KR20090097036A - One-time password generation method using SM, authentication method and authentication system using it - Google Patents

Abstract

The present invention relates to a one-time password generation method using SM, and an authentication method and authentication system using the same.

The OTP authentication system according to the present invention includes a CP server and OTP server, the CP server manages the content and subscriber authentication provided to the subscriber via the Internet, and provides an interface for OTP authentication of the subscriber. The PIN authentication server determines whether the subscriber is authenticated to the CP server by transmitting a random number to the subscriber who registered the PIN through SMS, extracting the PIN from the OTP inputted from the subscriber, and comparing the PIN to the registered PIN. do.

As described above, according to the present invention, since the OTP authentication of the subscriber is made through the transmission of a separate network and information, the security is improved, and since the OTP token is not required, the system configuration and management are easy and the service cost of the subscriber is improved. It has the effect of minimizing.

Description

One-time password generation method using SM, authentication method and authentication system using same {OTP GENERATING METHOD FOR USING THE SMS, AND PERSONAL IDENTIFICATION METHOD AND SYSTEM FOR USING THE SAME}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a subscriber authentication method online and relates to a method for generating a one time password (OTP) using SMS, an authentication method and authentication system using the one time password.

Conventionally, a subscriber authentication method in each content provider (CP) server available through a wired or wireless Internet is generally a method of inputting an ID and password (ID / PW). The authentication method using such an ID and password is usually very easy to infer and reveals a weakness as an authentication means as malicious programs such as keyboard hooking programs flood. In addition, as the wired / wireless Internet is activated, Internet services of various contents are generated. Accordingly, the number of IDs and passwords to be managed by subscribers increases, thereby increasing the inconvenience of subscribers during authentication.

On the other hand, the mobile phone authentication method, one of the other authentication methods, is weak in security due to the leaking of the subscriber's social security number and the cannon phone opened in the name of another person. Method was developed. However, in order to implement the token-based OTP method, subscribers must carry hardware inconveniently, and administrators must distribute and manage tokens to all subscribers, which increases the complexity and cost of operation. .

So, recently, in order to solve the inconvenience of token-based OTP, a random combination number is shown on the web like PINSafe, and the subscriber's password (for example, PIN (Personal Identification Number) number) is displayed on the screen. A method of generating OTP by combining numbers with losing numbers has emerged. However, the pinsafe method is vulnerable to security because it can be inferred by a capture-based hacking tool by showing a random combination of numbers on the web page that receives the password.

Accordingly, an object of the present invention is to provide a one-time password generation method using SMS, an authentication method and authentication system using the one-time password to protect subscriber information.

In order to solve the above technical problem, OTP authentication system according to an embodiment of the present invention,

When a random number is transmitted to a subscriber who has registered a PIN (Personal Identification Number) through SMS (Short Messaging Service), and receives a one time password (OTP) which is an operation value of the random number and the PIN from the subscriber, the PIN is received from the received OTP. Extracting and comparing the registered PIN with the previously registered PIN to determine whether to authenticate the subscriber. The PIN authentication server may include a PIN authentication unit that generates a PIN registration table and stores a PIN table registration number and subscriber information according to the PIN registration request of the subscriber; And a PIN DB (Data Base) in which the PIN registration table is stored.

When the PIN authentication unit receives a PIN authentication request from the subscriber, the PIN authentication unit generates a corresponding random number and transmits the random number to the subscriber through SMS, and stores the random number and the random number generation time. The PIN authentication unit compares the OTP transmission time transmitted from the subscriber and the random number generation time to determine the random number of the subscriber, and obtains a PIN value through a predetermined operation based on the OTP and the random number. In addition, the PIN authentication unit compares the PIN value and the PIN value registered in the PIN registration table, and determines that the authentication is successful when the comparison value is the same.

