KR20250099091A - Cross authentication method and system between online service server and client - Google Patents

Abstract

A computer implemented method for performing mutual authentication between an online service server and a service user is provided, comprising: (a) a step for an authentication server to generate a simple authentication number when a request for generating a simple authentication number including user account information of a service user accessing the online server is received from the online server; (b) a step for the authentication server to transmit a generation condition used for generating the simple authentication number to a simple authenticator of the user corresponding to the user account information; (c) a step for the simple authenticator to generate a verification authentication number corresponding to the simple authentication number using the generation condition of the simple authentication number; and (d) a step for the authentication server to generate a corresponding verification value corresponding to an additional verification value transmitted from the simple authenticator when verification of the online service server using the simple authentication number and the verification authentication number is completed, and to perform authentication of the corresponding service user by comparing whether the additional verification value matches the corresponding verification value.

Description

CROSS AUTHENTICATION METHOD AND SYSTEM BETWEEN ONLINE SERVICE SERVER AND CLIENT

The present invention relates to an authentication method and system, and more specifically, to a mutual authentication method and system between an online service server and a client.

When you want to safely use convenient electronic financial services or important online services, you can enhance the security of user authentication by configuring a separate authentication method in addition to the ID and password used in online services. Representative examples include OTP dongles, one-time passwords via SMS, one-time passwords via ARS, and mobile app-based biometric authentication, thereby strengthening user authentication against ID and password theft.

However, existing additional authentication methods require cumbersome input from users, such as having users directly enter a one-time password generated between the online service and the authentication medium, or entering separate biometric information. In particular, if a 4-6 digit temporary password must be re-entered on a mobile phone, it is not only difficult to memorize the number confirmed on the mobile phone screen, but also cumbersome to enter.

In order to eliminate the need to enter such temporary passwords, there is a service that sends push information to the mobile phone when the user logs on to the service with an ID and password, and when the user runs an authentication app, enters his/her biometric information (fingerprints, face, iris, etc.) into the mobile app, automatically logs the user into the online service if it is his/her real name. However, this also causes the hassle of entering biometric information.

Another simple authentication method is to install an access control app on the user's designated mobile phone in advance to determine whether to approve access, and then when the user enters his/her ID and password in an online service, a mobile push message is sent to notify the user of the access, and when the user runs the access approval app, the access confirmation method approves or rejects the access to the online service. However, this method has a problem in that if the service the user has accessed is a pharmed hacker's site, the hacker may use the ID and password entered by the user to send it to the actual online service, and the user may misunderstand the request for access confirmation to his/her mobile phone and approve the access. In addition, if a hacker who knows the user's ID and password accesses the user's ID and password as soon as the actual user accesses, the user may misunderstand the final access information that arrived on his/her smartphone as his/her own and approve the access.

Therefore, improved methods and technologies are needed that can determine whether a site is legitimate and confirm whether it is theirs, without the hassle of users having to re-enter temporary passwords.

The present invention provides a method and system for simple authentication that allows a user to conveniently proceed with connection after confirming whether the service is correct without having to input a separate one-time password or biometric information when performing two-factor authentication (i.e., mutual authentication according to service authentication and user authentication) for safe use of an online service.

According to one aspect of the present invention, a computer implemented method for performing mutual authentication between an online service server and a service user is provided, comprising: (a) a step in which an authentication server generates a simple authentication number when a request for generating a simple authentication number including user account information of a service user accessing the online server is received from the online server; (b) a step in which the authentication server transmits a generation condition used for generating the simple authentication number to a simple authenticator of the user corresponding to the user account information; (c) a step in which the simple authenticator generates a verification authentication number corresponding to the simple authentication number using the generation condition of the simple authentication number; and (d) a step in which the authentication server generates a corresponding verification value corresponding to an additional verification value transmitted from the simple authenticator when verification of the online service server using the simple authentication number and the verification authentication number is completed, and performs authentication of the corresponding service user by comparing whether the additional verification value matches the corresponding verification value.

