KR101991109B1 - Method and system of mobile authentication - Google Patents

Abstract

According to an aspect of the present invention, there is provided a method for authenticating a mobile financial transaction, the method comprising: extracting, by a user mobile device, a phone number of the user mobile device; Transmitting member information including the phone number to an authentication service provider server; Receiving an identification number using the member information from the authentication provider server; Extracting unique user identifiers (UUIDs) of an app for financial transactions installed on the user's mobile device; Transmitting the UUID of the extracted financial transaction app and the received personal identification number to a service server; And receiving, from the service server, a serial number of the financial transaction app generated to correspond to the identification number received by the service server and the UUID of the financial transaction app.

Description

Mobile authentication method and system {METHOD AND SYSTEM OF MOBILE AUTHENTICATION}

The present invention relates to a mobile authentication method and a system thereof, and more particularly, to a phone number of a mobile device extracted by using a short message service (SMS) of a mobile device and a UUID (Unique User Identifiers) of an app installed on the mobile device. Authentication method and system for conducting financial transactions such as payment and personal authentication using

Recently, with the widespread use of smartphones, various financial transaction services such as payment and account transactions using smartphone apps are being provided, and various services requiring authentication in addition to financial transactions are being utilized using smartphone apps.
In the case of financial transactions, since personal authentication or mobile device authentication is important, there are many authentications using public certificates, ARS, and SMS.However, each transaction requires one-time ID number by entering the password of the public certificate or calling the ARS system. , And received an SMS to enter the authentication number included in the SMS had to go through a cumbersome procedure.
In the case of a smart phone application (app or app: application), anyone can easily create and distribute a variety of apps that are produced and used.The user can easily use various services such as financial transactions on a smart phone. There is a high possibility of tampering with the app because it can be produced and distributed.
In addition, there is a problem that personal information or financial transaction information may be leaked when using the smartphone by hacking the smartphone or copying the app or using the smartphone itself.

The present invention has been made in the technical background as described above, using the user identification number and the UUID of the app generated on the basis of the member information, including the phone number of the mobile device to verify the identity and app authentication and proceed with payment, etc. The purpose of the present invention is to provide a mobile device authentication method and system for preventing the duplication or unauthorized use of an app.
In addition, if the mobile phone number can not be extracted due to the policy restrictions of the mobile device manufacturer, it is an object of the present invention to provide a way to extract the security using the SMS server.
The object of the present invention is not limited to the above-mentioned object, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

Mobile authentication method according to an aspect of the present invention for achieving the above object comprises the steps of: extracting a phone number of the user mobile device; Authenticating subscribers by transmitting member information including the phone number to an authentication service provider server; Receiving an identification number using the member information from the authentication provider server; Extracting Unique User Identifiers (UUIDs) of an App installed in the user's mobile device and transmitting the extracted UUIDs and the received personal identification numbers to a service server; And receiving, from the service server, a serial number of an app generated to correspond to a user authentication number received by the service server and a UUID of the app.
Mobile payment system according to another aspect of the present invention, by passing the member information including the phone number to the authentication provider server to receive the identity number, and deliver the UUID and the identity number of the installed app to the service server to A user mobile device receiving the app serial number; An authentication service provider server which receives the member information and performs member authentication using the phone number included in the member information, and transmits an authentication number to the user's mobile device after authentication; And a service server configured to generate and store a serial number of the app by using the UUID and the identity number of the app received from the user's mobile device, and to transmit the generated serial number of the app to the user's mobile device. do.

According to the present invention, by using the member information including the phone number of the user's mobile device and the UUID of the app for financial transactions, proceed with the user authentication and app authentication for financial transactions can improve the security in mobile financial transactions, Since fraudulent use of a copy of the app for financial transactions can be prevented, it is possible to prevent economic losses due to financial information leakage.
In addition, even when the mobile phone number cannot be extracted due to the policy restrictions of the mobile device manufacturer, it can be extracted and used for security by using an external device such as an SMS server.

