KR102782290B1 - Context authentication system and method using n-gram analysis in non-face-to-face environment - Google Patents

Abstract

The present invention relates to a technology capable of performing continuous context authentication while protecting the user's privacy by using information converted into n-grams rather than raw data, when performing context authentication using user behavior information generated while using a non-face-to-face service at a user terminal after initial authentication between a user of a non-face-to-face service and a non-face-to-face service providing server.

Description

{Context authentication system and method using n-gram analysis in non-face-to-face environment}

The present invention relates to a context authentication system and method using n-grams in a non-face-to-face environment, and more particularly, to a context authentication system and method using n-grams in a non-face-to-face environment capable of preserving the user's privacy while performing context authentication using user behavior information in a non-face-to-face service provision environment.

As the novel coronavirus infection situation continues, many companies, schools, and homes are using non-face-to-face services such as video communication services, remote work services, and collaboration management tool services.

As the use of non-face-to-face services increases, side effects are naturally increasing.

For example, there is a problem in which an illegitimate user (e.g. malicious user) who is not a legitimate user of a non-face-to-face service hijacks or exposes the terminal of an existing user (legitimate user) or uses illegally shared account information (e.g. authentication information) to receive non-face-to-face services, resulting in damages due to illegal acts such as user impersonation, damage and alteration of information, and leakage of confidential information.

Therefore, context authentication technology is being developed that utilizes user behavior information that can be collected from non-face-to-face services even after initial authentication (login, etc.).

In order to utilize this context authentication technology, a process of collecting and analyzing the user's behavior information in the physical domain area or logical domain area must be performed first. However, since conventional context data authentication methods perform authentication by creating a profile based on raw data of behavior information, another problem may arise due to the user's personal information included in the raw data, namely, the problem of privacy exposure.

Accordingly, we aim to develop a technology that can perform context authentication after initial authentication while preserving the user's privacy.

Japanese Patent Publication No. 2018-532301 (2018.11.01.)

Accordingly, the present invention has been devised to solve the above-mentioned problems, and relates to a context authentication system and method using n-grams in a non-face-to-face environment, which can perform continuous context authentication without violating the user's privacy by converting the data into n-grams when collecting and analyzing user behavior information that can be collected while using a non-face-to-face service after initial authentication.

In order to solve the above-described problem, according to one embodiment of the present invention, in an authentication system using context information generated by a user receiving a non-face-to-face service while using the non-face-to-face service, the system preferably includes: an authentication receiving unit which receives, in a server providing the non-face-to-face service, authentication information input by a user who wishes to receive the non-face-to-face service through a terminal means possessed by the user; an action collecting unit which collects, in the terminal means providing the non-face-to-face service, action information generated by a user receiving the non-face-to-face service through a linked input means; an action processing unit which generates action profile information by applying a preset analysis algorithm using the collected action information in the terminal means providing the non-face-to-face service; an authentication processing unit which generates authentication profile information by applying a preset analysis algorithm using the received authentication information in the server providing the non-face-to-face service; and a user judgment unit which determines, in the server providing the non-face-to-face service, whether a corresponding user is a legitimate user or an illegitimate user by using the action profile information and the authentication profile information.

Furthermore, it is preferable that the context authentication system using n-gram in the non-face-to-face environment further includes a service providing unit that performs an authentication operation on a corresponding user based on authentication information by the authentication receiving unit in a server providing a non-face-to-face service, and provides the non-face-to-face service to a corresponding terminal means when authentication is completed.

Furthermore, it is preferable that the behavior processing unit includes a meta generation unit that classifies the collected behavior information into physical-based context information and logic-based context information according to preset type items and generates behavior meta information using the classified types, an n-gram generation unit that generates n-gram information for each classified behavior information based on a pre-stored n-gram model, and a behavior profile generation unit that performs normalization on the behavior meta information, n-gram information of the physical-based context information, and n-gram information of the logic-based context information, and then combines them to generate the behavior profile information.

Furthermore, it is preferable that the authentication processing unit includes a meta generation unit that generates authentication meta information using the received authentication information, an n-gram generation unit that extracts physical/logical-based behavior information of a user corresponding to the received authentication information using a pre-collected user-based behavior information DB and generates n-gram information of the extracted base-based behavior information based on a pre-stored n-gram model, and an authentication profile generation unit that performs normalization on the authentication meta information, n-gram information of the physical-based context information, and n-gram information of the logical-based context information, and then combines them to generate the authentication profile information.

Furthermore, it is desirable for the user judgment unit to compare and analyze the behavior profile information and the authentication profile information to determine whether the two pieces of information match, and if they do, to determine the corresponding user as a legitimate user.

Furthermore, it is preferable that the context authentication system using n-gram in the non-face-to-face environment further includes an additional authentication unit that, if the user is not a legitimate user based on the judgment result of the user judgment unit, controls the terminal means through which the non-face-to-face service is provided to perform a preset additional authentication operation.

