KR20150124868A - Secure user two factor authentication method and system from Personal infomation leaking and smishing - Google Patents

Abstract

The present invention relates to a method and a system for a user two-factor authentication capable of preventing damage due to hacking, SMS phishing, and farming by two-factor authenticating a user by using a passcode set by the user or OTP and IMSI, ICCID which are unique identification numbers saved in a USIM. The method of the present invention may include the steps of: when an authentication server receives a user′s cell phone number in a registration step of the authentication service, checking whether the user is a proper user and storing unique information for the user authentication in a database; storing the user′s passcode in the USIM of a cell phone corresponding to the cell phone number by the authentication server in the registration step of the authentication service; when the authentication server receives the user′s cell phone number in a step of using the authentication service, requesting an input of a passcode from the pertinent user after checking whether the user is registered in the authentication service; when a passcode is inputted in the user′s cell phone, performing a first authentication by comparing the inputted passcode to the passcode stored in the USIM by an authentication application; extracting the unique information stored in the USIM with a result of the passcode authentication and transmitting the outcome to the authentication server by the authentication application; performing a second authentication by comparing the transmitted unique information to the stored unique information or unique information of a mobile communication company by the authentication server; transmitting a result of the authentication to the service server by the authentication application; and providing the pertinent user with the service depending on the result of the authentication by the service server.

Description

[0001] The present invention relates to a user authentication method and system for preventing personal information leakage and smashing,

The present invention relates to a technique for securely authenticating a user on a network, and more particularly, to a technique for securely authenticating a user on a network, including a subscriber information (IMSI, ICCID), a unique identification number stored in a universal subscriber identity module (USIM) The user is authenticated by using one password, and the OTP is transmitted to the mobile phone at the time of using the micropayment or authentication service, and the current user authentication process inputted by the PC is changed to transmit the OTP to the PC and input the OTP to the smartphone (USIM) that can prevent damage caused by hacking, smashing, pharming, etc. by allowing a user to input an app password into a smartphone.

Generally, a universal subscriber identity module (USIM) is an application for WCDMA network connection and subscriber authentication, and is mounted and operated on a UICC (Universal Integrated Circuit Card), which is a smart card for communication. The USIM application stores important information such as subscriber information (IMSI, ICCID), network information, and authentication information, and personal supplementary service information such as a text message, e-mail, and phone book. Herein, the subscriber information, which is unique identification information, is composed of an International Mobile Subscriber Identification (IMSI) and an Integrated Circuit Card Identifier (ICC-ID) of 19 or 20 digits. The USIM application shares a secret key K with an authentication center (AuC) for WCDMA subscriber authentication and performs a predetermined authentication procedure to provide confidentiality and integrity of the wireless network service.

On the other hand, the security on the network is divided into two stages of intrusion prevention and intrusion detection. Intrusion prevention is at the forefront of network security, including authentication, authorization, and access control. In the case of an externally connected network, an intrusion from the outside is inevitable. If an intruder breaks the intrusion prevention method and then enters the network, intruder detection must be performed to detect an intruder.

One of the most popular methods of intrusion prevention is User Authentication, which prevents users from accessing the network if they can not provide enough data to prove themselves. To prevent the intrusion of the network based on user authentication, the user authentication method should be designed for the network environment and the security weak points at the whole network level should be removed.

When using site login, personal authentication, micropayment, credit card payment, money transfer, etc. on the network, the user's ID and password are authenticated or the OTP (One Time Password) is transmitted to the mobile phone A method of authenticating by inputting this, and a method of using an authorized certificate.

In recent years, as IT technology has developed, malicious attack techniques such as hacking, smsing, and pharming have been diversified, making existing authentication methods ineffective. In addition, risk of exposure of important personal information due to lack of management of financial institutions . For example, ID and PWD are hacked and stolen, so items, mileage are taken away, OTP SMS is intercepted in the middle and used for micropayment fraud, The damage is occurring, and the anxiety of users is increasing. In particular, most users are storing their IDs and passwords in a smartphone memory in the form of cookies in order to use automatic login on their smartphones, thus increasing the risk of hacking.

Particularly, there is a method of transmitting an OTP to a user's mobile phone and inputting the OTP to a PC when using the site authentication and the micropayment on the network, and a small amount of OTP transmission SMS There is a lot of damage to payment fraud, and the anxiety of the users is increasing. In order to prevent such smashing, payment service operators are strengthening their efforts to prevent users from installing malicious apps.

