryption (end-to-end encryption) in a section requiring encryption/decryption protocol communication such as TLS/SSL among data between the operation server 300 and the institution server 200. Play a role. Here, the end-to-end communication encryption refers to an encryption method in which a message is transmitted in an encrypted state in all processes from a destination to a destination.

With this end-to-end communication encryption (end-to-end encryption), only the person at both ends, that is, the person sending and receiving the message, can see the content, and no one in the middle can see the content of the message.

In addition, the encryption protocol processing unit 323 is provided in the operation server 300 so that the operation server 300 instead of the content provider server 100 processes encryption according to the encryption condition required by the institution server 200.

To this end, the encryption protocol processing unit 323 is connected to the electronic authentication processing unit 322, the login processing unit 324, and the institution-specific data processing unit 325, and can call a specific page related to personal authentication information from the institution server 200. At this time, encryption of personal authentication information is performed according to the encryption/decryption process set in the institution server 200.

In addition, the encryption protocol processing unit 323 encrypts personal authentication information provided to the institution server 200 and decrypts the personal information received from the institution server 200. Specifically, the encryption protocol processing unit 323 encrypts the personal authentication information provided from the electronic authentication processing unit 322 and provides the encrypted personal authentication information to the login processing unit 324. In addition, when the encrypted personal information is transmitted from the communication unit 321, the encryption protocol processing unit 323 decrypts the encrypted personal information and provides the decrypted personal information to the data processing unit 325 for each institution.

The encryption protocol processing unit 323 may protect personal information using SSL or TLS (Transport Layer Security), which are personal information retention protocols.

The encryption/decryption processing unit 323 may perform encryption/decryption after exchanging data several times through communication such as SSL and TLS with the institution server 200 for encryption/decryption processing.

If necessary, when personal information is collected from the institution server 200, the encryption protocol processing unit 323 may record the billing details in the billing DB 328 and process the balance of the user.

The encryption/decryption processing of the SSL or TLS protocol by the encryption protocol processing unit 323 ensures confidentiality and identity for data communication between the operation server 300 and the institution server 200. Here, the guarantee of confidentiality means that data is encrypted in the communication step between the operation server 300 and the institution server 200 so that even if a third party intercepts the data, the original structure of the data is not recognized. In addition, the guarantee of the identity means that the content provider server 100 that first accesses the operation server 300 receives and processes a secret code for performing an encryption process for guaranteeing communication confidentiality afterwards.

4 is a configuration diagram showing an embodiment of an encryption protocol processing unit 323 according to the present invention. Referring to FIG. 4, the encryption protocol processing unit 323 may include a key management unit, a socket processing unit, an encryption key processing unit, and a data processing unit.

The key management unit is a component that selects key values as separate class entities and manages them so that they can be referenced and used from outside.

The socket processing unit is a component that authenticates the identity of the client (operation server) to the target organization server 200 through Client Hello and Server Hello in end-to-end communication. In addition, the institution server 200 also authenticates the identity so that it is possible to check whether the operating server, which is a client, is connected to the target institution server. At this time, the socket processing unit receives the public key of the agency server 200 and can confirm that the agency server that is accessing now is not the agency server that has been altered by a hacker.

The encryption key processing unit is configured to generate key values listed by the key management unit during a communication process with the institution server 200.

The data processing unit is a process of managing data to be actually encrypted/decrypted.

The login processing unit 324 is connected to the electronic authentication processing unit 322, the encryption protocol processing unit 323, and the communication unit 321, and is connected to the institution server 200 based on the personal authentication information provided from the electronic authentication processing unit 322. A login procedure is performed, a login session is obtained from the institution server 200, and various information on the login session is stored in the session DB 327. And the login processing unit 324 generates a reference number matching the login session, stores the login session and reference number in the session DB 327, and transmits the reference number to the content provider server 100 through the communication unit 321 do.

Thereafter, when the content provider server 100 provides a reference number previously issued to the operation server 300, the operation server 300 extracts a login session matched with the reference number and sends a reference number to the content provider server 100. It provides the search function of related data. And, when the validity period expiration signal of the login session is received from the institution server 200, the login processing unit 324 transmits the expiration signal to the content provider server 100.

In other words, when the reference number is transmitted from the content provider server 100, the operation server 300 calls a specific page related to personal authentication information from the institution server 200 unless the login session corresponding to the reference number is terminated. And, the specific page is provided to the content provider server 100.

The agency-specific data processing unit 325 is connected to the communication unit 321, the electronic authentication processing unit 322, the encryption/decryption processing unit 326, and the encryption protocol processing unit 323, and sends personal information corresponding to the personal authentication information to the institution server ( 200) through screen scraping.