An authentication method using context information of a user by a context authentication system using n-gram in a non-face-to-face environment in which each step is performed by an operation processing means according to one embodiment of the present invention, comprising: an initial authentication step (S100) in which a user who wishes to receive a non-face-to-face service inputs authentication information through a terminal means possessed by the user; a non-face-to-face service providing step (S200) in which a server providing a non-face-to-face service performs an authentication operation on the corresponding user based on the authentication information by the initial authentication step (S100), and when authentication is completed, provides the non-face-to-face service through the corresponding terminal means; an action collecting step (S300) in which action information generated by the user through a pre-linked input means is collected by the terminal means providing the non-face-to-face service; an action processing step (S400) in which action profile information is generated by applying a preset analysis algorithm using the action information collected by the action collecting step (S300) by the terminal means providing the non-face-to-face service; an authentication processing in which the server providing the non-face-to-face service generates authentication profile information by applying a preset analysis algorithm using the authentication information received by the initial authentication step (S100). It is preferable to include a user judgment step (S600) for judging whether a user receiving a non-face-to-face service is a legitimate user or an illegitimate user by using the action profile information by the action processing step (S400) and the authentication profile information by the authentication processing step (S500) in the server providing the non-face-to-face service.

Furthermore, it is preferable that the above-described behavior processing step (S400) include a meta generation step (S410) of classifying the collected behavior information into physical-based context information and logic-based context information according to preset type items and generating behavior meta information using the classified types, an n-gram generation step (S420) of generating n-gram information for each classified behavior information based on a pre-stored n-gram model, and a behavior profile generation step (S430) of receiving the behavior meta information by the meta generation step (S410), the n-gram information of the physical-based context information by the n-gram generation step (S420), and the n-gram information of the logic-based context information, performing normalization, and then combining them to generate the behavior profile information.

Furthermore, it is preferable that the authentication processing step (S500) include a meta generation step (S510) of generating authentication meta information using the received authentication information, a behavior extraction step (S520) of extracting physical/logical-based behavior information of a user corresponding to the received authentication information using a pre-collected user-specific behavior information DB, an n-gram generation step (S530) of generating n-gram information of the extracted base-specific behavior information based on a pre-stored n-gram model, and an authentication profile generation step (S540) of receiving the authentication meta information by the meta generation step (S510), the n-gram information of the physical-based context information and the n-gram information of the logical-based context information by the n-gram generation step (S530), performing normalization, and combining them to generate the authentication profile information.

Furthermore, it is preferable that the user judgment step (S600) compares and analyzes the behavior profile information by the behavior profile creation step (S430) and the authentication profile information by the authentication profile creation step (S540) to determine whether the two pieces of information match, and if they do match, determine the corresponding user as a legitimate user.

Furthermore, it is preferable that the context authentication method using n-gram in the non-face-to-face environment further includes an additional authentication step (S700) for controlling a terminal means through which the non-face-to-face service is provided to perform a preset additional authentication operation if the user is not a legitimate user as determined in the user judgment step (S600).

A context authentication system and method using n-grams in a non-face-to-face environment according to one embodiment of the present invention has the advantage of being able to perform continuous context authentication while protecting the user's privacy by using not only user information (authentication information) generated for initial authentication but also user information (behavior information) generated after initial authentication in a form converted to n-grams rather than raw data form when providing a non-face-to-face service.

Through this, even if an unauthorized user attempts to receive a non-face-to-face service using the unique information (authentication information) of an authenticated user that has been obtained without authorization, it is easy to determine that the user is unauthorized, thereby improving the security of the non-face-to-face service.

In addition, for legitimate users, the convenience of non-face-to-face services can be improved because login is performed through an agent and authentication is done without awareness.

FIG. 1 is a configuration example diagram showing a context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention.
FIG. 2 is a flowchart illustrating a context authentication method using n-gram in a non-face-to-face environment according to one embodiment of the present invention.

The purpose, features and advantages of the present invention described above will become more apparent through the following examples with reference to the accompanying drawings. The specific structural and functional descriptions below are merely exemplified for the purpose of explaining embodiments according to the concept of the present invention, and the embodiments according to the concept of the present invention may be implemented in various forms and should not be construed as being limited to the embodiments described in this specification or application. Since the embodiments according to the concept of the present invention may have various changes and may have various forms, specific embodiments will be illustrated in the drawings and described in detail in this specification or application. However, this is not intended to limit the embodiments according to the concept of the present invention to specific disclosed forms, but should be understood to include all modifications, equivalents or substitutes included in the spirit and technical scope of the present invention. The terms first and/or second, etc. may be used to describe various components, but the components are not limited to the terms. The above terms are only for the purpose of distinguishing one component from other components, for example, without departing from the scope of rights according to the concept of the present invention, the first component may be called the second component, and similarly, the second component may also be called the first component. When a component is said to be connected or connected to another component, it should be understood that it may be directly connected or connected to the other component, but there may be other components in between. On the other hand, when a component is said to be directly connected or directly connected to another component, it should be understood that there are no other components in between. Other expressions used to describe the relationship between components, such as 'between' and 'directly between' or 'adjacent to' and 'directly adjacent to', should also be interpreted in the same way. The terminology used herein is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this specification, the terms “include” or “have” are intended to indicate the presence of a described feature, number, step, operation, component, part, or combination thereof, but should be understood as not excluding in advance the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof. Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which this invention belongs. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning they have in the context of the relevant art, and shall not be interpreted in an ideal or overly formal sense unless explicitly defined herein. Hereinafter, the present invention will be described in detail by describing a preferred embodiment of the present invention with reference to the accompanying drawings. The same reference numerals presented in each drawing represent the same members.

In addition, a system refers to a set of components including devices, mechanisms, and means that are organized and interact regularly to perform necessary functions.