In addition, to prevent hacking, smashing, pharming, etc., each financial institution, site operator, and payment service operator require users to use additional authentication means in addition to the existing authentication means, or to make the number of digits or character combinations complicated The inconvenience of users is increasing.

Patent Document 1: Japanese Patent Application Laid-Open No. 10-2012-10602 (entitled " User Authentication Processing Method Enhanced Security Through Mobile Communication System and Mobile Communication Terminal Used Therefor)

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the above-mentioned problems, and an object of the present invention is to provide a method and system for authenticating a user by using a unique subscriber information (ICC-ID) and an OTP or a password stored in a USIM The present invention provides a user authentication method and system using USIM which enables secure and convenient login, personal authentication, micropayment, credit card settlement, fund transfer, and the like by changing the OTP transmission and input process .

According to another aspect of the present invention, there is provided a method for authenticating a user, comprising: receiving, at an authentication server subscription step, a user's mobile phone number, In a first step; A second step of the authentication server storing the password of the user in the user's mind (USIM) corresponding to the mobile number in the authentication service subscribing step; A third step of confirming whether the authentication server is a subscriber of the authentication service when the authentication server receives the mobile phone number of the user in the authentication service utilization step and requesting the user to input the password; A fourth step of, when the password is input to the user's mobile phone, comparing the inputted password with the password stored in the USIM; A fifth step of extracting the intrinsic information (ICCID) stored in the idle state together with the password authentication result by the authentication app, and transmitting the ICCID to the authentication server; A sixth step of comparing the unique information (ICCID) transmitted by the authentication server with the stored unique information (ICCID) or comparing the unique information with the unique information (ICCID) stored in the mobile communication company server to perform secondary authentication; A seventh step of the authentication server transmitting an authentication result to a service server; And an eighth step of the service server providing a service to the user according to the authentication result.

In the second step, the user directly inputs the password in response to the password input request of the authentication server or stores the password in the user's mind or requests the password registered in the service server, and the authentication server stores the user's mobile phone through the mobile communication network .

According to another embodiment of the present invention, there is provided a method of managing a service server, comprising: a first step of registering an ID and a password on a service server; A second step of confirming whether the authenticated user is a valid user in the mobile communication company server when the authentication server receives the mobile phone number of the user in the authentication service subscription step and storing unique information (ICCID) for user authentication in its own database; A third step of receiving the mobile phone number from the service server and transmitting the mobile phone number to the authentication server when the user requests authentication login in the authentication service use step; A fourth step of confirming whether the authentication server is an authentication service subscriber when the authentication server receives the mobile phone number of the user and activating an authentication app of the user mobile phone to extract unique information (ICCID) if it is an authentication service subscriber; A fifth step of the authentication app receiving the user's ID and password and transmitting the same to the authentication server together with unique information (ICCID); A sixth step of the authentication server comparing the received unique information (ICCID) with stored unique information (ICCID) or unique information (ICCID) stored in the mobile communication company server to perform primary authentication; A seventh step of the service server receiving the primary authentication result and the ID and the password from the authentication server and comparing the ID and the password with the self-registered ID and password to perform secondary authentication; And an eighth step of the service server providing a service to the user according to the authentication result.

In another embodiment of the present invention, a user inputs subscriber information such as a mobile phone number for payment or personal authentication on a web site such as a shopping mall or a content provider site subscribed to from a PC or a mobile phone, ) Or a request for authentication or authentication to the authentication agent server; The payment server or the authentication agent server requesting the user to authenticate the user; A third step of transmitting a user authentication result to a payment server or an authentication agent server; The payment server or the authentication agent server requests authentication to the authentication server using the USIM; A fifth step of activating the authenticated app in the user's mobile phone by pushing the authenticated app to the mobile phone of the corresponding subscriber; The payment server or the authentication agent server transmits OTP to the user's PC or cellular phone; The user inputs the OTP from the user's mobile phone or the user PC; The authentication app extracts the ICCID stored in the USIM and transmits the extracted ICCID to the authentication server together with the OTP; The authentication server compares the ICCID transmitted from the user's cellular phone with the ICCID of the corresponding subscriber registered in advance, and then transmits the authentication result and the OTP to the payment server after authenticating the ICCID; The payment server or the authentication agent server performs OTP authentication, and if the user authentication is successful, the payment server is approved and the web site is completed with the payment or authentication process.

