KR101001400B1 - Online mutual authentication method and system thereof - Google Patents

Abstract

The present invention relates to an online mutual authentication method and a system thereof.

In the online mutual authentication method according to the present invention, when a user terminal connected to an authentication device attempts to log in to a service providing server, the service providing server performs a first step of performing login authentication through an authentication server, and the login authentication is completed. Thereafter, when the user terminal requests a transaction from the service providing server, a second process of confirming the access of the authentication apparatus in the authentication server and generating an authentication serial number for transaction authentication, and the authentication server performs the authentication serial. A third process of sending the number and the transaction details to the authentication apparatus, displaying the transaction contents after confirming that the authentication serial number is not reused in the authentication apparatus, and for the transaction contents from the user in the authentication apparatus. Upon receiving an input of a decision to approve or reject, the service providing server executes the transaction according to the decision. It characterized in that it comprises a fourth step of rows or rejected.

As described above, the present invention can prevent fraud, such as phishing, there is an effect that enables more secure online financial transactions.

Phishing, Security, Mutual Authentication, Authentication, Hacking

Description

Online mutual authentication method and system

The present invention relates to an online mutual authentication method and a system thereof, and more particularly, to display a login or transaction information on a mobile terminal having an authentication device or an authentication chip connected to a user terminal, when the user approves authentication. The present invention relates to an online mutual authentication method and system that is secured from hacking and phishing by enabling login or transaction through a terminal.

With the recent development of the Internet infrastructure and financial transaction infrastructure, user authentication has become very important for website access and financial transactions.

In particular, phishing, or domains of legally owned users, which have recently been disguised or linked with e-mails sent from websites such as financial institutions to extract individual authentication numbers, credit card numbers, and account information. Keystroke information entered from a user's keyboard, etc. to steal or mislead users into misleading domain names (DNS) names, to steal personal information such as personal IDs, passwords, account information, etc. For example, keyboard hacking for hacking personal IDs, passwords, account information, etc. has become a problem, resulting in a more secure and efficient user authentication problem.

Conventional authentication methods include password authentication, public certificate authentication, security card authentication, OTP (one time password) authentication and security token authentication.

Password authentication is the simplest and most basic method of authentication, but very vulnerable to hacking and phishing. In addition, since a plurality of authentication information (for example, ID and password, etc.) required for login or financial transaction does not exist in general, when a user is leaked to another person through hacking or the like, the user has to bear the damage.

The public certificate authentication is a method of mutual authentication by exchanging certificates signed by a higher authority by a bank and a user through a public key infrastructure (PKI) authentication system.

Security card authentication is a method that asks for a verification number at the time of transaction using a security card printed with authentication numbers for several dozen serial numbers and inputs the corresponding verification number to increase the number of cases. Sometimes a combination is used.

OTP authentication stores one of the public / private pairs in a physically independent OTP device, and for each authentication, the authentication serial number changes continuously according to the current time, and encrypts a hash value of the content that can be verified by the certification authority. If the password is displayed, the user enters this number to authenticate.

Secure Token authentication is an extension of a public certificate. Instead of storing / processing an unencrypted certificate on an unsecured user's computer, secure token is stored on a secure token device and connected via USB to generate and authenticate a one-time key.

Among the security methods described above, the most widely used method in the current financial authentication system is a method of authenticating by using a certificate and a security card. However, this method is not only the case of physically stolen an accredited certificate or security card, but also the case that only the authentication information is stolen without being physically stolen. Authentication security at the site was difficult.

In addition, since OTP and security token authentication are stolen only when they are physically stolen, the information is stolen immediately, so it is somewhat safer to be stolen than authorized certificates or security cards. Authentication security was a difficult problem.

As such, the conventional authentication method has no method for authenticating the server currently used by the user, and is a one-way authentication method for authenticating the user on the server, thereby preventing the fraud such as 'phishing'. There is this.

The present invention has been made to solve the above problems, an object of the present invention is only when the authentication request message for the login or transaction content transmitted to the authentication device or mobile terminal connected to the user terminal is approved by the user By signing in or doing a transaction, you can help prevent fraud such as phishing.

