KR20170055665A - User authentication system and user authentication method therefor - Google Patents

Abstract

The present invention relates to a system and a method for authenticating a user, and relates to a system and a method for authenticating a user, in which the user has no need to memorize an identification (ID) and a password any more by providing a one time ID (OTID) and a password. According to the present invention, the authentication system comprises: a terminal in which an authentication application for generating the OTID for authentication is installed; an authentication management center for generating, comparing, and authenticating the OTID and the password; a password receiving place for transmitting the password generated by the authentication management center; and a service server for providing a web page having a login input window.

Description

[0001] USER AUTHENTICATION SYSTEM AND USER AUTHENTICATION METHOD THEREFOR [0002]

The present invention relates to a user authentication system and an authentication method. More particularly, the present invention relates to a user authentication system and an authentication method, which provide a One Time IDentification (OTID) and a password so that a user does not need to remember an ID and a password A user authentication system and an authentication method.

Today, when using Internet services, most users have used a single authentication method to enter their username and password. A single authentication method using an ID and a password has a problem that a user can access a user account by intercepting only a password. Also, there is a problem in that a user always has to remember a password for each Internet site and periodically change the password. come. In recent years, with the development of malicious hacking technology, user's personal information is leaked through infections such as malicious codes and viruses, and illegally used. Thus, user's password management becomes a very important problem.

In order to compensate for this, two authentication methods (Two Factor Authentication) such as One Time Password (OTP), a USB authentication method and PKI (Public Key Infrastructure) are used in a single authentication method using only an ID and a password as authentication elements. .

However, existing methods that use ID and password, and existing methods that use ID, password, and OTP (One Time Password) must not only know the ID but also remember the password or the secondary authentication method, And there is a problem that personal information is leaked at the time of password hacking, which is a fundamental alternative.

Korean Patent No. 10-1505137

An object of the present invention is to provide a user authentication system and an authentication method that do not require a user to memorize an ID and a password by providing a one-time ID (OTID) and a password in a field requiring user authentication.

Another object of the present invention is to provide a user authentication system and an authentication method which provide a variable password sent to a user as a password destination so that a user does not need to store a password any more and does not need to store a password.

Another object of the present invention is to provide a user authentication system and an authentication method that allow a user to easily detect a forgery or alteration of a web page by exposing OTID to a web page displayed after user authentication using OTID.

The present invention relates to an authentication system for user authentication, and an authentication system according to the present invention includes a terminal in which an authentication application for generating an OTID for authentication is installed, an authentication management unit for generating, comparing, And a service server for providing a web page having a login destination window and a password destination for transmitting a password generated by the authentication management center,

If the OTID input in the login input window is the same as the OTID generated in the authentication management center, the authentication management center transmits a password to the password receiver, and if the password input in the login window is generated by the authentication management center If the password is the same as the password, the user authentication is performed, and the OTID inputted in the login input window is the OTID generated in the application of the terminal.

A method of setting a user authentication system according to the present invention includes the steps of transmitting an application key, user information, and a password destination from a web page provided by an authentication application or a service server of a terminal to an authentication management center; Comparing the user identification code generated by the authentication management center with the user identification code transmitted from the terminal to the authentication management center; and transmitting the user identification code to the terminal And performing user registration.

A method for authenticating a user according to the present invention comprises the steps of: inputting an OTID generated in a terminal to a login screen provided by a service server; transmitting a user identification code to an authentication management center; Comparing the generated OTID with the OTID generated by the authentication management center; generating a password by the authentication management center and transmitting the password to the stored password destination; and transmitting the password sent to the password destination to the login input window of the service server Comparing the password generated by the authentication management center with the password transmitted from the service server, and transmitting the user authentication to the service server.

The OTID is generated using an application key, a time value, and a user identification code.

The service server according to the present invention can perform authentication without storing separate user information. Therefore, it can be safe from intentional or unintentional user information leakage such as hacking.

Also, since the ID and the password are not stored in the terminal, the ID and the password for connection to the service server can be securely lost or leaked from the lost terminal or the like.

In addition, since the OTID and the password which are changed in time are inputted to the login screen of the service server, it is safe from the loss and leakage of ID and password. In addition, the user need not remember the ID and the password for accessing the specific service server.

1 shows a user authentication system according to the present invention.
2 shows an authentication management center according to the present invention.
Figure 3 is a flow diagram illustrating the initial setup of a user authentication system in accordance with the present invention.
4 is a block diagram illustrating an initial setup of a user authentication system according to the present invention.
FIG. 5 illustrates a process of authenticating using the user authentication system according to the present invention.

Hereinafter, a user authentication system according to the present invention will be described in detail with reference to the accompanying drawings.

