KR101063523B1 - User authentication method using a user authentication password consisting of two or more characters - Google Patents

Abstract

The present invention relates to a user authentication method using a user authentication password consisting of two or more characters, and more particularly, (1) a session key set to a user by randomly arranging a one-time session key set and password characters corresponding to the session key set. Indirectly delivering; (2) randomly arranging a symbol set to be used for indirectly inputting a user authentication password and password characters corresponding to the symbol set to the user; (3) receiving the specific character from the user by matching the specific character from the password characters with a specific session key in the session key set; And (4) performing user authentication by checking whether the specific character received matches the user authentication password of the user, wherein in step (1), the specific session key is determined in advance, The determined specific session key is matched with the first authentication character of the user authentication password of the user, characterized in that for providing the user, a user authentication method using a user authentication password consisting of two or more characters.

According to a user authentication method using a user authentication password composed of two or more characters of the present invention, the user authentication system arbitrarily determines a session key and provides the user with the session key, thereby exposing the session key to the outside according to a user's preference or habit. Can be effectively prevented. In addition, by combining the configuration in which the user authentication system arbitrarily determines the session key and provides the user with a configuration that allows the user to input password subsets containing password characters instead of password characters, You can respond more effectively to attacks such as sneak attacks.

User authentication method, user authentication password consisting of two or more characters, session key

Description

A user authentication method using a user authentication password consisting of two or more characters {A USER AUTHENTICATION METHOD USING PASSWORDS WITH MORE THAN ONE CHARACTER}

The present invention relates to a user authentication method, and more particularly to a user authentication method using a user authentication password consisting of two or more characters.

In the modern society where information and communication technology is developed, personal identification number (PIN) and password are used to manage access to devices such as computers, KIOSK terminals, ATMs, and mobile terminals while protecting personal information. I use a lot of user authentication methods. In this method, a password or a personal identification number (user authentication number) stored in a device such as a computer is compared with a value input by a user to determine whether it is matched and then to determine whether to allow access.

Personal identification numbers (user authentication numbers) are usually made up of four digits. Numbers in the range of 0000 to 9999 are available and have 10000 cases. Depending on the device, consecutive numbers such as 1111 or numbers associated with personal information may be restricted when used as a personal identification number (user authentication number), so the number of cases may be less than 10,000. The user authentication method using such a personal identification number (user authentication number) can gain access to the device if the personal identification number (user authentication number) is known, otherwise access rights can not be obtained. There is no ambiguity about it. In addition, since authentication is attempted through the terminal depending on the memory of the user without the need for additional devices, no additional cost is required, so there is no need to consider additional management or maintenance costs.

However, this method has a safety problem because the attacker can easily find out the personal identification number by simply peeping over the shoulder as soon as the user enters the personal identification number (user authentication number). In order to solve this problem, the personal identification number (user authentication number) is indirectly generated by matching with a symbol or number (hereinafter referred to as a 'session key') that only the user knows, without directly entering the personal identification number (user authentication number). A method of input has been proposed. However, the existing user authentication system using the session key has a problem in that the session key is determined directly by the user, so that the session key is fixed by the user's preferences or habits and is easily exposed to an attacker. In particular, when an attacker records with a small camcorder or the like, moreover, if a user has recorded several times for the same user, exposure of the user authentication number due to the exposure of the session key becomes a bigger problem.

The present invention is proposed to solve the above problems of the existing methods, the user authentication system arbitrarily determines the session key to provide to the user, thereby effectively exposing the session key to the outside by the user's preference or habit Its purpose is to provide a user authentication method that can be prevented.

In addition, the apparatus capable of recording by combining the configuration in which the user authentication system arbitrarily determines the session key and provides the user with a configuration in which the user inputs a password subset including the password character instead of directly inputting the password character. It is another object of the present invention to provide a user authentication method that can respond more effectively to an attack such as a sneak attack.

