KR20140128139A - User authentication system and method using smart media - Google Patents

Abstract

The present invention relates to a system and a method of authenticating a user using a smart medium and, more specifically, to the system and the method of authenticating a user using a smart medium which perform an authentication process by acquiring information necessary for authentication using an authentication terminal having a smart medium for authentication and a short-range wireless communication unit, which is capable of reading medium information wirelessly from the smart medium for authentication, wherein authentication information, which requires a high security level, is neither memorized by a user nor stored in a mobile device.

Description

Technical Field [0001] The present invention relates to a user authentication system and method using smart media,

The present invention relates to a system and method for authenticating a user on an online basis, and more particularly, to a system and method for authenticating a smart medium for authentication and a smart medium for authentication without storing a user's authentication information, To a user authentication system and method using a smart medium that acquires information necessary for authentication and performs an authentication procedure using an authentication terminal having short-range wireless communication capable of wirelessly reading medium information.

Due to the rapid development of internet technology based on wired / wireless communication, it has become impossible to think about the world without internet now.

In order to receive various services provided on the Internet, the user must register as a member in a web server (hereinafter referred to as "service server") provided by a contents provider (CP). In order to prevent leakage of member information and use of services of third parties entered when registering a member, it is necessary to register an ID and password, or to obtain a public certificate and store it in a storage device.

Also, due to the development of Internet technology, e-commerce is being activated through online, various payment such as online transfer and card payment are being made online through activation of e-commerce, and electronic payment by e-commerce is performed safely Various user authentication schemes are applied. Such user recognition methods are also mainly used in knowledge-based authentication methods such as ID and password, and are subject to a public certificate, a one-time password (OTP), a token, a mobile authentication, and an ARS authentication.

However, in order to increase security, the ID password method recommends that users use different IDs and passwords for each of a large number of service servers, and users also apply several passwords. However, if you do not use any service server frequently, you will not be able to remember your ID and password, and you will have to go through troublesome procedures such as ID / password search. To solve this problem, if you use the same ID and password, There is a problem that the damage due to the password may become large, and there is a problem that the ID and the password must be stored in each service server, thereby becoming a hacking object.

The user authentication method such as the public certificate and the OTP method has a disadvantage that it is difficult to manage the user authentication because there is a concern that the storage device and the OTP terminal for storing the public certificate are separately stored.

Registration No. 10-0710032

SUMMARY OF THE INVENTION It is therefore an object of the present invention to provide a smart mobile communication device capable of wirelessly communicating with a smart medium for authentication and a smart medium for authentication without a need for a user to store authentication information of a user requiring high security, And a user authentication system and method using a smart medium that acquires information necessary for authentication using the provided authentication terminal and performs an authentication procedure.

According to another aspect of the present invention, there is provided a user authentication system using a smart medium, comprising: a user authentication request signal including user identification information when a login request is made based on user identification information; A service server for receiving the service request and determining whether to log in; A smart card reader for reading smart card identification information from the smart card to generate user authentication information, and a user authentication response signal including user authentication information, A terminal for authentication; And service subscription information including user identification terminal information for authentication and smart media identification information for authentication, and upon receiving the user authentication request signal from the service server, transmitting a user authentication request signal to the authentication terminal, And a user authentication server for verifying the user authentication response signal by the stored service subscription information when the user authentication response signal is received in response to the authentication request and providing the result to the service server .

Wherein the service authentication server generates a service authentication key, encrypts the user authentication request signal with the generated service authentication key, and transmits the encrypted service authentication key to the authentication terminal, And generates an authentication key and decodes a user authentication request signal received from the service authentication server using the service authentication key.

The service authentication key is generated by a Hash Message Authentication Code (HMAC) using the authentication terminal identification information (Did), smart medium identification information (TokenId), and server security information (Server_Secret).

The authentication terminal stores a personal identification number (PIN) set by a user, requests input of a user PIN when receiving the user authentication request signal, and transmits the user PIN And performs verification based on the service subscription information.

The authentication terminal further includes service subscription information and a message authentication value in the user authentication response signal, and the user authentication server performs a message verification based on the message authentication value, And transmits the user authentication result to the service server upon successful authentication.

The service server sends a user authentication request signal to the service terminal in response to a service registration request from the service terminal, requests the user registration, and when receiving the user registration request signal, And generates user registration information including the authentication terminal identification information and the authentication smart medium identification information, and transmits a user registration response signal including the user registration information, and in response to the user registration response signal When the service registration information is received, the user authentication server generates and transmits the user registration request signal to the authentication terminal upon receiving the user authentication issuance request signal, and when the user registration response signal is received in response to the user registration request signal, Service subscription information And then transmits the resultant to the authentication terminal to complete the user authentication registration.