On the other hand, OTP authentication system according to an embodiment of the present invention,

When receiving a random number transmitted through SMS (Short Messaging Service) and OTP (One Time Password), which is an operation value of the PIN, from a subscriber who has registered a PIN in a PIN authentication server to determine whether the subscriber is authenticated, And a CP (Content Provider) server requesting authentication of the subscriber by transmitting the received OTP to the authentication server. The CP server may include a CP site that provides an interface for PIN registration or OTP authentication of the subscriber; And a CP authentication unit configured to transmit a PIN input from the subscriber through the CP site to the PIN authentication server, perform PIN registration of the subscriber, and transmit the OTP input from the subscriber to the PIN authentication server.

Meanwhile, in a method in which an OTP authentication system managing a personal identification number (PIN) authentication of a subscriber performs one time password (OTP) authentication,

a) receiving a subscriber's PIN authentication request; b) generating a random number and transmitting it to the subscriber mobile phone via SMS; c) receiving an OTP which is an operation value of the random number and PIN from the subscriber; And d) comparing a PIN value calculated based on the OTP and the random number and a registered PIN, and transmitting authentication success if the same is the same. And registering the PIN entered from the subscriber before step a).

The registering of the PIN may include: a) generating a PIN registration table according to a PIN registration request of the subscriber, storing a PIN table registration number and subscriber information, and transferring the PIN table registration number to a content provider (CP) server; step; b) receiving a PIN and the PIN table registration number input from the subscriber from the CP server; And c) registering the PIN in the subscriber's PIN registration table corresponding to the PIN table registration number.

On the other hand, the subscriber mobile phone generates a one time password (OTP) using the Short Messaging Service (SMS),

a) receiving a random number generated from a PIN authentication server managing a personal identification number (PIN) authentication through a short messaging service (SMS); b) activating an OTP generating client generating an OTP through a specific codemap operation, requesting the subscriber to enter a PIN; And c) displaying the OTP generated by combining the subscriber's PIN and the ransom number.

The PIN may be a number or a letter or a combination of numbers and letters.

According to an embodiment of the present invention according to the above-described configuration when generating an OTP by adding a random number to the PIN registered by the subscriber not only can not predict the random number at a specific time, but also the OTP is input to the mobile communication network that the random number is delivered Since it is different from the Internet network, even if any one is exposed, the PIN of the subscriber cannot be inferred. In addition, since the CP server does not have the PIN information of the subscriber, even if the subscriber information leaked by the CP server, it is possible to perform secure authentication through the PIN authentication server.

In addition, if only SMS transmission is possible, it can be realized at a low cost without any special OTP generation algorithm, so that the service cost of the subscriber can be minimized.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

Now, a method of generating a one-time password using an SMS, an authentication method using the same, and an authentication system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a network diagram schematically illustrating an authentication system according to a first embodiment of the present invention.

Referring to FIG. 1, the authentication system according to the first embodiment of the present invention includes a subscriber cell phone 11, a subscriber computer 12, a personal identification number (PIN) authentication server 100, and a content provider (CP) server. 200 includes the SMS interworking GW (Gateway) (300).

The subscriber cell phone 11 may receive voice and data services through the mobile communication network 30, and is a mobile phone or a personalized mobile terminal capable of receiving a short message service (SMS) of a specific subscriber.

Subscriber computer 12 is a terminal that can be connected to a specific website or receive a specific Internet service through the Internet network 20. Therefore, the subscriber computer 12 is connected to the PIN authentication server 100 or CP server 200 to display the web provided by each server, and the subscriber authentication according to the guidance of the PIN authentication server 100 or CP server 200. It is responsible for registering PIN and transmitting OTP. In this case, the subscriber computer 12 is not limited to a desktop or laptop computer connected to the Internet network 20 through a wired or wireless connection, and may be replaced with a terminal having a module that can be connected to the Internet.

The PIN authentication server 100 is a server for providing OTP authentication to a subscriber, and includes a PIN authentication unit 110 and a PIN DB (Data Base) 130.

In the present invention, after the subscriber is subscribed to a specific CP server 200, in order to receive OTP authentication, the PIN must be registered in its ID.