According to a feature of the present invention for achieving the above object, a user authentication method using a user authentication password consisting of two or more characters,

(1) indirectly delivering a session key to a user by randomly arranging a one-time session key set and password characters corresponding to the session key set;

(2) randomly arranging a symbol set to be used for indirectly inputting a user authentication password and a password character corresponding to the symbol set to the user;

(3) receiving the specific character from the user by matching the specific character from the password characters with a specific session key in the session key set;

(4) performing user authentication by checking whether the specific character received matches the user authentication password of the user,

In the step (1), it is characterized in that the specific session key is determined in advance, and the determined specific session key is matched with the first authentication character of the user authentication password of the user and provided to the user.

Preferably,

In the step (1), randomly generating the elements of the session key set and the password characters corresponding in a ratio of 1: N (N> 1),

In the step (2), the password set and the corresponding password characters are randomly arranged to be 1: N correspondence and provided to the user,

In the step (3), by matching the password character set of size N from the password string set with a specific session key in the session key set, the password character set of size N is received from the user,

In step (4), the user authentication may be performed by checking whether the user authentication character of the user is included in the password character set having the size N input.

More preferably,

In step (1), the session character set N row is matched to one row of the session key set, and the generated session key set and password character array of N + 1 rows are provided to the user.

In the step (2), the session key set one row is fixed, and the user moves the password character array N rows or the session key set one row is fixed by the user. By being able to move, it is possible to match the password character set of size N with the particular session key.

Even more preferably, in the step (1), the session is generated by matching the password character array N rows with respect to one row of the session key set, and corresponding to each row constituting the password character array of N rows. One row of key sets can be displayed repeatedly.

Preferably, when the user authentication password is composed of L (L> 1) characters, step (2) in order for each of the L-1 characters constituting the user authentication password except for the first authentication character. To step (4) can be repeated.

According to a user authentication method using a user authentication password consisting of two or more characters of the present invention, the user authentication system arbitrarily determines the session key and provides the user, thereby exposing the session key to the outside according to the user's preference or habit. Can be effectively prevented.

In addition, by combining the configuration in which the user authentication system arbitrarily determines the session key and provides the user with a configuration that allows the user to input password subsets containing password characters instead of password characters, You can respond more effectively to attacks such as sneak attacks.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the configuration of a user authentication method according to an embodiment of the present invention. As shown in FIG. 1, a user authentication method according to an embodiment of the present invention includes a session key determination step (S000), a session key set and a password string set providing step (S100), a password input step (S200), and user authentication. In particular, the step (S300), in particular step S000, the step of confirming the first authentication character of the user authentication password (S010), the step of determining a specific session key (S020), the determined specific session key is the user authentication password of the Generating a session key set and a password string set to match the first authentication character (S030).

In step S000, a one-time session key set to be used for indirectly inputting a user authentication character and a password string set corresponding to the session key set are arbitrarily generated. In this case, “indirectly inputting a user authentication character” means that instead of directly inputting a user authentication character such as '1234' as in a conventional user input method, '1234' is sequentially entered to a specific session key known only to the user. Indirect input means the same as matching. In addition, the term "one-time" session key set means that the session key set is changed randomly every time the session key set and the password string set are generated. Step S000 may include step S010 to step S030.

In step S010, the first authentication character of the user authentication characters of the user who wants to proceed with the user authentication procedure is confirmed. For example, when the user authentication password for which the user authentication procedure is to be performed is '1234', the first authentication character '1' is checked.

In step S020, a specific session key to be used for this user authentication procedure is determined. Of course, steps S010 and S020 may be reversed.

In step S030, a session key set and a password string set are generated such that the specific session key determined in step S020 matches the first authentication character of the user authentication character checked in step S010. Since the password string set is mostly fixed according to the user authentication system, a session key set is arbitrarily generated. That is, in this step, the session key set is generated such that the specific session key determined in step S020 matches the password corresponding to the first authentication character of the user authentication password in the password string set.

In step S100, the elements of the session key set generated in step S000 are rearranged and provided to the user together with the password string set.

