KR20180002370A - Method for Carrying Out Confirming Identity and Preventing Denial When Using Online Service by User Terminal Comprising Key Storage/Authentication Module - Google Patents

Abstract

According to the present invention, a user registration method is performed in an environment including a user terminal including a key storage/authentication module, an authentication relay server, an authentication server, and a certificate issuing agency server. The user registration method comprises: (1) a first step of allowing an authentication relay server to perform pre-authentication on the basis of information received from the user terminal; (2) a second step of transmitting a public key and additional information generated by the key storage/authentication module to the authentication relay server from the user terminal, after successful authentication by the key storage/authentication module; (3) a third step of allowing the authentication relay server to transmit user-specific information and the public key to an authentication server; (4) a fourth step of allowing the authentication server to transmit the user-specific information and the public key to a certificate issuing server; (5) a fifth step of allowing the authentication server to receive a certificate including the user-specific information and the public key from the certificate issuing server; and (6) a sixth step of allowing the authentication server to combine the certificate with the user-specific information and to store the same while not transmitting the same to the user terminal. Identity confirmation and denial prevention functions can be performed even without a change in the key storage/authentication module.

Description

Technical Field [0001] The present invention relates to a method for performing authentication and non-repudiation of a user terminal using an online service in a user terminal including a key storage and authentication module,

The present invention relates to a method for using an online service by performing a user identification and non-repudiation function in a user terminal including a key storage and authentication module.

When using services such as financial transactions or purchasing goods online, authorized certificates are widely used in order to check identity, verify the authenticity of service use, and prevent the denial of service details used by users. The official certificate serves as the seal certificate, and the private key provided in the pair with the official certificate serves as the seal stamp. When a user performs an electronic signature using a private key when using a service on-line, the owner with the private key can verify that the corresponding digital signature is legitimate by verifying with the public key in the public certificate existing in a pair with the corresponding private key.

Certified certificates have these advantages, but in recent years, problems such as the installation of ActiveX and the leakage of public certificates and private keys have also been raised.

In recent years, there has been an increase in the number of platforms supporting modules for storing keys (public keys and private keys) used for authentication in a hardware secure storage, for example, Secure Elements (SE), TrustZone, . An example of this is the FIDO standard.

In this way, the module that securely stores and authenticates the key is not stored in a file but stores it in a hardware-isolated storage. Since the operation is also performed in the storage, .

In this specification, a module that performs such a function is referred to as a "key storage / authentication module ".

Such a key storage / authentication module generates a public key and a private key, and performs a user authentication process, such as a biometric authentication process, in order to obtain a right to use a private key in performing authentication. After obtaining the authority to use the private key through the user authentication process, the random challenge value transmitted by the server with the private key is electronically signed and sent to the server. The server processes the user login by verifying the received digital signature value with the public key of the key storage / authentication module. However, such a conventional key storage / authentication module is merely an anonymous authentication which can not perform the owner authentication, and can not perform the identity verification or the non-repudiation prevention function.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an online service providing method that solves the above problems of the prior art and provides the identity verification and non-repudiation functions without changing the key storage / authentication module.

A user registration method according to the present invention is performed in an environment including a user terminal including a key storage / authentication module, an authentication mediation server, an authentication server, and a certificate issuing authority server, wherein (1) A first step of performing pre-authentication based on information received from a terminal; (2) a second step of authenticating the key storage / authentication module and receiving the public key and the additional information generated by the key storage / authentication module from the user terminal; (3) a third step of the authentication mediating server transmitting the user specific information and the public key to the authentication server; (4) a fourth step of the authentication server transmitting the user-specific information and the public key to the certificate issuing server; (5) a fifth step in which the authentication server receives a certificate including user-specific information and a public key from a certificate issuing server; (6) The authentication server includes a sixth step of storing the certificate in combination with the user-specific information and not transmitting it to the user terminal.

The additional information may include at least key storage / authentication module information and key identification information.