Specifically, when the encrypted personal authentication information is provided from the encryption protocol processing unit 323, the institution-specific data processing unit 325 transmits the personal authentication information to the institution server 200 through the communication unit 321. In addition, when the agency server 200 provides personal information related to personal authentication information as a web page, the agency-specific data processing unit 325 collects the personal information written on the web page using screen scraping, and sends the personal information to the client. Return it. In other words, the agency-specific data processing unit 325 does not separately store personal information.

In addition, the agency-specific data processing unit 325 may transmit purpose information together with personal authentication information to the agency server 200, and when the agency server 200 provides personal information related to the scraping item as a web page, the web page The personal information listed in is collected using screen scraping.

The encryption/decryption processing unit 326 is connected to the electronic authentication processing unit 322, the communication unit 321, and the organization-specific data processing unit 325. After decrypting the electronic authentication information received by the communication unit 321, the electronic authentication processing unit 322 ), and encrypts the personal information provided from the data processing unit 325 for each institution, and then provides it to the communication unit 321.

The encryption/decryption processing unit 326 is a process that processes encryption/decryption running in internal logic such as SEED/DES/RSA/PKI in addition to end-to-end communication. For example, in order to transmit the plain text ABC to the institution server 200, encryption/decryption logic such as SEED must be applied according to the encryption/decryption algorithm required by the institution server 200. In other words, the encryption protocol processing unit 323 is an end-to-end communication encryption processing unit, and the encryption/decryption processing unit 326 is a process for encrypting/decrypting variables.

The encryption/decryption processing unit 326 may be connected to the electronic authentication processing unit 322, the communication unit 321, and the organization-specific data processing unit 325. After decrypting the electronic authentication information received by the communication unit 321, the electronic authentication processing unit 322 ), and encrypts the personal information provided from the data processing unit 325 for each institution, and then provides it to the communication unit 321.

In addition, the encryption/decryption processing unit 326 includes domestic and foreign standard encryption algorithms such as Korean standard symmetric key 128-bit block encryption algorithm (SEED), RSA (Rivest Shamir Adleman), AES (Advanced Encryption Standard), ARIA (Academy, Research Institute, Agency). It is possible to protect data transmitted between the content provider server 100 and the operation server 300 by using.

This encryption/decryption processing unit 326 can process even without an Internet connection, and only needs to be faithful to basic encryption/decryption logic, but the encryption protocol processing unit 323 needs to communicate with the institution server 200, so Internet connection is essential and It requires a more complex process.

Although described above with reference to preferred embodiments of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the present invention described in the following claims. You will understand that you can.

100: content provider server 200: institution server
300: operation server 310: service interface unit
312: service distribution unit 314: web service processing unit
316: App service processing unit 318: Key issuing unit
320: scraping service unit 321: communication unit
322: electronic authentication processing unit 323: encryption protocol processing unit
324: login processing unit 325: data processing unit for each institution
326: encryption/decryption processing unit 327: session database
328: billing database

Claims (6)

A content provider server for transmitting target organization information and electronic authentication information;
An institutional server storing a plurality of personal information; And
It is connected to the content provider server and the organization server through a communication network, and when target organization information and electronic authentication information are received through the communication network, a target organization matching the target organization information is selected, and the format requested by the target organization It generates personal authentication information by processing electronic authentication information, and includes an operating server that performs electronic authentication procedures for the agency server of the target institution based on the personal authentication information,
The operation server
A communication unit for transmitting encrypted personal authentication information to the institution server, receiving encrypted output information from the institution server, and transmitting personal information to the content provider server;
When object information including scraping items, target organization information, and electronic authentication information are received from the content provider server through the communication unit, the electronic authentication information is processed and processed in a format requested by the target organization included in the target organization information, An electronic authentication processing unit that generates authentication information;
An encryption protocol processing unit that encrypts personal authentication information provided from the electronic authentication processing unit and decrypts the output information received by the communication unit;
A login processing unit that obtains a login session from the institution server by performing a log-in procedure to the institution server based on the encrypted personal authentication information; And
An agency service for electronic authentication, comprising an agency-specific data processing unit for generating personal information by extracting the scraping item from the decrypted output information using screen scraping, and transmitting the personal information to a content provider server through a communication unit. system. The method of claim 1, wherein the operation server
Personal information corresponding to the personal authentication information is collected from an institutional server and provided to the content provider server. The method of claim 2, wherein the operation server
When the purpose information including the scraping item is received from the content provider server, personal information corresponding to the scraping item is collected from an institutional server and provided to the content provider server. The method of claim 1, wherein the content provider server
An agency service system for electronic authentication procedures, characterized in that transmitting approval information for consenting to use of personal information stored in the institutional server to the operation server. delete The method of claim 1, wherein the login processing unit
An electronic authentication procedure comprising generating a reference number matching the login session obtained from the institution server, storing the login session and reference number in a session database of the operation server, and transmitting the reference number to a content provider server Agency service system.

Images