In step S200, the specific password is received from the user by matching the specific password character with the specific session key in the session key set from the password string set provided in step S100. Matching a specific password with a particular session key means, for example, that if a particular password is '1' and a particular session key is '♥', '1' and '♥' are placed in the same column. As such, instead of directly inputting a specific password, a specific password may be input in a manner of matching the specific password with a specific session key, thereby effectively responding to the sneak attack.

In step S300, the user authentication is performed by checking whether the specific password input in step S200 matches the user authentication password of the user. For example, when the specific password inputted from the user through step S200 is '1', the user is legitimate by checking whether this value matches the authentication characters in the order that should be authenticated in this order among the user's user authentication passwords. To verify whether or not

According to an embodiment, in step S100, the session key set and the password string set may be arbitrarily generated and provided to the user so as to correspond in a ratio of 1: N. In this case, in step S200, the N password subset can be input from the user by matching the N password subset from the password string set with a specific session key in the session key set. In operation S300, the user authentication is performed by checking whether the user authentication password of the user is included in the input N password subset. Here, the ratio of the session key set and the password string set to 1: N means that if the session key set consists of 10 elements, the password string set consists of 10 × N elements. For example, when N is 3, for a session key set consisting of 10 elements, the number of elements in the password string set is 30. Since N is greater than 1, the total number of elements in the password string set is greater than the total number of elements in the session key set. In step S200 of the present embodiment, as described above, instead of matching the specific password character with the specific session key, the password subset including the specific password character is matched with the specific session key. That is, instead of matching a password character, eg, '1', to a particular session key in the session key set, the password subset {1, a, k} including '1' is matched. Of course, the number of elements of the password subset to be matched with a particular session key is not limited to N, but in order to facilitate the implementation of the invention using a symmetrical structure, the number is N in the preferred embodiment. In addition, in step S300 of the present embodiment, instead of receiving a specific password character, instead of receiving a password subset including the specific password character, instead of checking whether the password character input from the user matches the user authentication password. The user authentication procedure is performed by checking whether the user authentication password is included in the password subset input from the user.

According to another embodiment, in step S100, the password string set N rows may be matched to one session key set row, and the generated session key set and password string set of N + 1 rows may be provided to the user. In this case, in step S200, the user can move the password string set N rows while fixing one session key set row, so that the N password subsets can be matched with a specific session key. Alternatively, it is possible to configure the session key set to be moved while fixing N lines of password string sets. Of course, one row of session string sets may be matched to one row of password string sets, and one row of session key sets may be repeatedly displayed to correspond to each row constituting the password string set of N rows. This is to allow the user to easily check the matching of the elements of the session key set with the elements of the password string set.

The user authentication password mostly consists of two or more characters. In this case, steps S100 to S300 should be repeated as many times as the number of characters constituting the user authentication password. Of course, according to the present invention, since the first authentication character of the user authentication password automatically completes the authentication procedure in the process (step S000) provided by matching with a specific session key, only for the second and subsequent authentication characters of the user authentication password. Steps S100 to S300 may be performed. In general terms, when the user authentication password is composed of L characters, steps S100 to S300 are repeatedly performed in order for each of the L-1 characters.

2 is a diagram showing the configuration of a user authentication device for implementing a user authentication method according to an embodiment of the present invention. As shown in FIG. 2, a user authentication apparatus according to an embodiment of the present invention may include an input module 210, a storage module 220, a calculation module 230, and a display module 240. have.

The input module 210 is a module for receiving information from a user through a keyboard, a mouse, a touch screen, a keypad, an RFID, a smart card, a biometric (fingerprint, an iris, a voice, a face), and other methods. The user inputs his own ID through the input module 210, the input module 210 transmits the input ID to the calculation module 230, if the user ID is valid, the user according to the access authority The authentication method receives a password (including a personal identification number (PIN), a password, a user authentication number, and the like) to accommodate the user's access. 3 is a diagram illustrating a configuration of an input module of a user authentication device according to an embodiment of the present invention. As shown in FIG. 3, the input module of the user authentication apparatus according to an embodiment of the present invention may be implemented as an input module using a touch screen method (FIG. 3A) and an input module using a button (FIG. 3B). In addition, although not shown in the drawings, various input methods may be adopted according to a system environment such as a finger mouse for a smartphone, a touch pad for a notebook, and an input method using tilt or motion using a G-sensor.