A context authentication system and method using n-gram in a non-face-to-face environment according to one embodiment of the present invention is a technology for improving the security and convenience of non-face-to-face services that have been increasing recently.

Specifically, the context authentication system and method using n-gram in a non-face-to-face environment according to one embodiment of the present invention can determine whether a user is a normal user (legitimate user) through behavior information that can be collected from a user receiving a non-face-to-face service after user authentication through input of authentication information for receiving a non-face-to-face service, so that it has the advantage of providing higher security to a non-face-to-face service provider by performing user authentication through authentication information first and user authentication through behavior information second.

In addition, even though two-factor authentication is performed, it has the advantage of providing convenience because the user is only directly involved in the first authentication process of entering authentication information.

FIG. 1 is a configuration example diagram showing a context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention. With reference to FIG. 1, the context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention will be described in detail.

According to one embodiment of the present invention, a context authentication system using n-gram in a non-face-to-face environment is preferably configured to include an authentication receiving unit (100), an action collecting unit (200), an action processing unit (300), an authentication processing unit (400), and a user judgment unit (500), as illustrated in FIG. 1. It is preferable that each of the components is individually or integrally included in at least one operation processing means including a computer, etc., to perform operations.

A context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention relates to a secondary authentication system for a non-face-to-face service using context information of a user who wishes to receive a non-face-to-face service or a user who receives a non-face-to-face service through a terminal device possessed by the user, at a server providing the non-face-to-face service.

Here, secondary authentication refers to the process of first receiving authentication information from the user through a login process for providing a non-face-to-face service, and then collecting information on the actions of the authenticated user while using the non-face-to-face service to determine whether the authenticated user is a legitimate or illegitimate user, which is why it is considered secondary authentication.

Through this, it is possible to determine whether a user without permission to use the non-face-to-face service has hijacked the terminal of an authorized user, or has illegally used the non-face-to-face service by using account information illegally shared from an authorized user, or by using account information of an authorized user that has been illegally obtained.

Therefore, the context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention performs primary authentication for providing a non-face-to-face service through the authentication receiving unit (100).

In addition, in advance, in order to receive non-face-to-face services, it is desirable for users to install a non-face-to-face service access agent on a terminal means for executing non-face-to-face services.

It is preferable that the above authentication receiving unit (100) receives authentication information input by a user who wishes to receive a non-face-to-face service through a terminal device possessed by the user from the server providing the non-face-to-face service. The above authentication receiving unit (100) performs the first authentication, also known as 'login', prior to providing the non-face-to-face service using the received authentication information.

In detail, it is preferable that the authentication receiving unit (100) receives authentication information input by a user who wishes to receive a non-face-to-face service through a terminal device possessed by the user. Here, authentication information means unique information including an ID and PW, but is not limited thereto.

At this time, the context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention further includes a service providing unit (110), as illustrated in FIG. 1, to perform an authentication operation using the authentication information received by the authentication receiving unit (100).

It is preferable that the above service provider (110) performs an authentication operation on the corresponding user based on the authentication information by the authentication receiving unit (100) in a server that provides a non-face-to-face service, and when the authentication is completed, provides the non-face-to-face service using the corresponding terminal means.

Through this, if the ID/PW is a user who has already registered, the first authentication of the corresponding user will be performed. Accordingly, when authentication is completed, it is desirable to provide a non-face-to-face service using the corresponding terminal means (where an agent for accessing non-face-to-face services is installed).

At this time, the service provider (110) performs an authentication operation for the corresponding user, and if the authentication is not completed, the non-face-to-face service is naturally not provided using the corresponding terminal means.

In a context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention, after the first authentication of a non-face-to-face service using authentication information is performed through the authentication receiving unit (100) and the service providing unit (110), context authentication is performed through the behavior collecting unit (200), the behavior processing unit (300), the authentication processing unit (400), and the user determination unit (500), thereby determining whether a user who has completed the first authentication is a legitimate user or an illegitimate user.

That is, the context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention does not perform user authentication to provide a non-face-to-face service, but determines whether a user who has already completed authentication is a legitimate user or an illegitimate user, which is clearly different from an authentication system for service provision or service access.

It is preferable that the above-mentioned action collection unit (200) collects action information generated by a user receiving a non-face-to-face service through a pre-linked input means in a terminal means where a non-face-to-face service is provided.

The above-mentioned behavior collection unit (200) collects behavior information generated by a user while using a non-face-to-face service. As a pre-linked input means, a keyboard, mouse, or the terminal means itself may serve as an input means, and is not limited thereto.

The above action information refers to information generated when a user operates a pre-linked input means, or information generated in the operating system of a terminal means receiving a non-face-to-face service. This will be described in detail later.

It is preferable that the above-mentioned behavior processing unit (300) generates behavior profile information by applying a preset analysis algorithm using the behavior information collected through the above-mentioned behavior collection unit (200) in a terminal means where a non-face-to-face service is provided.

To this end, it is preferable that the above-mentioned behavior processing unit (300) includes a meta generation unit (310), an n-gram generation unit (320), and a behavior profile generation unit (330), as illustrated in FIG. 1.

It is preferable that the above meta generation unit (310) classifies the collected behavior information into physical-based context information and logic-based context information according to preset type items, and generates behavior meta information using the classified types.

