KR102503526B1 - Apparatus and method for providing authentication service - Google Patents

Abstract

The present invention relates to an authentication service providing device and an authentication service providing method. According to a first aspect of the present invention, an authentication service providing apparatus communicating with each of a first user terminal and a second user terminal, providing a first interface for receiving a query when an authentication request is received from the first user terminal An interface management unit, an answer generation unit generating an answer matching the query when a query is received through the first interface, and an authentication processing unit authenticating the first user terminal when the answer is received through the second user terminal can include

Description

Authentication service providing device and authentication service providing method {APPARATUS AND METHOD FOR PROVIDING AUTHENTICATION SERVICE}

The present invention relates to an authentication service providing apparatus and an authentication service providing method, and more particularly, to an apparatus and method for more safely and conveniently authenticating a user using a plurality of user terminals.

Recently, as e-commerce has become active, research on more secure payment methods has been actively conducted.

In this regard, in most cases, user information used for payment includes sensitive information that should never be leaked to the outside. Therefore, it is necessary to develop a technology for authenticating whether a person requesting the user information is a person with a legitimate right so that the user information can be used only by the user himself/herself.

The prior art developed as part of this allows the user to set a password for accessing user information and allows access to the user information only when the corresponding password is entered. As such, in the prior art of authenticating a user using a password, when the user accidentally exposes the password to the outside or the password is leaked due to hacking, etc., a third party without permission to access user information inputs the password. Thus, there was a problem in accessing user information.

Accordingly, in another prior art, a customer is authenticated through an authorized certification authority based on an authorized certificate. Although the authentication method according to the prior art is relatively safer than the authentication method using a password, it has a problem in that it cannot prevent illegal acquisition of a public certificate password through hacking and phishing using a keystroke method, and also uses a public certificate. There was a problem in that the authentication procedure becomes complicated as the program for the authentication should be separately installed in the user terminal.

In this regard, Korean Patent Publication No. 10-2011-0042621, which is a prior art document, describes a method of providing an authentication service. However, prior art literature only presents a complicated method of authenticating a user using a public certificate, so it is still necessary to develop a technology for simple and safe user authentication.

On the other hand, the above-mentioned background art is technical information that the inventor possessed for derivation of the present invention or acquired in the process of derivation of the present invention, and cannot necessarily be said to be known art disclosed to the general public prior to filing the present invention. .

An object of an embodiment of the present invention is to provide an authentication service providing device and an authentication service providing method.

As a technical means for achieving the above technical problem, according to a first aspect of the present invention, an authentication service providing device communicating with each of a first user terminal and a second user terminal, receiving an authentication request from the first user terminal , an interface management unit providing a first interface for receiving a query, an answer generating unit generating an answer matching the query when receiving a query through the first interface, and receiving the answer through the second user terminal. If so, it may include an authentication processing unit for authenticating the first user terminal.

According to a second aspect of the present invention, a method for providing an authentication service by an authentication service providing apparatus communicating with each of a first user terminal and a second user terminal, wherein upon receiving an authentication request from the first user terminal, a query is received. providing a first interface for a query, generating an answer matching the query when a query is received through the first interface, and when receiving the answer through the second user terminal, the first user terminal It may include a step of authenticating.

According to a third aspect of the present invention, a computer-readable recording medium on which a program for performing a method for providing an authentication service is recorded, wherein the method for providing an authentication service, upon receiving an authentication request from a first user terminal, receives a query. Providing a first interface for, generating an answer matching the query when a query is received through the first interface, and receiving the answer through a second user terminal, the first user terminal An authentication step may be included.

According to a fourth aspect of the present invention, a computer program performed by an authentication service providing device and stored in a recording medium for performing an authentication service providing method, wherein the authentication service providing method includes an authentication request from a first user terminal. is received, providing a first interface for receiving a query, generating an answer matching the query when receiving a query through the first interface, and receiving the answer through a second user terminal. , may include authenticating the first user terminal.

According to any one of the above-described problem solving means of the present invention, an embodiment of the present invention may provide an authentication service providing device and an authentication service providing method.

