KR20170035460A - Apparatus and method for providing authentication service - Google Patents

Abstract

The present invention relates to an authentication service providing apparatus and a method of providing an authentication service. According to a first aspect of the present invention, there is provided an apparatus for providing an authentication service communicating with a first user terminal and a second user terminal, the apparatus comprising: a first interface for receiving a query when receiving an authentication request from the first user terminal An interface management unit configured to receive an inquiry through the first interface and generate an answer matched with the inquiry when the inquiry is received through the first interface; . ≪ / RTI >

Description

[0001] APPARATUS AND METHOD FOR PROVIDING AUTHENTICATION SERVICE [0002]

The present invention relates to an authentication service providing apparatus and an authentication service providing method, and more particularly, to an apparatus and a method for more securely and easily authenticating a user by using a plurality of user terminals.

Recently, as e-commerce becomes more active, studies on safer settlement methods have become active.

In this regard, most of the user information used at the time of payment includes sensitive information that should never be leaked to the outside. Therefore, it has become necessary to develop a technique for certifying that the user who requests the user information has a legitimate authority so that the user information can be used only by the user.

The conventional technology developed in this way allows the user to set a password for accessing user information and access the user information only by inputting the corresponding password. In the conventional technology for authenticating a user using a password, when a user accidentally exposes a password to the outside or a password is leaked due to hacking or the like, a third party who is not authorized to access the user information inputs a password So that the user information can be accessed.

Another conventional technology has authenticated a customer through an authorized certification authority based on an authorized certificate. Such an authentication method according to the related art is relatively more secure than an authentication method using a password, but there is a problem in that illegal acquisition of an authorized certificate password through hacking and phishing using the keystroke means can not be prevented. Also, There is a problem that the authentication procedure becomes complicated due to the fact that a program for the authentication is installed separately in the user terminal.

Korean Patent Laid-Open No. 10-2011-0042621, which is related to the prior art, describes a method for providing an authentication service. However, the prior art document merely suggests a complicated method of authenticating a user using a public certificate, so that it is still necessary to develop a technique for authenticating a user simply and safely.

On the other hand, the background art described above is technical information acquired by the inventor for the derivation of the present invention or obtained in the derivation process of the present invention, and can not necessarily be a known technology disclosed to the general public before the application of the present invention .

An embodiment of the present invention is directed to an authentication service providing apparatus and a method of providing an authentication service.

According to a first aspect of the present invention, there is provided an authentication service providing apparatus for communicating with a first user terminal and a second user terminal, the authentication service providing apparatus comprising: An interface management unit for providing a first interface for receiving a query, an answer generator for generating an answer matched with the query upon receiving a query through the first interface, And an authentication processing unit for authenticating the first user terminal.

According to a second aspect of the present invention, there is provided a method of providing an authentication service by an authentication service providing apparatus communicating with a first user terminal and a second user terminal, the method comprising: receiving an authentication request from the first user terminal; The method comprising: providing a first interface for the first user terminal, receiving an inquiry through the first interface, generating an answer matched to the query, and upon receiving the answer via the second user terminal, Lt; / RTI >

According to a third aspect of the present invention, there is provided a computer-readable recording medium having recorded thereon a program for performing a method of providing an authentication service, the method comprising: receiving an authentication request from a first user terminal; Receiving an inquiry through the first interface, generating an answer matched to the query, and upon receiving the answer via the second user terminal, And authenticating.

According to a fourth aspect of the present invention, there is provided a computer program stored in a recording medium for performing a method of providing an authentication service, the authentication program being provided by an authentication service providing apparatus, Providing a first interface for receiving a query, receiving an inquiry through the first interface, generating an answer matched to the query, and receiving the answer via the second user terminal , And authenticating the first user terminal.

According to any one of the above-described objects of the present invention, an embodiment of the present invention can provide an authentication service providing apparatus and a method of providing an authentication service.