1 is a flow chart of the authentication method for mobile financial transactions according to an embodiment of the present invention.
2 is a flow chart of a phone number extraction method according to an embodiment of the present invention.
Figure 3 is a flow chart of the app authentication confirmation method using the UUID of the app for financial transactions in accordance with an embodiment of the present invention.
Figure 4 is a flow chart of a financial transaction method using the app for financial transactions completed authentication according to an embodiment of the present invention.
5 is a structural diagram of a mobile payment system according to another embodiment of the present invention;
6 is a structural diagram of a service server for performing authentication according to another embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms, and only the present embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Meanwhile, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and / or “comprising” refers to a component, step, operation and / or device that is present in one or more other components, steps, operations and / or elements. Or does not exclude additions.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to enhance the convenience and understanding of the description of each embodiment will be described as an app for financial transactions as an example, the present invention may be applied to various kinds of apps that require authentication, without being limited thereto.
1 shows a flowchart of a user authentication method according to an embodiment of the present invention.
Identity authentication of Figure 1 corresponds to the user information registration step for authentication according to the present invention.
If you download and run an app for financial transactions (App: Application) for financial transactions such as payment or account transactions (S110), you agree to the terms and conditions for financial transactions, your name and date of birth, domestic / foreign people, male / Member information such as women is input (S112).
Thereafter, the step of extracting the phone number of the mobile device is performed (S120).
If the operating system of the mobile device provides the phone number of the mobile device such as Google's Android operating system, the phone number can be simply extracted from the device information of the mobile device through the operating system.
However, if the operating system does not provide device information such as the phone number of the mobile device, such as a mobile device such as an iPhone (iPhone) using the iOS operating system, a method of extracting a phone number using SMS can be used.
The mobile device obtains a phone number through the phone number extraction step (S120), and then obtains a carrier using the user's selection input (S130), and transmits the phone number together with the member information already entered, such as the name and date of birth, to the service server. (S132).
The service server transfers the received information to the authentication provider server and requests authentication (S134). The transmission of the member information including the telephone number can be configured to be directly transmitted to the authentication provider server without passing through the service server.
When the authentication provider server transmits the member information including the received phone number to the telecommunication company server and requests subscriber confirmation (S136), the telecommunication company server compares the member information including the phone number with the subscriber information and performs subscriber verification (S136). S138) The result is notified to the authentication provider server (S140).
When the authentication service provider server completes the subscriber verification, the authentication service provider generates a self-authentication number and delivers it to the service server and notifies that the service is authenticated (S142), and the service server delivers the user authentication number to the user's mobile device (S144). The identity verification number may be transferred directly from the authentication provider server to the user's mobile device without passing through the service server.
If identity verification is performed as above, the app is subsequently authenticated. The user's mobile device, which has received his / her authentication number, can receive an additional financial transaction app verification confirmation (S150) using the phone number and the UUID of the financial transaction app to proceed with a security transaction with enhanced security.
The following describes in detail how to extract the phone number of the user's mobile device when the mobile device OS does not restrict or support phone number extraction, such as iOS, and then the app authentication using the extracted phone number and app UUID. It will be described in detail.

2 is a flowchart illustrating a method of extracting a telephone number.
The mobile device transmits the SMS message including the server authentication number (a kind of index for the service server to check and manage the mobile device phone number) generated by the financial transaction app to the SMS server (S1210).
When receiving the SMS message sent from the mobile device, the SMS server extracts and acquires the server authentication number and the phone number which are automatically included in the SMS message (S1220) and transmits it back to the service server (S1230). Stores the received mobile phone number and server authentication number together (S1240). That is, the phone number and server authentication number of the mobile device are stored in association with each other.
The SMS message goes through the SMS server, and in this process, the phone number of the mobile device is automatically verified, thereby preventing the forgery / falsification of the phone number due to incorrect input of the phone number of the mobile device operator (e.g. Phone numbers can also be obtained from mobile devices such as iPhones, which cannot obtain device information.
The mobile device sends a server authentication number to the service server again to request a phone number (S1250), and the service server compares the stored server authentication number with the server authentication number received from the mobile device. The corresponding telephone number is extracted (S1260).
By using the extracted phone number, the service server transmits the phone number to the user's mobile device (S1270), thereby preventing forgery / falsification of the phone number of the mobile device. Meanwhile, the mobile device receiving the phone number may be configured to display the phone number automatically received on the mobile device to confirm that the user has successfully extracted the phone number (S1280).
On the other hand, step S1260 may be omitted, and if the service server obtains the mobile device phone number in step S1240, it may be configured to immediately proceed to step S1280 to deliver the phone number to the mobile device.
In the above-described process, the mobile device transmits the SMS text to the service provider, the SMS server delivers the SMS message sent by the mobile device to the service server or a separate server operated by the service provider, and the service server or the separate server sends the phone number. The extraction may proceed. In this case, the server authentication number may not be necessary.
Unlike the phone number extraction method, the user directly inputs the phone number of the conventional mobile device and requests his / her authentication number to the authentication service provider server, the phone number is automatically extracted by the SMS server to prevent the forgery / falsification of the phone number. .