Wherein the service server transmits a user registration confirmation message to the authentication terminal when the service registration request is generated from the service terminal, stores the user identification information (PIN) preset by the user in the authentication terminal, When receiving the registration confirmation message, it requests the input of the user PIN. If the user PIN is inputted from the user, the service PIN is compared with the pre-established PIN, and the service registration key is generated and displayed. When the service registration key displayed on the terminal for authentication is input from the terminal, the service authentication key includes the service registration key in the user authentication issue request signal, and the user authentication server encrypts the user registration request signal with the service registration key, The authentication terminal stores the service registration key Seen is characterized in that the processing by decrypting the registration request signal.

The user authentication server deletes the service registration key after encrypting the user registration request signal and the authentication terminal deletes the service registration key after decoding the user registration request signal and uses the service registration key as a one- .

The authentication terminal further includes a message authentication value in the user registration response signal. The user authentication server performs message verification based on the message authentication value, and generates the service subscription information upon successful verification, And transmits the user registration result to the service server after user registration is completed.

According to another aspect of the present invention, there is provided a method for authenticating a user using a smart medium, comprising: transmitting a user authentication request signal including user identification information to a service server, A user login request process; A user authentication requesting step in which the user authentication server sends a user authentication request signal to the authentication terminal upon receiving the user authentication request signal to request user authentication; The terminal for authentication verifies the service subscription information stored in advance upon receipt of the user authentication request signal from the user authentication server, leads the smart medium identification information from the smart medium upon successful verification, generates user authentication information, A user authentication information providing step of transmitting a user authentication response signal including information; An authentication result providing step of authenticating the user authentication response signal by the stored service subscription information when the user authentication server receives the user authentication response signal and providing the result to the service server; And a login process for determining whether or not to log in.

The user authentication request process includes: a service authentication key generation step in which the service authentication server generates a service authentication key; An encryption step of encrypting the user authentication request signal with the generated service authentication key; And a transmitting step of transmitting the encrypted user authentication request signal, wherein the providing of the user authentication information comprises: generating a service authentication key for generating the service authentication key according to service subscription information previously stored in the authentication terminal step; A decoding step of decoding a user authentication request signal received from the service authentication server with the service authentication key; A verification step of comparing the decrypted user authentication request signal with a service subscription information stored in advance and verifying the decoded user authentication request signal; Generating user authentication information by reading smart media identification information from the smart media upon successful verification; And a user authentication response step of generating and transmitting a user authentication response signal including the user authentication information.

The service authentication key is generated by a Hash Message Authentication Code (HMAC) using the authentication terminal identification information (Did), smart medium identification information (TokenId), and server security information (Server_Secret) .

The user authentication information providing step may include a PIN verification step of requesting the user terminal to input the user PIN when the authentication terminal receives the user authentication request signal and determining whether the user PIN is identical to a predetermined user PIN upon inputting the user PIN Further included,

And when the pin verification is successful in the pin verification step, the authentication key generation step is performed.

The method of claim 1, further comprising transmitting a message authentication value to a user authentication response signal in a user authentication response step of the user authentication information providing process, wherein the authentication result providing step includes: when the user authentication response signal is received, A service subscriber information verification step of verifying the user authentication response signal by subscription information; A message authentication step of performing message authentication based on the message authentication value when the user authentication server succeeds in verifying the service subscriber information; And providing an authentication result to the service server when the message authentication is successful.

The method includes the steps of: when the user authentication server receives a user registration response signal including authentication terminal identification information and smart medium identification information from an authentication terminal upon receiving a user issuance request signal from a service server, And generating a service subscription information including smart medium identification information and registering the service subscription information, and transmitting the subscription information to the authentication terminal so that the authentication terminal stores and registers the service subscription information.

Wherein the user registration step comprises: a user authentication issue request step of requesting user registration by transmitting a user authentication issue request signal when a service registration request is made from the service terminal; A user registration request step of generating the user registration request signal when the user authentication server receives the user authentication issue request signal and transmitting the user registration request signal to the authentication terminal; Wherein the authentication terminal reads the authentication smart medium identification information from the smart medium for user authentication upon receipt of the user registration request signal to generate user registration information including the authentication terminal identification information and the authentication smart medium identification information, A user registration response step of transmitting a user registration response signal including the user registration information to the user authentication server; A service subscription information registration step of generating and storing the service subscription information when the user authentication server receives the user registration response signal and transmitting the service subscription information to the authentication terminal; And a service subscription information storing step of storing, when the service subscription information is received in response to the user registration response signal, the authentication terminal.

Wherein the user registration step comprises: a user registration confirmation request step of transmitting a user registration confirmation message to the authentication terminal when a service registration request is generated from a service terminal; When the authentication terminal stores the user's personal identification information (PIN) preset by the user, requests input of the user PIN when receiving the user registration confirmation message, and inputs the user PIN from the user, A service registration key generation step of generating and displaying a service registration key when they are compared with each other, and a service registration key input step of determining whether a service registration key displayed on the authentication terminal is inputted from the service terminal of the user, Wherein the service registration key includes a service registration key and the service registration key includes a service registration key and a service registration key, wherein when the service registration key is input, the service server transmits the service registration key in the user authentication issue request signal in the user authentication issue request step, Encrypts the user registration request signal with the service registration key And the authentication terminal decodes the user registration request signal received by the service registration key stored in the user registration response step and processes the user registration request signal.