As described above, the above-mentioned action information refers to information generated when a user operates a pre-linked input means, or information generated in the operating system of a terminal means receiving a non-face-to-face service.

In detail, the meta generation unit (310) classifies the collected behavior information into physical-based context information and logic-based context information according to preset type items.

Examples of physics-based context information are shown in Table 1 below.

Example of physics-based context information explanation Keyboard input information Using a function called through hooking, it includes information on the input key, key input time, key pressed time, and key released time. Mouse input information Using a function called through hooking, it includes information on the input mouse button, input wheel, and movement coordinates.

Also, examples of logic-based context information are given in Table 2 below.

Example of logic-based context information explanation Startup Program A list of programs that are automatically run when the terminal device boots and the operating system starts. Background Process count The number of background processes running when the user uses the terminal. Background Process count statistics Statistics on the number of background processes running when a user uses a terminal device Active Program ID ID of the activated program Active Program duration Active program usage time Active Program duration statistics Statistics on active program usage time File upload count Number of file uploads File download count Number of file downloads Webpage history list List of URLs the user visits Webpage history time The URL the user visits and the time of visit Webpage refresh count Number of times the web page is refreshed Network traffic usage Network traffic usage of user terminals Network traffic usage statistics Network traffic usage statistics of user terminals IP address IP address Gateway address Gateway address Mac address MAC address DNS server IP DNS server address Browser type The type of browser you are using to access the web Browser language The language of the browser you are using to access the web Network connection count Number of network connected devices Open port count Number of open ports HTTP status code type count Number of occurrences by HTTP status code type UDP connection attempt count Number of UDP connection attempts HTTP GET method count Number of HTTP GET method occurrences HTTP POST method count Number of HTTP POST method occurrences TFTP request Whether a TFTP request occurred FTP request Whether an FTP request occurred FTP connection count Number of FTP connections Location User access location information Memory usage Memory usage of user terminal Memory usage statistics Memory usage statistics for user terminals USB mount count Number of USBs installed in user terminal

The context information in Tables 1 and 2 above is only an example of the present invention, and is not limited thereto because the external interface linked to the terminal means may be different depending on the non-face-to-face service, including a touchpad, etc., in addition to a keyboard and mouse.

However, as shown in Tables 1 and 2 above, the physical-based context information and the logic-based context information are information generated when a user performs an action through a terminal means installed with a non-face-to-face service access agent to receive a non-face-to-face service, and since each user includes unique characteristic information about the action, it is possible to determine (secondary authentication) whether a user who has logged in (first authentication) is a legitimate user or an illegitimate user.

It is preferable that the above n-gram generation unit (320) generates n-gram information for each context information classified by the meta generation unit (310) based on a pre-stored n-gram model.

Here, the n-gram algorithm is to extract the features of text expressed in natural language so that it can be handled as a simple list of symbols. In order to investigate the features of the symbol string, it is checked whether the same part of the symbol string is repeated. At this time, if the same symbol string is found among the symbol strings cut into n pieces, it is counted and analyzed. Through this, a set of n consecutive sequences that can be extracted from the symbol string is obtained, and the similarity between the components in the set is compared to evaluate how similar the elements of the n-gram set extracted from each symbol string are. If there are many identical n-grams, it means that many identical symbol string patterns with length n are shared, and through this, the similarity between two symbol strings can be predicted.

By utilizing these points, in a context authentication system using n-gram in a non-face-to-face environment according to one embodiment of the present invention, the n-gram information for each behavior information (physical-based context information/logic-based context information) generated by the n-gram generation unit (320) for each user and the n-gram for each behavior information previously collected are used to analyze the reciprocity between two symbol strings to determine whether the user is a legitimate or illegitimate user.

At this time, the above-described text data is only an example for explaining the n-gram algorithm, and n-gram information can be generated and utilized for file content, image content, video content, and voice content, etc., so the n-gram generation unit (320) can generate n-gram information for each behavior information classified by the meta generation unit (310).

It is preferable that the above-mentioned behavior profile generation unit (330) performs normalization on the behavior meta information by the above-mentioned meta generation unit (310), the n-gram information of the physical-based context information by the above-mentioned n-gram generation unit (320), and the n-gram information of the logic-based context information, and then combines them to generate the above-mentioned behavior profile information.

That is, in order to determine whether the first authenticated user currently receiving the non-face-to-face service is a legitimate user or an illegitimate user, the behavior profile information currently being generated by the first authenticated user is generated.

It is preferable that the above authentication processing unit (400) generates authentication profile information by applying a preset analysis algorithm using the authentication information received by the authentication receiving unit (100) in a server providing a non-face-to-face service.

To this end, it is preferable that the authentication processing unit (400) includes a meta generation unit (410), an n-gram generation unit (420), and an authentication profile generation unit (430), as illustrated in FIG. 1.

It is preferable that the above meta generation unit (410) generates authentication meta information using the received authentication information.

It is preferable that the above n-gram generation unit (420) extracts the user's physical/logical base behavior information corresponding to the received authentication information using a pre-collected user-specific behavior information DB, and generates n-gram information of the extracted base-specific behavior information based on a pre-stored n-gram model.

That is, simply put, the n-gram generation unit (420) generates n-gram information for each past collected behavior information of the user who entered the authentication information.

To this end, it is desirable for servers providing non-face-to-face services to collect behavioral information for each user receiving the non-face-to-face service in advance and create a database.