Further, according to any one of the tasks of the present invention, since information to be input to each of the plurality of user terminals is different while performing authentication using a plurality of user terminals, the authentication service providing apparatus and authentication A service providing method can be suggested.

Further, according to any one of the means for solving the problems of the present invention, it is possible to provide an apparatus and a method that can more easily authenticate a user.

The effects obtained by the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description will be.

1 is a configuration diagram of an authentication system according to an embodiment of the present invention.
2 is a block diagram illustrating an apparatus for providing an authentication service according to an embodiment of the present invention.
3 is a flowchart illustrating an authentication service providing method according to an embodiment of the present invention.
4 to 5 are exemplary diagrams for explaining a method of providing an authentication service according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an authentication system according to an embodiment of the present invention.

As shown in FIG. 1, the authentication system 100 includes a first user terminal 10, an authentication service providing apparatus 20, and a second user terminal 30.

The authentication service providing apparatus 20 according to an embodiment of the present invention can perform authentication or authentication of the first user terminal 10 by using the second user terminal 30 for the authentication request from the first user terminal 10, The non-authentication processing can be performed.

Also, the authentication service providing apparatus 20 may be configured to allow the authentication service providing apparatus 20 to authenticate a user who requests authentication from the first user terminal 10 through the first user terminal 10, prior to performing the authentication service providing method according to an embodiment of the present invention. Lt; RTI ID = 0.0 > user information < / RTI >

In this regard, 'user information' refers to various information that can be stored in a user account matching a user. The user information may include user identification information such as, for example, the user's contact, the name of the user, and the like. Also, the user information may include information that is accessible only through authentication, for example, card serial information registered by the user for payment, card password, and the like.

The authentication service providing apparatus 20 can transmit the user information so that the subsequent process according to the authentication can be performed when the first user terminal 10 is authenticated. If the subsequent process is a payment processing process, the authentication service providing apparatus 20 may transmit the user information to a payment server (such as a card company server, a bank company server, a PG company server, or the like) to perform payment processing.

The authentication service providing apparatus 20 may be implemented as a web server capable of providing a web service to each of the first user terminal 10 and the second user terminal 30, Server or a server system of various web content providers such as an online shopping mall server. In addition, the authentication service providing apparatus 20 may be implemented as a group of server systems including a web server, a load balancing server, and a database server.

Meanwhile, the authentication service providing apparatus 20 can communicate with the first user terminal 10 and the second user terminal 30 via the network N, respectively.

The network N may be a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN) wireless networks such as mobile radio communication network, Wibro (Wireless Broadband Internet), Mobile WiMAX, HSDPA (High Speed Downlink Packet Access) satellite communication network and LTE (Long Term Evolution) network.

The authentication service providing apparatus 20 as described above will be described in more detail below with reference to Fig.

Each of the first user terminal 10 and the second user terminal 30 may be implemented as an electronic terminal equipped with a client program for communicating with the authentication service providing apparatus 20. [

At this time, the electronic terminal may be implemented as a computer, a portable terminal, a television, a wearable device, or the like, which may include an interface capable of interacting with a user. Here, the computer includes, for example, a notebook computer, a desktop computer, a laptop computer, and the like, each of which is equipped with a web browser (WEB Browser), and the portable terminal may be a wireless communication device , Personal Communication System (PCS), Personal Digital Cellular (PDC), Personal Handyphone System (PHS), Personal Digital Assistant (PDA), Global System for Mobile communications (GSM), International Mobile Telecommunication (IMT) (W-CDMA), Wibro (Wireless Broadband Internet), Smart Phone, Mobile WiMAX (Mobile Worldwide Interoperability for Microwave Access) (Handheld) based wireless communication device. In addition, the television may include an Internet Protocol Television (IPTV), an Internet television (TV), a terrestrial TV, a cable TV, and the like. Further, the wearable device is an information processing device of a type that can be directly worn on a human body, for example, a watch, a glasses, an accessory, a garment, shoes, or the like, and can be connected to a remote server via a network, Lt; / RTI >

Each of the first user terminal 10 and the second user terminal 30 implemented by such an electronic terminal is used for distinguishing two different user terminals from each other and is referred to as a user terminal having a specific function It does not.