The PIN authentication unit 110 generates a PIN registration table according to the PIN registration request of the subscriber, and registers the subscriber's PIN by storing the subscriber's mobile phone number and the PIN in the PIN DB 130 together with the generated PIN table registration number. When a subscriber's PIN authentication request is generated, a random number is generated, stored in the PIN registration table along with the generation time of the random number, and then the random number is transmitted to the subscriber's mobile phone 11 via SMS. Meanwhile, the PIN authenticator 110 extracts the PIN from the OTP input from the subscriber computer 12 and compares the PIN with the PIN stored in the PIN registration table to determine whether the subscriber is authenticated.

In the PIN DB (Data Base) 130, a subscriber's PIN registration table is stored as shown in FIG. 2A. The PIN registration table includes a PIN table registration number, a mobile phone number, a PIN, a random number, a random number generation time, and the like. The random number may have a validity for a predetermined time from the random number generation time.

The CP server 200 is a server for managing contents and subscriber information provided to subscribers, and includes a CP site 220, a CP subscriber authenticator 210, and a subscriber DB 230.

The CP site 220 provides the web to the subscriber computer 12 connected through the Internet network, and provides the subscriber with the corresponding contents and various services. The CP site 220 serves as an interface for requesting and inputting a PIN and an OTP for registering a subscriber's PIN from the subscriber computer 12.

The CP subscriber authentication unit 210 manages the ID and password (ID / PW) and subscriber information of the subscriber, and transmits the subscriber information to the PIN authentication unit 110 of the PIN authentication server 100 when registering the subscriber's PIN. Request a PIN registration. And, when receiving the subscriber's PIN table registration number from the PIN authentication unit 110 and stores it in the subscriber DB (230). Next, when the CP subscriber authenticator 210 receives the PIN to be registered, the CP subscriber authenticator 210 transmits the received PIN and the PIN table registration number to the PIN authenticator 110 to register the subscriber's PIN. .

After that, when the CP subscriber authentication unit 210 receives an OTP authentication request from the registered PIN subscriber, the CP subscriber authentication unit 210 includes the PIN table registration number in a PIN authentication request message and transmits the PIN authentication server 100 to the PIN authentication server 100. In addition, the subscriber requests an OTP input and transmits the OTP to the PIN authentication server 100 when the corresponding OTP is input. And according to the authentication result, the subscriber's service request is accepted or rejected.

The CP subscriber authenticator 210 may selectively request PIN authentication when the subscriber computer 12 logs in to the CP site 220 or requests a high security service such as billing and subscriber information.

In the subscriber DB 230, subscriber information, such as subscriber IP / PW and mobile phone number, which are input when the subscriber joins the CP site 220, and the subscriber's PIN is registered from the PIN authentication server 100 when the subscriber's PIN is registered as shown in FIG. 2B. The table registration number is stored.

The SMS interworking GW 300 transmits an SMS to the subscriber mobile phone 11 through the mobile communication network 30 or performs SMS authentication for owner authentication of the subscriber mobile phone 11.

Next, a PIN registration method through a CP site according to a first embodiment of the present invention will be described with reference to FIG. 3.

3 is a flowchart illustrating a PIN registration method through a CP site according to a first embodiment of the present invention.

Referring to FIG. 3, a subscriber subscribed to a website of the CP server 200 according to the first embodiment of the present invention logs in through a subscriber computer 12 through an ID and a password, and then requests a PIN registration ( S301). In addition, the CP server 200 succeeds in mobile phone authentication through a mobile communication network in connection with the SMS-linked GW 300 for personal authentication of the subscriber (S302). Here, the mobile phone personal authentication for the mobile phone subscriber is preferably performed to prove that the subscriber requesting the PIN registration for OTP authentication is the subscriber owning the mobile phone. May be omitted.

The CP server 200 transmits the subscriber's PIN registration request, subscriber information such as subscriber ID, password, and mobile number to the PIN authentication server 100 (S303). The PIN authentication server 100 generates a PIN registration table, stores subscriber information together with the PIN table registration number (S304), and transfers the PIN table registration number to the CP server 200 (S305). The CP server 200 stores the received PIN table registration number (S306), requests the subscriber computer 12 to enter a PIN through the web (S307), and receives a corresponding PIN (S308). The PIN entered at this time is a number randomly generated by the subscriber.