Since the above-mentioned behavior information, which is the physical-based context information and the logic-based context information, contains unique characteristic information about the actions of each user, the server providing the non-face-to-face service can collect and database the behavior information of each user receiving the non-face-to-face service, thereby utilizing it to improve the security of the non-face-to-face service.

Through this, it is desirable for the n-gram generation unit (420) to extract physical-based context information and logical-based context information of the user who entered authentication information, and generate each n-gram piece of information.

It is preferable that the above authentication profile generation unit (430) performs normalization on the authentication meta information by the meta generation unit (410), the n-gram information of the physical-based context information by the n-gram generation unit (420), and the n-gram information of the logic-based context information, and then combines them to generate the authentication profile information.

That is, in order to determine whether the first authenticated user currently receiving non-face-to-face services is a legitimate user or an illegitimate user, the authentication profile information that the first authenticated user has generated in the past is generated.

It is preferable that the above user judgment unit (500) receives the behavior profile information from the behavior processing unit (300) from the server providing the non-face-to-face service and uses it together with the authentication profile information from the authentication processing unit (400) to determine whether the corresponding user is a legitimate user or an illegitimate user.

In detail, the user judgment unit (500) compares and analyzes the behavior profile information and the authentication profile information to determine whether the two pieces of information match, and if they do, determines the corresponding user as a legitimate user.

To determine whether the two pieces of information match, a set of n consecutive sequences that can be extracted from the symbol strings of n-gram information by the generated behavior profile information and n-gram information by the authentication profile information are obtained, and the similarity/identity between the components in the set is compared to determine whether the elements of the set by n-gram information by the authentication profile information intersect with the elements of the set by n-gram information by the behavior profile information.

It is preferable that the above user judgment unit (500) obtains a set to determine whether the two pieces of information described above match, and applies a deep learning algorithm to the process of comparing the similarity/identity between components within the set.

Specifically, in a case where a server providing a non-face-to-face service generates and stores a deep learning learning model for each user using the behavior information of each user receiving the non-face-to-face service collected in advance, the authentication profile information by the authentication processing unit (400) is used to quickly extract the corresponding deep learning learning model, and the behavior profile information by the behavior processing unit (300) is input into the extracted deep learning learning model to output whether or not they match. If the output result matches, the user is determined to be a legitimate user (valid user), and if the user does not match, the user is determined to be an invalid user (invalid user).

Based on the judgment result of the user judgment unit (500) above, if the server providing the non-face-to-face service determines that the user is a legitimate user, the user is authenticated without any separate notification or message, and the non-face-to-face service is continuously provided.

In contrast, if it is determined that the user is not a legitimate user, the operation of the additional authentication unit (600) is performed as shown in Fig. 1.

It is preferable that the above additional authentication unit (600) performs a preset additional authentication operation by controlling the terminal means through which the non-face-to-face service is provided if the user is determined to be an unauthorized user as determined by the user judgment unit (500).

That is, although the ID, etc. were entered correctly through the agent installed on the terminal device receiving the non-face-to-face service, since the behavior information (physical-based context information or logical-based context information) is abnormal, the user is requested to perform additional authentication using a preset terminal device (such as a smartphone).

These additional authentication actions can be used in a variety of ways, including but not limited to, requesting password re-entry, locking the screen of a terminal providing a non-face-to-face service, and forcing logout of a non-face-to-face service.

FIG. 2 is a flowchart illustrating a context authentication method using n-gram in a non-face-to-face environment according to one embodiment of the present invention. Referring to FIG. 2, the context authentication method using n-gram in a non-face-to-face environment according to one embodiment of the present invention will be described in detail.

A context authentication method using n-gram in a non-face-to-face environment according to one embodiment of the present invention includes an initial authentication step (S100), a non-face-to-face service provision step (S200), a behavior collection step (S300), a behavior processing step (S400), an authentication processing step (S500), and a user judgment step (S600), as illustrated in FIG. 2. Each step is performed by a context authentication system using n-gram in a non-face-to-face environment, which is performed by an operation processing means.

Let's take a closer look at each step:

In the above first authentication step (S100), users wishing to receive non-face-to-face services enter authentication information through a terminal device they possess.

Here, the meaning of 'first' does not only mean using the non-face-to-face service for the first time, but also means performing a new login operation to receive the non-face-to-face service. Considering this, the server providing the non-face-to-face service performs the first authentication, also known as 'login', before providing the non-face-to-face service by receiving the authentication information entered by the user through the first authentication step (S100). Here, the authentication information means unique information including ID and PW, but is not limited thereto.

In the above non-face-to-face service provision step (S200), the service provision unit (110) of the server providing the non-face-to-face service performs an authentication operation of the corresponding user based on the authentication information obtained through the initial authentication step (S100).

Through this, if the ID/PW is a user who has already registered, the first authentication of the corresponding user will be performed. Accordingly, when authentication is completed, the non-face-to-face service will be provided through the corresponding terminal means (where the non-face-to-face service access agent is installed).

The above-described initial authentication step (S100) and non-face-to-face service provision step (S200) are user authentication processes for providing non-face-to-face services, and the behavior collection step (S300), behavior processing step (S400), authentication processing step (S500), and user judgment step (S600) described below do not perform user authentication for providing non-face-to-face services, but rather determine whether a user who has already been authenticated is a legitimate user or an illegitimate user, which is clearly different from authentication for service provision or service access.