1 shows a user authentication system according to the present invention.

The user authentication system according to the present invention includes a terminal 100, a password receiver 200, a service server 300, and an authentication management center 400.

The terminal 100 may be a PC, a smart phone, a tablet, or the like capable of wired or wireless communication. The terminal may be provided with user authentication software. Preferably, the user authentication software may be a user authentication application. In the present invention, the user authentication software is installed, but it is possible to transmit and receive necessary information through a web browser.

In the case of a portable device such as a smart phone or a tablet, a device capable of installing and executing a user authentication application can be used. In the description of the present invention, an embodiment will be described in which a user authentication application is installed in a terminal. In the present invention, for convenience of explanation, the user authentication application is represented by an authentication application.

The authentication application installed in the user terminal can be downloaded from a separate application provider. As another embodiment, the authentication application may be provided from an authentication management center.

 In order to execute the authentication application installed in the terminal, the user must designate and input an application key.

The terminal generates an OTID using an application key, a time value, and a user identification code. The OTID generated in this manner has a value that changes in a predetermined time period. For example, if the generated OTID is '340815', it can be used as the login ID. If the next OTID '562782' is displayed after the exposure time has elapsed, the past OTID '340815' can not be used. The OTID has a value that changes in a predetermined time period.

The password destination (200, PW destination) is a place where the Internet can be wirelessly or wired and the user is authenticated. The password can be set as an e-mail, a short message service (SMS) of a cellular phone, or an SNS (social network service) account. The password receiver may be set to one or more.

The service server 300 may be a server of a service provider that the user desires to log in. A user can subscribe as a member through an Internet web page of a company that manages a service server. The service server can use a service provided by the user on the Internet homepage through login of the Internet web page. For example, it may be a shopping mall server, a social network server, a societies server, a payment server, or the like, and may be a server that logs in by inputting OTID and a password and requires user authentication. Such user authentication can be performed through login of the homepage provided by the service server.

The authentication management center 400 performs functions related to user registration, OTID and password generation, comparison, and authentication.

2 shows an authentication management center according to the present invention.

Referring to the drawings, an authentication management center 400 according to the present invention includes an authentication processing unit 410, a user verification code generation unit 420, a user identification code generation unit 430, an OTID generation and comparison unit 440, A generating and comparing unit 450, and a member information DB 460. In addition, an OTID forgery prevention unit can be further provided.

The authentication processing unit 410 performs functions related to registration and authentication of a user. The authentication processing unit receives user information, at least one password destination, and an application key, and stores it in the member information DB together with the user identification code. The authentication processing unit also performs functions related to authentication.

The user information may include at least one of personal information such as a name, a resident number, an address, a telephone number, and an e-mail. The application key may be a character, a number, a symbol, an image, a voice, a moving picture, a one-dimensional code, a two-dimensional code, a QR code, a three-dimensional code or a combination thereof as a key for driving an application. The user identification code will be described later in the description of the user identification code generation unit.

The user confirmation code generation unit 420 is a code for user confirmation, and is transmitted to the password destination input by the user at the time of initial setting. The user confirms that the password receiver is valid by transmitting the user confirmation code transmitted to the password receiver to the authentication center through the authentication application of the terminal.

The user identification code generator 430 generates a unique identification code of the user. The user identification code may be encrypted and stored in the authentication application of the user's terminal. The user identification code performs an activation function of an application, an index function of member information, and an OTID.

The OTID generating and comparing unit 440) generates an OTID that changes at predetermined time intervals. The OTID is generated using an application key, a time value, and a user identification code. The OTID may be a letter, a number, a symbol, an image, a voice, a moving picture, a one-dimensional code, a two-dimensional code, a QR code, a three-dimensional code or a combination thereof.

The generated OTID is inputted through the service server, and the OTID generated in the user terminal is compared with each other, and it is determined whether or not they are the same. On the other hand, if the OTIDs do not match, login failure information can be output to the user terminal.

The password generating and comparing unit 450 generates a password in the case of a valid OTID. The password thus generated is transmitted to the password destination registered in the member information DB. At this time, the password may be a letter, a number, a symbol, an image, a voice, a moving picture, a one-dimensional code, a two-dimensional code, a QR code, a three-dimensional code or a combination thereof.

On the other hand, the generated password can be transmitted to one password destination. However, if two or more password destinations are registered, the generated password can be divided and transmitted to two or more password destinations. For example, if the registered password destination is an email and a mobile phone and the generated password is 'ac123456', 'ac12' can be provided by e-mail and '3456' can be transmitted to a mobile phone. Accordingly, even if a part of the password is exposed to the outside, it is necessary to check the remaining part of the password, so that a more secure password can be transmitted.