In one embodiment, the request for generating the simple authentication number may be transmitted from the online service server to the authentication server when the user account information entered by the service user into the online site provided by the online service server matches the account information of the user that has been pre-registered.

In one embodiment, in step (b), the conditions for generating the simple authentication number may be transmitted from the authentication server to the user's mobile device corresponding to the user account information or the simple authenticator installed in the mobile device via a push message or socket data communication.

In one embodiment, in the step (a), the authentication server further receives client connection environment information about a connection terminal of a corresponding service user who has connected to the online service server from the online service server, and uses the client connection information when generating the simple authentication number, and in the step (b), the authentication server can transmit a generation condition of the simple authentication number including the client connection environment information to the simple authenticator.

In one embodiment, the client connection environment information may be at least one of a server variable related to a connection terminal connected to the online service server, a host name, cookie information, a previous URL, a current connection IP address, a previous connection IP address, client browser information, client language information, a system variable of the connection terminal, a server host name of an online service server providing a service to the connection terminal, a server IP address, a session ID, and session maximum validity time information.

In one embodiment, in the step (a), the authentication server may generate the simple authentication number using the client connection environment information as a first seed value and at least one pre-designated additional information as a second seed value, and using time or the number of attempts as an operation condition, and may generate the verification authentication number by applying the same generation condition.

In one embodiment, when verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to a pre-specified condition and transmits it to the authentication server, and the authentication server generates the corresponding verification value by applying the same condition as the pre-specified condition, and when the additional verification value and the corresponding verification value match, the online service server can notify normal authentication.

In one embodiment, the authentication server further includes a step of transmitting the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

If a subsequent access attempt is made using the same account information as the user account information of the service user before the verification validity period of the simple authentication number through the authentication number posting screen has expired or before the verification of the online service server by the service user is completed,

The above authentication server may maintain the simple authentication number generated for a first-priority connection as is or prohibit the creation of a new simple authentication number for a second-priority connection during the verification validity period of the simple authentication number or until verification of the online service server is completed.

According to another aspect of the present invention, there is provided an authentication system for performing mutual authentication between an online service server and a service user, comprising: an authentication server; and a simple authenticator on the service user side communicating with the authentication server, wherein the authentication server generates a simple authentication number when a request for generating a simple authentication number including user account information of a service user accessing the online server is received from the online server, and transmits a generation condition used for generating the simple authentication number to the simple authenticator corresponding to the user account information so that a verification authentication number for verification of the simple authentication number can be generated, and generates a corresponding verification value in response to an additional verification value transmitted from the simple authenticator when verification of the online service server using the simple authentication number and the verification authentication number is completed, and performs authentication of the corresponding service user by comparing whether the additional verification value and the corresponding verification value match.

In one embodiment, the authentication server may further receive client connection environment information for a connection terminal of a corresponding service user who has connected to the online service server from the online service server, use the client connection information when generating the simple authentication number, and transmit a generation condition of the simple authentication number including the client connection environment information to the simple authenticator.

In one embodiment, the client connection environment information may be at least one of a server variable related to a connection terminal connected to the online service server, a host name, cookie information, a previous URL, a current connection IP address, a previous connection IP address, client browser information, client language information, a system variable of the connection terminal, a server host name of an online service server providing a service to the connection terminal, a server IP address, a session ID, and session maximum validity time information.

In one embodiment, the authentication server generates the simple authentication number using the client connection environment information as a first seed value and at least one pre-designated additional information as a second seed value, and using time or the number of attempts as an operation condition, and the simple authenticator can generate the verification authentication number by applying the same generation condition as the simple authentication number.

