KR101479318B1 - system for issuing an OTP generator and method thereof - Google Patents

Abstract

The present invention relates to an OTP generator issuing system and a method thereof, wherein a user visits a service provider operating a OTP issuing server (30) using a communication network or directly requests a secret information issuance for issuing an OTP generator, The authentication server 30 requests and receives a random number of the IC cards 20 and 25 included in the user terminal 10 and transmits the random number and user information of the received IC cards 20 and 25 to the integrated authentication server 40 Receives the secret information for issuing the encrypted OTP generator generated by the integrated authentication server 40, and issues the secret information for issuing the encrypted OTP generator to the user terminal 10. The integrated authentication server 40 receives the random number and the user information of the IC cards 20 and 25 included in the user terminal 10 and transmits the received user information to the mobile communication company 50 to authenticate the IC card 20 And 25, generates and encrypts secret information for issuing the OTP generator, and transmits the secret information to the OTP issuing server 30. The mobile communication company server 50 receives the user information from the integrated authentication server 40, authenticates it, and transmits the authentication result. It is possible to eliminate the inconvenience of replacing the existing security card and having a separate OTP generator by providing a one-time password generating device that generates an OTP using an IC card (e.g., USIM card, smart card) To overcome the security vulnerability caused by repeated use of the same password.

Description

[0001] The present invention relates to a system for issuing an OTP generator and a method thereof,

The present invention relates to an OTP generator issuance and management system and a method thereof, and more particularly, to an OTP generator and an OTP generator for providing a OTP generator for generating a one-time password (OTP) The present invention relates to an OTP generator issuing system and method for overcoming a security vulnerability caused by repeated use of the same password by using a password or the like.

OTP (One Time Password) is a user authentication method that uses a one-time password of a random number generated randomly. This one-time password is referred to as OTP and the terminal which generates such a password in an extended sense is also called OTP.

This system was introduced to enhance security, and it was introduced to overcome the security vulnerability caused by repeated use of the same password by generating one time password every login.

It is mainly used in electronic banking transactions such as online banking in a banking system, and a user uses an OTP generator which is a hardware for generating a one-time password. Due to the inconvenience of having a separate OTP generator, it has not been used in a wide range of application fields and industries except for electronic financial transactions.

A method of issuing an authentication and membership using a mobile terminal equipped with a chip card such as the USIM has already been disclosed in, for example, Korean Patent Laid-Open No. 10-2010-0064139 (published on June, 14, 2010).

FIG. 1 shows a network configuration diagram of a membership issuing and managing system according to a conventional technique.

The network of the membership issuing and management system according to the related art requests the authentication server 3 to perform the first authentication for the user and the mobile terminal 1 and when the first authentication is approved, An authentication unit for obtaining authentication information and requesting the user and the mobile terminal (1) for a second authentication to the membership issuing server (5) using the authentication information; And a recording unit for issuing a membership from the membership issuing server 5 and recording the membership on the chip when the second authentication is approved.

In the related art, a contact type chip card in which a mobile terminal and a chip card are electrically and physically coupled is used. The above-mentioned prior art has an advantage that a user has a plurality of cards provided by various service providers such as a financial institution and combines them with a single chip card so that one user does not need to carry several cards at the same time. However, Issuance and registration must be separately provided. Also, when a mobile terminal such as a smart device is occupied by hacking or the like, there may arise a problem that all financial information of the user is exposed at once. In the case of the plastic membership card, only one card to which only one card number is assigned can be issued, and it is inconvenient to carry ten cards.

Disclosure of Invention Technical Problem [8] The present invention has been proposed in order to solve the above-described problems of the related art, and an object of the present invention is to provide an OTP (one-time password) generator for generating an OTP And an OTP generator issuing system capable of eliminating the inconvenience of having a separate OTP generator.

Another object of the present invention is to provide an OTP (one-time password) generator for generating an OTP (one-time password) using an IC card, display an OTP generated at the user terminal by generating an OTP (disposable password) The present invention provides a system and method for issuing an OTP generator that can overcome a security vulnerability caused by repeated use of a password.