The storage module 220 stores the ID of the user and a user authentication password corresponding thereto. The calculation module 230 searches for the ID received from the input module 210 in the ID list in the storage module 220 to determine whether it is a valid user ID, and if it is a valid ID, obtains a user authentication password corresponding to the ID. The personal identification password inputted through the module 210 and the password stored in the storage module 220 are compared and accommodated in case of matching. If the ID is invalid, the display module 240 indicates that the ID is invalid. In addition, the symbols are arranged according to the value received from the input module 210 and transmitted to the display module 240. The display module 240 may display, for example, a character array required for password input and symbols to be used as a session key on a screen in a two-dimensional form and provide a user with a guide message such as a usage message or an error message. The input module 210 and the display module 240 may be implemented as one integrated device.

4 is a diagram illustrating an example of a user authentication password input screen that can be displayed on a display module in a user authentication method according to an embodiment of the present invention. As illustrated in FIG. 4, the user authentication password input screen may include a session key set on one line and a password string set on N lines corresponding thereto. The set of session keys in one line may consist of, for example, M symbols, each symbol representing a one-time session key to be used to indirectly enter a user authentication password. Here, the symbol that can be used as the session key may be any means that can be easily identified by the user such as various images, symbols, and colors as well as a shape image. The N string password string set starting from the second line may be any string that can be represented, such as numbers or letters, as symbols that can be used for the user authentication password. The number of characters that can be input by the user, that is, the password can be N × M, and N and M can be changed according to the system environment. If N is chosen to be greater than or equal to 2, the user can enter a subset of passwords that contain password characters instead of password characters, thus providing greater security than conventional authentication methods against multiple shoulder surfing attacks (peeping or recording). Can be provided. Additional information, such as color and pattern, can be provided for each row so that users can easily distinguish each row in entering a password. In addition, the position of the session key set is not limited to the first row as shown in FIG. 4, but may be located in the middle or the last row of the matrix, and for the convenience of the user, the same symbol may be repeatedly displayed several times. It may also be (see Figure 6). In the user authentication password input screen shown in FIG. 4, one digit of the user authentication password can be input by one operation on the (N + 1) × M matrix, and repeating L-1 times from L to the second digit. L-1 digit user authentication password can be entered until the first time. However, the first digit of the password is used for providing the session key, not for authentication, and user input for this is not received.

Hereinafter, a detailed operation process of the user authentication method proposed by the present invention will be described with reference to FIGS. 5 and 6.

5 is a diagram illustrating a process of inputting a four-digit user authentication password (that is, L = 4) according to the user authentication method proposed by the present invention. Although the embodiment illustrated in FIG. 5 is described as a touch input method, the present invention is not limited thereto, and the same method may be applied to other input methods. In the embodiment shown in Fig. 5, the four-digit password '1317' made up of numbers is used. The number N of password string sets is 2, and the number of elements of one row of session key sets or one row of password string sets ( If M) is 5, the process is authenticated.

First, the user authentication system randomly generates a session key set (first line) consisting of five elements and a corresponding password string set in a ratio of 1: 2 with the session key set and provides the user to the user (FIG. 5A). To this end, the user authentication system first grasps the first authentication number '1' of the user authentication password '1317', and then uses the session key ('♥' in the embodiment of FIG. 5) to be used in the current user authentication process. Determine. From FIG. 5A, it can be seen that the first authentication character '1' of the user authentication password '1317' is provided in a matching manner in the same column as the session key '♥' to be used.

Next, the user grasps the session key from the combination of the provided session key set and the password string set (FIG. 5B). That is, the user finds the session key to use for the authentication procedure by finding the session key ♥ corresponding to the first character (= 1) of the user authentication password. When the user knows the session key to be used in this way, in the next step, the authentication system randomly rearranges the session key set and the password string set again, and the second character (= 3) of the user authentication password is displayed in the same column as the session key (♥). The password string set is moved left and right so as to be located (FIG. 5C). When the second character (= 3) of the user authentication password is located in the same column as the session key (♥) through the process shown in FIG. 5C, the second character of the user authentication password is input using the input button. Notify (FIG. 5D). 5c to 5d, the third character (= 1) and the fourth character (= 7) of the user authentication password are also input to the user authentication system (FIGS. 5E and 5F). When all input of the user authentication password is completed, user authentication is completed (FIG. 5G).