A user login method according to the present invention includes: (1) a first step of an authentication mediation server receiving and confirming user identification information from a user terminal; (2) a second step of the authentication mediation server transmitting a random challenge value and additional information to the user terminal; (3) a third step of the authentication mediation server receiving the digital signature value generated by the key storage / authentication module for the random challenge value and the additional information after authentication by the key storage / authentication module and verification of the additional information succeeds; (4) a fourth step of the authentication mediating server transmitting the user unique information, the random challenge value, and the digital signature value to the authentication server; (5) a fifth step of the authentication server loading a certificate corresponding to the user-specific information; (6) The authentication server verifies the digital signature value using the public key extracted from the certificate, and if the verification succeeds, the login step is permitted.

The login method according to the present invention may further include a step 5-1 in which the authentication server transmits the identification information of the certificate to the certificate issuance server, inquires about the validity of the certificate, and receives the result.

A non-repudiation service method for an on-line service used by a logged-in user by the above-mentioned method includes: (1) a first step of an authentication mediation server receiving service related information from a user terminal; (2) a second step of the authentication mediating server transmitting the additional information, the random challenge value, and the service related information to the user terminal; (3) After the authentication by the key storage / authentication module and the verification of the additional information and the service related information are successful, the key storage / authentication module transmits the random challenge value, the additional information and the digital signature value generated by the service related information to the authentication mediation server A third step of receiving the first signal; (4) a fourth step of the authentication mediating server transmitting the user's unique information, the random challenge value, the service related information and the digital signature value to the authentication server; (5) a fifth step of the authentication server loading a certificate corresponding to the user-specific information; (6) The authentication server verifies the digital signature value using the public key extracted from the certificate, and if the verification succeeds, the service-related information and the digital signature value are stored.

The non-repudiation method according to the present invention may further include a fifth step of the authentication server transmitting the identification information of the certificate to the certificate issuing server to inquire about the validity of the certificate and receiving the result.

According to the present invention, even when a user terminal equipped with a key storage / authentication module that can not be changed is used, the identity verification and the non-repudiation prevention functions can be performed. Therefore, even if a user certificate is not stored in the user terminal, Can be satisfied.

1 is a diagram illustrating a user registration process according to the present invention.
FIG. 2 is a diagram showing a process in which a user registered by FIG. 1 logs in; FIG.
FIG. 3 illustrates a non-repudiation process performed when a user who is logged in by using FIG. 2 uses an online service. FIG.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Encryption / decryption may be applied to the information (data) transmission process performed in the present specification, and the description describing the process of transmitting information (data) in the present specification and claims is not limited to encryption / decryption Should be construed as including. Expressions of the form "transfer from A to B" or "receive from A" in this specification include transmission (transfer) or reception of another medium in between, It does not just represent transmission (forwarding) or receiving. In the description of the present invention, the order of each step should be understood to be non-limiting, unless the preceding step must be performed logically and temporally before the next step. That is to say, except for the exceptional cases mentioned above, even if the process described in the following stage is performed before the process described in the preceding stage, it does not affect the essence of the invention and the scope of the right should be defined regardless of the order of the stages. &Quot; A " or " B " is defined herein to mean not only selectively pointing to either A or B, but also including both A and B. It is also to be understood that the term "comprising " is intended to encompass further including other elements in addition to the elements listed as being included.

FIG. 1 shows a process of registering a user to use an online service according to the present invention.

The present invention is performed in an environment including a user terminal 10 including a key storage / authentication module 15, an authentication mediation server 22, an authentication server 24, and a certificate issuing server 30. [ The authentication mediation server 22 and the authentication server 24 are controlled by the authentication service organization 20, and the database 25 is interlocked. The user terminal 10 can be used regardless of the types of electronic apparatuses that can perform electronic calculations such as a smart phone, a PC, and a tablet PC and are capable of data communication. The user terminal 10 can use an authentication function provided by the key storage / authentication module using a web browser or a mobile application. The authentication mediation server 22 and the authentication server 24 may be implemented as a single physical server or as a single physical server, It can also be implemented as a physically separate server. The certificate issuing server 30 is controlled by a certificate issuing authority (CA) such as a financial settlement company.

The user is authenticated according to the procedure required by the authentication service organization (20). For example, by visiting a financial institution and confirming a face-to-face identity, or through a non-face-to-face identification determined by the law, an identification process is performed in advance and predetermined information (pre- User identification information and password registration. In this specification, the user identification information may be an ID unique to the authentication service institution as the information selected by the user so as not to be duplicated with other users. On the other hand, the user-specific information is defined as meaning information that can be used uniquely for other than the authentication service organization such as a resident registration number or a mobile phone number of the user.

