KR20170029944A - Apparatus for user authentication - Google Patents
Apparatus for user authentication Download PDFInfo
- Publication number
- KR20170029944A KR20170029944A KR1020150127141A KR20150127141A KR20170029944A KR 20170029944 A KR20170029944 A KR 20170029944A KR 1020150127141 A KR1020150127141 A KR 1020150127141A KR 20150127141 A KR20150127141 A KR 20150127141A KR 20170029944 A KR20170029944 A KR 20170029944A
- Authority
- KR
- South Korea
- Prior art keywords
- service
- master
- authentication key
- program
- user
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Power Engineering (AREA)
- Storage Device Security (AREA)
Abstract
An apparatus for communicating with a master server and a service server according to an aspect of the present invention includes at least one processor; Memory; And a master program and a service program stored in the memory and configured to be executed by the one or more processors, wherein the master program includes a plurality of different service secret hashes using different service secret divisors input from the user, And the service program generates a service user authentication key using the selected service secret hash value and the personal secret number among the plurality of service secret hash values and stores the service user authentication key as authentication information Wherein the master program maps the unique code received from the service program to the selected service secret hash value among the plurality of service secret hash values and stores the unique code.
Description
BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to user authentication, and more particularly, to an apparatus for user authentication that realizes double security using a hash function.
Today, communication networks around the world are interconnected so that the exchange of information through the Internet is becoming common, so that the retrieval, storage and extraction of information becomes more and more active. On the other hand, the technique of recognizing a user using a specific server is used The leakage of personal information and the hacking of the network are also serious social problems. In the meantime, typical hacking activities in Korea are mainly simple intrusion, identity theft, data cut, data modification and destruction. Hacking situation in foreign countries is very serious compared to domestic ones.
In the conventional general user authentication scheme, when a user provides his / her identification information (ID) and a password to the server side, the server side stores a hash function for all user's passwords, Take a value, compare the two values, and verify that the user is a legitimate user. For reference, a hash function is a function that can be computed quickly and easily in one direction, but computes theoretically in the reverse direction.
However, in the conventional user authentication technique, if the user identification information and the password are exposed, the personal information may be exposed as well, so that the security is weak. Also, when the authentication program is copied or copied, . Also, there is a problem that security is weak because of one-dimensional authentication by ID and password.
The present invention has been proposed in order to solve the above-mentioned problems, and it is an object of the present invention to provide a method and system for authenticating a user who can authenticate a user by using multiple security means The purpose of the device is to provide.
According to an aspect of the present invention, there is provided an apparatus for communicating with a master server and a service server, the apparatus comprising: at least one processor; Memory; And a master program and a service program stored in the memory and configured to be executed by the one or more processors, wherein the master program includes a plurality of different service secret hashes using different service secret divisors input from the user, And the service program generates a service user authentication key using the selected service secret hash value and the personal secret number among the plurality of service secret hash values and stores the service user authentication key as authentication information Wherein the master program maps the unique code received from the service program to the selected service secret hash value among the plurality of service secret hash values and stores the unique code.
Wherein the service program receives a personal secret number and a disposable secret code issued by the service server at the time of authentication of the user, transmits the unique code to the master program to request a service secret hash value, A service secret hash value corresponding to the unique code from the program, generates a service user authentication key using the received service secret hash value and the inputted personal secret, and transmits the service user authentication key and the disposable secret Transmits an authentication request including a one-time authentication key generated using a password to the service server, and transmits an authentication response based on a comparison result between the one-time authentication key generated by the service server and the one- .
Wherein the master program generates a master device authentication key using unique information of the device and encrypts each of the plurality of service secret hash values together with the master device authentication key, and when receiving a service secret hash value request from the service program , The service secret hash value, and the master device authentication key, and then verify the decrypted master device authentication key.
The service program generates and stores a service device authentication key using unique information of the device, generates and stores a service program authentication key using the service device authentication key, the selected service secret hash value and the time stamp, , The service device authentication key and the service program authentication key are transmitted to the service server as authentication information and registered, and at the time of user authentication, a pre-authentication including the stored device authentication key and the stored service program authentication key Request to the service server. At this time, the one-time secret password may be issued when the device authentication key and the service program authentication key registered in the service server match the device authentication key and the service program authentication key included in the pre-authentication request.