Wherein the user registration response step includes: a smart medium identification information obtaining step of reading smart medium identification information for authentication from a smart medium for user authentication upon receipt of a user registration request signal; A user registration information generating step of generating user registration information including authentication terminal identification information and the authentication smart medium identification information; A user registration response signal generation step of generating a user registration response signal including the user registration information; An encryption step of encrypting the user registration response signal with the service authentication key generated by the user identification information and the server security information generated by the user authentication server; And a transmission step of transmitting the encrypted user registration response signal to a user authentication server. In the service registration information registration step, when the user registration response signal is received, the user authentication server transmits a user identification A service authentication key generation step of generating a service authentication key identical to the service authentication key by information and server security information generated by the user authentication server; A decoding step of decoding the encrypted user registration response signal with the generated service authentication key; And a service registration step of generating and registering service subscription information from the decoded user registration response signal, and then transmitting the service subscription information to the authentication terminal.

When the service registration request and the service authentication request are generated in at least one of the user registration confirmation request step and the user authentication request step, the authentication server identification information for the authentication terminals registered as lost or stolen by the user authentication server, And a lost / stolen terminal notification step of comparing the requested authentication terminal identification information and rejecting a service registration request if the authentication terminal is registered as lost or stolen.

According to the present invention, the authentication mobile terminal does not store the user authentication information but acquires information necessary for authentication through the authentication smart medium separately owned by the user and the authentication terminal designated by the user, It is possible to prevent the outflow of the user authentication information.

In addition, since the user does not need to input the login password or the password of the certificate through the input device such as a keyboard, a touch pad, or the like when performing the user authentication, the user authentication information leakage caused by the input device driver hooking, The present invention has an effect that can be prevented.

In addition, the present invention does not require the user to memorize or manage the password and the certificate password by acquiring the information necessary for authentication through the smart medium for authentication owned by the user and the authentication terminal and performing the authentication procedure, The convenience of the user and security can be improved by relaying the user authentication request of the terminal to be authenticated to the mobile device.

1 is a diagram illustrating a network configuration of a user authentication system using a smart medium according to the present invention.
FIG. 2 is a conceptual diagram illustrating a configuration of a user authentication system using a smart medium according to the present invention.
FIG. 3 is a diagram illustrating a configuration of an authentication terminal having a local area wireless communication module according to the present invention.
4 is a flowchart illustrating a user registration method for user authentication in a user authentication system using a smart medium according to the present invention.
5 is a flowchart illustrating a method of registering a user in an authentication terminal of a user authentication system using short-range wireless communication according to the present invention.
6 is a flowchart illustrating a method of authenticating a user of a user authentication system using a smart medium according to the present invention.
7 is a flowchart illustrating a user authentication method in an authentication terminal of a user authentication system using a smart medium according to the present invention.
8 is a diagram illustrating an authentication key structure applied to hardware security applied to a user authentication system using a smart medium according to the present invention.

Hereinafter, a configuration and operation of a user authentication system using a smart medium according to the present invention will be described with reference to the accompanying drawings, and a user authentication method in the system will be described.

FIG. 1 is a diagram illustrating a network configuration of a user authentication system using a smart medium according to the present invention. FIG. 2 is a conceptual view of a configuration of a user authentication system using a smart medium according to the present invention, FIG. 2 is a diagram illustrating an authentication key structure applied to hardware security applied to a user authentication system using a smart medium according to an embodiment of the present invention;

1, 2 and 8, a user authentication system according to the present invention includes a service terminal unit 100, a user authentication server 220, and a service server 300, (Hereinafter referred to as "apps") are installed in the terminal for authentication for authentication purposes and the authentication relay gateway 210 transmits and receives data through a dedicated application.

The user terminal unit 100, the authentication relay gateway 210, the user authentication server 220, and the service server 300 are connected to each other through wired / wireless data communication network 110 to perform data communication.

The wired / wireless data communication network 110 is composed of an Internet network including a WiFi network and a wide area network (WAN), and a mobile communication network including a 3G network and a Long Term Evolution (LTE) network There is a network.

The user authentication server 220 may be configured in the same local network 230 as the authentication relay gateway 210 or may be connected through the wired / wireless data communication network 110.

Also, the user authentication server 220 may be connected to the service server 300 through the same local network, or may be connected through the wired / wireless data communication network 110 as shown in FIG.