The user inputs pre-registered information such as ID / PW and the authentication mediation server 22 requests the pre-authentication (100). The authentication mediation server 22 confirms the user in the database 25 (105), and transmits the content to the user terminal 10 when the pre-authentication is successful.

If the pre-authentication is successful, the key storage / authentication module 15 is called and a user authentication process, for example, fingerprint authentication, which is mounted on the key storage / authentication module is performed (110). If the user authentication is successful, a public key and a private key are generated 115. The generated private key is stored in a hardware-isolated storage (e.g., USIM, SE, etc.) of the key storage / To the authentication mediation server 22 (120). It is preferable that additional information is transmitted together with the public key. The additional information may be key storage / authentication module information, key identification information (Key ID), and the like.

The authentication mediation server 22 transmits the user-specific information and the public key to the authentication server 24 (125). The authentication server 24 receives the service institution authentication 130 from the certificate issuing server 30 and transmits the user unique information and the public key to the certificate issuance server 30 when the authentication is successful. The certificate issuing server 30 issues a certificate of the user including the user specific information and the public key, and transmits the issued certificate to the authentication server 24. The authentication server 24 combines the certificate with the user information and stores it in the database 25 (150).

FIG. 2 illustrates a process in which a user logs in through authentication of an authentication service organization after the user registration process described above.

The user transmits the user identification information or ID to the authentication mediation server 22 through the user terminal 10 (200). The authentication mediation server 22 refers to the database 25 to confirm the user (205). If the authentication mediation server 22 is successful, the authentication mediation server 22 transmits the authentication policy and the random challenge value to the user terminal 10 (210). The authentication policy includes key storage / authentication module information and key identification information received as additional information.

The key storage / authentication module 15 is invoked to perform user authentication (such as biometric authentication such as fingerprint authentication) registered in advance (step 215). If authentication is successful, the authentication policy is checked, And performs digital signature on the challenge value and the additional information (220). The generated digital signature value is transmitted 225 to the authentication mediation server 22 and the authentication mediation server 22 transmits the user unique information, the random challenge value and the digital signature value to the authentication server 24 ). The authentication server 24 loads the certificate from the database 25 based on the user-specific information (235). Extracts the public key included in the certificate, and verifies the digital signature value using the extracted public key (240).

The authentication server 24 sends the certificate identification information to the certificate issuing server 30 (245), and the certificate issuing server 30 can verify the validity of the certificate (250). Although it has been shown that the certificate issuing server 30 verifies the validity of the certificate for convenience, it is preferable that a separate server for performing certificate validation is actually provided.

The certificate validation result is transmitted to the authentication server 24 (255). If the validation result is verified as a valid certificate, the authentication server 24 completes the login procedure (260).

FIG. 3 shows a process in which a non-repudiation method according to the present invention is performed when a user who has logged in through the process shown in FIG. 2 uses an online service. Actually, a server that provides an online service is not shown separately because it is not related to the content of the present invention.

2, when a user who is logged in uses the online service, the service related information is transmitted to the authentication mediation server 22 (300). When the online service is a financial transaction, the service related information may be financial transaction information (for example, a transfer amount, a transfer account, receiving account information in the case of a transfer), and in the case of purchasing an item at an online shopping mall, Product information, purchase amount, payment information, and the like may be service-related information.

The authentication mediation server 22 transmits the authentication policy, the random challenge value, and the service related information to the user terminal 10 (305). The key storage / authentication module 15 is called to perform pre-registered user authentication (e.g., biometric authentication such as fingerprint recognition) (310).

The key storage / authentication module 15 confirms the service related information to the user through the user terminal 10, and when the user confirms the additional information (key storage / authentication module information and key identification information, etc.) And then performs a digital signature on the challenge value, service related information, and additional information with the private key load and the private key (315). The digital signature value is transmitted to the authentication mediation server 22 (320). The authentication mediation server 22 transmits the user specific information, the random challenge value, the service related information, and the digital signature value to the authentication server 24 (325).