In addition, according to any one of the problem solving means of the present invention, while performing authentication using a plurality of user terminals, as the information input to each of the plurality of user terminals is different, the authentication service providing device and authentication with improved security How to provide service can be suggested.

In addition, according to any one of the problem solving means of the present invention, it is possible to provide a device and method capable of authenticating a user more conveniently.

The effects obtainable in the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below. will be.

1 is a configuration diagram of an authentication system according to an embodiment of the present invention.
2 is a block diagram illustrating an authentication service providing apparatus according to an embodiment of the present invention.
3 is a flow chart illustrating a method for providing an authentication service according to an embodiment of the present invention.
4 and 5 are exemplary diagrams for explaining an authentication service providing method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail so that those skilled in the art can easily practice the present invention with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected" but also the case where it is "electrically connected" with another element interposed therebetween. . In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an authentication system according to an embodiment of the present invention.

As shown in FIG. 1 , the authentication system 100 includes a first user terminal 10 , an authentication service providing device 20 and a second user terminal 30 .

Authentication service providing device 20 according to an embodiment of the present invention, for the authentication request from the first user terminal 10, by using the second user terminal 30 to authenticate the first user terminal 10 or Unauthorized processing can be performed.

In addition, the authentication service providing device 20 prior to performing the authentication service providing method according to an embodiment of the present invention, a user requesting authentication from the first user terminal 10 through the first user terminal 10 User information of can be received and stored.

In this regard, 'user information' refers to various information that can be stored in a user account that matches a user. User information may include, for example, user identification information such as a user's contact information and a user's name. In addition, user information may include information that is accessible only through authentication, for example, card serial information registered by the user for payment, card password, and the like.

When the authentication service providing device 20 authenticates the first user terminal 10, user information can be transmitted so that a subsequent process according to the authentication can be performed. If the subsequent process is a payment processing process, the authentication service providing device 20 may transmit the user information to a payment server (a card company server, a bank company server, or a PG company server) so that payment processing is performed.

Such an authentication service providing device 20 may be implemented as a web server capable of providing web services to each of the first user terminal 10 and the second user terminal 30, or, for example, a portal site. It may be a server or may be implemented as a server system of various web content providers such as an online shopping mall server. In addition, it goes without saying that the authentication service providing device 20 may be implemented as a group of server systems including a web server, a load balancing server, and a database server.

Meanwhile, the authentication service providing device 20 may communicate with each of the first user terminal 10 and the second user terminal 30 through the network N.

At this time, the network (N) includes a local area network (LAN), a wide area network (WAN), a value-added network (VAN), a personal area network (PAN), and a mobile communication network. (mobile radio communication network), Wibro (Wireless Broadband Internet), Mobile WiMAX, HSDPA (High Speed Downlink Packet Access) satellite communication network, LTE (Long Term Evolution) network, etc. It can be implemented in all types of wired / wireless networks.

The authentication service providing device 20 as described above will be described later in more detail with reference to FIG. 2 .

Meanwhile, each of the first user terminal 10 and the second user terminal 30 may be implemented as an electronic terminal in which a client program for communication with the authentication service providing device 20 is installed.

At this time, the electronic terminal may be implemented as a computer, a portable terminal, a television, a wearable device, or the like that may include an interface capable of interacting with a user. Here, the computer includes, for example, a laptop, desktop, or laptop equipped with a web browser, and the portable terminal is, for example, a wireless communication device that ensures portability and mobility. , PCS(Personal Communication System), PDC(Personal Digital Cellular), PHS(Personal Handyphone System), PDA(Personal Digital Assistant), GSM(Global System for Mobile communications), IMT(International Mobile Telecommunication)-2000, CDMA(Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), Wibro (Wireless Broadband Internet), Smart Phone, Mobile WiMAX (Mobile Worldwide Interoperability for Microwave Access), etc. (Handheld)-based wireless communication device may be included. In addition, television may include IPTV (Internet Protocol Television), Internet TV (Internet Television), terrestrial TV, cable TV, and the like. Furthermore, a wearable device is a type of information processing device that can be worn directly on the human body, such as, for example, a watch, glasses, accessories, clothes, shoes, etc. can be connected with

Each of the first user terminal 10 and the second user terminal 30 implemented as such an electronic terminal is only used to distinguish and refer to two different user terminals, and refers to a user terminal having a specific function. It is not.