The above-mentioned action collection step (S300) collects action information generated by a user receiving a non-face-to-face service through a pre-linked input means in the action collection unit (200) of a terminal means providing a non-face-to-face service.

The above-mentioned behavior collection step (S300) collects behavior information that a user generates while using a non-face-to-face service. As for pre-linked input means, a keyboard, mouse, or the terminal itself may serve as an input means, and is not limited thereto.

The above action information refers to information generated when a user operates a pre-linked input means, or information generated in the operating system of a terminal means receiving a non-face-to-face service. This will be described in detail later.

The above-mentioned behavior processing step (S400) uses the behavior information collected by the above-mentioned behavior collection step (S300) in the behavior processing unit (300) of the terminal means through which the non-face-to-face service is provided, and applies a preset analysis algorithm to generate behavior profile information.

To this end, the above-described behavior processing step (S400) performs a meta generation step (S410), an n-gram generation step (S420), and a behavior profile generation step (S430), as illustrated in FIG. 2.

The above meta generation step (S410) classifies the collected behavior information into physical-based context information and logic-based context information according to preset type items, and generates behavior meta information using the classified types.

As described above, the above-mentioned action information refers to information generated when a user operates a pre-linked input means, or information generated in the operating system of a terminal means receiving a non-face-to-face service.

In detail, the above meta generation step (S410) classifies the collected behavior information into physical-based context information and logic-based context information according to preset type items.

An example of physical-based context information is as shown in Table 1 above, and an example of logic-based context information is as shown in Table 2 above.

Physical-based context information and logic-based context information are information generated when a user performs an action through a terminal means that has installed an agent for accessing a non-face-to-face service to receive a non-face-to-face service. Since each user includes unique characteristic information about the action, it is possible to determine (secondary authentication) whether a user who has logged in (first authentication) is a legitimate user or an illegitimate user.

The above n-gram generation step (S420) generates n-gram information for each context information classified by the meta generation step (S410) based on the pre-stored n-gram model.

Here, the n-gram algorithm is to extract the features of text expressed in natural language so that it can be handled as a simple list of symbols. In order to investigate the features of the symbol string, it is checked whether the same part of the symbol string is repeated. At this time, if the same symbol string is found among the symbol strings cut into n pieces, it is counted and analyzed. Through this, a set of n consecutive sequences that can be extracted from the symbol string is obtained, and the similarity between the components in the set is compared to evaluate how similar the elements of the n-gram set extracted from each symbol string are. If there are many identical n-grams, it means that many identical symbol string patterns with length n are shared, and through this, the similarity between two symbol strings can be predicted.

By utilizing these points, in a context authentication method using n-gram in a non-face-to-face environment according to one embodiment of the present invention, by analyzing the reciprocity between two symbol strings using n-gram information for each behavior information (physical-based context information/logical-based context information) generated for each user and n-gram for each behavior information collected previously, it is possible to determine whether the user is a legitimate or illegitimate user.

At this time, the above-described text data is only an example for explaining the n-gram algorithm, and n-gram information can be generated and utilized for file content, image content, video content, and voice content, etc. Therefore, the n-gram generation step (S420) generates n-gram information for each classified context information.

The above-described behavior profile generation step (S430) receives the behavior meta information from the meta generation step (S410), the n-gram information of the physical-based behavior information from the n-gram generation step (S420), and the n-gram information of the logic-based behavior information, performs normalization, and then combines them to generate the behavior profile information.

That is, in order to determine whether the first authenticated user currently receiving the non-face-to-face service is a legitimate user or an illegitimate user, the behavior profile information currently being generated by the first authenticated user is generated.

The above authentication processing step (S500) uses the authentication information received through the initial authentication step (S100) in the authentication processing unit (400) of the server providing the non-face-to-face service to apply a re-established analysis algorithm to generate authentication profile information.

To this end, the authentication processing step (S500) performs a meta creation step (S510), a behavior extraction step (S520), an n-gram creation step (S530), and an authentication profile creation step (S540).

The above meta generation step (S510) generates authentication meta information using the received authentication information.

The above-mentioned behavior extraction step (S520) extracts the user's physical/logical behavior information corresponding to the received authentication information using the previously collected user-specific behavior information DB. Simply put, it extracts the previously collected behavior information of the user who entered the authentication information.

To this end, it is desirable for servers providing non-face-to-face services to collect behavioral information for each user receiving the non-face-to-face service in advance and create a database.

Since the above-mentioned behavior information, which is the physical-based context information and the logic-based context information, contains unique characteristic information about the actions of each user, the server providing the non-face-to-face service can collect and database the behavior information of each user receiving the non-face-to-face service, thereby utilizing it to improve the security of the non-face-to-face service.

The above n-gram generation step (S530) generates n-gram information of the base-specific behavior information extracted by the above behavior extraction step (S520) based on the pre-stored n-gram model.

That is, the above n-gram generation step (S530) extracts past collected physical-based context information and logical-based context information of the user who entered the authentication information, and generates each n-gram information.

The above authentication profile generation step (S540) receives the authentication meta information by the meta generation step (S510), the n-gram information of the physical-based behavior information by the n-gram generation step (S530), and the n-gram information of the logic-based behavior information, performs normalization, and then combines them to generate the authentication profile information.