The authentication server 24 loads (330) the certificate from the database 25 based on the user-specific information, and verifies (335) the digital signature value using the extracted public key from the certificate.

The authentication server 24 transmits the certificate identification information to the certificate issuing server 30 (340), and the certificate issuing server 30 verifies the validity of the certificate (345). Although it has been described that the certificate issuing server 30 verifies the validity of the certificate as described with reference to FIG. 2, in practice, it is preferable that a separate server for performing certificate validation is provided. The certificate issuance server 30 transmits the validation result to the authentication server 24 and the authentication server 24 records the service related information and the digital signature value in the database 25 (355). According to the method of the present invention, the non-repudiation function can be provided to the service-related information used by the user without changing the key storage / authentication module 15.

According to the present invention, even when a user terminal equipped with a key storage / authentication module that can not be changed is used, the identity verification and the non-repudiation prevention functions can be performed. Therefore, even if a user certificate is not stored in the user terminal, Can be satisfied.

While the present invention has been described with reference to the accompanying drawings, it is to be understood that the scope of the present invention is defined by the claims that follow, and should not be construed as limited to the above-described embodiments and / or drawings. It is to be expressly understood that improvements, changes and modifications that are obvious to those skilled in the art are also within the scope of the present invention as set forth in the claims.

10: User terminal
15: Key storage / authentication module
22: Authentication mediation server
24: Authentication server
30: Certificate issuing server

Claims (6)

A user registration method performed in an environment including a user terminal including a key storage / authentication module, an authentication mediation server, an authentication server, and a certificate issuing authority server,
A first step in which the authentication mediation server performs pre-authentication based on information received from the user terminal;
A second step of authenticating the key storage / authentication module and receiving the public key and the additional information generated by the key storage / authentication module from the user terminal;
A third step of the authentication mediating server transmitting the user specific information and the public key to the authentication server;
A fourth step of the authentication server transmitting the user specific information and the public key to the certificate issuing server;
A fifth step of the authentication server receiving the certificate including the user-specific information and the public key from the certificate issuing server;
And a sixth step of the authentication server storing the certificate in combination with the user-specific information but not transmitting it to the user terminal.
How to register users.
The method according to claim 1,
The additional information includes at least key storage / authentication module information and key identification information.
How to register users.
In the login method of a user registered according to claim 1,
A first step of the authentication mediation server receiving and verifying user identification information from the user terminal;
A second step in which the authentication mediation server transmits a random challenge value and additional information to the user terminal;
A third step of the authentication mediation server receiving the digital signature value generated by the key storage / authentication module for the random challenge value and the additional information after authentication by the key storage / authentication module and verification of the additional information succeed;
A fourth step of the authentication mediating server transmitting the user specific information, the random challenge value, and the electronic signature value to the authentication server;
A fifth step of the authentication server loading a certificate corresponding to the user-specific information,
And a sixth step of the authentication server verifying the digital signature value using the public key extracted from the certificate and allowing the login if the verification is successful.
How users log in.
The method of claim 3,
Further comprising a fifth step of the authentication server transmitting the identification information of the certificate to the certificate issuing server to inquire whether the certificate is valid and receiving the result,
How users log in.
A non-repudiation service method for an online service used by a user logged in according to claim 3,
A first step of an authentication mediation server receiving service related information from a user terminal;
A second step of the authentication mediation server transmitting the additional information, the random challenge value, and the service related information to the user terminal;
After the authentication by the key storage / authentication module and the confirmation of the additional information and the service related information are successful, the authentication / mediation server receives the digital signature value generated by the key storage / authentication module for the random challenge value, A third step,
A fourth step of the authentication mediating server transmitting the user specific information, the random challenge value, the service related information and the digital signature value to the authentication server,
A fifth step of the authentication server loading a certificate corresponding to the user-specific information,
And a sixth step of verifying the digital signature value using the public key extracted from the certificate and storing the service related information and the digital signature value when the authentication server succeeds in verification.
Non - repudiation measures.
The method of claim 5,
Further comprising a fifth step of the authentication server transmitting the identification information of the certificate to the certificate issuing server to inquire whether the certificate is valid and receiving the result,
Non - repudiation measures.

Images