Meanwhile, the authentication service providing apparatus 20 according to an embodiment of the present invention can communicate with a third party apparatus (not shown) via the network N. [

The third party device (not shown) may be a device that transmits an answer to the inquiry to the authentication service providing device 20 as the authentication service providing device 20 transmits the query, and when the query is a mathematical expression, (For example, a calculator module) for performing an operation of the mathematical expression. Such a third party device (not shown) may be implemented as a group of server systems including a web server, a load balancing server, and a database server.

2 is a block diagram illustrating an authentication service providing apparatus 20 according to an embodiment of the present invention.

The authentication service providing apparatus 20 according to the preferred embodiment of the present invention includes an interface management unit 210 that provides a first interface for receiving a query.

That is, when receiving the authentication request from the first user terminal 10, the interface management unit 210 may provide the first interface for receiving the query to the first user terminal 10.

Here, the 'first interface' means an interface constituting a screen of the first user terminal so that the user can easily input a query.

Also, the interface management unit 210 may provide a second interface for receiving an answer to the second user terminal 30.

The interface management unit 210 may also provide a triggering signal to the second user terminal 30 for execution of an application installed in the second user terminal 30 and providing a second interface.

The second user terminal 30 receiving the triggering signal may provide a second interface by executing an application installed on the second user terminal 30. When the provision of the second interface ends To the authentication service providing apparatus 20 by forming a communication channel with the authentication service providing apparatus 20 through the second interface.

The 'second interface' refers to an interface that forms a screen of the second user terminal so that the user can easily input an answer.

For example, if the second user terminal 30 is a portable terminal, the second interface may be an interface capable of receiving numbers or characters as the user senses a click, a touch, a tap, And may be an interface that acquires a series of numbers or characters received within a specified period in response to a voice prompt.

Meanwhile, the interface management unit 210 may search for a second user terminal to which a second interface or a triggering signal is to be provided.

For example, the interface management unit 210 may search for a second user terminal that is at least one of the user terminals registered in the user account corresponding to the first user terminal that transmitted the authentication request.

For example, the interface management unit 210 may acquire, from the first user terminal 10 that has transmitted the authentication request, terminal identification information matching the second user terminal (for example, A telephone number or the like in the case of the second user terminal 30).

Meanwhile, the authentication service providing apparatus 20 may further include an answer generating unit 220 that generates an answer matching the inquiry when receiving the inquiry through the first interface.

For example, if the query is a mathematical expression, the answer generating unit 220 may calculate the result of the mathematical expression and generate the calculated result as a response.

In addition, the answer generator 220 may request and obtain an answer matched to the query by a third party device (not shown).

For example, if the third party device (not shown) includes a calculator module, it can send a mathematical query to a third party device (not shown) and obtain the answer as its response.

The authentication service providing apparatus 20 may further include an authentication processing unit 230 for authenticating the first user terminal 10 upon receiving an answer via the second user terminal 20. [

That is, the authentication processing unit 230 can authenticate the first user terminal 10 provided with the first interface if the answer received through the second interface is an answer matching the query received through the first interface.

On the other hand, if the answer received through the second interface is an answer that is not matched with the query received via the first interface, the authentication processing unit 230 can disqualify the first user terminal 10.

3 is a flowchart illustrating an authentication service providing method according to an embodiment of the present invention.

The authentication service providing method according to the embodiment shown in FIG. 3 includes steps that are performed in a time-series manner in the authentication service providing apparatus 20 shown in FIG. Therefore, the contents described above with respect to the authentication service provision 20 shown in FIG. 2 may be applied to the authentication service provision method according to the embodiment shown in FIG. Fig. 3 is described below with reference to Figs. 4 and 5. Fig.

