KR100752393B1 - Token and method for personal authentication - Google Patents

Abstract

The present invention relates to a personal authentication token and an authentication method, and more particularly, to a personal authentication token and an authentication method in which only a user of an authentication token can input a one-time password required for the authentication process, thereby enhancing security.

An authentication token storing a certificate for personal authentication is generated by generating a one-time password required for authentication according to a request from a host terminal connected for personal authentication, and using the one-time password input from the user, Authentication means for receiving the generated authentication information from the host terminal to determine whether or not to authenticate, display means for displaying the one-time password generated by the authentication means, and communication with the host terminal, And control means for controlling the authentication means and the display means so that personal authentication is performed by user input of the displayed one-time password.

Authentication certificate, electronic signature, authentication token, smart card, USB, user authentication, one-time password

Description

[0002] Personal authentication tokens and authentication methods [

1 is a configuration diagram of a personal authentication token according to a preferred embodiment of the present invention;

2 is a flowchart illustrating a personal authentication method according to an exemplary embodiment of the present invention.

DESCRIPTION OF THE REFERENCE SYMBOLS

110: authentication means 120: display means

130: control means 131: interface

132: Processor

The present invention relates to a personal authentication token and an authentication method, and more particularly, to a personal authentication token and an authentication method in which only a user of a token can input a one-time password required for an authentication process.

As the use of the Internet spreads rapidly, modern people solve a lot of daily life such as electronic commerce, financial services, information acquisition and entertainment through the Internet. In particular, the importance of security is increasingly emphasized because e-commerce or financial services can be harmed by malicious users when personal information is leaked.

To solve this security problem, an authentication token has been developed and widely used for public authentication for use of Internet financial services and the like. Generally, unlike a hard disk (HDD) or a general USB memory, an authentication token is relatively secure because the certificate file stored in the authentication token can not be confirmed by a window searcher or the like, and copying to another medium is impossible.

Conventionally, a process of performing authentication using an authentication token will be described. First, an authentication program is accessed in order to use a financial service while a user or an authentication token is connected to a USB port of a PC. Then, on the authentication token side, a predetermined ID / password or a one-time password or the like is transmitted to the authentication program side, and user authentication is performed according to an encryption algorithm unique to the authentication token and the authentication program.

However, the conventional authentication token using the password has a fundamental weakness because the user is authenticated by the password transmitted to the authentication program side. That is, when a password is leaked by hacking illegally acquiring keyboard input data, there is a problem that personal authentication information can be illegally used on-line.

As a technique for solving such a problem, an authentication token using biometrics technology is excellent in security, but has a drawback that the price of the device is too high and the procedure is troublesome.

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made in an effort to solve the above problems, and an object of the present invention is to provide a method and system for authenticating a user by performing authentication using a user identification information It is an object of the present invention to provide a personal authentication token and an authentication method that prevent unauthorized authentication.

Other objects and advantages of the present invention will be described hereinafter and will be understood by the embodiments of the present invention. Further, the objects and advantages of the present invention can be realized by the means and the combination shown in the claims.

According to an aspect of the present invention, there is provided an authentication token storing a certificate for personal authentication, the authentication token generating a one-time password required for authentication according to a request from a host terminal connected for personal authentication, Authentication means for receiving the authentication information generated by using the one-time password input from the host terminal and determining whether to authenticate the host terminal, display means for displaying the one-time password generated by the authentication means, And control means for controlling the authentication means and the display means so that personal authentication is performed by user input of the disposable password displayed through the display means.

According to another aspect of the present invention, there is provided a method for performing personal authentication using an authentication token storing a certificate for personal authentication, the method comprising: generating a one-time password by requesting authentication from the host terminal; A one-time password output step of outputting a one-time password to the authentication token through a display unit provided in the authentication token, an authentication information transmission step of transmitting authentication information to the host terminal after generating the authentication information by inputting the one- ; And an authentication step of comparing the authentication information generated by using the one-time password with the authentication information transmitted from the host terminal and authenticating the authentication token, and transmitting the authentication result to the host terminal.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined.

Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

1 is a configuration diagram of a personal authentication token according to a preferred embodiment of the present invention. 1, a personal authentication token 100 according to an embodiment of the present invention includes an authentication unit 110, a display unit 120, and a control unit 130. [

First, the user starts the authentication process by connecting the personal authentication token 100 with a host computer (not shown in the figure) and inputting the user PIN in the authentication program. In general, the personal authentication token 100 may be connected to a host computer, but may also be connected to a mobile terminal (notebook computer, PDA, online banking terminal, etc.) equipped with a USB port.

The authentication means 110 is a chip on which an encryption algorithm is installed, and stores a personal certificate and an associated encryption key. When the authentication means 110 receives the start message from the host computer (not shown in the figure) and senses the start of the authentication process, it generates a one time password (hereinafter referred to as "OTP " . Here, OTP is a random number generated randomly, and has sufficient safety because it is unpredictable.

The authentication means 110 generating the OTP generates the message requesting the authentication information from the host computer (authentication program) while outputting the OTP to the display means 120 under the control of the control means 130, (Authentication program).