As described above, in the online mutual authentication method according to the present invention, when a user terminal connected to an authentication apparatus attempts to log in to a service providing server, the service providing server performs a first step of performing login authentication through an authentication server; After the authentication is completed, when the user terminal requests a transaction from the service providing server, the authentication server checks the access of the authentication device and generates an authentication serial number for transaction authentication; A third process of sending the authentication serial number and transaction details to the authentication apparatus, displaying the transaction contents after confirming that the authentication serial number is not reused in the authentication apparatus, and performing the transaction from the user in the authentication apparatus. Upon receiving a decision to approve or reject the content, the service providing server may And a fourth process of executing or rejecting an existing transaction.

In addition, the on-line mutual authentication system according to the present invention is connected to the user terminal, the authentication device to determine whether the authentication serial number is valid, and if it is just the authentication device for receiving an approval or rejection decision from the user by displaying an authentication request message for the login or transaction details And a service providing server for providing a login or transaction service to the user according to the approval or rejection decision, and searching for an authentication device for the user when receiving a login or transaction content authentication request from the service providing server. Characterized in that the authentication server for transmitting to the authentication device to generate.

In addition, the on-line mutual authentication system according to the present invention includes a communication unit for performing wired and wireless communication with a user terminal and an authentication server, an ID, a user password, an access serial number generated every time of connection, and an authentication serial number generated for every authentication request. A storage unit for storing the; and a display unit for displaying a request message for login or transaction contents authentication; and determining whether the connection serial number and the authentication serial number are valid, and determining the connection serial number, the authentication serial number, and the user's. And an authentication device including a control unit for signing and encrypting a decision about login or transaction details authentication, and performing decryption on the connection serial number and the authentication serial number received from the authentication server.

As described above, the present invention can prevent fraud such as phishing, and thus has the effect of enabling more secure online financial transactions.

Hereinafter, an online mutual authentication method and a system thereof according to the present invention will be described in detail with reference to FIGS. 1 to 7.

1 is a block diagram of an online mutual authentication system according to an embodiment of the present invention.

Online mutual authentication system according to an embodiment of the present invention includes a user terminal 100, the authentication device 200, the authentication server 300 and the bank server 400.

The user terminal 100 includes a user PC and the like, and the authentication device 200 is directly connected through a USB module or the like or performs Bluetooth wireless communication with the authentication device 200. In addition, the user terminal 100 is responsible for the communication between the authentication device 200 and the authentication server 300 and serves as a relay for transmitting and receiving packets between the two. In addition, the user terminal 100 may be equipped with a USB disk module (not shown) and may automate the software installation required for communication with the authentication device 200 by using a USB disk module (not shown), and is connected to the authentication server 300. This allows for automatic updating of software and standardization of protocols for use without additional software installation.

The authentication device 200 is portable and connected to the user terminal 100 via USB or Bluetooth, and any connection method capable of providing a data transmission pipe is possible. To this end, the authentication device 200 includes a display unit 210, a control unit 220, a communication unit 230, a storage unit 240, a keypad 250, and an approval / deny button 260.

The display unit 210 displays a login authentication request message or a transaction content authentication request message.

The controller 220 signs the certificate, the access serial number, the authentication serial number, the user's approval / deny decision, etc. with the private key of the authentication apparatus 200 and encrypts it with the public key of the authentication server 300 to the authentication server 300. And, when receiving the authentication serial number from the authentication server 300 decrypts with the secret key of the authentication device 200 and confirms the signature with the public key of the authentication device 200. At this time, since the connection serial number and the authentication serial number are integers of a sufficiently large range to increase monotonously, the serial number received by counting the connection serial number or authentication serial number from the control unit 220 without storing the connection serial number or the authentication serial number. If is not already counted number may be determined as a valid access serial number or authentication serial number.

In addition, the control unit 220 receives the certificate of the authentication server 300 from the authentication server 300 when the connection request to the authentication server 300 and generates a connection serial number.

In addition, when the controller 220 receives the authentication serial number from the authentication server 300, the controller 220 compares the authentication serial number with the received authentication serial number stored in the storage unit 240 every time when authentication, and if there is no matching number. It is judged as a legitimate authentication request, and if there is a matching number, it is judged as an unjust request such as reuse.

Here, the connection serial number is a number assigned by the authentication device 200 whenever the authentication device 200 is connected to the authentication server 300, and the authentication serial number is the authentication device 200 to the authentication server 300. As a number generated by the authentication server 200 each time a request for authentication is made, it is preferable that the connection serial number and the authentication serial number be given using a large enough integer that monotonically increases. On the other hand, the present invention describes a case where the connection serial number is given by the authentication apparatus 200, but may be given and stored by the authentication server (300).