In one embodiment, when verification of the online service server is completed through the simple authentication number and the verification authentication number, the simple authenticator generates the additional verification value according to a pre-specified condition and transmits it to the authentication server, and the authentication server generates the corresponding verification value by applying the same condition as the pre-specified condition, and when the additional verification value and the corresponding verification value match, the online service server can notify normal authentication.

In one embodiment, the authentication server transmits the simple authentication number to the online service server so that the simple authentication number is posted through an authentication number posting screen provided by the online service server,

If a subsequent access attempt is made using the same account information as the user account information of the service user before the verification validity period of the simple authentication number through the authentication number posting screen has expired or before the verification of the online service server by the service user is completed,

The above authentication server may maintain the simple authentication number generated for a first-priority connection as is or prohibit the creation of a new simple authentication number for a second-priority connection during the verification validity period of the simple authentication number or until verification of the online service server is completed.

According to an embodiment of the present invention, when a user enters an ID and password in an online service and the simple authentication number provided by the service for additional authentication is the same as the simple authentication number provided by a mobile simple authenticator, the user's service access is approved, thereby eliminating unnecessary re-entering of authentication numbers by the user.

In addition, according to an embodiment of the present invention, if another person attempts to access an online service using the user's ID and password, a user having a simple authenticator can be aware of the situation in which a request for access permission has been made by someone other than the user, thereby enabling security management of the user ID and password.

FIG. 1 is a drawing for explaining a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention.
FIG. 2 is a block diagram of one embodiment of an authentication server implementing a mutual authentication method according to an embodiment of the present invention.
FIG. 3 is a block diagram of one embodiment of a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention.
Figure 4 is an example of a screen where a simple authentication number is posted on an online service site operated by an online service server.
Figure 5 is an example of a screen where a verification authentication number generated by a simple authenticator is displayed.
Figure 6 is a drawing for explaining a method for handling a connection attempt by a hacker during an authentication process according to the mutual authentication method of Figure 1.
Figure 7 is a diagram illustrating a processing result posted on an online service site operated by an online service server when a connection attempt is made by a hacker such as Figure 6.
FIGS. 8 and 9 are implementation examples of a mutual authentication method according to an embodiment of the present invention when accessing an online service server via a user's mobile device.

The present invention can be modified in various ways and has various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, but should be understood to include all modifications, equivalents, or substitutes included in the spirit and technical scope of the present invention.

In describing the present invention, if it is judged that a detailed description of a related known technology may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, numbers (e.g., first, second, etc.) used in the description of this specification are merely identifiers for distinguishing one component from another.

Additionally, throughout the specification, when a component is referred to as being "connected" or "connected" to another component, it should be understood that the component may be directly connected or connected to the other component, but may also be connected or connected via another component in between, unless otherwise specifically stated.

Also, throughout the specification, when a part is said to "include" a certain component, this does not mean that other components are excluded, unless otherwise specifically stated, but rather that other components can be included. Also, terms such as "part", "module", etc. described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented by one or more hardware or software, or a combination of hardware and software.

In addition, in the following description, the simple authenticator is described mainly as a software-based authentication device installed in the form of an application program on a user-owned mobile device, but it is not necessarily limited to this. For example, the simple authenticator may be a hardware authentication device with communication functions. However, for the convenience and focus of the description, the former case is assumed and the embodiments of the present invention are described below.

In addition, the following description assumes that the client terminal, which is the connection terminal connecting to the online service server, and the simple authenticator are physically configured separately based on Fig. 1, but the simple authenticator may be implemented integrally with the client terminal. In the latter case, the mobile device illustrated in Fig. 1 will be omitted. In addition, it is self-evident that the client terminal itself may be a mobile device.

FIG. 1 is a diagram for explaining a mutual authentication method and system between an online service server and a service user according to an embodiment of the present invention. In addition, FIG. 2 is a block diagram of an embodiment of an authentication server implementing a mutual authentication method according to an embodiment of the present invention, and FIG. 3 is a block diagram of an embodiment of a simple authenticator implementing a mutual authentication method according to an embodiment of the present invention. Hereinafter, a mutual authentication method and system according to an embodiment of the present invention will be explained with reference to FIG. 2 and FIG. 3 with FIG. 1 as the center.

