KR101570317B1 - One Time Password application method - Google Patents

Abstract

The present invention relates to a method for implementing a computer for a one time password (OTP) application executed in a user terminal. Provided is the method for implementing the computer which includes the steps of: checking a network connection state of the user terminal if a driving request for the OTP application is received; and controlling the OTP application to be driven when the network connection is inactive according to the checking result of the network connection state.

Description

OTP Application Method {One Time Password application method}

The present invention relates to a method for preventing a user from being stolen by a third party when operating a software-based OTP (One Time Password) application at a user terminal. More particularly, the present invention relates to a method for verifying whether a network is inactivated when an OTP application is activated and for executing an OTP application if the network is inactivated.

Recently, the use of OTP (One Time Password), which is a one-time password, is spreading in places where financial transactions or confidentiality are needed. Traditionally, OTP is divided into hardware based dongle method and software application method of user terminal according to the driving method. The hardware dongle method has the advantage of high security but inconvenience and cost of portability, and the software method has a merit that the security effect is somewhat poor, but the cost is low.

Although it has been thought that financial transaction using OTP is safe, if a user looks at the Internet banking hacking accident recently, a memory hacking attack that modifies a transaction account occurs even if a user performs a normal transaction at a transaction terminal.

A memory hacking attack is a hacking attack that modifies transaction account information to another account when data is sent from a transaction terminal to a transaction server, even though a normal user enters transaction accounts, remittances, and OTP token values in an online transaction medium .

In order to prevent this, overseas trading OTP, which generates the OTP token value by receiving the transaction account and transaction amount in the OTP generation algorithm, has been applied to the financial sector. Transaction-linked OTP technology is a technique for generating an OTP token value by additionally inputting transaction information (transaction account, remittance amount) to a conventional OTP technology for calculating an OTP token value by calculating the time or the number of attempts to individual OTP eigenvalues. Therefore, even if a memory hacking attack occurs on a transaction terminal, transactions can not be performed unless the remittance account and the remittance amount match the transaction-linked OTP.

However, transaction-based OTP is composed of highly secure hardware-based OTP, rather than a cost-effective and portable software method. This is because an attack on a user terminal can attack an operating environment itself rather than simply phishing an app. Typically, when a user operates an app on a user terminal, it is possible to transmit the input value or the output result or the screen itself to the outside, and the remote hacker can control the user terminal of the user through the remote control technology Is also possible.

Therefore, a new alternative is needed to protect the transaction itself while the software - based transaction - oriented OTP runs safely on the user terminal.

The present invention provides a computer-implemented method for an OTP application that can prevent the risk of hacking during the operation of a software-based OTP application.

The present invention also provides a computer-implemented method for an OTP application that prevents an OTP token value from being leaked through hacking software when a transaction-linked OTP application is installed or running in a user terminal.

According to an aspect of the present invention, there is provided a computer implemented method for an OTP (One Time Password) application executed in a user terminal,

Confirming a network connection state of the user terminal when a driving request for the OTP application is received; And controlling the OTP application to be activated when the network connection is in a deactivated state, according to a result of the checking of the network connection status.

In one embodiment, the step of verifying the network connection status comprises:

Determining whether a network to which an IP (Internet Protocol) address is allocated exists; And

And determining that the network connection is in an inactive state when the network to which the IP address is allocated does not exist.

In one embodiment, the step of verifying the network connection status comprises:

And determining that the network connection is in a disabled state even when a short-range wireless communication method network capable of communicating with the outside is activated without an IP address assigned to the user terminal.

In one embodiment, the method further includes controlling, when the network connection is not inactivated, at least one of driving the OTP application and performing a function according to the driving according to a result of checking the network connection state can do.

In one embodiment, if the network connection is not disabled when the drive request is received, guidance information for inducing a switch to the inactive state of the network connection is displayed on the screen or the network connection is disabled Forcibly switching to a state; And driving the OTP application with the network connection switched to the inactive state.

In one embodiment, the OTP application is activated while the network connection is in an inactive state; And generating an OTP through the OTP application,

The OTP may be a transaction-linked OTP generated by using at least one of transaction information selected by a user and code information classified and identified by a user.

In one embodiment, only when the network connection is in an inactive state, control is made so that at least one of input of transaction information, storage of data on the transaction information, creation of the OTP, and screen presentation of the generated OTP is possible . ≪ / RTI >

In one embodiment, the method may further include, after the OTP is displayed on the screen, controlling the OTP application and / or performing the function according to the driving when the predefined display setting time has elapsed .

In one embodiment, in the state that the OTP application is running, checking whether the OTP application is switched from Foreground to Background; And controlling, when switching to the background, at least one of driving the OTP application and performing the function according to the driving.