Wherein the service program transmits the unique code to the master program upon authentication of the user and receives a service secret hash value corresponding to the unique code from the master program in response thereto, And generating a service user authentication key using the personal password input from the user and transmitting an authentication request including the service user authentication key to the service server, And receive the authentication response according to the comparison result of the service user authentication key included in the request.
The master program receives and stores a nickname for each of the plurality of service secret hash values, and the service program can select a service secret hash value based on the nicknames received from the master program.
The master program generates a master secret hash value using the master secret divisor input from the user, generates a master user authentication key using the private secret and the master secret hash value, And transmits the hash value to the master server and registers the hash value as the information, and when generating or changing the hash value of the service secret, the service secret hash value can be generated or changed upon successful authentication using the master user authentication key.
The master program may enable generation or modification of a service secret hash value upon successful authentication using the master user authentication key and the one-time secret password issued by the master server at the time of creating or changing the service secret hash value .
The master program generates and stores a master device authentication key using unique information of the apparatus, generates and stores a master program authentication key using the master device authentication key, the master secret hash value and the time stamp, The master device authentication key and the master program authentication key are transmitted to the master server as authentication information and registered, and when the service secret hash value is created or changed, the master device authentication key and the master program authentication key are used And may perform the final authentication using the master user authentication key.
In the present invention, when a user registers and uses different authentication information for each service server, the authentication information is stored in advance in a separate safe space so that the user can use the information for authentication only with simple input, Increase.
According to the present invention, multiple authentication is performed using a device authentication key, a program authentication key, a user authentication key, and a one-time secret password, Increase convenience.
1 is a diagram illustrating an authentication system according to an embodiment of the present invention.
FIG. 2 is a diagram showing a configuration of a user terminal of FIG. 1. FIG.
3 is a flowchart illustrating a process of registering a service secret hash value according to an embodiment of the present invention.
4 is a flowchart illustrating a process of setting authentication information for a specific service server according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a process of logging into the
The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 is a diagram illustrating an authentication system according to an embodiment of the present invention, and FIG. 2 is a diagram illustrating a configuration of a user terminal of FIG.
1, the authentication system according to the present embodiment includes a
The
The
The
The I /
The
In some embodiments, the software components include an operating system 111, a graphics module (instruction set) 112, a master program 113 (instruction set), and a
The operating system 111 may be an embedded operating system such as, for example, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS or VxWorks, Android, Management, storage control, power management, etc.), and facilitates communication between the various hardware and software components.
The
The
The
The service secret hash value is stored in the
The
The
The
The
Alternatively, when user authentication is required, the
When the
The
The
Alternatively, the
The
The
Hereinafter, the secret hash value, the device authentication key, the program authentication key, the user authentication key, and the one-time authentication key will be described.
The secret hash value is generated using the secret divisor input from the user through the input device of the
The
The master secret hash value and the service secret hash value are different from each other because the seed secret secrets are different from each other. Also, when there are multiple service secret hash values, secret secrets of each service secret hash value are also different from each other, and therefore, each service secret hash value is different. The service secret hash value is stored in synchronization with the
The secret hash value may not be stored by itself, but may be encrypted and stored. When encrypting, the secret hash value can be encrypted with the device authentication key. Therefore, the
The device authentication key is a value generated by inputting unique information of the
The program authentication key is a value generated by inputting a device authentication key, a time stamp, and a secret hash value into a hash function as a seed value. The time stamp is a character string indicating the time at which the program authentication key is generated. Accordingly, the master program authentication key is generated from the master device authentication key, the time stamp, and the master secret hash value, and the service program authentication key is generated from the service device authentication key, the time stamp, and the service secret hash value. The program authorization key may be stored in
The user authentication key is a value generated by inputting a secret hash value and a personal password input by the user through the input device into the hash function as a seed value. Thus, the master user authentication key is generated from the master secret hash value and the personal password, and the service user authentication key is generated from the service secret hash value and the personal password. At this time, the personal password input by the user when generating the master user authentication key and the personal password input when generating the service user authentication key may differ depending on the user's selection. The personal password may be, for example, a six-digit number. However, it is not limited thereto and may be a combination of numbers and letters. Compared with the secret divisor, the secret divisor is a long text string or an image file, but the personal password input by the user when generating the user authentication key is a certain number of digits.
Among the above-described secret hash value, device authentication key, program authentication key, and user authentication key, the device authentication key and the program authentication key are both stored in the
The one-time secret password is a value generated in the
The one-time authentication key is a value generated by inputting the one-time secret password inputted by the user and the user authentication key into the hash function as the seed value. Specifically, when the disposable secret password is issued from the
There are two types of authentication success.