Meanwhile, the authentication service providing device 20 according to an embodiment of the present invention may also communicate with a third party device (not shown) through the network N.

The third party device (not shown) may be a device that transmits an answer to the query to the authentication service providing device 20 as the authentication service providing device 20 transmits the query. It may be a device capable of providing the authentication service providing device 20 with a resource (for example, a calculator module) for performing mathematical calculations. Such a third party device (not shown) may be implemented as a group of server systems such as a web server, a load balancing server, and a database server.

Meanwhile, FIG. 2 is a block diagram showing an authentication service providing apparatus 20 according to an embodiment of the present invention.

An authentication service providing apparatus 20 according to a preferred embodiment of the present invention includes an interface management unit 210 providing a first interface for receiving a query.

That is, when receiving an authentication request from the first user terminal 10 , the interface management unit 210 may provide the first interface for receiving a query to the first user terminal 10 .

In this case, the 'first interface' refers to an interface constituting the screen of the first user terminal so that the user can conveniently input a query.

In addition, the interface management unit 210 may provide a second interface for receiving answers to the second user terminal 30 .

In addition, the interface manager 210 may provide a triggering signal for execution of an application installed in the second user terminal 30 and providing a second interface to the second user terminal 30 .

The second user terminal 30 receiving the triggering signal as described above may provide a second interface by executing an application installed on the second user terminal 30, and when the provision of the second interface ends Information received through the second interface may be transmitted to the authentication service providing device 20 by establishing a communication channel with the authentication service providing device 20.

In relation to the 'second interface' means an interface that configures the screen of the second user terminal so that the user can conveniently enter the answer.

For example, the second interface may be an interface capable of receiving numbers or letters as it detects a user's click, touch, tap, etc. Also, when the second user terminal 30 is a portable terminal, the ARS It may be an interface that obtains a series of numbers or letters received within a specified period according to voice guidance as an answer.

Meanwhile, the interface management unit 210 may search for a second interface or a second user terminal to which a triggering signal is to be provided.

For example, the interface management unit 210 may search for a second user terminal that is at least one of user terminals registered in a user account corresponding to the first user terminal that sent the authentication request.

In addition, for example, the interface management unit 210, from the first user terminal 10 that transmitted the authentication request, the terminal identification information (eg, the second user terminal 30 is a portable terminal matching the second user terminal) In case of receiving a phone number, etc.), it is possible to search for the second user terminal 30 .

Meanwhile, the authentication service providing apparatus 20 may further include an answer generating unit 220 that generates an answer matching the query when receiving a query through the first interface.

For example, if the query is a mathematical expression, the answer generating unit 220 may calculate the mathematical expression and generate the calculated result value as an answer.

In addition, the answer generator 220 may request and obtain an answer matching the query from a third party device (not shown).

For example, if the third party device (not shown) includes a calculator module, a mathematical expression query may be transmitted to the third party device (not shown) and an answer may be obtained as a response.

Meanwhile, the authentication service providing apparatus 20 may further include an authentication processing unit 230 that authenticates the first user terminal 10 when an answer is received through the second user terminal 20 .

That is, the authentication processing unit 230 may authenticate the first user terminal 10 provided with the first interface if the answer received through the second interface matches the query received through the first interface.

On the other hand, if the answer received through the second interface does not match the query received through the first interface, the authentication processing unit 230 may de-authenticate the first user terminal 10.

Meanwhile, FIG. 3 is a flowchart illustrating a method of providing an authentication service according to an embodiment of the present invention.

The authentication service providing method according to the embodiment shown in FIG. 3 includes steps processed time-sequentially in the authentication service providing apparatus 20 shown in FIG. 2 . Therefore, even if the content is omitted below, the information described above with respect to the authentication service provision 20 shown in FIG. 2 can also be applied to the authentication service providing method according to the embodiment shown in FIG. 3 . FIG. 3 is described below with reference to FIGS. 4 and 5 .

The authentication service providing apparatus 20 communicating with each of the first user terminal 10 and the second user terminal 30 may receive an authentication request from the first user terminal 10 (S310).