It is still another object of the present invention to provide an OTP generator issuing system and a method thereof, in which a plurality of service providers can use one OTP generator for an OTP service and can generate and service different OTPs for each service provider will be.

To achieve these and other advantages and in accordance with the purpose of the present invention, as embodied and broadly described herein, an OTP generator issuing system according to the present invention includes a driver module installed by using a wireless communication network or a service provider operating an OTP issuing server, A user terminal for requesting an OTP issuance server for confidential information for issuing an OTP generator by using a communication network by a user who owns an IC card injected with an authentication module by visiting or using a wireless communication network; Requesting secret information for issuing an OTP generator from the user terminal, requesting a random number of the user's IC card and receiving the random number together with the user information, transmitting the random number of the received IC card and the user information to the integrated authentication server, An OTP issuing server for receiving the encrypted OTP information generated by the integrated authentication server authenticating the user information in the mobile communication company server and issuing secret information for issuing the encrypted OTP generator to the user terminal; Receives the random number and user information of the IC card from the OTP issuance server, transmits the received user information to the mobile communication company server and authenticates, generates secret information for issuing the OTP generator using the random number of the IC card, An OTP issuing server; And a mobile communication company server that receives user information from the integrated authentication server, authenticates the user, and transmits an authentication result.

According to an embodiment of the present invention, a user terminal includes an IC card, wherein the IC card includes an authentication module for generating authentication information and secret information for issuing an OTP generator, An authentication module may be injected into the IC card to be issued or a user may visit the service provider in advance to receive the service module, and the user terminal may be provided with a drive module received from the mobile communication company server through a wireless communication network, And the drive module is installed.

According to an embodiment of the present invention, the user terminal having the IC card requests the OTP issuance server to issue the secret information for issuing the OTP generator using the communication network. Requesting an IC card random number generated by the user's IC card to the user terminal; The user terminal requests the IC card to generate a random number and transmits the IC card random number generated by the authentication module included in the IC card to the OTP issuing server; Receiving the IC card random number from the user terminal and transmitting the IC card random number and the user information of the user terminal together to the integrated authentication server; When the authentication is completed, the integrated authentication server generates and encrypts secret information for issuing the OTP generator using the random number of the IC card, and transmits the secret information to the OTP issuing server ; After receiving the secret information for issuing the encrypted OTP generator, the OTP issuing server issues secret information for issuing the encrypted OTP generator through the issuer connected to the OTP issuing server or transmits the secret information for issuing the encrypted OTP generator to the user terminal Issuing; And the user terminal decrypts the secret information for issuing the encrypted OTP generator to the IC card, and stores the encrypted secret information in the IC card to complete the issuance.

According to an embodiment of the present invention, a user may request an OTP issuance server to issue an authentication module or visit a service provider operating the OTP issuance server by using a user terminal, The OTP issuance server receives an issuance request of an authentication module from a user terminal and transmits information necessary for issuing an authentication module including financial information and identification information about the user of the user terminal to the user terminal; The user terminal transmits information required for issuing an authentication module received from the OTP issuing server to a mobile communication company server to request issuance of an authentication module; The mobile communication company server includes a step of receiving a request for issuing an authentication module from a user terminal, receiving information required for issuing the authentication module, and installing a driving module for installing the authentication module to the user terminal through a communication network; The user terminal driving the driving module issued from the mobile communication company server to install an authentication module in the IC card; The user requesting the OTP issuance server to issue secret information using the user terminal; The OTP issuance server requests the issuance of the secret information from the user terminal and requests the issuance of the secret information to the integrated authentication server; The integrated authentication server requests secret information issuance from the OTP issuance server to generate secret information, and transmits the generated secret information to the OTP issuance server to approve the second issuance; And the OTP issuing server transmits secret information received from the integrated authentication server to the user terminal and stores the secret information in the IC card.