Then, the authentication means 110 compares the authentication information transmitted from the host computer (authentication program) with the previously stored authentication information, performs authentication, generates a message according to the authentication result, ). Here, the previously stored authentication information is information on the authentication of the host computer (authenticated) by receiving the authentication start message from the PIN and the host computer (authentication program) originally stored by the authentication means 110 and using the one- Program) generated by the same algorithm.

If the authentication information transmitted from the host computer (authentication program) matches the previously stored authentication information, an authentication success message is transmitted. The authentication information transmitted from the host computer (authentication program) and the previously stored authentication information The authentication failure message is transmitted.

The authentication means 110 for performing the functions described above may be implemented in the form of an IC chip, but is not limited thereto.

On the other hand, the display means 120 displays the OTP generated by the authentication means 110 so that the user can visually recognize the OTP. Also, the display means 120 can use a display device such as a liquid crystal display (LCD), but the present invention is not limited thereto, and a light emitting diode (LED) or a seventh segment can also be used.

Also, the power required for the display means 120 to display the OTP can be supplied from the host computer via the USB interface.

The control means 130 controls each component of the personal authentication token 100 using the processor 132. That is, the control unit 130 includes a processor 132, an authentication unit 110, a display unit 120, and an interface 131 that can connect the host computer to communicate with the inside or outside of the personal authentication token 100 And controls the overall authentication procedure. Here, the processor 132 may be an Intel 8051 series or the like, but is not limited thereto.

Hereinafter, the overall operation of the present invention will be described with reference to FIG.

2 is a flowchart of a personal authentication method according to a preferred embodiment of the present invention. In the following description, the same reference numerals as those in Fig. 1 denote the same members performing the same function.

First, when an authentication program (including an authentication program linked with a server on-line) is executed while the user has plugged the personal authentication token 100 into the USB slot of the host computer, the authentication program requests the user to input the PIN.

Thereafter, when the user inputs a PIN according to the request of the authentication program (201), the host computer (authentication program) generates a message informing the start of the authentication process (205) and transmits the message to the personal authentication token 100 (207 ).

Then, the personal authentication token 100 recognizes the start of the authentication process by analyzing the start message transmitted from the host computer (authentication program), and generates the OTP (209). Then, the generated OTP is displayed on the display means 120 so that the user can read it (211).

Then, the personal authentication token 100 generates a message requesting authentication information (213), and transmits the message to the host computer (authentication program) (215).

Then, the host computer (authentication program) requesting the authentication information requests the OTP input to the user, and the user identifies the OTP output through the display means 120 and inputs the OTP to the host computer (authentication program) (219) .

Then, the host computer (authentication program) generates the authentication information using the PIN input from the user in step 201 and the OTP input in step 219, and transmits the generated authentication information to the personal authentication token 100 (step 223) .

On the other hand, the personal authentication token 100 compares the PIN and OTP included in the authentication information transmitted from the host computer (authentication program) with the PIN originally stored in the authentication means 110 and the OTP generated from "209 " And determines whether the user has succeeded in authentication (225).

Then, the personal authentication token 100 generates (227) a message (an authentication success message or an authentication failure message) notifying the authentication result to the host computer (authentication program) (229), and the host computer transmits the personal authentication token 100 to the display device connected thereto and informs the user of the authentication result.

Since the one-time password required for authentication is output through the display means 120, the personal authentication token 100 according to the present invention is free from the burden of the user having to remember the password, , The price is very cheap.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It will be understood that various modifications and changes may be made without departing from the scope of the appended claims.

According to the personal authentication method and apparatus of the present invention, since the authentication is performed through the user authentication information (PIN) and the one-time password (OTP) generated by itself and displayed only by the user, The illegal authentication by the hacker can be prevented.

In addition, since the one-time password required for authentication is output through the display device, the present invention eliminates the burden of the user having to remember the password, and when compared with the biometric device generally used for verifying the actual user of the authentication token, The price is very cheap.

Claims (11)

As an authentication token storing a certificate for personal authentication, A one-time password required for authentication is generated in response to a request from a connected host terminal for personal authentication, and authentication information generated using the one-time password input from the host terminal is received from the host terminal to determine whether to authenticate Authentication means; Display means for displaying the one-time password generated by said authentication means; And And control means for controlling the authentication means and the display means to process the communication with the host terminal and perform personal authentication by user input of the disposable password displayed through the display means, A personal authentication token that includes the. The method according to claim 1, The authentication means, When receiving an authentication start message from the host terminal and requesting authentication, generates a one-time password under the control of the control means and outputs the generated one-time password through the display means. As a result, And transmits the authentication success message to the host terminal when the authentication information matches the authentication information, and when the authentication information is transmitted to the host terminal, If they do not match, an authentication failure message is transmitted to the host terminal Personal authentication token. delete delete delete A method for performing personal authentication using an authentication token storing a certificate for personal authentication, A one-time password generating step of generating a one-time password by requesting authentication from the host terminal by the authentication token; A one-time password output step of outputting the one-time password to the authentication token through a display means provided in the authentication token; An authentication information transmission step of generating authentication information using the one-time password inputted from the user by the host terminal and transmitting the authentication information to the authentication token; And An authentication step of authenticating the authentication token by comparing the authentication information transmitted from the host terminal with the authentication information generated by using the one-time password, and transmitting the authentication result to the host terminal And a personal authentication method. delete delete delete delete delete

Images