The authentication service providing apparatus 20 communicating with the first user terminal 10 and the second user terminal 30 may receive the authentication request from the first user terminal 10 at step S310.

In the following description, it is assumed that the first user terminal 10 is a computer and the second user terminal 30 is a portable terminal.

Upon receiving the authentication request, the authentication service providing apparatus 20 may provide the first interface for receiving the query to the first user terminal 10 (S320).

The authentication service providing apparatus 20 can receive the query through the first interface (S330).

4 is a diagram illustrating an authentication service providing method according to an embodiment of the present invention. Referring to FIG. 4, the authentication service providing method according to an embodiment of the present invention includes a first Lt; / RTI >

As shown in FIG. 4, the authentication service providing apparatus 20 may provide a first interface 410, 420 that can receive a query from a user.

The first interface includes, for example, an interface 420 on one side of the screen of the first user terminal 10 for inputting an expression through each operator or number input, The other side of the screen includes an interface 410 for displaying the mathematical expression input through the interface 420 so that the user can check the mathematical expression inputted by the user.

Meanwhile, the authentication service providing apparatus 20 may generate an answer matching the query (S340).

That is, as shown in FIG. 4, when the user inputs the mathematical expression, the authentication service providing apparatus 20 calculates the formula to calculate that the answer matched with the query is '55'.

The authentication service providing apparatus 20 may provide a second interface to the second user terminal 30. [

The authentication service provision apparatus 20 also provides a triggering signal to the second user terminal 30, which is capable of executing an application installed on the second user terminal 30 and providing a second interface for receiving answers .

At this time, the authentication service providing apparatus 20 may provide a second interface (or a triggering signal) after generating an answer matched with the query, and may also generate a second interface (or triggering signal) Can be provided.

The authentication service providing apparatus 20 can receive the information through the second interface (S350).

At this time, the second interface can perform the ARS voice guidance to the second user terminal 30 to acquire the received information within a designated period according to the voice guidance. Also, the second interface can acquire information input to the second user terminal 30 by sensing a user's click, touch, tap, etc. through the second user terminal 30. [

If the information obtained by the second interface is different from the answer, the authentication service providing apparatus 20 can perform the unauthentication process on the first user terminal (S360) If it is the same information, the first user terminal can be authenticated (S370).

FIG. 5 is a diagram illustrating an authentication service providing method according to an embodiment of the present invention. Referring to FIG. 5, a screen 500 of a second user terminal 30 communicating with an authentication service providing apparatus 20 And shows an example of a second interface that appears.

As shown in FIG. 5, the authentication service providing apparatus 20 may provide a second interface 510 for receiving an answer from a user. The second user terminal 30 can receive information from the user through the second interface 510. [

Accordingly, the authentication service providing apparatus 20 can authenticate the first user terminal 10 by receiving '55' as an answer to the query through the second interface 510 as shown in FIG. 5, The second user terminal 10 may be unauthorized by receiving a different answer 56 from the correct answer 55 as an answer to the inquiry.

That is, according to the authentication service providing method according to the embodiment of the present invention, user authentication security can be further improved by inputting different information to each of the first user terminal and the second user terminal. Further, according to the authentication service providing method according to an embodiment of the present invention, the user can be more easily authenticated. For example, when the query is a mathematical expression, a user directly inputs a mathematical expression, In addition, since the answer of the mathematical expression is a number, the user can be authenticated with a simple numeric input.

On the other hand, when the first user terminal 10 authenticated according to the authentication service providing method described above requests authentication for payment processing in a payment server (not shown), for example, the authentication service providing apparatus 20, The user information corresponding to the first user terminal 10 subjected to the authentication processing can be transmitted to the payment server (not shown).

The term " part " used in the present embodiment means a hardware component such as software or a field programmable gate array (FPGA) or an ASIC, and 'part' performs certain roles. However, 'part' is not meant to be limited to software or hardware. &Quot; to " may be configured to reside on an addressable storage medium and may be configured to play one or more processors. Thus, by way of example, 'parts' may refer to components such as software components, object-oriented software components, class components and task components, and processes, functions, , Subroutines, segments of program patent code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables.