The user terminal unit 100 includes an authentication terminal 10, a service terminal 20 and an authentication smart medium (or a "smart medium") 30. The service terminal 20 is connected to the service server 300 via the wired and wireless data communication network 110 and is connected to a hypertext transmission protocol (HTTP) or a secure socket layer (SSL) And the authentication terminal 10 is connected to the user authentication server 220 directly or through the authentication relay gateway 210 and performs data communication according to the Secure Socket Layer (SSL) protocol do.

The smart media 30 for authentication may be a medium such as an integrated circuit (IC) storage element storing unique smart medium identification information (TokenId) and a smart card having an RFID tag or the like. The smart medium identification information (TokenId) may be a card serial number (CSN) if the smart medium is a card.

The authentication relay gateway 210 relays data communication between the user authentication application and the user authentication server 220 that can be applied to the authentication terminal 10 according to the present invention. The authentication relay gateway 210 includes an application DB 211 for storing user authentication application information for identifying a user authentication application installed in the authentication terminals 10.

The user authentication server 220 includes a service subscription information DB 221 for storing service subscription information for users subscribed to the user authentication service according to the present invention, And a hardware security module (HSM) 222 that controls overall operation related to hardware security.

The HSM 222 generates and manages a ticket master key (Ticket_Master_key: TMK) for issuing service subscription information (Ticket) and a user master key (User_Master_Key: UMK) for authenticating a user, And a service authentication key, and stores and distributes the user distribution key to the user through the authentication terminal unit 10. The TMK is used as a master key for service subscription information generation and verification, and UMK is used as a master key for user authentication information verification. 8, the HSM 222 generates the TMK_S, which is the TMK for each service server, by applying the service identification information and the UMK by the HMAC (Hash MAC: or H) UMK_S, which is a star UMK, is generated.

The authentication terminal 10 includes a user authentication application module 220 that is activated by driving a user authentication application that performs data communication with the user authentication server 220 through the authentication relay gateway 210 and provides an interface with a user A short range wireless communication module 18 that performs short range wireless communication with the smart medium 30 to read the card information of the smart medium 30, Acquires the card information that has been read through the module 18 and the authentication terminal identification information of the authentication terminal, generates a service authentication key by using a security standard algorithm HMAC (Hash MAC: or "H"), The service subscription information, the service subscription information, and stores the smart media according to the present invention on the basis of the stored service subscription information. It comprises a security authentication module 13 that performs a general operation related to a user authentication method. The authentication terminal identification information (DID) may be an International Mobile Equipment Identity (IMEI) or a telephone number.

The configuration and operation of the authentication terminal will be described in more detail with reference to FIG.

FIG. 3 is a diagram illustrating a configuration of an authentication terminal having a local area wireless communication module according to the present invention.

The authentication terminal 10 includes a control unit 11, a storage unit 14, an input unit 15, a display unit 16, a wireless communication unit 17, and a short range wireless communication module 18.

The storage unit 14 includes a program storage area for storing a control program for controlling operations according to the present invention, a temporary area for temporarily storing data generated during the execution of the control program, and service registration information and service And a data area for storing user data such as subscription information and the like.

The input unit 15 includes at least one or more of a key input unit having a plurality of buttons for performing power supply and selection of functions, and a touch pad for providing coordinates of a touch point touched by the user, And provides various user interface (UI) to the user.

The wireless communication unit 17 is a communication device capable of performing data communication and voice communication by connecting to a wired / wireless data communication network 110. The wireless communication unit 17 includes a wireless data communication device capable of connecting to a Wi-Fi network and performing data communication, And a mobile communication device that connects to the network and performs data and voice communication.

The near field communication module (NFC) 18 reads the smart medium identification information (TokenId) from the integrated device (IC) and the smart medium 30 to which the RFID tag is attached and provides it to the control section 11.

The control unit 11 includes a user authentication application module 12 and an authentication processing security module 13 that are activated by driving a user authentication application (app) according to the present invention, as described with reference to FIG. 2, Controls overall operation related to authentication.

4 is a flowchart illustrating a user registration method for user authentication in a user authentication system using a smart medium according to the present invention. Hereinafter, a user registration method for performing user authentication using the smart medium of the present invention will be described with reference to FIG.

First, the user must access the service server 300 through the service terminal 20 and request service registration. At this time, the service server 300 will provide a service registration unit that can input User Identification (UID) and Device Identification (DID) information to the service terminal 20. Then, the user inputs the user identification information and the authentication terminal identification information through the service terminal 20 and provides it to the service server 300 (S411). In addition, the service server 300 or the user authentication server 220 may provide a means for registering authentication terminal identification information of a terminal that has been lost or stolen from users, Or the lost authentication terminal, when the service registration request and / or the service authentication request is generated, the service server 300 or the user authentication server 220 authenticates the lost or stolen authentication terminals The terminal identification information may be configured to compare the terminal identification information for registration with the authentication terminal identification information and to reject the service registration request if the authentication terminal is registered as lost or stolen.

The service server 300 receiving the UID and DID transmits a user registration request signal including its service identification information (Spid), UID and DID to the user authentication server 220 at step S413.