6 is a user authentication password input screen for applying the user authentication method proposed in the present invention, and is an input screen for a case where the user authentication password is a combination of letters and numbers. As shown in FIG. 6, since the user authentication password includes not only numbers but also letters, the password string set includes not only numbers but also letters as elements (a to z, 0 to 9). In addition, by including not only the same session key setter but also characters together, the user can more easily check the correspondence between the session key set and the password string set. Looking at the lower input button, it consists of the left move button (left), right move button (right), and start button (start), the start button is changed to the input button (enter) when the user authentication process starts Can be.

As described above, according to the user authentication method using a user authentication password composed of two or more characters proposed by the present invention, the user authentication system arbitrarily determines a session key and provides the user with a user's preference or habit. By this, the session key can be effectively prevented from being exposed to the outside. In addition, by combining the configuration in which the user authentication system arbitrarily determines the session key and provides the user with a configuration that allows the user to input password subsets containing password characters instead of password characters, You can respond more effectively to attacks such as sneak attacks.

The present invention described above may be variously modified or applied by those skilled in the art, and the scope of the technical idea according to the present invention should be defined by the following claims.

1 is a view showing the configuration of a user authentication method according to an embodiment of the present invention.

2 is a diagram showing the configuration of a user authentication device for implementing a user authentication method according to an embodiment of the present invention.

3 is a view showing the configuration of an input module of a user authentication device according to an embodiment of the present invention.

4 is a diagram illustrating an example of a user authentication password input screen that can be displayed on a display module in a user authentication method according to an embodiment of the present invention.

5 is a diagram illustrating a process of inputting a four-digit personal identification number according to the user authentication method proposed in the present invention.

6 is a user authentication password input screen for applying the user authentication method proposed in the present invention, an input screen for the case where the user authentication password is a combination of letters and numbers.

<Explanation of symbols for the main parts of the drawings>

S000: Session Key Determination Step

S100: providing a session key set and a password string set

S200: password subset input step

S300: step of performing user authentication

210: input module

220: storage module

230: arithmetic module

240: display module

Claims (5)

A user authentication method for authenticating a user using a user authentication password composed of two or more characters, (1) randomly generate one-time session key set elements and password characters corresponding to the session key set in a ratio of 1: N (N> 1), and generate the password character array N for the session key set row 1; Indirectly delivering a specific session key to the user by providing the user with a session key set and password character array of N + 1 rows generated by matching the rows; (2) arbitrarily arranging a symbol set to be used for indirectly inputting a user authentication password and a password character corresponding to the symbol set in a ratio of 1: N to the user; (3) receiving a password character set of size N from the user by matching a password character set of size N from the password string set with a specific session key in the session key set; And (4) performing user authentication by checking whether the user authentication password of the user is included in the password character set of size N received; In the step (1), the specific session key is determined in advance, and the determined specific session key is arranged to match the first authentication character of the user authentication password of the user and provided to the user, In step (2), the session key set one row is fixed, and the user moves the password character array N rows, or the session key set one row is fixed, the user is fixed. And a password character set of size N to match with the specific session key. delete delete The method of claim 1, In the step (1), the session key set 1 row is generated by matching the password character array N rows with respect to the session key set one row, and the session key set one row is corresponding to each row constituting the password character array of the N rows. A user authentication method using a user authentication password consisting of two or more characters, characterized by repeatedly displaying. The method of claim 1, When the user authentication password is composed of L (L> 1) characters, steps (2) to (4) in order for each of the L-1 characters constituting the user authentication password except for the first authentication character. The user authentication method using a user authentication password consisting of two or more characters, characterized in that to repeat).

Images