According to an embodiment of the present invention, the integrated authentication server has a service domain key for accessing the authentication module for mutual authentication with the IC card, and the service domain key and the service domain key of the IC card transmitted at the time of issuing the secret information And generates a different session key every time using a random number to encrypt the secret information.

According to an embodiment of the present invention, the secret information includes an OTP generation key, a serial number, an expiration date, and a vendor code.

According to an embodiment of the present invention, the OTP generation key is encrypted using the authentication code delivered by the OTP issuing server, and is encrypted using the service domain key and the session key generated using the random number of the IC card .

According to an embodiment of the present invention, after the IC card is connected to the user terminal from the OTP issuance server, the IC card transmits the environment information (hash value of the drive module, information of the IC card, information of the user terminal) And stores the generated information in the IC card.

According to an embodiment of the present invention, the secret information which is issued by the OTP issuance server and stored in the IC card is input authentication information for authentication between the authentication module and the drive module securely received from the OTP issuance server, And the issuing of the information is completed.

According to an embodiment of the present invention, the user terminal performs mutual authentication with the IC card; Encrypting information necessary for OTP authentication and management (unlocking, PIN change, information confirmation) by the user terminal and transmitting the encrypted information to the IC card; Decrypting the information required for authentication and management of the received OTP and processing the corresponding job; And encrypting the processing result in the IC card and transmitting the encryption result to the user terminal.

According to an embodiment of the present invention, the user terminal and the IC card generate a session key after mutual authentication using the information of the driving module.

According to an embodiment of the present invention, the user terminal and the IC card perform encryption / decryption of all data communicated using the session key.

According to an embodiment of the present invention, when a terminal is contacted with a USIM or a contactless IC card connected to the user terminal to request a one-time password generation, the driving module installed in the user terminal transmits secret information stored in the IC chip And generates and transmits a one-time password through the authentication module. The driving module decrypts and outputs the one-time password to the screen, and the user performs the user authentication using the one-time password.

As described above, according to the present invention, it is necessary to provide a one-time password generator that generates an OTP (one-time password) using an IC card (e.g., USIM card, smart card, etc.) to replace an existing security card and have a separate OTP generator Can be eliminated. In addition, OTP (one-time password) is generated at regular intervals and the same password is used repeatedly to overcome security vulnerability.

1 is a network configuration diagram of a membership issuing and management system according to a conventional technique,
2A is a conceptual diagram illustrating a structural relationship between a user terminal and a contactless IC card according to the present invention;
2B is a conceptual diagram illustrating a structural relationship between a user terminal and a contact type IC card according to the present invention.
3 is a configuration diagram showing an OTP issuing system according to the present invention;
FIG. 4 is a flowchart illustrating a secret information issuing process for issuing an authentication module and an OTP generator according to the present invention;
5 is a flowchart illustrating an OTP generation process between a user terminal and an IC card according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a disposable password issuing apparatus and method according to the present invention will be described in detail with reference to the accompanying drawings.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. The specific configurations, effects, features, and advantages of the present invention will be apparent from the accompanying drawings and the following preferred embodiments.

FIG. 2A is a conceptual diagram illustrating a structural relationship between a user terminal and a contactless IC card according to the present invention, and FIG. 2B is a conceptual diagram illustrating a structural relationship between a user terminal and a contact type IC card according to the present invention.

Referring to FIGS. 2A and 2B, a system for issuing an OTP generator of the present invention includes a contactless IC card 20, a contact type IC card 25 and a user terminal 10 on the user side.

The contactless IC card 20 includes an authentication module 23 for generating authentication information such as OTP (One Time Password) as a smart card such as a general credit card issued to a user by a financial institution as a service provider, And an IC chip 21 and an antenna 22 as hardware. In addition, if necessary, the SIM 14, and the control unit 15 for integrally controlling the SIM 14 and the NFC element 12 may be included.