In order to achieve the above object, the system of the present invention comprises a USIM of a user terminal for storing a user's password and unique information, a service server or a payment server or an authentication agent server for providing a service to the user, An authentication server for storing user information such as unique information (ICCID), authenticating unique information (ICCID), and mediating user authentication; authentication means for authenticating whether the user is a legitimate user who can use the user authentication method, A mobile communication company server for transmitting information, and a user terminal connected to the service server and the authentication server to enable user authentication.

The user authentication method according to the present invention authenticates the user using the OTP or the password stored in the USIM or the service server, and performs the second authentication using the subscriber specific information (ICC ID, IMSI) of the USIM to double-authenticate the user. The service can be used. In particular, since the present invention can store the password in the USIM of the mobile terminal and authenticate the same using the same, it is safe from the hacking of the PC or the smartphone, and the subscriber information (ICC ID) Of the mobile phone and transmits the OTP to the PC instead of the mobile phone and inputting the application password instead of the OTP or the smart phone, thereby preventing the sms from being smuggled by the installation of malicious apps. In addition, the subscriber information can be read only by a trusted carrier authorized by the mobile communication company, so that it is possible to prevent the pharming due to the up / modulation of the application (App).

Since the present invention is double-authenticated by using the password and the subscriber information, even if the personal information such as the ID and the password is leaked, it is possible to prevent the damage due to leakage of personal information because the subscriber information is not known, It is possible to prevent hacking damage due to indiscriminate use of cookies, and it is safe from keyboard hacking and the like because the authentication means storage and media are separated in the PC.

In addition, since the user is required to input only the password at the time of authentication, and the subscriber information authentication is performed without the user knowing it, the procedure can be simplified rather than the authentication method that has been performed, It is possible to prevent inconvenience caused by

FIG. 1 is a schematic diagram showing an overall network configuration of a user authentication system using a USIM according to the present invention.
FIG. 2 is a flowchart illustrating a procedure for a user to input and store a password directly in a USIM in the first embodiment of the present invention. FIG.
3 is a flowchart illustrating a procedure for storing a password in a USIM through a mobile communication network in the first embodiment of the present invention.
FIG. 4 is a flowchart illustrating a procedure for authenticating a user using a USIM according to the first embodiment of the present invention; FIG.
5 is a flowchart illustrating a procedure for subscribing to an authentication service according to a second embodiment of the present invention;
6 is a flowchart showing a procedure for using an authentication service according to a second embodiment of the present invention;
FIG. 7 is a flowchart illustrating a procedure of applying an authentication service to a micropayment according to a third embodiment of the present invention;
8 is a flowchart showing an authentication procedure using a password instead of OTP in a micropayment according to a third embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. The following examples are merely illustrative of the present invention and are not intended to limit the scope of the present invention.

1 is a network configuration diagram of a user authentication system using a USIM according to the present invention.

1, a user authentication system 100 according to the present invention includes a user's cellular phone 112 equipped with a USIM for storing a user's password and unique information, a service server A service server 120 for providing a service to a user, a user information such as a mobile phone number, unique information (ICCID), and the like, (ICCID) and mediates user authentication; a mobile communication company server (hereinafter referred to as " user ") that authenticates whether the user is a legitimate user who can use the user authentication method and transmits user information to the authentication server 140, a payment server 150, a wired / wireless Internet 102 and a mobile communication network 104 for connecting the respective entities. In the exemplary embodiment of the present invention, the user terminal 110 has been described as an example of a user terminal. However, various types of wired / wireless terminals that can access the Internet, such as a smart phone, a tablet PC,

Referring to FIG. 1, the Internet 102 refers to a network of networks conforming to the TCP / IP communication protocol for connecting a computer network scattered around the world via wire / wireless, as is well known. The mobile communication network 104 is composed of a base station (BS) and a base station controller (BSC), and is a comprehensive communication network including an access network of CDMA, WCDMA as well as LTE, LTE-A and a mobile communication system to be implemented in the future.

The user PC 110 is a personal computer that can access the Internet. The USIM included in the user cell phone 112 is a card-like module that can be used in a mobile phone. The USIM is used for authentication, charging, UICC (Universal Integrated Circuit Card), which is a smart card for communication, which stores personal information so as to provide various services. Various information including unique subscriber information (IMSI, ICCID) is stored in the USIM. In the embodiment of the present invention, unique information given to each USIM is simply referred to as 'ICCID'.