In addition, during the description of the embodiment of the present invention, reference will be made to FIGS. 4 to 9 together. Here, FIG. 4 is an example related to a screen where a simple authentication number is posted on an online service site operated by an online service server, FIG. 5 is an example related to a screen where a verification authentication number generated by a simple authenticator is displayed, FIG. 6 is a drawing for explaining a processing method when a connection attempt is made by a hacker in the authentication process according to the mutual authentication method of FIG. 1, and FIG. 7 is a drawing exemplifying a processing result posted on an online service site operated by the online service server when a connection attempt is made by a hacker like FIG. 6. In addition, FIGS. 8 and 9 are implementation examples of a mutual authentication method according to an embodiment of the present invention when a user accesses an online service server through a mobile device.

Referring to step S1 of Fig. 1, when a service user wishes to use an online service by an online service site provided by an online service server (230), the service user makes a connection request to the online service server (230).

For example, if the online service to be used is an online banking service, the user can access a specific online service server (i.e., a specific bank server providing the online banking service) that provides the online banking service. Access to the online service server (230) can be via mobile access through a mobile device (210) (e.g., a smartphone, etc.) owned by the user, but FIG. 1 exemplifies a case in which access is made through a client terminal (200) (e.g., a company PC, etc.) separate from the mobile device (210) owned by the user.

Referring to step S2 of Fig. 1, in response to a connection request to the online service server (230), the online service server (230) may request a service user who wishes to use the online service to enter user account information. Here, the user account information refers to the identification information of the user that is stored (registered) in advance in the online service server (230) through a user registration procedure (or service subscription procedure). Typically, a user ID (Identifier) and a password may be utilized as the user account information. However, it goes without saying that various information (for example, the user's email address, phone number, certificate password on a PKI (Public Key Infrastructure)-based certificate, etc.) may be utilized as the user account information as long as it is information that can identify the user using the online service.

Referring to step S3 of FIG. 1, in response to a request for input of user account information, the service user inputs user account information into the corresponding online service site. Referring to step S4 of FIG. 1, when user account information is input by the service user, the online service server (230) verifies whether an account matching the user account information input by the user exists. The account DB (240) as illustrated in FIG. 1 may be utilized for verification of such account information. The account DB (240) stores account information regarding users (i.e., members) who can receive online services through the corresponding online service server (230). Although FIG. 1 exemplifies a case where the account DB (240) is provided separately from the online service server (230), it goes without saying that the account DB (240) may be implemented in an integrated manner with the online service server (230). In addition, depending on the system implementation method, the account DB (240) may be implemented in an integrated manner with the authentication server (250).

Referring to step S5 of Fig. 1, if the entered user account information matches a user account stored in the account DB (240), the online service server (230) requests the authentication server (250) to generate a simple authentication number. Here, the simple authentication number is utilized for the purpose of allowing the user to determine whether the online service site currently accessed by the user is provided by a genuine online service provider.

In step S5 of Fig. 1, when the online service server (230) requests the authentication server (250) to generate a simple authentication number, the online service server (230) may transmit the user account information of the corresponding service user to the authentication server (250). For example, the online service server (230) may transmit the request for generating a simple authentication number including the user ID of the corresponding user as the user account information to the authentication server (250).

In addition, according to one embodiment, the online service server (230) may additionally transmit client connection environment information to the authentication server (250) through step S5 of FIG. 1 (or through a separate step). Here, the client connection environment information refers to information that can directly or indirectly indicate the connection environment of the connection terminal of the corresponding service user who has connected to the online service server (230). Such client connection environment information may vary depending on the service server.