In relation to the following, for convenience of description, it is assumed that the first user terminal 10 is a computer, and the second user terminal 30 is a portable terminal.

Upon receiving the authentication request, the authentication service providing device 20 may provide a first interface for receiving a query to the first user terminal 10 (S320).

Further, the authentication service providing device 20 may receive the query through the first interface (S330).

In relation to FIG. 4, as an exemplary diagram for explaining an authentication service providing method according to an embodiment of the present invention, a first appearing through the screen 400 of the first user terminal 10 communicating with the authentication service providing device. An example of an interface is shown.

As shown in FIG. 4 , the authentication service providing apparatus 20 may provide first interfaces 410 and 420 through which a query may be input from a user.

The first interface includes, for example, an interface 420 capable of inputting a mathematical expression through each operator or numeric input on one side of the screen of the first user terminal 10, and also of the first user terminal 10. On the other side of the screen, an interface 410 for displaying the mathematical formula input through the interface 420 is included so that the user can check the mathematical formula input by the user.

Meanwhile, the authentication service providing device 20 may generate an answer matching the query (S340).

That is, as shown in FIG. 4 , when a user inputs a mathematical expression, the authentication service providing apparatus 20 may calculate that the answer matching the query is '55' by calculating the mathematical expression.

Also, the authentication service providing device 20 may provide a second interface to the second user terminal 30 .

In addition, the authentication service providing device 20 is installed on the second user terminal 30 and provides a triggering signal capable of executing an application that provides a second interface for receiving answers to the second user terminal 30. can

At this time, the authentication service providing device 20 may provide a second interface (or triggering signal) after generating an answer matching the query, and also provide a second interface (or triggering signal) while generating an answer matching the query. can provide.

Further, the authentication service providing device 20 may receive information through the second interface (S350).

At this time, the second interface may proceed with ARS voice guidance to the second user terminal 30 to acquire information received within a specified period according to the voice guidance. In addition, the second interface may obtain information input to the second user terminal 30 as it detects a user's click, touch, or tap through the second user terminal 30 .

In this way, if the information obtained by the second interface is different from the answer, the authentication service providing device 20 may disauthenticate the first user terminal (S360), and the information obtained by the second interface is different from the answer. If the same information, it is possible to authenticate the first user terminal (S370).

In relation to FIG. 5, as an exemplary diagram for explaining an authentication service providing method according to an embodiment of the present invention, through a screen 500 of a second user terminal 30 communicating with the authentication service providing device 20. An example of the appearing second interface is shown.

As shown in FIG. 5 , the authentication service providing device 20 may provide a second interface 510 through which an answer may be input from a user. Also, the second user terminal 30 may receive information from the user through the second interface 510 .

Therefore, the authentication service providing device 20 can authenticate the first user terminal 10 when receiving '55' as an answer to the query through the second interface 510, as shown in FIG. For example, when '56', which is different from '55', which is the correct answer, is received as an answer to the query, the first user terminal 10 may be unauthorized.

That is, according to the authentication service providing method according to an embodiment of the present invention, user authentication security can be further improved as information input to each of the first user terminal and the second user terminal is different. Moreover, according to the authentication service providing method according to an embodiment of the present invention, it is possible to more easily authenticate a user. For example, when a query is a mathematical expression, the user directly inputs the mathematical expression so that the user can determine the degree of difficulty of the mathematical expression. It can be set by itself, and since the answer of the mathematical expression is a number, the user can be authenticated by simply entering a number.

On the other hand, when the first user terminal 10, which has been authenticated according to the above-described authentication service providing method, requests authentication for payment processing in a payment server (not shown), for example, the authentication service providing device 20, User information corresponding to the authenticated first user terminal 10 may be transmitted to a payment server (not shown).

The term '~unit' used in this embodiment means software or a hardware component such as a field programmable gate array (FPGA) or ASIC, and '~unit' performs certain roles. However, '~ part' is not limited to software or hardware. '~bu' may be configured to be in an addressable storage medium and may be configured to reproduce one or more processors. Therefore, as an example, '~unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and procedures. , subroutines, segments of program patent code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

Functions provided within components and '~units' may be combined into smaller numbers of components and '~units' or separated from additional components and '~units'.