The CP server 200 transmits the input PIN and the corresponding PIN table registration number to the PIN authentication server 100 (S309), and sets the PIN received by the PIN authentication server 100 in the corresponding PIN registration table. Registration is completed (S310).

As described above, in the first embodiment of the present invention, the PIN authentication server 100 interoperates with the CP server 200 and registers the subscriber's PIN through the CP site 220.

Meanwhile, an authentication system and a PIN registration method according to a second embodiment of the present invention will be described with reference to FIGS. 4 and 5.

4 is a network diagram schematically illustrating an authentication system according to a second embodiment of the present invention.

Referring to FIG. 4, since the configuration of the authentication system according to the second embodiment of the present invention is the same as that of the first embodiment of FIG. 1, description thereof is omitted, except that the PIN authentication server 100 is a PIN authentication site. The only difference is that it further includes 120.

The PIN authentication site 120 is forwarded from the CP site upon the subscriber's PIN registration request and serves as an interface for performing PIN registration and PIN authentication from the subscriber computer 12.

5 is a flowchart illustrating a PIN registration method through a PIN authentication site according to a second embodiment of the present invention.

Referring to FIG. 5, a subscriber subscribed to a website of the CP server 200 according to the second embodiment of the present invention logs in via a subscriber computer 12 through an ID and a password, and then requests a PIN registration. S501). In addition, the CP server 200 transmits subscriber information such as the subscriber's PIN registration request and the subscriber's mobile phone number to the PIN authentication server 100 (S502). The PIN authentication server 100 generates a PIN registration table to store subscriber information together with a PIN table registration number (S503), and delivers the PIN table registration number and a URL (Uniform Resource Locator) of the PIN authentication site 120. In operation S504, a web forwarding request for setting a subscriber's PIN is requested.

CP server 200 stores the received PIN table registration number (S505), and forwards the URL of the PIN authentication site 120 through the CP site 220 (S506), PIN authentication server 100 is A PIN authentication web is provided so that the web for setting a PIN is displayed on the subscriber computer 12 (S507). The PIN authentication server 100 receives subscriber information such as a PIN, a mobile phone number, and a social security number through the PIN authentication web (S508). At this time, the PIN authentication server 100 performs mobile phone subscriber authentication through a mobile communication network by interworking with the SMS-linked GW 300 for personal authentication of the subscriber, and if the mobile phone subscriber authentication succeeds (S509), the PIN is received. PIN registration is completed by setting the corresponding PIN table (S510).

As described above, in the second embodiment of the present invention, the PIN authentication server 100 receives and registers the subscriber's PIN and information through the PIN authentication site 120 forwarded in conjunction with the CP server 200.

Meanwhile, an OTP authentication method using SMS according to a third embodiment of the present invention will be described with reference to FIG. 6.

6 is a flowchart illustrating an OTP authentication method using SMS according to a third embodiment of the present invention.

Referring to FIG. 6, in the OTP authentication method using SMS according to the third embodiment of the present invention, it is assumed that a subscriber registers a PIN in the PIN authentication server 100 through the first or second embodiment. do.

The PIN authentication server 100 receives the PIN authentication request and the PIN table registration number of the subscriber from the subscriber computer 12 which has logged in to the CP server 200 with the IP and the password (S601) (S602). Then, the PIN authentication server 100 generates a random number and stores the random number and the random number generation time in the subscriber's PIN table (S603). And the PIN authentication server 100 displays the OTP input request to the subscriber computer via the CP server (S604), and at the same time transmits the mobile phone number registered with the random number to the SMS-linked GW 300 (S605), The random number of the SMS format is transmitted to the subscriber cell phone 11 through the mobile communication network 30 (S606).

On the other hand, the OTP is generated by the sum of the PIN and the random number known by the subscriber, and the generated OTP is input to the subscriber computer 12 (S607). Then, the PIN authentication server 100 receives the OTP transmitted through the CP server 200, compares the PIN calculated based on the OTP and the stored PIN (S609), and determines whether the compared value is the same (S610). ).

Here, a method of calculating the PIN from the OTP by the PIN authentication server 100 will be described with reference to FIG. 7.