For example, taking a standard web server as an example, it can be composed of various server variables (Server Variables; host name (REMOTE_HOST), cookie information (HTTP_COOKIE), previous URL (HTTP_PEFERER), previous IP address (HTTP_X_FORWARDED_FOR), current IP address (REMOTE_ADDR), client browser (HTTP_USER_AGENT), client language (HTTP_ACCEPT_LANGUAGE)) that can extract the values of the connected client terminal, or variables of the service server that provides the service to the client terminal (server host name, server IP, session ID value, session maximum validity time, etc.). As another example, if the connecting client is not a standard web browser but its own client program, various system variables (Mac Address, HDD UUID, etc.) of the client terminal can be used as client connection environment information within the range permitted by the operating system (OS).

A request for generation of a simple authentication number as described above is received (accepted) through the communication interface unit (251) of the authentication server (250), and the user account information or/and client connection environment information transmitted together can be used as a seed value for generation of the simple authentication number.

Referring to step S6 of Fig. 1, in response to a request for generating a simple authentication number from an online service server (230), the authentication server (250) generates a simple authentication number. At this time, the generation of the simple authentication number can be performed by the simple authentication number generation unit (253) of the authentication server (250).

At this time, as explained above, the simple authentication number can be generated using the client connection environment information transmitted from the online service server (230). Below, other embodiments that can be used as a substitute for the client connection environment information or as an additional seed value for generating the simple authentication number together with the client connection environment information will be described in detail.

In one embodiment of the present invention, a pre-registered fixed key corresponding to the user account information of the service user may be used as a seed value for generating a simple authentication number.

For example, the fixed key corresponding to the user account information may be pre-registered and used as one or a combination of at least two of various user identification information, such as the user ID, password, the user's email address, phone number, certificate password, etc. As another example, the fixed key corresponding to the user account information may be pre-registered and used as one or a combination of at least two of identifiers, such as the phone number of a mobile device (e.g., a smartphone, etc.) owned by the user, a product serial number, a USIM card number, a MAC address, etc. As yet another example, the fixed key corresponding to the user account information may be used as a personal key that the user selected and registered when registering for the simple authentication service or that was granted when registering for the simple authentication service.

In another embodiment of the present invention, a dynamic allocation key that is dynamically allocated when a user accesses the online service server may be used as a seed value for generating an authentication number.

For example, as the dynamic allocation key, the connection terminal connection information of the service user connecting to the online service server may be used. At this time, the connection terminal connection information may be session information (e.g., session ID, etc.) or socket information (e.g., socket handle, etc.) that the online service server allocates to the service user's connection terminal when the service user connects.

Here, the session ID is a value assigned by the server to manage continuous data transmission and reception between the server and the connection terminal, and the socket handle information is an arbitrary connection-specific value assigned by the server itself to manage the socket, which is a unit for transmitting and receiving data over a network between the server and the connection terminal. This session ID or socket handle information is a value assigned dynamically and is assigned by the server itself, so it is difficult for hackers from outside the server to steal it, and therefore, using it has a beneficial effect in terms of security.

As another example, the dynamic allocation key may be a mobile IP address (which may be the entire IP address or a portion of the IP address) dynamically allocated by a mobile carrier to a mobile device owned by a service user. For example, assuming that a service user accesses the online service server through his or her mobile device, the mobile IP address dynamically allocated by the mobile carrier may be used as a seed value.

In addition, although the above explanation focuses on the case where a specific value is used as a seed value, it goes without saying that a random value randomly generated by the authentication server (250) may be used as a seed value for generating a simple authentication number.

Accordingly, the simple authentication number generation unit (253) of the authentication server (250) can generate a simple authentication number using at least one of the seed values described above, but using time or the number of attempts (i.e., the number of attempts to issue a simple authentication number) as an operation condition. For example, the simple authentication number generation unit (253) can generate a value obtained by multiplying the time or the number of attempts by at least one of the seed values described above and encrypting it according to a specific hash function. Accordingly, the simple authentication number can be generated as a value having a one-time use.