Upon receiving the user registration request signal, the user authentication server 220 transmits a user registration confirmation message including the Spid, UID, and DID to the authentication terminal 10 through the authentication relay gateway 210 in the form of a push message S415).

The user registration confirmation message may be transmitted to a Short Message Service (SMS) message or a MultiMedia Message (MMS) message. Then, the authentication terminal 10 receives the user registration confirmation message in the form of an SMS / MMS message and displays it on the display unit 16.

When the user registration confirmation message is received and displayed, the authentication processing security module 13 of the authentication terminal 10 generates and stores a service registration key, and displays it on the display unit 16 through the user authentication application module 12 (S417). The service registration key is a disposable secret key that is shared offline when subscribing for the service for the first time.

The service terminal 20 receives and displays the service registration key input means from the service server 300 after the service registration request (S411). At this time, when the user inputs the service registration key displayed on the display unit 16 of the authentication terminal 10 through the service terminal 20, the service terminal 20 provides the inputted service registration key to the service server 300 (S419).

The service server 300 receiving the service registration key generates a user authentication issue request signal including a Spid, a UID, a DID, and a service registration key and provides the user authentication issue request signal to the user authentication server 220 at step S421.

Then, the user authentication server 220 generates a user registration request signal including a Spid, a UID, a DID, a server random value (Random Server: R_S) randomly generated by the user and a key generation information (Server_Secret) And transmits the request signal to the authentication terminal 10 by encrypting the request signal with the service registration key included in the user authentication issue request signal (S423).

The user authentication issue request signal may also be encrypted and transmitted with the user registration key. However, in this case, the user authentication server 220 must receive the user registration key from the authentication terminal 10 because the user authentication server 220 must know the user registration key for releasing the encryption.

Upon receipt of the user registration request signal, the authentication terminal 10 cancels the encryption of the user registration request signal and transmits the smart medium identification information (TokenId) from the smart medium 30 for user authentication through the short- (S425).

When the smart medium identification information is read, the authentication terminal 10 reads the authentication terminal identification information (DID) and the key generation information (Server_Secret) included in the user registration request signal as shown in FIG. 8 and the following equation ) And generates the service authentication key by applying the read smart medium identification information to the HMAC (S427)

[Equation 1]

User_Secret (service authentication key) = HMAC (terminal identification information for authentication | smart medium identification information (TokenId), Server_Secret)

When the service authentication key is generated, the authentication terminal 10 generates and stores user registration information (S429), and then stores the service identification information (Spid), the user identification information (UID), and the server random value (Ramdom Server: R_S) And transmits the user registration response signal to the user authentication server 220 in step S431. The user registration response message includes the authentication terminal identification information (DID) and the smart medium identification information (TokenId). That is, the authentication terminal identification information and the smart medium identification information are not encrypted. The message authentication value is obtained by the following equation (2) as the MAC value of the user authentication information generated using the service authentication key.

&Quot; (2) "

ResSign =

HID (Spid | UID | DID | TokenId | R_C | R_S, User_secret

Upon receipt of the user registration response signal, the user authentication server 220 generates a service authentication key by DID, smart medium identification information, and Server_Secret (S433), decrypts the encrypted user registration response signal, (S435). If the verification is successful, a service ticket is generated (S437) and transmitted to the authentication terminal 10 (S439). The service subscription information includes a ticket body (Ticket_body) and MAC (MAC) information.

The ticket body includes a service subscription information identifier (TicketID), a Spid, a UID, a TokenId, a DID (IMEI), and a service validity period.

The Mac (MAC) is obtained by the following equation (3).

&Quot; (3) "

MAC = HMAC (Ticket_body, TMK_S)

TMK_S = HMAC (TicketId, TMK)

Here, TMK_S means TMK for each service subscriber.

Upon receiving the service subscription information, the authentication terminal 10 stores the verification result in the storage unit 14 and completes the registration (S441).

On the other hand, after transmitting the service subscription information to the authentication terminal 10, the service authentication server 220 transmits a service registration response signal to the service server 300 to notify that registration of the service is completed (S440). The service server 300 receives the service registration response signal from the service terminal 20 and informs the user that the service registration is completed (S443).

5 is a flowchart illustrating a method of registering a user in an authentication terminal of a user authentication system using short-distance wireless communication according to the present invention. Hereinafter, a user registration method in the authentication terminal will be described in detail with reference to FIG.

The control unit 11 of the authentication terminal 10 checks whether a user registration confirmation message is received from the user authentication server 220 (S511).

When the user registration confirmation message is received, the control unit 11 drives the user authentication application module 12 (S513), displays the user PIN input means on the display unit 16, and requests the input of the user PIN (S515). It is checked whether the user PIN is input (S517).

When the user PIN is input, the user authentication application module 12 provides the input PIN to the authentication processing security module 13, and the authentication processing security module 13, which receives the PIN, (S519). If they match, a service registration key is generated (S521), and the service registration key is provided to the user authentication application module 12. Then, the user authentication application module 12 displays the generated service registration key on the display unit 16 (S523).