The contact type IC card 25 includes an authentication module 26 for generating authentication information such as OTP (One Time Password) as a universal subscriber identity module (USIM) card and secret information 27 for OTP issuance do.

The user terminal 10 includes an NFC device 12 and a wireless antenna 13 as hardware so as to enable data communication with the contactless IC card 20 through Bluetooth or Near Field Communication (NFC) OTP software and a drive module 11 for transmitting and receiving data to and from the IC cards 20 and 25 and the OTP software.

The confidential information 24 and 27 for issuing the OTP generator included in the contactless IC card 20 and the contact type IC card 25 are confidential information such as a generated key, linkage information, PIN (Personal Identification Number) Required information.

 The authentication modules 23 and 26 correspond to a module (i.e., an OTP generator) for directly accessing the secret information for issuing the OTP generator and generating the OTP, as one of the configurations of the mobile OTP (One Time Password) According to an embodiment of the present invention, a user can take the IC card 20, 25 and take it directly to a service provider such as a financial institution and inject it.

On the other hand, The driving module 11 corresponds to mobile OTP driving software such as a graphical user interface, an authentication module installation program, and an on-line manual that are not directly related to OTP generation, (10). ≪ / RTI >

In the case of offline issuance, the user of the user terminal 10 is a service provider (for example, a financial institution) operating the OTP issuance server 30, And the service provider sends the confidential information 24 and 27 for issuing the OTP generator by connecting the IC cards 20 and 25 to the IC card issuer connected to the OTP issuing terminal, .

On-line issuance issues confidential information 24 and 27 for issuing an OTP generator via wireless communication between the drive module 11 of the user terminal 10 and the authentication modules 23 and 26 of the IC cards 20 and 25 Receive.

First, an OTP generator issuing system representing an online issuing method will be described with reference to FIG.

3 is a block diagram showing an OTP generator issuing system according to the present invention.

Referring to FIG. 3, the OTP (Disposable Password) generator issuing system according to the present invention uses a wireless communication network (e.g., OTA) or visits a service provider operating the OTP issuing server 30 so that the driving module 11 And visits the service provider operating the OTP issuance server 30 or accesses the user who owns the IC cards 20 and 25 injected by the authentication modules 23 and 26 using a wireless communication network A user terminal 10 for requesting an OTP (Disposable Password) issuance server 30 (e.g., a bank server) by using a communication network (e.g., OTA (Over The Air)) for secret information for issuing an OTP generator;

The user terminal 10 is requested to issue secret information for issuing the OTP generator and receives a random number of the user's IC card 20 and 25 together with the user information, And transmits the secret information for issuing the encrypted OTP generator, which is generated by the integrated authentication server 40 by authenticating the user information by the mobile communication company server 50, to the integrated authentication server 40 An OTP issuing server (30) for receiving and issuing secret information for issuing an encrypted OTP generator to the user terminal (10);

Receives the random number and user information of the user's IC cards 20 and 25 from the OTP issuance server 30 and transmits the received user information to the mobile communication company 50 to authenticate the IC cards 20 and 25 An integrated authentication server 40 for generating and encrypting secret information for issuing an OTP generator using a random number of the OTP issuing server 30;

And a mobile communication company server 50 for receiving and authenticating user information from the integrated authentication server 40 and transmitting an authentication result.

Here, the user's IC cards 20 and 25 may be issued by injecting authentication modules 23 and 26 at the time of issuance by a service provider (e.g., a financial institution) (23, 26) can be injected.

Also, the user terminal 10 may be installed in the user terminal 10 by downloading the drive module 11 through a wireless communication network or by visiting the service provider directly.

Therefore, the user terminal 10 and the user's IC cards 20 and 25 of the OTP generating device issuing system shown in FIG. 3 include the driving module 11 and the authentication modules 23 and 26.

The user terminal 10 sends an OTP (disposable password) to the issuing server 30 (e.g., the bank server) using the communication network (e.g., OTA (Over The Air)) by the user who owns the IC cards 20, And requests issuance of the secret information for issuing the generator (S101).