3 is a flowchart illustrating a method for verifying app certification for financial transactions using the UUID of an app for financial transactions. When the user checks and inputs the identification number received on the mobile device (S1510), the mobile device extracts the unique user identifiers (UUIDs) of the app for financial transactions through the operating system (S1520). It will be apparent to those skilled in the art that the user's mobile device has already received and stored his / her own authentication number, so that the user's mobile device can be automatically processed without the user's input.
The UUID is an ID assigned by the storage when the app is downloaded from the App Store, such as the App Store.The UUID is assigned to the app differently for each individual download and is stored in the operating system of the downloaded mobile device. Even if you duplicate it, you can't duplicate the UUID, so you can prevent the forgery and alteration of your app.
When the UUID and the ID number and the mobile device phone number of the financial transaction app is delivered to the service server (S1530), the service server passes the ID number and the phone number back to the authentication provider server and requests verification of the ID number. S1540).
The authentication provider server compares the identification number and phone number generated at the time of phone number authentication with the identification number and phone number received from the service server in step S1540 to determine whether the user (mobile device holder) is the same as the subscriber. Proceed with authentication (S1550). That is, it may be checked whether the UUID is transmitted from the mobile device that has requested the ID number generation in steps S110 to S144 (holder identification).
The authentication service provider server notifies the authentication result to the service server (S1560), and the service server registers the member information for providing the financial transaction service after confirming that the authentication is completed (S1570). The registered member information includes a mobile phone number, date of birth, domestic / foreign people, gender, and UUID of an app for financial transactions.
Meanwhile, the service server may additionally generate an app serial number when the authentication is completed, and store and manage the app serial number together with the ID number, the app UUID, and / or the mobile device phone number. When the identity verification and registration of the member information is completed, notify the user's mobile device that the identity verification and registration process is completed, and forward the generated financial transaction app serial number together (S1580) to store on the user's mobile device and later the app for financial transactions To be used for authentication at runtime.
Meanwhile, in the above description, the service server and the authentication provider server are assumed and described as separate servers, but may be implemented as one server and maintained by one service provider. In this case, data transmission and reception between the service server and the authentication provider server becomes unnecessary.