7 illustrates an OTP generation and a method for calculating a PIN from the OTP according to an embodiment of the present invention.

Referring to FIG. 7, a method (A) of generating an OTP input from a subscriber and a method of calculating a PIN in the PIN authentication server 100 according to an embodiment of the present invention.

First, the OTP is generated through a simple operation based on the PIN known to the subscriber and the random number received by the SMS. For example, the calculation method may be addition or subtraction as follows. In response to the PIN a 6140, which is known to the subscriber as shown in FIG. 7A, if the random number transmitted to the SMS is b (1234567) according to the present invention, the OTP value c is a + b and 1240707 is a value. do.

Next, the method of extracting the PIN is, when the generated OTP c (1240707) value is transmitted to the PIN authentication server 100, as shown in (B) of Figure 7, the PIN authentication server 100 is a valid time of the OTP c Is determined by comparing the transmitted time with the random number generation time stored in the PIN DB 130, and subtracts the corresponding random number b (1234567) from the OTP c (1240707). At this time, the PIN authentication server 100 may check whether the random number generation time is valid. Then, 6140 (= 1240707-1234567), which is an original PIN value, is calculated, and this value may be compared with the PIN value stored in the PIN DB 130 to determine whether it is normal authentication.

If the comparison result of the determination in step S610 is the same, the PIN authentication server 100 transmits the authentication success result to the CP server 200 (S611), and the CP server 200 provides the service to the subscriber computer 12. To provide (S612).

On the other hand, when the comparison result of the determination in step S610 is different or does not exist, the PIN authentication server 100 transmits the authentication failure result to the CP server 200 and the subscriber computer 12 (S613) (S614).

As described above, when an OTP is generated by adding a random number to a PIN registered by a subscriber, the OTP is not input to the mobile communication network 30 through which the random number is transmitted. Since it is different from the Internet network 20, even if any one is hacked there is an effect that can not infer the PIN of the subscriber. In addition, since the CP server does not have the subscriber's PIN information, secure authentication may be performed through the PIN authentication server even when the subscriber information is leaked by the CP server.

In addition, if only SMS transmission is possible, it can be realized at a low cost without any special OTP generation algorithm, so that the service cost of the subscriber can be minimized.

Although the embodiments of the present invention have been described above, the present invention is not limited only to the above embodiments, and various other changes are possible.

For example, in the embodiment of the present invention shown in FIG. Can be generated. Here, the OTP generating client installed in the subscriber cell phone 11 has a specific code map and a calculation function, and when a random number is received by the subscriber cell phone 11, the OTP generation client may output a message for requesting a PIN input to the subscriber. When the PIN is input, the OTP calculated based on the random number and the PIN may be output.

In addition, the subscriber mobile phone 11 may store the subscriber's PIN through the OTP generating client, and automatically calculates and outputs the OTP based on the stored PIN and the random number when the subscriber mobile phone 11 receives a random number. . Thus, the OTP can be easily generated by the subscriber, and the PIN is not limited to numbers, and the security efficiency can be improved by using a combination of letters and numbers such as a password.

An embodiment of the present invention is not implemented only through the above-described apparatus and / or method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention, a recording medium on which the program is recorded, and the like. In addition, such an implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a network diagram schematically illustrating an authentication system according to a first embodiment of the present invention.

2A is a table configuration diagram stored in a subscriber DB of a CP server according to an embodiment of the present invention.

2B is a diagram illustrating a PIN registration table stored in a PIN registration server according to an exemplary embodiment of the present invention.

3 is a flowchart illustrating a PIN registration method through a CP site according to a first embodiment of the present invention.

4 is a network diagram schematically illustrating an authentication system according to a second embodiment of the present invention.

5 is a flowchart illustrating a PIN registration method through a PIN authentication site according to a second embodiment of the present invention.

6 is a flowchart illustrating an OTP authentication method using SMS according to a third embodiment of the present invention.

7 illustrates an OTP generation and a method for calculating a PIN from the OTP according to an embodiment of the present invention.