That is, the control unit 220 signs and encrypts with the public key when the login or transaction contents are authenticated, and the encrypted contents by the illegal intruders such as hackers are intercepted and then retransmitted and reused. Encrypt and include the authentication serial number in the login or transaction details, so that even if retransmitted, if the authentication serial number is already used, it can be judged as an invalid authentication request.

In addition, when the user password is input through the user terminal 100 or the keypad 250, the controller 220 compares the user password previously stored in the storage 240 to perform user authentication.

The communication unit 230 includes a usb module or a Bluetooth communication module for wired and wireless communication with the user terminal 100 and the authentication server 300.

The storage unit 240 stores an authentication device ID, a user password, a connection serial number and an authentication serial number, and a mutual authentication result with the authentication server 300.

The keypad 250 is for receiving a password from the user so that others cannot use it when the authentication apparatus 200 is lost or stolen. However, the authentication apparatus 200 may receive a password from the user through the user terminal 100, and the keypad 250 may be omitted when the user inputs the password through the user terminal 100.

The approval / deny button 260 receives an approval or rejection decision from the user when a message for approval or rejection of the login authentication request or the transaction authentication request is displayed on the display unit 210.

The authentication apparatus 200 having the above configuration is portable and not easy to duplicate, and the user can physically secure the security and can intuitively recognize the compromise of the security.

On the other hand, the authentication server 300 performs mutual authentication with the authentication device 200, and receives a login authentication request or transaction content authentication request from the bank server 400, generates an authentication serial number, and with the certificate or transaction content itself After signing with the secret key of the encryption device and the public key of the authentication device 200, the encryption device 200 is transmitted, and the encrypted connection serial number, authentication serial number, certificate or transaction details using their private key, The signature is verified with the public key of the authentication apparatus 200. In addition, the authentication server 300 stores the authentication device information for each authentication device ID, and checks whether the authentication device corresponding to the authentication device ID is connected when the authentication request is made.

The bank server 400 provides a bank site for transactions such as transfers, and executes a login or transaction when the user's approval is reached from the authentication apparatus 200 and the authentication server 300.

Hereinafter, an online mutual authentication method according to an embodiment of the present invention will be described in detail with reference to FIGS. 2 to 4. In this case, the authentication apparatus 200 is connected to the user terminal 100 in FIGS. 2 to 4 to communicate with the authentication server 300 and the bank server 400 through the user terminal 100.

First, when the authentication apparatus 200 is connected to the user terminal 100 (S101), the authentication apparatus 200 receives a user password from the user through the user terminal 100 and performs user authentication (S102). 2 illustrates an example of receiving a user password through the user terminal 100, but may also receive a user password through the keypad 250.

When the user authentication is completed, the authentication device 200 performs mutual authentication with the authentication server 300 by using a certificate, an authentication device ID and a connection serial number (S103). The authentication method for the processes S102 to S103 will be described in more detail later with reference to FIG. 3.

Then, when the user terminal 100 attempts to log in by accessing the bank server 400 (S104), the bank server 400 performs login authentication through the authentication server 300 and the authentication device 200. (S105), the specific method will be described later with reference to FIG. However, login authentication may be performed using only security methods such as a general public certificate and OTP.

After the login authentication is completed, when the user terminal 100 accesses the site of the bank server 400, inputs transaction details such as a transfer, and requests transaction execution (S106), the bank server 400 authenticates the server. Request the transaction details authentication for the 300 (S107).

Accordingly, the authentication server 300 checks whether the authentication device corresponding to the authentication device ID is connected and generates an authentication serial number (S108), and transmits the authentication serial number and transaction contents to the authentication device 200 (S109). . At this time, the authentication server 300 signs the authentication serial number and the transaction details with the secret key of the authentication server 300, encrypts the public key of the authentication apparatus 200, and transmits them. Transactions also include all online transactions such as bank transfers, wire transfers and e-commerce payments.