When the above authentication and app for financial transactions authentication is completed, the user proceeds by using the app for financial transactions after the authentication is completed when the financial transactions. 4 is a flowchart illustrating a method of performing a financial transaction using an app for financial transactions after authentication is completed.
If there is a user's payment request, the merchant transmits the payment amount, the phone number of the user's mobile device, and the user's date of birth through the merchant device to a service server providing a secure financial transaction (S410).
When the user's payment is made online on the mobile device, the payment amount, phone number, and date of birth may be transmitted from the user's mobile device to the service server.
The service server compares the phone number and date of birth received from the merchant device with the phone number and date of birth in the member information stored in the database at the time of registration, and checks the membership (S420). Extract the app serial number stored in the financial transaction (S430).
The service server requests the user's mobile device to drive the financial transaction app using a push method using the user's phone number received from the affiliated device device (S440), and in response, the user's mobile device drives the financial transaction app (S450). ). The mobile device may have a plurality of apps for financial transactions installed. In this case, an app to receive a push-type app driving request may be distinguished using an app-specific identifier (app ID). The App ID is generated or obtained and stored and managed by the service server whenever an app is installed on the mobile device.
In order to prevent unauthorized use such as theft or loss of the user's mobile device when the app is running, a step of receiving a password from a user or inputting biometric information such as a fingerprint or a signature may be added.
The driven financial transaction app extracts the UUID of the financial transaction app through the operating system, and extracts the serial number of the financial transaction app stored and received from the service server at the time of authentication (S460), and the UUID of the financial transaction app And transmits the app serial number for the financial transaction to the service server for the financial transaction authentication (S470).
The service server compares the received UUID and app serial number with the UUID and app serial number of the financial transaction app in the member information stored in the database upon membership registration and authentication, and determines whether the app is forged or forged. (S480).
In addition to the above-mentioned phone number and date of birth, the app serial number for financial transactions and the UUID of the app for financial transactions can be further used for authentication for financial transactions. UUID is used to store the user's mobile device and service server, not directly input by the user, there is an advantage that can minimize the user's inconvenience due to enhanced security.
After completing the authentication of the app for financial transactions, financial transactions are possible in various ways of performing a normal payment service (S490).
Meanwhile, instead of using only one of the app serial number and the app UUID, the mobile device transmits the app UUID or the app serial number to the service server, and the service server determines whether the app is forged or forged using the app UUID or the app serial number. It's also possible to use app serial numbers and app UUIDs together to analyze this information along with the phone number to identify cases such as USIM replacement, app dump copy, illegal app duplication, etc. And it is preferable to use the app UUID together.

Figure 5 shows an app authentication system 50 for identity authentication and financial transactions in accordance with a preferred embodiment of the present invention.
The system 50 includes a user portable device 510, an SMS server 520, a service server 530, an authentication provider server 540, and a communication company server 550.
The user mobile device 510 transmits a phone number and a server authentication number by transmitting an SMS to the SMS server through the above-described process, and receives a phone number from the service server 530 that has received the phone number and server authentication number from the SMS server. Receive and display on the screen.
The user mobile device 510 may also use a method of directly extracting a phone number from an operating system of the user mobile device 510 in addition to using the SMS.
According to the present invention, the authentication is performed using the phone number received from the service server 530 or directly extracted from the user mobile device 510 and the ID number received from the authentication provider server 540, and the mobile device 510 In order to check whether the forgery / forgery of the app installed in the financial transaction app UUID and financial transaction using the app serial number for the financial transaction from the service server 530 can be authenticated for the financial transaction.
The SMS server 520 obtains the phone number of the mobile device 510 from the SMS received from the mobile device 510 of the user, transfers it to the service server 530, and then delivers the phone number to the mobile device 510 again. It extracts a phone number from a mobile device 510 such as an iPhone with limited access.
The service server 530 transfers the phone number to the user mobile device 510 using the phone number and server authentication number received from the SMS server 520, registers the user's member information for the financial transaction service, and performs the financial transaction. The app serial number for the mobile device 510 is generated and passed to the user authentication and financial transaction app authentication.
In addition, if there is a payment request from a merchant terminal (not shown), the financial transaction app of the user's mobile device 510 is push-driven by a push method and the financial transaction app serial number and the UUID of the financial transaction app from the mobile device 510. The financial transaction process such as payment is performed by checking the forgery / falsification of the financial transaction app by comparing the serial number of the financial transaction app stored in the database and the UUID of the financial transaction app.
The authentication service provider server 540 generates a personal authentication number for self-authentication. The service provider server 540 uses the member information including the phone number received from the service server 530 to request a subscriber confirmation to the service provider server 550 and the service provider server ( 550 confirms the subscription information and notifies the result, generates a personal identification number and delivers it to the mobile device 510 to proceed with the identity verification.
The communication company server 550 performs subscriber verification by comparing the user information received from the authentication provider server 540 with the subscriber information stored in the database of the communication company server 550 and transmits the result to the authentication service provider server 540 to authenticate the user. Proceed.
Meanwhile, the SMS server function and the authentication provider server function may be performed by the service server.
The above system can prevent the forgery / tampering of the app, so that more secure financial transactions are possible.