The service server 120 is a normal service site in which a user connects to the user PC 110 or the mobile phone via the Internet 102 to use content or purchase goods, . In other words, the service server 120 is a server of a company that mediates various sites, online shopping malls, portal sites, or settlement businesses that require login, and authentication services.

The authentication server 130 is a server for providing user authentication using a USIM according to the present invention. The authentication server 130 stores information necessary for user authentication such as a mobile phone number and ICCID, performs authentication, transmits an authentication result, It serves to mediate certification work.

The mobile communication company server 140 stores information on the mobile communication subscriber (subscriber information stored in the USIM), thereby authenticating whether the mobile phone user is a subscriber of the mobile communication company, transmitting the necessary customer information to the authentication server 130, Update information.

The payment server (PG) 150 is a payment gateway (PG) or a payment agency service server for processing payment according to a request of the service server 120. [

According to the present invention for authenticating a user using the user authentication system 100, the procedure differs depending on whether or not a password is stored in the USIM of the mobile phone 110. In the embodiment of the present invention, A first embodiment of authenticating using an authentication application of the mobile phone and authenticating with an ICCID by the authentication server 130; and a second embodiment of authenticating by using the ICCID in the service server 120 without storing the password in the USIM, A second embodiment for authenticating with ICCID, and a third embodiment, which is a micropayment procedure to which the authentication service of the present invention is applied, will be described below.

[First Embodiment]

FIG. 2 is a flowchart illustrating a procedure in which a user directly inputs and stores a password in a USIM according to a first embodiment of the present invention. That is, in the method of FIG. 2, the password is not stored in the service server 120 but directly stored in the USIM of the user's cell phone 112 to authenticate the user.

Referring to FIG. 2, the user enters cell phone information necessary for using the user authentication using the USIM in the user PC 110 or the cellular phone to the service server 120, and the service server 120 transmits To the server 130 (S101, S102).

The authentication server 130 transmits the mobile phone information to the communication company server 140 and requests the user to authenticate whether the user is a legitimate user capable of authenticating the user using the USIM (S103).

After receiving the mobile phone information, the communication server 140 transmits the authentication result and the customer information to the authentication server 130 (S104, S105). Here, the customer information is the information of the user registered in the communication company server 140 such as the mobile phone number and the ICCID.

The authentication server 130 stores the customer information (ICCID) transmitted from the communication company server 140 in the database DB of the authentication server 130 and pushes the authentication application to the user mobile phone 112 to request the password input (S106).

The authenticated app executed in the user cell phone 112 requests the user to input the password, and stores the password in the USIM of the user's cell phone 112 when the password is input (S107, S108).

3 is a flowchart illustrating a procedure for storing a password in a USIM through a mobile communication network for user authentication using a USIM according to a first embodiment of the present invention. That is, FIG. 2 illustrates a method in which a user directly inputs a password through an authentication application, FIG. 3 illustrates a method in which the service server 120 provides a password in a case where a user ID and a password (ID / PWD) The authentication server 130 stores the password to the USIM of the corresponding user's cellular phone 112 via the mobile communication network 104. [

Referring to FIG. 3, an ID and a password PWD are registered in the service server 120 by the user.

After the user logs in the service server 120 using the user PC 110 or the cellular phone and inputs the cellular phone information to the service server 120 for user authentication, the service server 120 transmits the cellular phone information of the user And transmits the password to the authentication server 130 (S201, S202).

The authentication server 130 temporarily stores the password, and transmits the cellular phone information to the communication company server 140 to request the user to authenticate whether the user is a legitimate user capable of authenticating the user using the USIM (S203).

The communication company server 140 having received the mobile phone information transmits the authentication result, the mobile number, and the ICCID to the authentication server 130 (S204, S205).

The authentication server 130 stores the user information (customer information) transmitted from the communication company server 140 in the database DB of the authentication server 130 and moves the password of the user received from the service server 120 (S206, S207), the authentication application transmits the password to the USIM of the user's cell phone 112 by pushing the authentication app.

4 is a flowchart illustrating a procedure for authenticating a user using a USIM stored with a password according to the first embodiment of the present invention.

4, the user inputs cell phone information to the service server 120 to request user authentication using the USIM from the user PC 110 or the cellular phone, and the service server 120 transmits the cellular phone information to the authentication server 130 (S301, S302).