Thereafter, the authentication apparatus 200 decrypts the received authentication serial number and the transaction details and confirms the transaction information if the authentication serial number is not reused (S110). At this time, the authentication apparatus 200 compares the serial number received from the authentication server 300 and the authentication serial number stored at each time of authentication, and determines that it is a legitimate authentication request, not reuse, if there is no matching number. At this time, since the authentication serial number is an integer of a large enough range to increase monotonically, if the serial number received by counting the authentication serial number from the controller 220 without storing the authentication serial number is not already a counted number, a valid authentication serial number. You can also judge.

Therefore, when a decision of approval or rejection is input for the corresponding transaction content from the user (S111), the decision content of the user, that is, the decision on the approval or rejection of the transaction content and the authentication serial number are used as the secret key of the authentication apparatus 200. Signed and encrypted by the public key of the authentication server 300 and transmitted (S112).

The authentication server 300 decrypts the authentication serial number and the user's decision with its private key, verifies the signature with the public key of the authentication apparatus 200, and then notifies the bank server 400 of the user's decision (S113). .

Accordingly, the bank server 400 executes the transaction when the user approves the transaction from the decision of the user, and stops the execution of the transaction (S114).

Hereinafter, referring to FIG. 3, an authentication method between the authentication device 200 and the user terminal 100 and the authentication method between the authentication device 200 and the authentication server 300 of FIG. 2 will be described in detail.

First, when the authentication apparatus 200 requests user authentication for the user terminal 100 (S201), the user terminal 100 transmits the user password to the authentication apparatus 200 (S202). Thus, the authentication apparatus 200 compares the password set in advance and the input password and performs a user authentication (S203). At this time, the user may directly receive a user password through the keypad 250 of the authentication device 200 to perform user authentication, and the processes of S201 to S203 may prevent others from using the authentication device 200 arbitrarily. It is a process for.

After that, when the user authentication is completed, the authentication apparatus 200 requests a connection to the authentication server 300 having a fixed DNS address (S204). At this time, the authentication apparatus 200 requests the initialization by sending an initialization packet to the authentication server (300).

Accordingly, the authentication server 300 transmits its own certificate to the authentication device 200 (S205), the authentication device 200 confirms the certificate of the authentication server 300 as a certificate of the upper certification authority, and then the connection serial number To generate (S206).

Thereafter, the authentication device 200 signs the authentication device ID, the connection serial number, and the certificate of the authentication device 200 with the private key of the authentication device 200 and encrypts it with the public key of the authentication server 300. Transfer to (S207). Here, the connection serial number is a number assigned every time the authentication device 200 is connected to the authentication server 300, and is stored in the authentication device 200 to be connection information of the authentication device 200 to the authentication server 300.

Thereafter, the authentication server 300 receives, confirms and stores the certificate and the access serial number of the encrypted authentication device 200 (S208).

Subsequently, the authentication server 300 signs the authentication device ID and the connection serial number again with the private key of the authentication server 300, and then encrypts them with the public key of the authentication device 200 (S209). By transmitting the serial number to the authentication device 200 (S210), the authentication device 200 and the authentication server 300 is connected. Thus, the authentication device 200 transmits a connection confirmation message to the authentication server 300 (S211).

As described above, the present invention, the authentication device 200 and the authentication server 300 exchanges each other's certificates, checks each other's public keys included in the certificate, and signs and encrypts the connection serial number and the authentication device ID. By receiving it, mutual authentication is performed. That is, the mutual authentication process of FIG. 2 is performed by transmitting and receiving a unique message (connection serial number) between the authentication apparatus 200 and the authentication server 300 at least once each other.

Hereinafter, a method of performing login authentication of FIG. 2 will be described in detail with reference to FIG. 4.

First, the user terminal 100 requests a login for the bank server 400 (S301). In this case, the user terminal 100 transmits the authentication device ID to the bank server 400.

Thereafter, the bank server 400 requests login authentication to the authentication server 300 (S302), and the authentication server 300 generates an authentication serial number after checking whether the authentication device corresponding to the authentication device ID is connected ( S303).

Subsequently, the authentication server 300 signs the generated authentication serial number and the login authentication request with the secret key of the authentication server 300, encrypts the public key of the authentication device 200, and transmits the encrypted authentication serial number to the authentication device 200 (S304). ).

Thereafter, the authentication apparatus 200 decrypts the received authentication serial number to confirm the signature (S305), display a login message (S306), and receive a login authentication approval / rejection determination from the user (S307).