Claims (16)

When a random number is transmitted to a subscriber who has registered a PIN (Personal Identification Number) through SMS (Short Messaging Service), and receives a one time password (OTP) which is an operation value of the random number and the PIN from the subscriber, the PIN is received from the received OTP. PIN authentication server that determines whether to authenticate the subscriber by extracting and comparing with a registered PIN OTP authentication system comprising a. The method of claim 1, The PIN authentication server, A PIN authentication unit generating a PIN registration table according to the PIN registration request of the subscriber and storing the PIN table registration number and subscriber information; And PIN DB (Data Base) where the PIN registration table is stored OTP authentication system comprising a. The method of claim 2, The PIN registration table, OTP authentication system comprising any one or more of the subscriber's PIN table registration number, mobile phone number, PIN, random number or random number generation time. The method of claim 3, wherein The PIN authentication unit, Receiving a PIN authentication request from the subscriber, generates a corresponding random number and transmits it to the subscriber via SMS, and stores the random number and the random number generation time. The method of claim 4, wherein The PIN authentication unit, And comparing the OTP transmission time transmitted from the subscriber with the random number generation time to determine a random number of the subscriber, and obtaining a PIN value through a predetermined operation based on the OTP and the random number. The method of claim 5, wherein The PIN authentication unit, And comparing the PIN value with the PIN value registered in the PIN registration table and determining that the authentication is successful when the comparison value is the same. When receiving a random number transmitted through SMS (Short Messaging Service) and OTP (One Time Password), which is an operation value of the PIN, from a subscriber who has registered a PIN in a PIN authentication server to determine whether the subscriber is authenticated, CP (Content Provider) server requesting authentication of the subscriber by transmitting the received OTP to the authentication server OTP authentication system comprising a. The method of claim 7, wherein The CP server, A CP site providing an interface for PIN registration or OTP authentication of the subscriber; And OTP authentication system including a CP authentication unit for transmitting the PIN input from the subscriber through the CP site to the PIN authentication server to register the subscriber's PIN, and transmits the OTP input from the subscriber to the PIN authentication server . The method of claim 7, wherein The PIN authentication server, A PIN authentication site providing an interface for PIN registration or OTP authentication of the subscriber, The CP server forwards the PIN authentication site to the subscriber when the subscriber's PIN registration request or OTP authentication request. In the method that the OTP authentication system that manages the subscriber's Personal Identification Number (PIN) authentication performs one time password (OTP) authentication, a) receiving a subscriber's PIN authentication request; b) generating a random number and transmitting the random number to the subscriber mobile phone through SMS (Short Messaging Service); c) receiving an OTP which is an operation value of the random number and PIN from the subscriber; And d) comparing the PIN value calculated on the basis of the OTP and the random number and the registered PIN, and if successful, transmitting authentication success OTP authentication method comprising a. The method of claim 10, Before step a), OTP authentication method further comprising the step of registering the PIN entered from the subscriber. The method of claim 11, Registering the PIN, a) generating a PIN registration table according to the PIN registration request of the subscriber, storing the PIN table registration number and subscriber information, and transmitting the PIN table registration number to a content provider (CP) server; b) receiving a PIN and the PIN table registration number input from the subscriber from the CP server; And c) registering the PIN in the subscriber's PIN registration table corresponding to the PIN table registration number OTP authentication method comprising a. The method of claim 10, The random number is, An OTP authentication method having a validity for a predetermined time from a random number generation time. The method of claim 13, The OTP is, OTP authentication method, characterized in that the subscriber's registered PIN and the value added or subtracted the random number. In the method of the subscriber mobile phone to generate a One Time Password (OTP) using the Short Messaging Service (SMS), a) receiving a random number generated from a PIN authentication server managing a personal identification number (PIN) authentication through a short messaging service (SMS); b) activating an OTP generating client generating an OTP through a specific codemap operation, requesting the subscriber to enter a PIN; And c) displaying an OTP generated by combining the entered subscriber's PIN and the ransom number; OTP generation method comprising a. The method of claim 15, The PIN is, OTP generation method characterized by a number or a letter or a combination of numbers and letters.

Images