That is, in order to determine whether the first authenticated user currently receiving non-face-to-face services is a legitimate user or an illegitimate user, the authentication profile information that the first authenticated user has generated in the past is generated.

The above user judgment step (S600) uses the behavior profile information from the behavior processing step (S400) and the authentication profile information from the authentication processing step (S500) in the user judgment unit (500) of the server providing the non-face-to-face service to determine whether the user receiving the non-face-to-face service is a legitimate user or an illegitimate user.

In detail, the user judgment step (S600) compares and analyzes the behavior profile information from the behavior profile creation step (S430) and the authentication profile information from the authentication profile creation step (S540), determines whether the two pieces of information match, and if they match, determines the corresponding user as a legitimate user.

To determine whether the two pieces of information match, a set of n consecutive sequences that can be extracted from the symbol strings of n-gram information by the generated behavior profile information and n-gram information by the authentication profile information are obtained, and the similarity/identity between the components in the set is compared to determine whether the elements of the set by n-gram information by the authentication profile information intersect with the elements of the set by n-gram information by the behavior profile information.

The above user judgment step (S600) may apply a deep learning algorithm to the process of obtaining a set to determine whether the two pieces of information described above match and comparing the similarity/identity between components within the set.

In detail, in a case where a server providing a non-face-to-face service creates and stores a deep learning learning model for each user using the behavior information of each user receiving the non-face-to-face service collected in advance, the authentication profile information by the authentication processing step (S500) is used to quickly extract the corresponding deep learning learning model, and the behavior profile information by the behavior processing step (S400) is input into the extracted deep learning learning model to output whether or not it matches. If the output result matches, the user is determined to be a legitimate user (valid user), and if it does not match, the user is determined to be an invalid user (invalid user).

In the above user judgment step (S600), if the server providing the non-face-to-face service determines that the user is a legitimate user based on the judgment result, the user is authenticated without any separate notification or message, and the non-face-to-face service is continuously provided.

In contrast, if it is determined that the user is not a legitimate user, an additional authentication step (S700) is performed as shown in Fig. 2.

The above additional authentication step (S700) is performed by the additional authentication unit (600) of the server providing the non-face-to-face service, and, based on the judgment result of the user judgment step (S600), controls the terminal means through which the non-face-to-face service is provided to perform a preset additional authentication operation.

That is, although the ID, etc. were entered correctly through the agent installed on the terminal device receiving the non-face-to-face service, since the behavior information (physical-based context information or logical-based context information) is abnormal, the user is requested to perform additional authentication using a preset terminal device (such as a smartphone).

These additional authentication actions can be used in a variety of ways, including but not limited to, requesting password re-entry, locking the screen of a terminal providing a non-face-to-face service, and forcing logout of a non-face-to-face service.

Although the preferred embodiments of the present invention have been described above, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but are merely intended to explain it. Therefore, the technical idea of the present invention includes not only each disclosed embodiment but also a combination of the disclosed embodiments, and further, the scope of the technical idea of the present invention is not limited by these embodiments. In addition, those skilled in the art to which the present invention pertains can make numerous changes and modifications to the present invention without departing from the spirit and scope of the appended claims, and all such appropriate changes and modifications should be considered as equivalents and falling within the scope of the present invention.

100 : Authentication Receiving Unit
110: Service Provider
200 : Action Collection Department
300: Action Processing Unit
310: Meta generation unit 320: n-gram generation unit
330: Behavior profile generation section
400: Authentication Processing Unit
410: Meta generation unit 420: n-gram generation unit
430: Authentication profile creation section
500 : User judgment
600: Additional authentication

Claims (11)