The member information DB 460 stores user information and a password input from the user terminal.

Meanwhile, the present invention may further include an OTID forgery prevention unit. When the user authentication is performed, the OTID forgeries preventing unit displays an OTID used in user authentication on the Internet web page of the service server. Accordingly, since the same OTID as the OTID displayed in the authentication application of the terminal is displayed on the web page, the user can confirm whether the web page is a forged or modified web page.

Hereinafter, an initial setting method and an authentication performing method of the user authentication system according to the present invention will be described.

FIG. 3 is a flowchart illustrating an initial setting of a user authentication system according to the present invention, and FIG. 4 is a block diagram illustrating an initial setting of a user authentication system according to the present invention.

First, the user must download and install the authentication application on the terminal.

1. transmitting an application key, user information, and a password destination from a terminal to an authentication management center;

Through the authentication application installed in the terminal, an application key (application key) for executing the authentication application, user information, and a password destination are input. Here, the user information may include at least one of personal information such as a name, a resident number, an address, a telephone number, e-mail, and the like.

The authentication management unit of the authentication management center temporarily stores the transmitted application key, user information, and password destination.

In the present invention, the application key, the user information, and the password destination are transmitted through the terminal. However, the application key, the user information, and the password destination can be received through the web page provided from the service server .

2. The authentication center generates a user identification code and transmits it to a password destination;

When the application key, the user information, and the password receiving site for executing the authentication application are transmitted from the terminal to the authentication management center, the authentication management unit of the authentication management center generates a user authentication code and transmits the user authentication code to the password destination. The user sees the password transmitted to the password destination and inputs the user authentication code to the authentication application of the terminal. The entered user identification code is transmitted to the authentication management center.

3. comparing the user identification code generated by the authentication management center with the user identification code transmitted from the terminal to the authentication management center;

Then, the authentication management unit of the authentication management center compares the user identification code transmitted to the password receiver and the user identification code transmitted from the terminal, and confirms that the same value is obtained. The same value means that the password destination entered by the user is valid.

4. transmitting the user identification code to the terminal and performing user registration;

Then, the authentication management unit of the authentication management center transmits a user identification code to the terminal. The user identification code transmitted to the terminal is stored in the authentication application. At this time, it is preferable that the user identification code stored in the authentication application is encrypted and stored.

The user identification code functions to activate an authentication application. Activation here means that all the requirements to create an OTID have been satisfied in the authentication application.

In addition to the user identification code, the authentication management unit stores the temporarily stored application key, user information, and password destination.

By performing all of these processes, the initial registration process of the user authentication system is completed.

Hereinafter, a process of authenticating using the user authentication system according to the present invention will be described.

FIG. 5 illustrates a process of authenticating using the user authentication system according to the present invention.

1. inputting an OTID generated in a terminal into a login screen provided by a service server;

When the user enters the application key, the terminal generates the OTID using the application key, the time value, and the user identification code. At this time, the generated OTID has a value that varies with time according to the time value.

On the other hand, the service server provides a login screen for inputting an ID and a password. Here, the login screen may be a screen provided by a terminal, a PC, or a tablet used by the user.

The OTID generated in the terminal is input to the ID input window of the login screen provided from the service server. The entered OTID is forwarded to the certificate management center.

2. generating an OTID by an authentication management center using a user identification code transmitted from a terminal;

The terminal transmits the user identification code to the authentication management center. The authentication management center acquires the corresponding user and the application key of the corresponding user in the member information DB using the transmitted user identification code. Thereafter, the Authentication Management Center generates the OTID using the application key, the time value, and the user identification code.

In this manner, since the user identification code is set as the index value, it is possible to reduce the temporal and resource costs associated with the member search.

3. comparing the OTID transmitted from the service server with the OTID generated by the authentication center;

The OTID input by the user to the terminal is transmitted to the authentication management center via the service server, and the OTID generated by the authentication management center is compared using the user identification code transmitted from the terminal to the authentication management center. If it is the same OTID, it is confirmed that it is registered user.

This comparison of OTIDs can limit the number of times that OTID comparison attempts are avoided indiscriminately. For example, when the OTID is compared, the use of the service can be restricted for a certain period of time if the number of times is not the same.

4. The authentication center generates a password and transmits a password to the stored password destination;

The OTID transmitted from the service server is compared with the OTID generated by the authentication management center, and if it is the same value, the authentication management center generates a password. At this time, the created password is sent to the password destination registered by the user.

The retrieval of the password destination is performed using the user identification code as an index value. By using the user identification code as an index value, it is possible to prevent unnecessary server operation. On the other hand, since the user identification code is used as an index value, it is possible to reduce the time and resource costs according to the member search.