According to another aspect of the present invention there is provided a computer implemented method for an One Time Password (OTP) application running on a user terminal,

Confirming a network connection state of the user terminal while the OTP application is running; And controlling at least one of driving the OTP application and performing a function according to the driving when the network connection is established, in response to the checking result of the network connection state.

In one embodiment, the step of controlling at least one of the driving of the OTP application and the performance of the function according to the driving is limited,

Control is performed such that at least one of initialization of data of the OTP application, restriction of data processing according to driving of the OTP application, screen initialization of the OTP application, display of the drive end display screen of the OTP application, and forced end of the OTP application is performed Lt; / RTI >

According to the embodiment of the present invention, even if the OTP application is operated in the user terminal, the OTP token value is not leaked by the third party for a valid time.

Also, according to the embodiment of the present invention, it is impossible for the third party to know what transaction information is inputted or selected by the user while the network is inactivated.

Also, according to the embodiment of the present invention, when compared with a hardware-based transaction-oriented OTP dongle having only a conventional numeric input button, it is possible to activate a transaction-linked OTP owing to a convenient input structure of a user terminal, And the economics of the software type.

1 is a functional block diagram of a transaction-linked OTP application as an embodiment of the present invention;
2 is a schematic flow diagram of a method of operating an OTP application according to an embodiment of the present invention.
FIG. 3 through FIG. 7 illustrate execution screens of a transaction-linked OTP application according to one embodiment of the present invention. FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

FIG. 1 is a functional block diagram of a transaction-linked OTP application according to an embodiment of the present invention, and FIG. 2 is a schematic flowchart of a method for operating an OTP application according to an embodiment of the present invention. 3 to 7 are views illustrating execution screens of a transaction-linked OTP application according to an embodiment of the present invention.

Although the accompanying drawings of the present specification illustrate and illustrate the case of an OTP application that generates a transaction-linked OTP (i.e., an OTP used for securing a financial transaction), the OTP application according to an embodiment of the present invention Those skilled in the art will readily understand that the driving method can be applied to various other OTP generating applications equally or similarly. Therefore, in the present specification, for convenience and concentration of explanation, the case of transaction-linked OTP application will be mainly described.

Referring to FIG. 1, a transaction-linked OTP application 100 (hereinafter referred to as a "transaction-linked OTP application"), which is an example of an OTP application installed in a user terminal according to an embodiment of the present invention, A transaction information storage unit 120, an OTP generation unit 130, a GUI (Graphic User Interface) screen display unit 140, and a control unit 150 for performing functions. Hereinafter, the functions of the components in Fig. 1 will be described with reference to the flow chart in Fig. 2 and the example screens in Figs. 3 to 7 together.

The network check unit 110 checks the network connection state of the user terminal when the transaction-linked OTP application is initially operated so that the transaction-linked OTP app can be driven when the network connection is in the inactive state. 2, when the request for driving the transaction-linked OTP application is received according to the user's selection, the network checking unit 110 checks whether the network connection of the user terminal is in the inactive state (refer to FIG. 2 (See step S220 of FIG.

Here, the network deactivation state may be set when all the network devices (for example, 3G, LTE, WiFi, Bluetooth, NFC, etc.) mounted on the user terminal are in the inactive state. However, ) It may be set to the case that only the network requiring address assignment is in the inactive state.

In the latter case of the above description, when a request for driving a transaction-linked OTP application by a user is received, the network check unit 110 checks whether a network to which an IP address is allocated exists in the user terminal, If the assigned network does not exist, it can be determined that the network is in a disabled state. That is, in the latter case, even if a short-range wireless communication method network such as Bluetooth or NFC capable of communicating with the outside can be activated without assigning an IP address, if the network requiring IP address allocation is in a disabled state, It is determined that the network is in a disabled state at S220.

As another example, in the method of recognizing the network status value, the network identifying unit 110 may determine that the network connection is in a disabled state if the address system assigned to the network device is a loopback address. Such a loopback address may be 127.0.0.1 for an IP address assigned to a network device and may be :: 1 or 0: 0: 0: 0: 0: 0: 0: 0: 1 for an IPv6 address.

As described above, in applying the OTP application driving method according to the embodiment of the present invention, how to define the network deactivation state may be different according to the environment setting of the application.

The control unit 150 controls whether or not the transaction-linked OTP application is activated and / or whether the function is executed in accordance with the app operation according to the confirmation result of the network identification unit 110. First, if it is determined in step S220 of FIG. 2 that the network is in a deactivated state, the control unit 150 controls the OTP app linked to the transaction to be normally driven (executed). For example, when it is determined that the network is in the inactive state, the controller 150 displays the GUI screen for displaying the GUI screen for generating the transaction-linked OTP, as shown in the example screens of FIGS. 3 to 7, Or to control the operation of the OTP generation unit 130 so as to generate a transaction-linked OTP.