After the display of the service registration key, the user authentication application module 12 checks whether a use registration request signal is received from the user authentication server 220 (S525) and outputs the signal to the authentication processing security module 13 when received.

Upon receipt of the use registration request signal, the authentication processing security module 13 decrypts the received use registration request signal with the service registration key stored in the storage unit 14 and stores the generated registration request signal in step S527. After the decryption, the service registration key is disposable, so it will be deleted or processed so as not to be used any more.

After decoding the use registration request signal, the authentication processing security module 13 drives the local communication module 18 (S529) and checks whether the smart medium identification information is read from the local communication module 18 (S531) .

When the smart medium identification information is read from the smart medium 30, the authentication processing module 13 generates a service authentication key according to Equation (1) (S533), generates service registration information including the service authentication key, And stores it in the unit 14 (S535).

When the service authentication key is generated, the authentication processing security module 13 generates a user registration response signal, encrypts the user registration response signal with the service authentication key (S537), and transmits the user registration response signal to the user authentication server 220 (S539) .

After the transmission of the user response signal, the authentication processing security module 13 checks whether the service subscriber information is received from the user authentication server 220 (S541). If the service subscription information is received, 14 (S543) and completes the user registration.

6 is a flowchart illustrating a method of authenticating a user of a user authentication system using a smart medium according to the present invention.

6, when the user accesses the service server 300 through the service terminal 20 and then inputs the user identification information (UID) to request the user to log in, the service terminal 20 transmits the user identification information (UID) To the service server 300 (S611).

The service server 300 transmits a user authentication request signal including service identification information (Spid) and user identification information (UID) to the user authentication server 220 when the user identification information is received from the service terminal 20 (S613 ).

Upon receiving the user authentication request signal, the user authentication server 220 refers to the service subscription information DB 221, loads the authentication terminal identification information (DID) and the service authentication key corresponding to the user identification information (UID) Generates a server random value R_S of the server random number R_S to generate a user authentication request signal including service identification information Spid, DID, UID and server random value R_S, encrypts the generated user authentication request signal with a service authentication key To the authentication terminal 10 (S615).

Upon receiving the user authentication request signal, the authentication terminal 10 loads the service ticket corresponding to the service identification information of the user authentication request signal, and transmits user identification information (UID), authentication terminal identification information (DID ), And the period of the service subscription information (S617).

If the verification is successful, the authentication terminal 10 drives the short-range wireless communication module 18 to read the smart medium identification information of the user authentication smart medium 30 (S619), read the smart medium identification information (TokenId) A user authentication response signal including the DID, the service subscription information, the server random value R_S, and the client random value R_C message authentication value ResSign is generated (S621) (S623).

When the user authentication response signal is received, the user authentication server 220 decrypts the message authentication value by using the service authentication key (S625), verifies the message authentication value based on the message authentication value (S629) And performs the subscription information verification (S629).

After the verification, the user authentication server 220 provides the user authentication result of the verification to the service server 300 (S631).

Upon receipt of the user authentication result, the service server 300 may permit the login of the user requesting the login through the service terminal 20 or notify the login failure according to the result.

7 is a flowchart illustrating a user authentication method in an authentication terminal of a user authentication system using a smart medium according to the present invention.

Referring to FIG. 7, the control unit 11 of the authentication terminal 10 checks whether a user authentication request signal is received (S711). The user authentication request signal may be received in the form of a push message.

When the user authentication request signal is received and the user touches the user authentication request signal, the controller 11 drives the user authentication application module 13 (S713).

When the application module 13 is activated, the user authentication application module 13 displays the user PIN input means on the display unit 16 to request input of the user PIN (S715), and the user PIN is input through the user PIN input means Is input (S717).

The user authentication application module 13 provides the user PIN to the authentication processing security module 13 and the authentication processing security module 13 registers the user PIN inputted from the user authentication application module 13 and the user PIN (Step S719). If the user PIN matches the user PIN, it is determined whether the user PIN matches the user PIN.

If the input PIN and the registration PIN are determined as a result of the determination, the authentication processing security module 13 decrypts and stores the user authentication request signal using the service authentication key of the service registration information for the service server 300 (S721 ).

After decrypting the user authentication request signal, the authentication processing security module 13 drives the short-range wireless communication module 18 and receives the smart medium identification information TokenId from the short-range wireless communication module 18 from the user- Is input (S725).

When the smart medium identification information is input, the authentication processing security module 13 decrypts and verifies the user authentication request signal (S721 is decrypted and verified by the service authentication key), generates a user authentication response signal, encrypts (S727), and then transmits it to the user authentication server 220 (S729).

While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. It will be easily understood. It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, it is intended to cover various modifications within the scope of the appended claims.