5. The method of claim 1, further comprising the steps of: inputting the password sent to the password destination by the user in the login window of the service server;

And sends the generated password to the password destination previously stored in the member information DB. The transmitted password is confirmed by the user and the password is input into the password input window of the login screen of the service server. The entered password is transmitted to the authentication management center via the service server.

6. comparing the password generated by the authentication management center with the password transmitted from the service server;

The authentication management center compares the password generated by the authentication management center with the password input by the user transmitted to the authentication management center via the service server. If the password is the same as the comparison result, it means that the member is a normal member.

7. transmitting the user authentication to the service server;

If the passwords compared in the authentication management center are the same, the authentication management center transmits to the service server that the user is authenticated. If valid OTIDs and passwords are leaked, you can log in using them. Therefore, for more reliable user authentication, the authentication management center can transmit the authentication processing result to the web page and the authentication application simultaneously or separately. This allows the user to know that he or she is performing user authentication by someone.

When the authentication is performed through the above process, the service server can perform the authentication without storing the separate user information. Therefore, it can be safe from intentional or unintentional user information leakage such as hacking.

Also, since the terminal does not store essential components for generating the OTID, it can be safe from the loss of the terminal.

In addition, since the OTID and the password which are changed in time are inputted to the login screen of the service server, it is safe from the loss and leakage of ID and password. In addition, the user need not remember the ID and the password for accessing the specific service server.

The OTID can be continuously displayed on the web page of the service server according to the present invention. Accordingly, the user can easily check whether the OTID displayed on the web page is identical to the OTID of the authentication application of the terminal, thereby easily knowing whether the web page is a forged or altered web page.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the present invention is not limited to the disclosed exemplary embodiments, but various changes and modifications may be made by those skilled in the art without departing from the scope of the present invention.

100: terminal
200: Password destination
300: service server
400: Certificate Management Center
410:
420: User identification code generation unit
430: a user identification code generating section
440: OTID generation and comparison unit
450: Password generation and comparison unit
460: Member Information DB

Claims (11)

An authentication system for user authentication,
The user authentication system
A terminal having an authentication application for generating an OTID (One Time IDentification) for authentication,
An authentication management center that performs OTID and password generation, comparison, and authentication;
A password destination for transmitting a password generated by the authentication management center,
And a service server for providing a web page having a login input window,
Wherein the OTID input in the login input window is an OTID generated in an application of the terminal.
The method according to claim 1,
If the OTID input in the login input window is the same as the OTID generated in the authentication management center, the authentication management center transmits a password to the password receiver, and if the password input in the login window is generated by the authentication management center And when the password is the same as the password, the user authentication is performed.
The method according to claim 1 or 2,
Wherein the OTID is generated using an application key, a time value, and a user identification code.
A method for setting a user authentication system,
Transmitting an application key, user information, and a password destination from an authentication application of the terminal to an authentication management center;
Generating a user identification code and transmitting the user identification code to a password destination;
Comparing the user identification code generated by the authentication management center with the user identification code transmitted from the terminal to the authentication management center,
Wherein the authentication center transmits the user identification code to the terminal and performs user registration.
A method for setting a user authentication system,
Transmitting an application key, user information, and a password destination from a web page provided by a service server to an authentication management center;
Generating a user identification code and transmitting the user identification code to a password destination;
Comparing the user identification code generated by the authentication management center with the user identification code transmitted from the terminal to the authentication management center,
Wherein the authentication center transmits the user identification code to the terminal and performs user registration.
The method according to claim 4 or 5,
Wherein the user identification code is encrypted and stored in the terminal.
The OTID generated from the terminal is transmitted to the authentication management center via the service server, and the OTID generated from the terminal is compared with the OTID generated in the authentication management center, and in the case of the same OTID, the password is transmitted to the password receiver .
The method of claim 7,
Wherein the OTID is input to a login window of a web page connected to the service server.
The method of claim 7,
Wherein the password transmitted to the password destination is input to a login screen window of a web page connected to the service server.
As a user authentication method,
Inputting an OTID generated by a terminal into a login screen provided by a service server;
Transmitting a user identification code from the terminal to an authentication management center;
Comparing the OTID transmitted from the service server with the OTID generated by the authentication management center;
The authentication management center generates a password and transmits the password to the stored password destination;
A step of the user inputting the password sent to the password destination in the login input window of the service server,
Comparing the password generated by the authentication management center with the password transmitted from the service server,
And transmitting the user authentication to the service server.
The method according to any one of claims 4 to 10,
Wherein the OTID is generated using an application key, a time value, and a user identification code.

Images