First, the
Secondly, the
In the above description, the user is authenticated using both the device authentication key, the program authentication key, and the user authentication key. However, the user can be authenticated using only the user authentication key, and the device authentication key and the program authentication key It can be used for authentication. In the case of using the device authentication key, it is possible to prevent authentication from being attempted by another
On the other hand, the above-described authentication method can be applied when the user sets a new service secret hash value in the
3 is a flowchart illustrating a process of registering a service secret hash value according to an embodiment of the present invention.
3, the user executes the
The
The
Next, a service secret hash value to be selectively used by the plurality of
The user selects the service secret divisor through the input device of the user terminal 100 (S311). A service secret divider can be either a long string, an image file, a sound file, or a video file, as well as a master secret divisor. And the master secret divisor and the service secret divisor are chosen to be different. Then, the user inputs a nickname for the selected service secret divisor through the input device of the user terminal 100 (S313).
The
The
In this manner, the user can set a plurality of service secret hash values. Each of the service secret hash values is different in secret value by different secret numbers. Also, by differentiating the nickname of each service secret hash value, the user can easily distinguish each service secret hash value.
On the other hand, the
4 is a flowchart illustrating a process of setting authentication information for a specific service server according to an exemplary embodiment of the present invention. For example, it is an example of setting login authentication using the authentication information according to the present invention, rather than login authentication using an ID / password, while registering in the
Although not shown in FIG. 4, the user can execute the
Referring to FIG. 4, the
The
The
The
The
The
5 is a flowchart illustrating a process of logging into the
Referring to FIG. 5, the user executes the
The
The
The
The
The
The
The
The
When the authentication is successful, the
As described above with reference to FIG. 5, the user does not need to select the secret divisor to log in to the
In the embodiment with reference to Fig. 5, authentication of the user using the one-time secret password will be described. However, you do not need to use a one-time secret password. That is, when the personal password is input from the user in step S505, the
While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.
Although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed to obtain a sequence of sequential orders, or a desired result . In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.
The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.
It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.
100: user terminal
200: master server
400: service server
Claims (9)
One or more processors;
Memory; And
A master program and a service program stored in the memory and configured to be executed by the one or more processors,
The master program includes:
Generates and stores a plurality of different service secret hash values using different service secret powers inputted from the user,
The service program includes:
Generates a service user authentication key using the selected service secret hash value and the personal secret number among the plurality of service secret hash values, transmits the service user authentication key to the service server as authentication information,
The master program includes:
And maps the unique code received from the service program to the selected service secret hash value among the plurality of service secret hash values.
Wherein the service program, when authenticating the user,
A personal password, and a disposable secret code issued by the service server,
Transmitting the unique code to the master program to request a service secret hash value and receiving a service secret hash value corresponding to the unique code from the master program in response thereto,
Generating a service user authentication key using the received service secret hash value and the input personal password, and transmitting the authentication request including the service user authentication key and the one-time authentication key generated using the one- And receives an authentication response according to a result of the comparison between the one-time authentication key generated by the service server and the one-time authentication key included in the authentication request.
The master program includes:
Generates a master device authentication key using unique information of the device and encrypts each of the plurality of service secret hash values together with the master device authentication key,
And decrypting the service secret hash value and the master device authentication key and verifying the decrypted master device authentication key when receiving the service secret hash value request from the service program.
The service program includes:
Generates and stores a service device authentication key using the unique information of the device, generates and stores a service program authentication key using the service device authentication key, the selected service secret hash value and the time stamp, Key and the service program authentication key are transmitted to the service server as authentication information and registered,
Upon authentication of the user,
Transmitting a pre-authentication request including the stored device authentication key and the stored service program authentication key to the service server,
Wherein the one-time secret code is issued when a device authentication key and a service program authentication key registered in the service server match with a device authentication key and a service program authentication key included in the pre-authentication request.
Wherein the service program, when authenticating the user,
Transmitting the unique code to the master program and receiving a service secret hash value corresponding to the unique code from the master program in response thereto,
Generates a service user authentication key using the received service secret hash value and the personal password input by the user, transmits an authentication request including the service user authentication key to the service server, And receives an authentication response according to a comparison result of the service user authentication key and the service user authentication key included in the authentication request.