 When the authentication device 200 receives a decision to approve / deny the login authentication from the user, the authentication serial number is signed with the secret key of the authentication device 200 together with the user decision contents, and then encrypted with the public key of the authentication server 300. The authentication server 300 is transmitted (S308).

Accordingly, the authentication server 300 transmits the user decision contents for the login authentication to the bank server 400 (S309), and the bank server 400 executes the login approval or rejection according to the user decision contents (S310).

Thereafter, the bank server 400 transmits the login authentication result to the user terminal 100, and the user terminal 100 displays the result so that the user can check it (S312).

2 and 4 illustrate an example of including only an authentication serial number in a login content or a transaction content, but may include an authentication serial number and a connection serial number.

On the other hand, Figure 5 is a block diagram of an online mutual authentication system according to another embodiment of the present invention.

Online mutual authentication system according to another embodiment of the present invention includes a user terminal 500, a mobile terminal 600 including the authentication chip 610, the authentication server 700 and the bank server 800.

The mobile terminal 600 includes a mobile phone, a PDA, a WiBro phone, a mobile terminal, a terminal capable of a telephone call or a multimedia service through a circuit switched network (CSN) and a packet switched network (PSN). Include.

The mobile terminal 600 includes an authentication chip 610, and since the authentication chip 610 is the same as the detailed configuration of the authentication apparatus 200 of FIG. 1, a detailed description thereof will be omitted. However, the mobile terminal 600 does not need to include a separate display unit and an approval / gerber button, a communication unit, a storage unit, and a keypad, and may use the configuration mounted on the existing mobile terminal as it is, and the control unit of the authentication apparatus 200. Just add 220.

In addition, since the authentication server 700 and the bank server 800 performs the same functions as the authentication server 300 and the bank server 400 of FIG. 1, a detailed description thereof will be omitted. However, the authentication server 700 stores the mobile terminal 600 information for each user ID.

Hereinafter, a login authentication method according to another embodiment of the present invention will be described in detail with reference to FIG. 6.

First, the user terminal 500 attempts to log in to the user ID with respect to the bank server 800 (S401).

Accordingly, the bank server 800 requests login authentication for the authentication server 700 (S402), and the authentication server 700 registers the mobile terminal 600 including the authentication chip 610 for the user ID. It is searched whether it is (S403).

When the search result of the process S403, the mobile terminal 600 is registered, the authentication server 700 generates the authentication serial number for the login authentication request (S404), the login authentication request message and the authentication serial number to the authentication server After signing with the secret key of 700, the key is encrypted with the public key of the authentication chip 610, and then transmitted to the mobile terminal 600 through the wireless network (S405). Here, the authentication server 700 stores the mobile terminal 600 information for each user ID, so that the mobile terminal 600 does not need to generate a separate connection serial number, and the mobile terminal 600 and the authentication server 700. ) Mutual authentication process can be omitted.

Accordingly, the mobile terminal 600 decrypts the received authentication serial number to verify the signature (S406), receives the login authentication chip password (S407), and displays the login authentication request message when the authentication chip password is input (S408). ) The user receives an approval / deny decision (S409).

Thereafter, the mobile terminal 600 signs the decision and the authentication serial number of the user with the secret key of the authentication chip 610 and encrypts it with the public key of the authentication server 700 and transmits the result to the authentication server 700 through the wireless network. In operation S410, the authentication server 700 notifies the bank server 800 of whether to approve the login according to the user's decision (S411), and the bank server 800 executes or rejects the login according to the approval (S412). .

Subsequently, the bank server 800 notifies the user terminal 500 of the login execution or rejection result (S413), and the user terminal 500 displays the login execution or rejection result so that the user can check it (S414).

Hereinafter, with reference to Figure 7, the transaction details authentication method according to another embodiment of the present invention will be described in detail.

First, the user terminal 500 transmits the transaction contents received from the user to the bank server 800 and requests for transaction execution (S501).

Accordingly, the bank server 800 requests the transaction details authentication for the authentication server 700 (S502), the authentication server 700 determines whether the mobile terminal that contains the authentication authentication chip for the user ID is registered. (S503), if registered, generates and stores the authentication serial number (S504).

Thereafter, the authentication server 700 signs the transaction contents authentication request message and the authentication serial number by using the secret key of the authentication server 700, and then encrypts them with the public key of the authentication chip 610 to transmit the mobile terminal through a wireless communication network ( 600) (S505).