The authentication server 130 compares the cellular phone information requested to be authenticated with the information of the database (DB) stored in the authentication server 130 and confirms whether the user can use the user authentication method using the USIM (S303). When the requested user is identified as a legitimate user who can use the user authentication method using the USIM, the authentication server 130 requests the password input by pushing the authentication application to the corresponding user's cell phone 112 (S304).

When the user inputs the password in the user's cell phone 112, the authentication app compares the password stored in the USIM of the user's cell phone 112 with the password input by the user and authenticates (S305, S306).

When the password authentication is completed, the authentication application extracts and encrypts the ICCID of the user mobile phone USIM 112, and transmits the password authentication result and ICCID to the authentication server 130 (S307, S308).

The authentication server 130 compares the ICCID stored in the database DB of the authentication server 130 with the ICCID transmitted from the user's cellular phone 110 or the ICCID of the mobile communication company server 140 to perform USIM authentication, And the authentication result of the ICCID to the service server 120 (S309, S310).

When the authentication result is successfully completed, the service server 130 provides a service such as login and payment. If the authentication result does not normally complete, the service server 130 notifies the user of the authentication failure message (S311 to S313).

 [Second Embodiment]

5 is a flowchart illustrating a procedure for subscribing to an authentication service according to a second embodiment of the present invention.

Referring to FIG. 5, a user is registered in the service server 120 and an ID and a password PWD are registered in the subscriber database (S401 and S402).

After the user inputs the user's mobile phone number into the user's PC 110 or cellular phone, the service server 120 transmits the mobile phone number to the authentication server 130 and requests the authentication service subscription S403, S404).

The authentication server 130 transmits the delivered mobile phone number to the communication company server 140 to request a name confirmation, and the communication company server 140 confirms the name and transmits the corresponding customer information to the authentication server 130 (S405- S407).

After the authentication server 130 stores the customer information requesting the authentication service in its own database, the authentication server 130 transmits a text message (SMS) including the download URL for installing the authentication app to the corresponding user's cellular phone 112 (S408 and S409) .

Accordingly, the user's cell phone 112 installs the authentication application, subscribes to the authentication service, inputs the ID and the password of the service server 120, and requests the authentication server 130 to perform ID and password verification (S410- S413).

The authentication server 130 transmits the ID and the password to the service server 120 to request the ID and the password verification. The service server 120 verifies the received ID and password, and then transmits the verification result to the authentication server 130 (S414 to S416).

The authentication server 130 receives the result of the ID and the password verification, processes the completion of the authentication service subscription if the user is a legitimate user, transmits the authentication service subscription information to the service server 120, And notifies completion (S417 to S419).

6 is a flowchart illustrating a procedure for using a user authentication service according to a second embodiment of the present invention. First, the subscriber information about the authentication service subscribers is updated frequently between the authentication server 130 and the mobile communication server server 140, and the latest customer information is stored in the database of the authentication server 130 (S513).

6, the user accesses the service server 120 and selects 'authentication login (secure login)' among the general login and 'authentication login (secure login)', and inputs the mobile phone number (S501 and S502) .

The service server 120 sends the mobile phone number to the authentication server 130 to request user authentication, and the authentication server 130 activates the authentication application of the mobile phone (S503 to S505).

The authentication application of the mobile phone extracts the ICCID from the USIM of the user's cell phone 112, receives the ID and the password, and transmits it to the authentication server 130 (S506 to S508).

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the internal database DB or the ICCID of the mobile communication company server 140 to authenticate the user and transmits the ICCID authentication result, To the server 120 (S509, S510).

If the ICCID authentication result is a valid user, the service server 120 compares the ID and the password transmitted from the user with the self-registered ID and password, and permits the login according to the verification result (S511, S512).

[Third Embodiment]

7 is a flowchart illustrating a procedure of applying an authentication service to a micropayment according to a third embodiment of the present invention. In the third embodiment, the service server 120 is a web site such as a shopping mall or a contents provider (CP) site .

Referring to FIG. 7, when a user purchases goods or contents from a web site 120 such as a shopping mall or a contents provider site subscribed to the authentication service according to the present invention using the PC 110 or a mobile phone, Subscriber information such as a mobile phone number is input (S601). The web site 120 requests payment from the payment gateway 150 and the payment server 150 requests the communication company 140 to perform subscriber authentication in steps S602 and S603. The communication company 140 transmits the subscriber authentication result to the payment server 150. If the subscriber is a legitimate subscriber, the payment server 150 requests the authentication server 130 to authenticate using the USIM (S604, S605).