In addition, components and '~units' may be implemented to play one or more CPUs in a device or a secure multimedia card.

The authentication service providing method according to the embodiment described with reference to FIG. 3 may be implemented in the form of a recording medium including instructions executable by a computer, such as program modules executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism, and includes any information delivery media.

In addition, the authentication service providing method according to an embodiment of the present invention may be implemented as a computer program (or computer program product) including instructions executable by a computer. A computer program includes programmable machine instructions processed by a processor and may be implemented in a high-level programming language, object-oriented programming language, assembly language, or machine language. . Also, the computer program may be recorded on a tangible computer-readable recording medium (eg, a memory, a hard disk, a magnetic/optical medium, or a solid-state drive (SSD)).

Therefore, the authentication service providing method according to an embodiment of the present invention can be implemented by executing the computer program as described above by a computing device. A computing device may include at least some of a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to a low-speed bus and a storage device. Each of these components are connected to each other using various buses and may be mounted on a common motherboard or mounted in any other suitable manner.

Here, the processor may process commands within the computing device, for example, to display graphic information for providing a GUI (Graphic User Interface) on an external input/output device, such as a display connected to a high-speed interface. Examples include instructions stored in memory or storage devices. As another example, multiple processors and/or multiple buses may be used along with multiple memories and memory types as appropriate. Also, the processor may be implemented as a chipset comprising chips including a plurality of independent analog and/or digital processors.

Memory also stores information within the computing device. In one example, the memory may consist of a volatile memory unit or a collection thereof. As another example, the memory may be composed of a non-volatile memory unit or a collection thereof. Memory may also be another form of computer readable medium, such as, for example, a magnetic or optical disk.

Also, the storage device may provide a large amount of storage space to the computing device. A storage device may be a computer-readable medium or a component that includes such a medium, and may include, for example, devices in a storage area network (SAN) or other components, such as a floppy disk device, a hard disk device, an optical disk device, or a tape device, flash memory, or other semiconductor memory device or device array of the like.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts should be construed as being included in the scope of the present invention. do.

10: first user terminal 20: authentication service providing device
30: user terminal
210: Interface management unit 220: Answer generation unit
230: authentication processing unit

Claims (11)

An authentication service providing device communicating with each of a first user terminal and a second user terminal,
an interface manager for providing a first interface for receiving a query through the first user terminal when an authentication request is received from the first user terminal;
an answer generator configured to generate an answer matching the query when a query is received through the first interface; and
When receiving the answer through the second user terminal, including an authentication processing unit for authenticating the first user terminal,
The interface management unit additionally,
When a query is received through the first interface, a triggering signal for execution of an application installed on the second user terminal and providing a second interface for receiving the answer is provided to the second user terminal, authentication Service Provisioning Device. According to claim 1
The interface management unit additionally,
When a query is received through the first interface, providing a second interface for receiving the answer to the second user terminal, authentication service providing apparatus. delete According to claim 1,
The first interface is configured to allow mathematical expression input,
An answer to the query is an operation result value of the mathematical expression, the authentication service providing device. According to claim 1,
The authentication service providing device communicates with a third party device through a network,
The answer generation unit additionally,
An authentication service providing device that obtains an answer matching the query from the third party device. A method in which an authentication service providing device communicating with each of a first user terminal and a second user terminal provides an authentication service,
providing a first interface for receiving a query through the first user terminal when receiving an authentication request from the first user terminal;
When a query is received through the first interface, an answer matching the query is generated, but as the second user terminal, the application installed on the second user terminal and providing a second interface for receiving the answer providing a triggering signal for execution; and
When receiving the answer through the second user terminal, comprising the step of authenticating the first user terminal, authentication service providing method. According to claim 6,
To the second user terminal, further comprising providing a second interface for receiving the answer, authentication service providing method. delete According to claim 6,
The first interface is configured to allow mathematical expression input,
The method of providing authentication service, wherein the answer to the query is an operation result value of the mathematical expression. A computer-readable recording medium on which a program for performing the method according to claim 6 is recorded. A computer program executed by an authentication service providing device and stored in a recording medium to perform the method according to claim 6.

Images