In contrast, if it is determined in step S220 of FIG. 2 that the network connection is not deactivated (i.e., the network is connected), the control unit 150 restricts the operation of the transaction-linked OTP application Application execution is not allowed) (refer to step S240 of FIG. 2). In this case, the control unit 150 can control the pop-up to guide the network inactivation through the GUI screen (i.e., pop-up for guiding the network connection to the inactive state (refer to FIG. 3)) to be displayed S244]. Accordingly, when the user performs the network deactivation as in step S248 of FIG. 2, the control unit 150 may cause the transaction-linked OTP application to be executed.

Also, the network check unit 110 can check whether the network connection is restored every second or at a specified period even while the transaction-linked OTP application is running (refer to step S250 of FIG. 2). Accordingly, when the network connection is resumed, the control unit 150 may limit the operation of the transaction-linked OTP application or restrict the function execution according to the application activation (refer to step S260 of FIG. 2).

In the step S260 of FIG. 2, the restriction of the operation of the transaction-linked OTP application may be expressed by displaying a pop-up for switching the network connection state back to the inactive state, a method of forcibly terminating the network connection state, have. There is also an operating system that allows the network connection to be automatically disabled or reconnected depending on the operating system installed in the user terminal. Accordingly, in this case, the control unit 150 of the transaction-linked OTP application can directly control the airplane mode or the network deactivation mode. For this purpose, the transaction-linked OTP application may place the network control unit under have.

In the step S260 of FIG. 2, limiting the execution of the function according to the operation of the transaction-linked OTP application means that data initialization of the transaction-linked OTP application, limitation of data processing (calculation) This could be the case. In this case, the value to be initialized may be the transaction information that the user has input or selected, the OTP token value generated by the OTP generation unit 130, or the like, or may be all the data currently generated or newly stored have.

If it is determined that the network connection is maintained in the inactive state as a result of the periodic check through the network identification unit 110, the control unit 150 displays the GUI screen (FIG. 3 to FIG. 7 Storing the transaction information through the transaction information storage unit 120, generating the transaction-linked OTP through the OTP generation unit 130, displaying the application screen through the GUI screen display unit 140, And so on.

In the embodiment of the present invention, the transaction information selected by the user can be used to generate the transaction-linked OTP through the transaction-linked OTP app. 3 to 6, a transaction bank (i.e., a financial institution), a deposit account information, and a transaction amount are used for the creation of a transaction-linked OTP, but the present invention is not limited thereto. That is, at least one of transaction information such as transaction bank, account holder name, transaction amount, deposit account number, assigned transaction number, transaction condition, etc. may be utilized in the creation of transaction-linked OTP. The input items or the selection items of such transaction information can be variously modified according to the implementation method of the application.

In this case, the transaction information once received according to the implementation method is encrypted and stored, and can be reused according to the user's selection if necessary. When storing frequently used transaction information, a nickname can be set so that the transaction information can be easily called and used in the future. In addition, the transaction information input or reused according to the implementation method may be converted into a hash value and transmitted to the OTP generation unit 130.

The OTP generation unit 130 receives the transaction information selected in the OTP inherent key value and the OTP variable value (time and / or trial number) to generate a transaction-linked OTP token value, To the screen display unit 140.

The GUI screen display unit 140 displays the OTP token details generated by the OTP generation unit 130 to the user (refer to FIG. 6). In addition to the OTP token value, the OTP application termination or OTP app termination and network resume button may be additionally provided on the GUI screen display section 140 according to the implementation method (refer to FIG. 7).

In the case of an operating system in which the transaction-linked OTP application is allowed to directly control the inactivation / activation of the network, the control unit 150 drives the network immediately before the application termination via the network identification unit 110 and controls the control unit 150 to terminate the application It is possible. In this case, the control unit 150 may further transmit the transaction information selected or selected by the user immediately before terminating the application to the other server after the network is resumed.

In the above description, transaction information related to withdrawal and withdrawal from a bank is mainly used for generating transaction-linked OTP. However, the transaction information to be used in generating transaction-linked OTPs may be changed according to the characteristics of the transaction institution. For example, a securities company can be composed of a stock code, a purchase quantity, and a purchase price. In the case of a shopping mall, a product code, an order quantity, and an order amount can be configured. In the case of a bond or an electronic money, A transaction agency, a transaction number, a transaction amount, and the like.

In the above description, only the case where transaction information is used for transaction-linked OTP generation is mainly described, but code information that is discriminated for each user may be used for transaction-linked OTP generation. For example, regardless of the transaction information, code information for identifying a user displayed on the OTP application screen (e.g., numbers, letters, figures, and shapes shown through an image displayed in the form of a rotary password selection key in a safe A matching user identification code) may be used to generate the transaction-linked OTP.