The authentication server 130 pushes the authentication application to the mobile phone 112 of the subscriber and activates the authentication application in the user mobile phone 112. The payment server 150 transmits an OTP (One Time Password) authentication to the user PC 110 (S606, S607). The user inputs the OTP in the user's cellular phone 112, and the authentication app extracts the ICCID stored in the USIM and transmits it to the authentication server 130 together with the input OTP (S606 to S611). As described above, in the present invention, the payment server 150 transmits the OTP to the user PC 110, and allows the user phone 112 on which the USIM is installed to input the OTP.

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the corresponding subscriber registered in advance, authenticates the ICCID, and transmits the authentication result and the OTP to the payment server 150 (S612 and S613). The payment server 150 performs OTP authentication, and if all user authentication is successful, the payment server 150 approves the payment, and the website 120 completes the payment processing (S614 to S616).

8 is a flowchart showing an authentication procedure using a password instead of OTP in a micropayment according to a third embodiment of the present invention.

Referring to FIG. 8, when a user purchases goods or contents from a web site 120 such as a shopping mall or a contents provider site subscribed to the authentication service according to the present invention using the user PC 110, The subscriber information such as the number is input (S701). The web site 120 requests payment from the payment gateway 150 or the authentication agency and the payment server 150 or the authentication agency requests the communication company server 140 to perform subscriber authentication in steps S702, S703). The communication company server 140 transmits the subscriber authentication result to the payment server 150. If the subscriber is a legitimate subscriber, the payment server 150 requests the authentication server 130 to authenticate using the USIM (7604, S705).

The authentication server 130 pushes the authentication application to the cell phone 112 of the subscriber, activates the authentication application in the user cell phone 112, and requests the application password authentication (S706, S707). App passwords are passwords you have set up in advance.

The user inputs the app password in the user's cell phone 112 to perform the app password authentication, and the authentication app extracts the ICCID stored in the USIM and transmits it to the authentication server 130 together with the app password authentication result (S708 to S710).

The authentication server 130 compares the ICCID transmitted from the user's cellular phone 112 with the ICCID of the corresponding subscriber registered in advance, authenticates the ICCID, and transmits the authentication result and the application password authentication result to the payment server 150 (S711) . The payment server 150 approves the settlement if all user authentication is successful, and the service site 120 completes the settlement processing accordingly (S712 to S714).

 As described above, according to the present invention, the payment server 150 can prevent the smsing by performing the application password authentication using the authentication application and the authentication using the USIM without using the OTP capable of smoothing.

That is, the present invention can prevent damage due to leakage of personal information by performing double user authentication using unique subscriber information stored in a USIM of a user's mobile phone and a password stored in a service server or a USIM, And authentication of the owner's cellular phone is authenticated by the subscriber information (ICC ID), which is a unique identification number assigned to the USIM, so that smsing due to SMS deception can be prevented. And subscriber information can be read only by a trusted carrier approved by the mobile carrier, thus preventing pharming due to up / modulation of the app.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

102: Internet 104: Mobile communication network
110: user PC 112: user mobile phone
120: service server 130: authentication server
140: carrier company server 150: payment server
100: User authentication system

Claims (12)