In an authentication system that uses context information generated by a user receiving a non-face-to-face service while using the non-face-to-face service,
An authentication receiving unit that receives authentication information entered by a user wishing to receive a non-face-to-face service through a terminal device in the server providing the non-face-to-face service;
An action collection unit that collects action information generated by a user receiving a non-face-to-face service through a connected input means in a terminal means where a non-face-to-face service is provided;
In a terminal device where a non-face-to-face service is provided, a behavior processing unit that generates behavior profile information by applying a preset analysis algorithm using the collected behavior information;
An authentication processing unit that generates authentication profile information by applying a preset analysis algorithm using the received authentication information on a server providing a non-face-to-face service; and
A user judgment unit that determines whether a user is a legitimate user or an illegitimate user by using the behavior profile information and authentication profile information in a server providing a non-face-to-face service;
Including,
The above action processing unit
A meta generation unit that classifies the collected above-mentioned behavior information into physical-based context information and logic-based context information according to preset type items and generates behavior meta information using the classified types; and
An n-gram generation unit that generates n-gram information for each classified behavioral information based on a pre-stored n-gram model; and
It includes an action profile generation unit that performs normalization on the above action meta information, n-gram information of physical-based context information, and n-gram information of logic-based context information, and then combines them to generate the action profile information;
The above authentication processing unit
A meta generation unit that generates authentication meta information using the received authentication information; and
An n-gram generation unit that extracts the user's physical/logical behavior information corresponding to the received authentication information using the previously collected user behavior information DB, and generates n-gram information of the extracted user behavior information based on the stored n-gram model; and
An authentication profile generation unit is included, which performs normalization on the above authentication meta information, n-gram information of physical-based context information, and n-gram information of logic-based context information, and then combines them to generate the authentication profile information;
The above user judgment part
A context authentication system using n-grams in a non-face-to-face environment, wherein the system obtains a set of continuous sequences extractable from a symbol string by n-gram information by each of the above-mentioned behavior profile information and the n-gram information by the above-mentioned authentication profile information, determines whether an element of the set by the n-gram information by the above-mentioned authentication profile information intersects an element of the set by the n-gram information by the above-mentioned behavior profile information, and if they match, determines the corresponding user as a legitimate user.
In paragraph 1,
The context authentication system using n-gram in the above non-face-to-face environment
In a server providing a non-face-to-face service, an authentication operation is performed on the corresponding user based on the authentication information by the authentication receiving unit, and when authentication is completed, a service providing unit that provides a non-face-to-face service using the corresponding terminal means;
A context authentication system using n-gram in a non-face-to-face environment, which further includes.
delete delete delete In paragraph 1,
The context authentication system using n-gram in the above non-face-to-face environment
An additional authentication unit that controls the terminal means through which the non-face-to-face service is provided and performs a preset additional authentication operation if the user is not a legitimate user based on the judgment result of the user judgment unit above;
A context authentication system using n-gram in a non-face-to-face environment, which further includes.
An authentication method using user context information by a context authentication system using n-gram in a non-face-to-face environment where each step is performed by an operation processing means,
The initial authentication step (S100) in which a user wishing to receive a non-face-to-face service enters authentication information through a terminal device in his/her possession;
A non-face-to-face service provision step (S200) in which a server providing a non-face-to-face service performs an authentication operation on the corresponding user based on the authentication information from the initial authentication step (S100), and, when authentication is completed, provides the non-face-to-face service using the corresponding terminal means;
Action collection step (S300) for collecting action information generated by a user through a connected input means in a terminal means where a non-face-to-face service is provided;
A behavior processing step (S400) of generating behavior profile information by applying a preset analysis algorithm using the behavior information collected through the behavior collection step (S300) in a terminal means where a non-face-to-face service is provided;
An authentication processing step (S500) in which authentication profile information is generated by applying a preset analysis algorithm using the authentication information received through the initial authentication step (S100) from a server providing a non-face-to-face service; and
An authentication method using user context information by a context authentication system using n-gram in a non-face-to-face environment where each step is performed by an operation processing means,
The initial authentication step (S100) in which a user wishing to receive a non-face-to-face service enters authentication information through a terminal device in his/her possession;
A non-face-to-face service provision step (S200) in which a server providing a non-face-to-face service performs an authentication operation on the corresponding user based on the authentication information from the initial authentication step (S100), and, when authentication is completed, provides the non-face-to-face service using the corresponding terminal means;
Action collection step (S300) for collecting action information generated by a user through a connected input means in a terminal means where a non-face-to-face service is provided;
A behavior processing step (S400) of generating behavior profile information by applying a preset analysis algorithm using the behavior information collected through the behavior collection step (S300) in a terminal means where a non-face-to-face service is provided;
An authentication processing step (S500) in which authentication profile information is generated by applying a preset analysis algorithm using the authentication information received through the initial authentication step (S100) from a server providing a non-face-to-face service; and
A user judgment step (S600) for determining whether a user receiving a non-face-to-face service is a legitimate user or an illegitimate user by using the action profile information from the action processing step (S400) and the authentication profile information from the authentication processing step (S500) in a server providing a non-face-to-face service;
Including,
The above action processing step (S400)
A meta-generation step (S410) in which the collected above-mentioned behavior information is classified into physical-based context information and logic-based context information according to preset type items and behavior meta-information is generated using the classified types;
An n-gram generation step (S420) for generating n-gram information for each classified behavior information based on a pre-stored n-gram model; and
A behavior profile generation step (S430) is included, which receives the behavior meta information by the above meta generation step (S410), the n-gram information of the physical-based context information by the above n-gram generation step (S420), and the n-gram information of the logic-based context information, performs normalization, and then combines them to generate the behavior profile information.
The above authentication processing step (S500)
A meta generation step (S510) for generating authentication meta information using the received authentication information;
An action extraction step (S520) for extracting physical/logical-based action information of a user corresponding to the received authentication information using a DB of user-specific action information collected in advance;
An n-gram generation step (S530) for generating n-gram information of extracted base-specific behavior information based on a pre-stored n-gram model; and
An authentication profile generation step (S540) is included, which receives the authentication meta information by the meta generation step (S510), the n-gram information of the physical-based context information by the n-gram generation step (S530), and the n-gram information of the logic-based context information, performs normalization, and then combines them to generate the authentication profile information.
The above user judgment step (S600)
A context authentication method using n-grams in a non-face-to-face environment, wherein, by using the above-mentioned behavior profile information and the authentication profile information, a set of continuous sequences extractable from a symbol string by n-gram information by each of the above-mentioned behavior profile information and the n-gram information by the authentication profile information is obtained, and whether an element of the set by the n-gram information by the authentication profile information intersects an element of the set by the n-gram information by the above-mentioned behavior profile information, and if they match, the corresponding user is determined to be a legitimate user.
delete delete delete In Article 7,
The context authentication method using n-gram in the above non-face-to-face environment
An additional authentication step (S700) for controlling the terminal means through which the non-face-to-face service is provided and performing a preset additional authentication operation if the user is not a legitimate user as determined in the above user judgment step (S600);
A context authentication method using n-gram in a non-face-to-face environment, which further includes.