6 is a structural diagram according to an embodiment of a service server 530 that performs user authentication of the present invention.
The service server 530 includes an authentication information transceiver 532, a member information storage 534, and an authentication performer 536.
The authentication information transceiver 532 exchanges information necessary for user authentication with the user mobile device 510 and the authentication provider server 540.
First, member information including a phone number is received from the user mobile device 510, and the received member information is transmitted to the authentication service provider server 540 so that the authentication service provider server 540 performs user verification using the member information. After receiving the result with the identity number and sends it back to the user mobile device (510).
The member information storage unit 534 stores member information necessary for authentication.
Member information including the phone number received from the user mobile device 510 is stored, and the personal identification number received from the authentication provider server 540 is stored.
If the user authentication is successful using the user authentication number, the app serial number generated corresponding to the UUID and the UUID received from the user mobile device 510 is also stored in the member information storage unit 534.
Finally, the authentication performing unit 536 compares the personal identification number received from the user portable device 510 with the personal identification number received from the authentication provider server 540 and performs user authentication.
When the authentication unit 536 also receives the app serial number and / or UUID together with the payment request from the user mobile device 510, the app is compared with the app serial number and / or UUID stored in the member information storage unit 534. App verification to determine the authenticity of the checkout step is performed.
By using both user authentication and app authentication at the same time, it is possible to strengthen financial transaction security in a mobile environment.

In the above, the configuration of the present invention has been described in detail with reference to the accompanying drawings, which are merely examples, and those skilled in the art to which the present invention pertains various modifications and changes within the scope of the technical idea of the present invention. Of course this is possible. For example, a UUID alone can uniquely identify a particular app installed on a particular mobile device, so that the app serial number is not used for user authentication and / or payment authentication, or is replaced with an arbitrary password or biometric information instead of the date of birth. Stored in the service server and used for payment is included in the technical idea of the present invention. Therefore, the protection scope of the present invention should not be limited to the above-described embodiment but should be defined by the description of the claims below.

50: Identity Verification and App Verification System
510: user mobile device 520: SMS server
530: service server 532: authentication information transceiver
534: member information storage unit 536: authentication performing unit
540: authentication provider server 550: carrier server

Claims (9)