A first step of storing unique information (ICCID) for user authentication in its own database by confirming whether the authenticated user is a valid user to the mobile communication company server when the authentication server receives the mobile phone number of the user in the authentication service subscribing step;
A second step of storing the user's password in the user's mind (USIM) in the authentication service subscription step;
A third step of confirming whether the authentication server is a subscriber of the authentication service when the authentication server receives the mobile phone number of the user in the authentication service utilization step and requesting the user to input the password;
A fourth step of, when the password is input to the user's mobile phone, comparing the inputted password with the password stored in the USIM;
A fifth step of extracting the intrinsic information (ICCID) stored in the idle state together with the password authentication result by the authentication app, and transmitting the ICCID to the authentication server;
A sixth step of comparing the unique information (ICCID) transmitted by the authentication server with the stored unique information (ICCID) or comparing with the unique information (ICCID) of the mobile communication company to perform secondary authentication;
A seventh step of the authentication server transmitting an authentication result to a service server; And
And the service server providing a service to the user according to the authentication result. 2. The method of claim 1,
Wherein the authentication server transmits a password to the authentication server via the mobile communication network and stores the authentication password in the user's mobile phone through the mobile communication network. USIM). A first step of registering an ID and a password on a service server;
A second step of confirming whether the authenticated user is a valid user in the mobile communication company server when the authentication server receives the mobile phone number of the user in the authentication service subscription step and storing unique information (ICCID) for user authentication in its own database;
A third step of receiving the mobile phone number from the service server and transmitting the mobile phone number to the authentication server when the user requests authentication login in the authentication service use step;
A fourth step of confirming whether the authentication server is an authentication service subscriber when the authentication server receives the mobile phone number of the user and activating an authentication app of the user mobile phone to extract unique information (ICCID) if it is an authentication service subscriber;
A fifth step of the authentication app receiving the user's ID and password and transmitting the same to the authentication server together with unique information (ICCID);
A sixth step of the authentication server comparing the received unique information (ICCID) with stored unique information (ICCID) or comparing it with unique information (ICCID) of the mobile communication company to perform primary authentication;
A seventh step of the service server receiving the primary authentication result and the ID and the password from the authentication server and comparing the ID and the password with the self-registered ID and password to perform secondary authentication; And
And the service server providing a service to the user according to the authentication result. The service server receiving subscriber information such as a mobile phone number for payment;
When the service server requests payment to the payment server, the payment server requests the communication company server to perform subscriber authentication;
If the authentication result of the communication company is a legitimate subscriber, the payment server requests authentication to the authentication server using USIM;
The authentication server activates the authentication application in the user's cellular phone by pushing the authentication application to the cellular phone of the subscriber, and the payment server transmits a message for OTP authentication to the user computer;
The authentication application extracts unique information (ICCID) stored in the USIM and transmits it to the authentication server together with the input OTP. The authentication server compares the transmitted unique information (ICCID) with the unique information (ICCID) of the registered subscriber Authenticating the unique information (ICCID) and transmitting the authentication result and the OTP to the payment server; And
Wherein the payment server performs OTP authentication and approves the payment if all user authentication is successful, thereby completing the payment processing by the service server. 5. The method according to claim 4,
The method comprising: transmitting a message for OTP authentication to the user computer; and inputting an OTP to the user's mobile phone The service server receiving subscriber information such as a mobile phone number for payment;
When the service server requests payment to the payment server, the payment server requests the communication company to perform subscriber authentication;
If the authentication result of the communication company is a legitimate subscriber, the payment server requests authentication to the authentication server using USIM;
The authentication server pushing the authentication application to the cell phone of the subscriber, activating the authentication application in the user's cell phone and requesting the application password authentication;
The authentication application processes the app password authentication, extracts the unique information (ICCID) stored in the USIM, and sends it to the authentication server together with the application password authentication result. The authentication server transmits the unique information (ICCID) Authenticating unique information (ICCID) by comparing with unique information (ICCID), and transmitting the authentication result to a payment server; And
Wherein the payment server approves payment when all user authentication is successful, and then the service server completes the payment processing accordingly. 7. The method of claim 6,
And authenticating the user by inputting the app password to the user's mobile phone without transmitting the OTP 8. The method according to any one of claims 1 to 7,
The unique information
And an international mobile communication subscriber code (IMSI) or an integrated circuit card identifier (ICCID) corresponding to a user's mobile phone number. 8. The method according to any one of claims 1 to 7,
The user inputs the user's mobile phone information to the user's PC or mobile phone and transmits the mobile phone's information to the authentication server. The authentication server transmits the mobile phone information to the mobile communication company server, compares the mobile phone number with the mobile communication company server, Whether the user is a user who can use the service, and a user identification method using the USIM. 8. The method according to any one of claims 1 to 7,
Wherein the password is inputted only by the authentication server and the user's pre-determined password, and is compared with the password stored in the USIM or the service server to confirm whether the user himself or herself is correct. 8. The method according to any one of claims 1 to 7,
Wherein the password authentication result and unique information (ICCID) in the mobile phone are encrypted and transmitted to the authentication server. (USIM) of a user terminal for storing a user's password and unique information,
A service server for providing a service to a user,
An authentication server for storing user information such as a mobile phone number and unique information (ICCID), authenticating unique information (ICCID) and mediating user authentication,
A communication company server which authenticates whether the user is a legitimate user who can use the user authentication method and transmits the user information to the authentication server,
And a user terminal connected to the service server and the authentication server to enable user authentication.

Images