The functions provided within the components and components may be combined with a smaller number of components and components or separated from additional components and components.

In addition, the components and components may be implemented to play back one or more CPUs in a device or a secure multimedia card

The authentication service providing method according to the embodiment described with reference to FIG. 3 may also be implemented in the form of a recording medium including instructions executable by a computer such as a program module executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

Furthermore, the authentication service providing method according to an embodiment of the present invention may be implemented as a computer program (or a computer program product) including instructions executable by a computer. A computer program includes programmable machine instructions that are processed by a processor and can be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language . The computer program may also be recorded on a computer readable recording medium of a type (e.g., memory, hard disk, magnetic / optical medium or solid-state drive).

Therefore, the authentication service providing method according to the embodiment of the present invention can be realized by the computer program as described above being executed by the computing device. The computing device may include a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using a variety of buses and can be mounted on a common motherboard or mounted in any other suitable manner.

Where the processor may process instructions within the computing device, such as to display graphical information to provide a graphical user interface (GUI) on an external input, output device, such as a display connected to a high speed interface And commands stored in memory or storage devices. As another example, multiple processors and / or multiple busses may be used with multiple memory and memory types as appropriate. The processor may also be implemented as a chipset comprised of chips comprising multiple independent analog and / or digital processors.

The memory also stores information within the computing device. In one example, the memory may comprise volatile memory units or a collection thereof. In another example, the memory may be comprised of non-volatile memory units or a collection thereof. The memory may also be another type of computer readable medium such as, for example, a magnetic or optical disk.

And the storage device can provide a large amount of storage space to the computing device. The storage device may be a computer readable medium or a configuration including such a medium and may include, for example, devices in a SAN (Storage Area Network) or other configurations, and may be a floppy disk device, a hard disk device, Or a tape device, flash memory, or other similar semiconductor memory device or device array.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

10: first user terminal 20: authentication service providing device
30: User terminal
210: interface management unit 220:
230: authentication processing unit

Claims (11)

An authentication service providing apparatus for communicating with a first user terminal and a second user terminal,
An interface management unit for providing a first interface for receiving a query upon receiving an authentication request from the first user terminal;
An answer generator for generating an answer that matches the query when the query is received through the first interface; And
And an authentication processing unit for authenticating the first user terminal when the response is received through the second user terminal. The method of claim 1, wherein
In addition,
And upon receiving a query through the first interface, provides a second interface for receiving the answer to the second user terminal. The method according to claim 1,
In addition,
And providing a triggering signal to the second user terminal for execution of an application installed on the second user terminal and providing a second interface for receiving the answer upon receipt of the query via the first interface, Service provider. The method according to claim 1,
Wherein the first interface is configured to enable input of a formula,
Wherein the answer to the query is an operation result value of the equation. The method according to claim 1,
The authentication service providing apparatus communicates with a third party apparatus via a network,
In addition,
And obtains an answer that matches the query from the third party device. A method for providing an authentication service by an authentication service providing apparatus communicating with a first user terminal and a second user terminal,
Receiving a request for authentication from the first user terminal, providing a first interface for receiving a query;
Receiving an inquiry through the first interface, generating an answer that matches the query; And
And authenticating the first user terminal upon receiving the answer via the second user terminal. The method according to claim 6,
Further comprising: providing a second interface for receiving the answer to the second user terminal. The method according to claim 6,
Further comprising providing a triggering signal to the second user terminal for execution of an application installed on the second user terminal and providing a second interface for receiving the answer. The method according to claim 6,
Wherein the first interface is configured to enable input of a formula,
Wherein an answer to the query is an operation result value of the equation. A computer-readable recording medium on which a program for carrying out the method according to claim 6 is recorded. A computer program executed by an authentication service providing apparatus and stored in a recording medium for performing the method of claim 6.

Images