In the mobile device authentication, possession and user authentication and transaction authentication method that the app installed on the user's mobile device runs,
Receiving member information about a user's personal information other than the mobile phone number from a user;
Extracting a phone number of the user's mobile device without a user's input;
Transmitting the phone number and member information secured in different ways together to an authentication server in order to perform all device authentication, possession authentication and user authentication;
Receiving an authentication number from the authentication server when authentication is successful when the authentication server inquires the telephone number and the member information to the communication company;
As an identifier of an App installed on the user's mobile device, the app distributor assigns the app to the user's mobile device in order to prevent illegal duplication and forgery of the app. Extracting UUIDs that are not duplicated together even if the installed app is duplicated because it is stored;
Transmitting the UUID of the extracted app, the extracted phone number, and the received personal identification number to a service server; And
After the above steps for registration the service server,
Receiving a transaction approval request including member information from the affiliated device;
Comparing the received member information with stored member information and transmitting an app execution request to a user mobile device corresponding to the member information;
Receiving a UUID of the app automatically extracted and transmitted by an app of the user mobile device receiving the app execution request;
Comparing the received UUID with the UUID of the app included in the stored member information and determining whether the app is forged or not; And
Making a payment if the received UUID and the UUID of the app included in the stored member information match;
Mobile device authentication, possession authentication and user authentication and transaction authentication method comprising a.
The method of claim 1, wherein the extracting the telephone number comprises
Transmitting an SMS message including a server authentication number for authenticating the mobile device generated by the app to an SMS (Short Message Service) server;
Requesting a phone number of the user's mobile device by transmitting a server authentication number stored in the user's mobile device to the service server (receiving and storing the phone number and the server authentication number of the user's mobile device from the SMS server); ; And
Receiving the telephone number from the service server;
Mobile device authentication, possession authentication and user authentication and transaction authentication method comprising a.
delete In order to perform device authentication, possession authentication and user authentication, the user information (except the mobile device phone number) and the member information about the personal information of the user directly entered in the app installed on the user's mobile device is automatically After receiving the extracted phone number from the user's mobile device, using the phone number and the member information, the identity authentication request is made to the following authentication server, and as a result, the identity authentication number is received from the following authentication server, and the user's mobile device is received. Pass it on,
In order to authenticate the app to prevent illegal copying and forgery of the app, even when the installed app is duplicated when the app is downloaded from the user's mobile device, the distributor of the app is given and stored in the OS area of the user's mobile device. Receive the app UUID, the phone number and the personal identification number that is not duplicated together with the phone number to pass along to the authentication server and, if authentication, membership registration and to send the user authentication completion notice to the user mobile device Service server; And
In order to verify the identity, the subscriber confirms the subscription request to the telecommunication company according to the identity verification request of the service server, generates a personal identification number according to the result, stores it with the telephone number, and stores the identity verification number in the service. To the server,
An authentication server for comparing the identification number and phone number received from the service server for app authentication with the identification number and phone number previously stored at the time of authenticating the app and transmitting the result of app verification to the service server
Including,
The service server,
When the payment request including the phone number of the user's mobile device is received from the merchant device, the app transmits a request for executing the app to the user's mobile device corresponding to the phone number, and the app automatically extracts and sends the app. When receiving the UUID of the process of determining whether the forgery of the app compared to the UUID of the app corresponding to the stored member information, and if the received UUID and the UUI of the app corresponding to the member information is the process of payment The mobile authentication system that will perform more.
The method of claim 4, wherein
An SMS server that receives an SMS message including a server authentication number from the user's mobile device and delivers the server authentication number to the service server together with the phone number of the user's mobile device.
Mobile authentication system comprising more.
delete In the method of performing the user authentication in the service server using the user's mobile device and the authentication server,
In order to perform device authentication, possession authentication and user authentication, the user information (except the mobile device phone number) and the member information about the personal information of the user directly entered in the app installed on the user's mobile device is automatically Receiving the extracted telephone number from the user mobile device;
Transmitting a subscriber confirmation request to the authentication server together with the telephone number and the member information;
Receiving the identification number from the authentication server and transmitting the identification number to the mobile device;
For app authentication to prevent illegal copying and forgery of the app, as an identifier of an app installed on the mobile device, the app's distributor is given when downloading the app and stored in the OS area of the user's mobile device. Receiving an app UUID, a phone number of the mobile device, and the personal identification number from the mobile device, which are not duplicated together even if the installed app is duplicated, and transmitting the app UUID to the authentication server together with a personal authentication request; And
And transmitting an authentication check result received from the authentication server to the mobile device.
When trading after the above steps,
Receiving a transaction approval request including member information from the affiliated device;
Comparing the received member information with stored member information and transmitting an app execution request to a user mobile device corresponding to the member information;
Receiving a UUID of the app automatically extracted and transmitted by an app of the user mobile device receiving the app execution request; And
Comparing the received UUID with the UUID of the app included in the stored member information and determining whether the app is forged or not;
Method of performing user authentication further comprising.
In order to perform device authentication, possession authentication and user authentication, the user information (except the mobile device phone number) and the member information about the personal information of the user directly entered in the app installed on the user's mobile device is automatically Receive the extracted phone number from the user mobile device, and transmit the member information to the authentication server to receive the identification number as a result of the authentication using the member information from the authentication server, and the received identification number When the app is transmitted to the mobile device and downloaded from the mobile device as the identifier of the app installed on the mobile device, the app distributor is assigned and stored in the OS area of the user's mobile device. App UUID, phone number of the mobile device and the bone stored on the mobile device Authentication information receiving unit for receiving an authorization number;
A member information storage unit for storing the member information including the phone number received from the authentication information transmitting and receiving unit, the identity number and the UUID for app authentication to prevent illegal copying and forgery of the app; And
In the payment step, the app authentication to determine whether the forgery of the app by comparing the UUID of the app automatically extracted and sent by the app of the mobile device with the payment approval request from the mobile device stored in the member information storage unit Authentication performing unit to perform;
Performing authentication comprising a service server.
The method of claim 8, wherein the authentication performing unit
Authentication performing service server that further performs app authentication by comparing the identification number received from the user's mobile device and the identification number received and stored from the authentication server.

Images