10: authentication terminal 121:
12: user authentication application module 13: authentication processing security module
14: storage unit 15: input unit
16: Display section 17: Wireless communication section
18: Local area communication module 20: Service terminal
30: Smart medium for authentication 100:
110: wired / wireless data communication network 200: user authentication server section
210: Authentication relay gateway 211: App DB
220: user authentication server 221: service subscription information DB
222: hardware security module (HSM) 300: service server

Claims (19)

A service server for transmitting a user authentication request signal including user identification information when a login request is made by user identification information, receiving a user authentication result in response to the user authentication request signal, and determining whether to log in;
A smart card reader for reading smart card identification information from the smart card to generate user authentication information, and a user authentication response signal including user authentication information, A terminal for authentication; And
Wherein the authentication server transmits the user authentication request signal to the authentication terminal upon receiving the user authentication request signal from the service server, And a user authentication server for verifying the user authentication response signal based on the stored service subscription information and providing the result to the service server when the user authentication response signal is received in response to the request User authentication system using media.
The method according to claim 1,
The service authentication server generates a service authentication key, encrypts the user authentication request signal with the generated service authentication key,
Wherein the authentication terminal generates the service authentication key using the smart media for authentication stored in advance and stores the user authentication request signal received from the service authentication server with the service authentication key. User authentication system using media.
3. The method of claim 2,
Wherein the service authentication key is generated by a Hash Message Authentication Code (HMAC) applying the authentication terminal identification information (Did), smart medium identification information (TokenId), and server security information (Server_Secret) User authentication system using media.
The method according to claim 1,
The authentication terminal stores a user's Personal Identification Number (PIN) set by the user,
Wherein the authentication unit requests the input of a user PIN when receiving the user authentication request signal and performs verification based on the service subscription information when the user PIN is matched with the set user PIN upon inputting the user PIN. .
The method according to claim 1,
Wherein the authentication terminal further includes a service subscription information and a message authentication value in the user authentication response signal,
Wherein the user authentication server transmits the user authentication result to the service server upon successful verification after performing forgery verification of the service subscription information and message authentication by the message authentication value.
The method according to claim 1,
The service server,
When a service registration request is received from the service terminal, a user authentication issuance request signal is transmitted to request a user registration,
The authentication terminal
Upon receiving the user registration request signal, reads the smart medium identification information for authentication from the smart medium for user authentication to generate user registration information including the authentication terminal identification information and the smart medium identification information for authentication, And if the service subscription information is received in response to the user registration response signal,
Upon receipt of the user authentication issuance request signal, the user authentication server generates the user registration request signal and transmits the signal to the authentication terminal. When the user registration response signal is received in response thereto, the service registration information is generated and stored And transmits the user authentication request to the authentication terminal to complete the user authentication registration.
The method according to claim 6,
The service server,
When a service registration request is generated from the service terminal, transmits a user registration confirmation message to the authentication terminal,
When the authentication terminal stores the user's personal identification information (PIN) preset by the user, requests input of the user PIN when receiving the user registration confirmation message, and inputs the user PIN from the user, The service registration key is generated, displayed and stored,
When the service server inputs the service registration key displayed on the authentication terminal from the service terminal of the user, the service server includes the service registration key in the user authentication issue request signal,
The user authentication server encrypts and transmits a user registration request signal with the service registration key,
Wherein the authentication terminal decrypts and processes the user registration request signal received with the stored service registration key.
8. The method of claim 7,
The user authentication server deletes the service registration key after encrypting the user registration request signal,
The authentication terminal deletes the service registration key after decoding the user registration request signal,
And the service registration key is used for a single use.
The method according to claim 6,
Wherein the authentication terminal further includes a message authentication value in the user registration response signal,
The user authentication server performs message verification based on the message authentication value, generates the service subscription information when the verification is successful, transmits the service subscription information to the authentication terminal, and transmits the user registration result to the service server after completion of user registration A user authentication system using smart media as a feature.
A user login request process for requesting user authentication by transmitting a user authentication request signal including user identification information when a service server generates a login request based on user identification information;
A user authentication requesting step in which the user authentication server sends a user authentication request signal to the authentication terminal upon receiving the user authentication request signal to request user authentication;
The terminal for authentication verifies the service subscription information stored in advance upon receipt of the user authentication request signal from the user authentication server, leads the smart medium identification information from the smart medium upon successful verification, generates user authentication information, A user authentication information providing step of transmitting a user authentication response signal including information;
Wherein the user authentication server verifies the user authentication response signal with the stored service subscription information when the user authentication response signal is received, and provides the authentication result to the service server,
And a login process of determining whether the service server receives the user authentication result and whether the user is logged in.
11. The method of claim 10,
The user authentication request process includes:
A service authentication key generation step in which the service authentication server generates a service authentication key;
An encryption step of encrypting the user authentication request signal with the generated service authentication key; And
And transmitting the encrypted user authentication request signal,
The user authentication information providing process includes:
A service authentication key generation step of generating the service authentication key according to service subscription information stored in advance in the terminal for authentication;