The OTP issuance server 30 requests the IC card 10 to generate an IC card random number generated by the user's IC card 20 or 25 (e.g., USIM card, smart card, etc.) (S102).

The user terminal 10 requests the IC cards 20 and 25 to generate a random number and sends the IC card random number generated by the authentication modules 23 and 26 included in the IC cards 20 and 25 to the OTP issuing server (S103).

The OTP issuance server 30 receives a random number of the IC cards 20 and 25 from the user terminal 10 and transmits the random number of the IC cards 20 and 25 and the user information of the user terminal 10 together To the server 40 (S104).

The integrated authentication server 40 transmits the user information of the user terminal 10 to the mobile communication company server 50 to request authentication, and when the authentication is completed, the integrated authentication server 40 uses the random number of the IC card 20, Generates and encrypts secret information for issuing the generator, and transmits it to the OTP issuing server 30 (S105, S106).

After receiving the secret information for issuing the encrypted OTP generator, the OTP issuing server 30 issues the secret information for issuing the encrypted OTP generator to the user terminal 10 (S107).

The user terminal 10 causes the IC cards 20 and 25 to decrypt secret information for issuing the encrypted OTP generator And the issuance is completed (S108).

FIG. 4 is a flowchart illustrating a secret information issuing process for issuing an authentication module and an OTP generator according to the present invention.

4, an authentication module 23, 26 is installed in the IC card 20, 25 and the secret information 24, 27 is stored, and the process of issuing the OTP generator to the IC cards 20, Respectively.

The user requests the OTP issuance server 30 (for example, a bank or the like) for the first issuance (issue of the authentication modules 23 and 26) using the user terminal 10 (S401). Here, the authentication modules 23 and 26 are modules for generating a one-time password by directly accessing secret information such as generated key, linkage information, and PIN (Personal Identification Number) information in the configuration of the mobile OTP software. For example, (JavaCard Applet).

The OTP issuing server 30 receives an application for issuing an authentication module (issuance of an authentication module) from the user terminal 10 and obtains information necessary for issuing an authentication module including financial information and identification information about the user of the user terminal 10 To the user terminal 10 (S402).

The user terminal 10 transmits information required for issuing the authentication module received from the OTP issuance server 30 to the mobile communication company server 50 to request the first issuance (issuance of the authentication modules 23 and 26) S403).

The mobile communication company server 50 receives the information (financial information, identification information, and the like) necessary for issuing the authentication module and receives the authentication module (23, 26) from the user terminal 10 23, and 26 are installed in the user terminal 10 through a communication network (S405).

The user terminal 10 drives the drive module 11 issued from the mobile communication company server 50 and installs the authentication module 21 in the IC card 20 at step S406. Here, the issuance of the authentication modules 23 and 26 is performed by the mobile communication company operating the mobile communication company server 50 to the IC cards 20 and 25 (for example, USIM card, smart card) ) Can be installed and issued.

The user requests the OTP issuance server 30 to issue the second issuance (issuance of the secret information 24, 27) using the user terminal 10 (S407). Also, the second issuance may be made by visiting a service provider (for example, financial institution or the like) operating the OTP issuance server 30 and connecting the user terminal 10 to the OTP issuance server 30 And may be issued through an OTP issuing terminal operated by the service provider.

The OTP issuance server 30 receives a second issuance of the secret information 24 and 27 from the user terminal 10 and requests the integrated authentication server 40 to issue a second issuance in step S408.

The integrated authentication server 40 receives the secondary issuance request from the OTP issuance server 30 to generate secondary issuance information (confidential information 24 and 27) and transmits the generated secondary issuance information to the OTP issuance server 30 to approve the second issuance (S410).

The integrated authentication server 40 stores the user PIN (Personal Identification Number) information for accessing the authentication modules 23 and 26 in the Put Key command (IC card 20 or 25) Change command, ISO / IEC 7816-4 definition). The eigenvalues R1 and R2 of the drive module 11 are used for mutual authentication.