Accordingly, the mobile terminal 600 decrypts the authentication serial number to confirm the signature (S506), receives the authentication chip password from the user (S507), and displays a transaction content authentication request message (S508) to authenticate the transaction content from the user. Receive a decision to approve or reject for (S509).

After that, the mobile terminal 600 signs the decision and the authentication serial number of the user with the secret key of the authentication chip 610, encrypts it with the public key of the authentication server 700, and transmits it to the authentication server 700 through the wireless communication network. At step S510, the authentication server 700 notifies the bank server 800 of the approval (S510).

Accordingly, the bank server 800 executes or rejects the transaction according to the approval (S512), and notifies the user terminal 500 of the transaction result (S513). Thereafter, the user terminal 500 displays the transaction result so that the user can check it (S514).

As described above, the present invention can prevent phishing and the like by authenticating the user's login or transaction content using the portable authentication device 200.

The present invention takes a bank transaction from the bank server 400 as an example, but applies to all online transactions such as electronic commerce on-line.

1 is a block diagram of an online mutual authentication system according to an embodiment of the present invention.

2 is a flowchart illustrating a transaction content authentication method through online mutual authentication according to an embodiment of the present invention.

FIG. 3 is a flow chart illustrating in detail the authentication between the authentication device and the user terminal of FIG. 2 and the authentication method between the authentication device and the authentication server.

4 is a flowchart specifically illustrating a method of performing login authentication for a bank site of FIG. 2.

5 is a block diagram of an online mutual authentication system according to another embodiment of the present invention.

6 is a flowchart illustrating a login authentication method according to another embodiment of the present invention.

7 is a flow chart showing a transaction content authentication method according to another embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

100, 500: user terminal 200: authentication device

300, 700: authentication server 400, 800: bank server

210: display unit 220: control unit

230: communication unit 240: storage unit

250: keypad 260: OK / deny button

Claims (22)