In the above description, only the case of limiting or permitting the execution of functions according to the operation or operation of the transaction-linked OTP app has been mainly described according to the result of checking the network connection state, but there may be further additional restrictions. For example, if the OTP app is running in a transaction, it is checked whether the screen of the app is switched from the foreground to the background, and when the application is switched to the background, There may also be additional constraints to limit the performance of functions according to the present invention.

In the above description, the respective roles of the components related to the method of operating the transaction-linked OTP application in the user terminal have been described. Hereinafter, an example of actual implementation will be described in order to understand the contents of the present invention more clearly .

First, when the operating system of the user terminal supports the setting of the airplane mode (airplane boarding mode) or the setting of the WiFi in the app, when the interworking OTP app is activated, the network check unit 110 checks the current airplane mode value and the WiFi setting value And disables the network if it is connected. If your operating system does not support Airplane mode or WiFi mode switching in your app, it will stop the app from running and instruct the user to unconfigure and connect to the network.

When the network is inactivated, the GUI screen display unit 140 is driven to receive a transaction institution, a transaction account, a transaction amount, a transaction condition, and the like from the user. In order to store information on frequently used transaction subjects, it is possible to store transaction subject aliases, if necessary, and to prevent users from unnecessarily inputting transaction agencies and transaction accounts. At this time, the input value may be encrypted or transformed into a hash value according to the implementation method, and the application may be terminated by transmitting the modified value to a third external verification server previously specified at the time of restarting the network. The OTP generation unit 130 generates an OTP token value using variable information (time or frequency) in the OTP eigenvalue using transaction information or the like. The created OTP token value is displayed on the GUI screen display unit 140.

In this case, the controller 150 configures the screen display setting time, and when the designated screen display setting time has elapsed after the transaction-linked OTP has been displayed on the screen, at least one of the functions Can be controlled to be limited. Alternatively, the control unit 150 may block the OTP application which is interlocked with the transaction from continuing to operate, and present a selection button for inducing the network connection together with the OTP to the user on the OTP display screen so that the user can input the OTP to the transaction medium The environment can be provided.

A computer-implemented method for an OTP application according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims And changes may be made without departing from the spirit and scope of the invention.

Claims (11)

A computer-implemented method for an One Time Password (OTP) application running on a user terminal,
Confirming a network connection state of the user terminal when a driving request for the OTP application is received; And
And controlling the OTP application to be activated when the network connection is in an inactive state, in accordance with a result of the checking of the network connection status.
The method according to claim 1,
Wherein the checking of the network connection status comprises:
Determining whether a network to which an IP (Internet Protocol) address is allocated exists; And
Determining that the network connection is in an inactive state when the network to which the IP address is allocated does not exist
Lt; / RTI >
3. The method of claim 2,
Wherein the checking of the network connection status comprises:
And determining that the network connection is in a disabled state even when a short-range wireless communication method capable of communicating with the outside is activated without an IP address assigned to the user terminal.
The method according to claim 1,
Controlling at least one of driving the OTP application and performing a function according to the driving when the network connection is not inactivated according to a result of checking the network connection status
Lt; / RTI >
The method according to claim 1,
If the network connection is not inactivated when the driving request is received, guidance information for inducing a transition to the inactive state of the network connection is displayed on the screen or the network connection is forcibly switched to the inactive state step; And
Driving the OTP application with the network connection switched to the inactive state
Lt; / RTI >
The method according to claim 1,
The OTP application is activated while the network connection is in a disabled state; And generating an OTP through the OTP application,
Wherein the OTP is a transaction-linked OTP generated by using at least one of transaction information selected by a user and code information classified and identified by a user.
The method according to claim 1,
And controlling to enable at least one of input of transaction information, storage of data relating to the transaction information, creation of the OTP, and display of the created OTP to be possible only when the network connection is in the inactive state Way.
8. The method of claim 7,
Further comprising controlling, after the OTP is displayed on the screen, that at least one of driving the OTP application and performing the function according to the driving is limited when a predefined display setting time has elapsed.
The method according to claim 1,
Checking whether the OTP application is switched from a foreground to a background when the OTP application is running; And
Controlling, when switching to the background, at least one of driving the OTP application and performing a function according to the driving;
Lt; / RTI >
A computer-implemented method for an One Time Password (OTP) application running on a user terminal,
Confirming a network connection state of the user terminal while the OTP application is running; And
Controlling the OTP application so that at least one of the function of performing the OTP application and the function of performing the operation is limited when the network connection is established,
Lt; / RTI >
11. The method of claim 10,
Wherein the step of controlling at least one of driving the OTP application and performing a function according to the driving is limited,
Control is performed such that at least one of initialization of data of the OTP application, restriction of data processing according to driving of the OTP application, screen initialization of the OTP application, display of the drive end display screen of the OTP application, and forced end of the OTP application is performed The computer-implemented method.

Images