Here, R1 is a unique random number of the drive module 11 generated at the time of secondary issuance and is stored securely in the user terminal 10. [ R2 is information (e.g., a drive module hash value, IC card information, terminal information, and the like) generated by the drive module 11 using the environment information at the time of secondary issuance and is stored in the IC cards 20 and 25 . And is information that can only be generated only by the user terminal 10.

The OTP issuing server 30 transmits the secondary issuing information (confidential information 24 and 27) received from the integrated authentication server 40 to the user terminal 10 so as to be stored in the IC cards 20 and 25 (S411, S412).

Confidential information 24, 27 included in the IC card 20 is confidential information such as a generated key, linkage information, and a PIN (Personal Identification Number) associated with the authentication information. The authentication modules 23 and 26 correspond to a module for directly accessing the secret information 24 and 27 to generate an OTP, which is one of the configurations of mobile OTP (One Time Password) software.

The user terminal 10 includes OTP software and a drive module 11 for transmitting and receiving data with the OTP software and the IC cards 20 and 25. Here, the driving module 11 is mobile OTP driving software such as a graphical user interface, an authentication module installation program, and an on-line manual, which are not directly related to the generation of a one-time password in the configuration of mobile OTP software.

5 is a flowchart illustrating an OTP generation process between a user terminal and an IC card according to the present invention.

When the user requests OTP generation through the user terminal 10, the user terminal 10 performs a mutual authentication process with the IC cards 20 and 25 (step S501). After the mutual authentication process, the user terminal 10 encrypts the association information (e.g., time, event, etc.) for OTP generation and transmits the encrypted information to the IC cards 20 and 25. (Step S502)

The IC cards 20 and 25 receive and decode the encrypted association information, generate an OTP using the decrypted OTP generation key information (step S503), encrypt the generated OTP and transmit the encrypted connection information to the user terminal 10 (Step S504). The user terminal 10 decrypts the encrypted OTP transmitted from the IC cards 20 and 25 and displays the decrypted OTP on a display unit (not shown) (S505), and transmits the decrypted OTP to the user (for example, Internet banking , Automatic Teller's Machine (ATM), etc.).

Although the preferred embodiments of the present invention have been described above, the scope of the present invention is not limited thereto, and various modifications and changes may be made by those skilled in the art.

10: user terminal 11: drive module
20, 25: IC card 23, 26: authentication module
24, 27: secret information 30: OTP issuing server
40: integrated authentication server 50: mobile communication company server

Claims (9)