A first step of performing a login authentication through an authentication server when a user terminal connected to an authentication device attempts to log in to a service providing server; After the login authentication is completed, when the user terminal requests a transaction from the service providing server, a second process of confirming access of the authentication apparatus in the authentication server and generating an authentication serial number for transaction authentication; A third step of sending, by the authentication server, the authentication serial number and transaction details to the authentication apparatus and confirming that the authentication serial number is a valid number by the authentication apparatus and displaying the transaction contents; And If the authentication device receives a decision to approve or reject the transaction content from the user, the service providing server includes a fourth step of executing or rejecting the transaction in accordance with the determination, Before the first process, the authentication device and the authentication server perform mutual authentication through a connection serial number generated when the authentication device requests a connection to the authentication server. Online mutual authentication method. According to claim 1, Before mutual authentication between the authentication device and the authentication server, On-line mutual authentication method further comprising the step of performing a user authentication for the authentication device. The method of claim 2, wherein the performing of the user authentication comprises: Online authentication method, characterized in that the authentication device receives a user password through the keypad provided in the user terminal or the authentication device, compared to the previously stored password. delete The method of claim 1, wherein the mutual authentication process between the authentication device and the authentication server is When the authentication device requests access to the authentication server, the authentication server transmitting its certificate to the authentication device; Checking the certificate received by the authentication device and generating a connection serial number of the authentication device; Signing, by the authentication apparatus, the ID and the access serial number of the authentication apparatus and encrypting the ID and the connection serial number together with a certificate of the authentication apparatus; Checking and storing the certificate and the access serial number of the authentication device in the authentication server, and transmitting the signed and encrypted authentication device ID and access serial number to the authentication device again; And And the authentication device transmits a connection confirmation message to the authentication server. The method of claim 1, wherein the first process comprises: Step 1-1, when the user terminal requests login to the service providing server, the service providing server requests login authentication to the authentication server; The authentication server checks whether the corresponding authentication device is connected, and generates an authentication serial number and transmits the authentication serial number and the login authentication request to the authentication device; The authentication apparatus checks whether the authentication serial number is valid and displays a login authentication message to receive an approval or rejection decision for the login authentication message from the user; And And the authentication apparatus includes a first step of transmitting the determination along with the authentication serial number to the service providing server, and performing login approval or rejection according to the determination at the service providing server. Mutual authentication method. The method of claim 6, The first step 1-1 The user terminal transmits the authentication device ID to the service providing server at the login request, The first step 1-2 And the authentication server checks whether the authentication device corresponding to the authentication device ID is connected. The method of claim 6, wherein the first step 1-3 is And comparing the authentication serial number stored at each authentication by the authentication apparatus with the authentication serial number received from the authentication server, and determining that the authentication is a legitimate authentication request. The method of claim 1, The authentication device is an online mutual authentication method characterized in that the communication with the user terminal equipped with a Bluetooth or USB module. delete When the user terminal attempts to log in to the service providing server, the service providing server performing a login authentication through an authentication server; After the login authentication is completed, when the user terminal requests a transaction from the service providing server, the authentication server searches whether the mobile terminal corresponding to the user ID of the user terminal is registered, and if so, the transaction authentication is performed. A second process of generating an authentication serial number for the service; A third step of sending, by the authentication server, the authentication serial number and transaction details to the mobile terminal, confirming that the authentication serial number is a valid number in the mobile terminal, and displaying the transaction contents; And If the mobile terminal receives a decision to approve or reject the transaction content from the user, the service providing server comprises a fourth step of executing or rejecting the transaction in accordance with the determination; Online mutual authentication method. An authentication device connected to the user terminal to determine whether the authentication serial number is legitimate and, if legitimate, display an authentication request message for a login or transaction content and receive an approval or rejection decision from the user; A service providing server providing a user with a login or transaction service according to the approval or rejection decision; And When receiving the login or transaction content authentication request from the service providing server includes an authentication server for searching the authentication device for the user to generate the authentication serial number and transmit to the authentication device, And the authentication apparatus and the authentication server perform mutual authentication through a connection serial number generated when the authentication apparatus requests a connection to the authentication server. The method of claim 12, wherein the authentication device A communication unit for performing wired or wireless communication with the user terminal and the authentication server; A storage unit for storing an ID of the authentication device, a user password, and an authentication serial number received from the authentication server each time authentication is performed; A display unit displaying a request message for the login or transaction contents authentication; And When the authentication serial number is received from the authentication server, it is compared with the authentication serial number stored in the storage unit to determine whether the received authentication serial number is justified, and when the user password is input, the user is compared with the user password stored in the storage unit. On-line mutual authentication system comprising a control unit for performing the authentication. The method of claim 13, The communication unit is an online mutual authentication system, characterized in that to mount a Bluetooth module or a USB module. An authentication device for determining whether the authentication serial number is valid and receiving an approval or rejection decision from the user by displaying an authentication request message for login or transaction contents if the authentication serial number is justified; A service providing server providing a user with a login or transaction service according to the approval or rejection decision; And When receiving the login or transaction content authentication request from the service providing server includes an authentication server for searching the authentication device for the user to generate the authentication serial number and transmit to the authentication device, If the authentication device is a mobile terminal, When the user terminal requests login authentication or transaction with the service providing server, the authentication server searches whether the mobile terminal corresponding to the user ID of the user terminal is registered, and generates the authentication serial number if registered. Online mutual authentication system. The method of claim 13, wherein the authentication device, An approval / deny button for receiving an approval or rejection decision from a user with respect to the request message for login or transaction content authentication; And On-line mutual authentication system further comprises a keypad for receiving the user password. delete Communication unit for performing wired and wireless communication with the user terminal and the authentication server; A storage unit for storing an ID of the authentication apparatus, a user password, a connection serial number generated at every connection, and an authentication serial number generated at every authentication request; A display unit for displaying a request message for login or transaction contents authentication; And It is determined whether the connection serial number and the authentication serial number are valid, and the signature and encryption of the connection serial number, the authentication serial number, and the decision on the user's login or transaction contents authentication are received, and the received from the authentication server. On-line mutual authentication system comprising an authentication device including a control for performing the decryption of the serial number and the authentication serial number. The method of claim 18, wherein the control unit, And receiving a user password and performing user authentication by comparing with a user password stored in the storage unit. The method of claim 18, wherein the authentication device, An approval / deny button for receiving an approval or rejection decision from a user with respect to the request message for login or transaction content authentication; And On-line mutual authentication system further comprises a keypad for receiving the user password. The method of claim 18, The communication unit is an online mutual authentication system, characterized in that to mount a Bluetooth module or a USB module. The method of claim 18, The authentication device is an online mutual authentication system, characterized in that the mobile terminal of the user.

Images