A decoding step of decoding a user authentication request signal received from the service authentication server with the service authentication key;
A verification step of comparing the decrypted user authentication request signal with a service subscription information stored in advance and verifying the decoded user authentication request signal;
Generating user authentication information by reading smart media identification information from the smart media upon successful verification; And
And a user authentication response step of generating and transmitting a user authentication response signal including the user authentication information.
12. The method of claim 11,
The service authentication key includes:
Wherein the authentication information is generated by a Hash Message Authentication Code (HMAC) using the authentication terminal identification information (Did), smart medium identification information (TokenId) and server security information (Server_Secret) Way.
12. The method of claim 11,
The user authentication information providing process includes:
Further comprising a pin validation step of requesting the user terminal to input a user PIN when the authentication terminal receives the user authentication request signal and determining whether the user PIN is identical to a predetermined user PIN upon inputting the user PIN,
And performing the service authentication key generation step when the pin verification is successful in the pin verification step.
14. The method according to claim 11 or 13,
The method further comprises transmitting a message authentication value to the user authentication response signal in the user authentication response step of the user authentication information providing process,
The authentication result providing process includes:
A service subscriber information verification step of verifying the user authentication response signal by the stored service subscription information when the user authentication server receives the user authentication response signal;
A message authentication step of performing message authentication based on the message authentication value when the user authentication server succeeds in verifying the service subscriber information; And
And providing an authentication result to the service server if the message authentication is successful.
12. The method of claim 11,
Upon receipt of the user issuance request signal from the service server, the user authentication server receives the user registration response signal including the authentication terminal identification information and the smart medium identification information from the authentication terminal, And registering the service subscription information and transmitting the service subscription information to the authentication terminal so that the authentication terminal stores and registers the service subscription information. .
16. The method of claim 15,
The user registration process includes:
A user authentication issue request step of requesting user registration by transmitting a user authentication issue request signal when the service server generates a service registration request from the service terminal;
A user registration request step of generating the user registration request signal when the user authentication server receives the user authentication issue request signal and transmitting the user registration request signal to the authentication terminal;
Wherein the authentication terminal reads the authentication smart medium identification information from the smart medium for user authentication upon receipt of the user registration request signal to generate user registration information including the authentication terminal identification information and the authentication smart medium identification information, A user registration response step of transmitting a user registration response signal including the user registration information to the user authentication server;
A service subscription information registration step of generating and storing the service subscription information when the user authentication server receives the user registration response signal and transmitting the service subscription information to the authentication terminal; And
And a service subscription information storing step of storing the service subscription information in response to the user registration response signal.
17. The method of claim 16,
The user registration process includes:
A user registration confirmation request step of transmitting a user registration confirmation message to the authentication terminal when the service server generates a service registration request from the service terminal;
When the authentication terminal stores the user's personal identification information (PIN) preset by the user, requests input of the user PIN when receiving the user registration confirmation message, and inputs the user PIN from the user, A service registration key generation step of generating, displaying and storing a service registration key,
Further comprising a service registration key input determination step of determining, by the service server, whether a service registration key displayed on the authentication terminal is input from the service terminal of the user,
If the service registration key is input, the service server transmits the service registration key in the user authentication issue request signal in the user authentication issue request step,
The user authentication server encrypts and transmits a user registration request signal with the service registration key in a user registration request step,
Wherein the authentication terminal decrypts and processes the user registration request signal received in the service registration key stored in the user registration response step.
17. The method of claim 16,
In the user registration response step,
A smart medium identification information acquisition step of reading smart medium identification information for authentication from a smart medium for user authentication upon receipt of a user registration request signal;
A user registration information generating step of generating user registration information including authentication terminal identification information and the authentication smart medium identification information;
A user registration response signal generation step of generating a user registration response signal including the user registration information;
An encryption step of encrypting the user registration response signal with the service authentication key generated by the user identification information and the server security information generated by the user authentication server; And
And a transmitting step of transmitting the encrypted user registration response signal to a user authentication server,
The service subscription information registration step includes:
When the user registration response signal is received, the user authentication server generates a service authentication key for generating a service authentication key identical to the service authentication key according to the user identification information acquired at the service registration request and the server security information generated by the user authentication server Generating step;
A decoding step of decoding the encrypted user registration response signal with the generated service authentication key; And
A service registration step of generating and registering service subscription information from the decoded user registration response signal, and then transmitting the subscription information to the authentication terminal.
18. The method of claim 17,
When the service registration request and the service authentication request are generated in at least one of the user registration confirmation request step and the user authentication request step, the authentication server identification information for the authentication terminals registered as lost or stolen by the user authentication server, Further comprising a lost / stolen terminal notifying step of comparing the requested authentication terminal identification information and rejecting a service registration request if the authentication terminal is registered as lost or stolen.

Images