The IC card 20 and 25 and storing the authentication modules 23 and 26 and the confidential information 24 and 27 in the IC cards 20 and 25, A user terminal (10) for generating a password;
The authentication module 23 and the driving module 11 are issued to the user terminal 10 and the secret information 24 and 27 issued by the integrated authentication server 40 are transmitted to the user terminal 10, An OTP issuing server (30) for issuing an OTP to the server;
Upon receipt of the request for issuing the confidential information 24 and 27 from the OTP issuance server 30, the confidential information 24 and 27 are generated and encrypted after the user authentication through the mobile communication company server 50, 30 to the integrated authentication server 40;
And the mobile communication company server (50) which receives user information from the integrated authentication server (40), authenticates and transmits an authentication result,
The IC card (20, 25)
The hash value of the driving module 11 of the user terminal 10, the information of the IC cards 20 and 25, and the information of the user terminal 10 after connecting with the user terminal 10 (R1, R2) of the drive module (11) having environmental information, and storing the generated eigenvalues (R1, R2) in the IC card (20, 25) for mutual authentication;
The driving module 11 transmits and receives data to and from the IC cards 20 and 25 so that a plurality of service providers share one OTP generator and the user terminal 10 can use the OTP service OTP generator issuing and management system.
The method according to claim 1,
The OTP issuing server 30 includes the secret information 24, 27, the driving module 11, and the authentication module 23, 26 related to OTP issuance,
The secret information 24 or 27 includes an OTP generation key, a serial number, an expiration date, a vendor code, and is stored in the IC cards 20 and 25, and is transmitted to the OTP issuing server 30 using an issuer Issued directly to the IC cards 20 and 25, issued via the mobile communication network,
The driving module 11 is installed in the user terminal 10 and outputs a disposable password or installs a module. The driving module 11 is directly installed in the user terminal 10, is issued through the mobile communication network,
The authentication modules 23 and 26 are stored in the IC cards 20 and 25 to generate and manage the one-time passwords. The authentication modules 23 and 26 directly issue the IC cards 20 and 25 or install them through the mobile communication network Wherein the OTP generator is an OTP generator.
The OTP issuing server 30 requests the user terminal 10 to generate a random number of the IC cards 20 and 25 (S102);
The user terminal 10 requests the IC card 20 or 25 to generate the random number in response to the request and transmits the random number generated by the authentication module 23 or 26 included in the IC card 20 or 25 (S103) of delivering a random number of the IC cards (20, 25) to the OTP issuing server (30);
The OTP issuance server 30 receives a random number of the IC cards 20 and 25 from the user terminal 10 and transmits a random number of the IC cards 20 and 25 and user information of the user terminal 10 together To the integrated authentication server 40 (S104);
The integrated authentication server 40 transmits the user information of the user terminal 10 to the mobile communication company server 50 to request authentication and when the authentication is completed, the integrated authentication server 40 transmits secret information 24, 27 for issuing the OTP generator (S105, S106), encrypting the encrypted data using the random numbers of the IC cards (20, 25) and transmitting the encrypted data to the OTP issuing server (30);
After the OTP issuance server 30 receives the secret information for issuing the encrypted OTP generator, issuing the secret information for issuing the encrypted OTP generator to the user terminal 10 (S 107);
The user terminal 10 includes a step of decrypting the secret information for issuing the encrypted OTP generator from the IC cards 20 and 25 and storing the secret information in the IC cards 20 and 25 and,
The IC card (20, 25)
The user terminal 10 is connected to an environment including the hash value of the drive module 11 of the user terminal 10, information of the IC cards 20 and 25, and information of the user terminal 10 (R1, R2) of the drive module (11) having information on the IC card (20, 25) for mutual authentication;
The driving module 11 transmits and receives data to and from the IC cards 20 and 25 so that a plurality of service providers share one OTP generator and the user terminal 10 can use the OTP service How to issue and manage OTP generators.
The method of claim 3,
The IC card (20, 25) generates a random number in the drive module (11) of the user terminal (10) and stores it together with the user terminal (10);
The eigenvalue R1 of the driving module 11 is a unique random number of the driving module 11 generated during the secondary issuance and is stored in the user terminal 10, The hash value of the drive module 11 generated by the drive module 11 using the environment information and the information of the IC cards 20 and 25 during the second issuance, And is stored in the IC card (20, 25) when the second issuance is performed.
delete The method of claim 3,
The random number of the IC cards 20 and 25 delivered at the time of issuance of the confidential information 24 and 27 and the integrated authentication server 40 issue the confidential information 24 and 27 to the IC cards 20 and 25 Generating a session key after mutual authentication using the service domain key (SDKey) for encrypting the secret information (24, 27), and encrypting the secret information (24, 27).
delete The method of claim 3,
Generates a session key after mutual authentication using information and a random number shared between the user terminal 10 and the IC cards 20 and 25 at the time of issuance of the confidential information 24 and 27, And encrypting and decrypting data communicated between the IC cards (20, 25).
The method of claim 3,
The driving module 11 installed in the user terminal 10 is connected to the authentication modules 23 and 26 and the USIM or the contactless IC card connected to the user terminal 10, After the authentication, the disposable password is generated through the authentication modules (23, 26) using the secret information (24, 27) stored in the IC chip, and encrypted and transmitted. The drive module (11) decrypts the disposable password And the user performs the user authentication using the one-time password.

Images