The master program includes:
Stores a nickname for each of the plurality of service secret hash values,
The service program includes:
Wherein the service secret hash value is selected based on nicknames received from the master program.
The master program includes:
Generates a master secret hash value using a master secret divisor input from a user, generates a master user authentication key using the private password and the master secret hash value, and transmits the master user authentication key as authentication information to the master server And registers,
Upon creation or modification of the service secret hash value,
And to generate or change a service secret hash value upon successful authentication using the master user authentication key.
The master program, when generating or changing a service secret hash value,
And to generate or change a service secret hash value upon successful authentication using the master user authentication key and the one-time secret password issued by the master server.
The master program includes:
Generates and stores a master device authentication key using unique information of the user device, generates and stores a master program authentication key using the master device authentication key, the master secret hash value and the time stamp, Key and the master program authentication key are transmitted to the master server as authentication information and registered,
Upon creation or modification of the service secret hash value,
Performs pre-authentication using the master device authentication key and the master program authentication key, and performs final authentication using the master user authentication key.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| KR1020150127141A KR101746598B1 (en) | 2015-09-08 | 2015-09-08 | Apparatus for user authentication |
| PCT/KR2015/009523 WO2016039568A1 (en) | 2014-09-11 | 2015-09-10 | Device and method for user authentication |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| KR1020150127141A KR101746598B1 (en) | 2015-09-08 | 2015-09-08 | Apparatus for user authentication |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| KR20170029944A true KR20170029944A (en) | 2017-03-16 |
| KR101746598B1 KR101746598B1 (en) | 2017-06-13 |
Family
ID=58497842
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| KR1020150127141A KR101746598B1 (en) | 2014-09-11 | 2015-09-08 | Apparatus for user authentication |
Country Status (1)
| Country | Link |
|---|---|
| KR (1) | KR101746598B1 (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20100101887A (en) | 2009-03-10 | 2010-09-20 | 삼성전자주식회사 | Method and system for authenticating in communication system |
-
2015
- 2015-09-08 KR KR1020150127141A patent/KR101746598B1/en active IP Right Grant
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20100101887A (en) | 2009-03-10 | 2010-09-20 | 삼성전자주식회사 | Method and system for authenticating in communication system |
Also Published As
| Publication number | Publication date |
|---|---|
| KR101746598B1 (en) | 2017-06-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3605997B1 (en) | Method, apparatus and system for securing a mobile application | |
| EP3257194B1 (en) | Systems and methods for securely managing biometric data | |
| CN112425114B (en) | Password manager protected by public key-private key pair | |
| US20160104154A1 (en) | Securing host card emulation credentials | |
| KR20180117715A (en) | Method and system for user authentication with improved security | |
| WO2015183497A1 (en) | Cryptocurrency virtual wallet system and method | |
| KR101416542B1 (en) | Method for Apparatus for managing passcode | |
| CN103905188B (en) | Utilize the method and intelligent cipher key equipment of intelligent cipher key equipment generation dynamic password | |
| EP3813073B1 (en) | Method and system for securing sensitive information | |
| CN106487758B (en) | data security signature method, service terminal and private key backup server | |
| KR20160131744A (en) | Apparatus and method for user authentication | |
| WO2018043466A1 (en) | Data extraction system, data extraction method, registration device, and program | |
| KR20160150097A (en) | Apparatus and method for user authentication | |
| US10911236B2 (en) | Systems and methods updating cryptographic processes in white-box cryptography | |
| TWM540310U (en) | System for encryption and authentication | |
| KR101746598B1 (en) | Apparatus for user authentication | |
| EP3236631B1 (en) | Data checking device and data checking method using the same | |
| KR20160046655A (en) | Apparatus and method for user authentication using subscriber identification module | |
| KR101571126B1 (en) | Apparatus and method for user authentication | |
| CN103514540A (en) | USBKEY business realization method and system | |
| CA2904646A1 (en) | Secure authentication using dynamic passcode | |
| KR20160122556A (en) | Apparatus and method for otp authentication | |
| KR102005543B1 (en) | Apparatus and method for user authentication | |
| JP2014212420A (en) | Authentication medium, authentication terminal, authentication system, and authentication method | |
| KR20190068851A (en) | Operation method of server apparatus, operation method of terminal and server apparatus |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| A201 | Request for examination | ||
| E902 | Notification of reason for refusal | ||
| E701 | Decision to grant or registration of patent right | ||
| GRNT | Written decision to grant |