Also, here, the time OTP method is a method of generating an OTP using the generation time as an operation condition. According to this, an OTP can be generated as a value encrypted according to a specific hash function by multiplying a determined specific OTP generation key by the generation time as an operation condition.

As described above, when a simple authentication number is generated, the authentication server (250) transmits the simple authentication number generated through the preceding step S6 to the online service server (230) through the communication interface unit (251). The transmitted simple authentication number is posted so that the user can check it through the screen of the online service site operated by the online service server (230) according to step S9 of FIG. 1. An example of this is illustrated in FIG. 4. Referring to FIG. 4, it can be confirmed that the simple authentication number (see reference numeral 30A of FIG. 4) is posted through the authentication number posting screen on the right side of the online banking site. After the simple authentication number is posted on the screen, an approval waiting state may continue until confirmation by the user is completed [see step S10 of FIG. 1].

In addition, referring to step S8 of Fig. 1, the authentication server (250) transmits the conditions for generating a simple authentication number to a simple authentication device (220) installed in a mobile device (110) owned by a service user through a communication interface unit (251).

In Fig. 1, the transmission of the simple authentication number generation condition of step S8 is exemplified as being performed via a push server (260), but it does not necessarily have to be like this, and of course, it can be transmitted directly from the authentication server (250) to the simple authentication device (220). In addition, although Fig. 1 mainly illustrates a case in which the simple authentication number generation condition is transmitted via a push message, the transmission of the simple authentication number generation condition can also be done via a transmission method using socket data communication.

When transmitting the simple authentication number generation conditions through the push server (260), the authentication server (250) transmits the generation conditions to the push server (260), and at this time, the push server (260) can transmit the simple authentication number generation conditions to the simple authenticator (220) through a push message. Here, the push message may be a message service provided by each app in a specific mobile operating system. However, it is obvious that the transmission of the simple authentication number generation conditions does not necessarily have to be through a push message, and may be through various commercial messaging services such as SMS and MMS, or may be through a specific communication protocol. In other exemplary cases where the transmission of the simple authentication number generation conditions is not through a push message, the above-mentioned push server (260) may be replaced with a general communication server in its function.

In addition, although Fig. 1 has described the case where the simple authentication number generation condition is directly transmitted to the simple authentication device (220), it is not necessarily required to be like this. For example, it is obvious that the simple authentication number generation condition can be transmitted to the mobile device (210) through a push message, etc., and the simple authentication device (220) can read it and receive (acquire) the simple authentication number generation condition. Such reception of the simple authentication number generation condition can be performed by the communication interface unit (221) of the simple authentication device (220).

The conditions for generating the simple authentication number to be transmitted through step S8 of the above-described drawing 1 may be all of the seed values and calculation conditions used for generating the simple authentication number in step S6 of the drawing 1, or may be only a part of them. For example, if the authentication server (250) and the simple authentication device (220) each store in advance some of the seed values and calculation conditions used for generating the simple authentication number and use them in common, there is no need to separately transmit the conditions stored in advance.

Accordingly, the simple authenticator (220) can generate a verification authentication number for verifying the simple authentication number displayed on the online service site screen of the online service server (230) using the received generation conditions [see step S11 of FIG. 1]. The generation of such a verification authentication number can be performed by the verification authentication number generation unit (223) of the simple authenticator (220).

The verification authentication number generated in this manner can be displayed on the app screen of the mobile device (210) through the authentication number display unit (227) of the simple authentication device (220). At this time, an example of the verification authentication number (refer to the drawing symbol 30B of FIG. 5) being displayed on the app screen is illustrated in FIG. 5.

Steps S7 to S11 described above are not necessarily limited to the order shown in Fig. 1, and may be performed in different order or simultaneously.

When a verification authentication number is displayed on the app screen through the above-described process, the user can determine whether the online service server is a genuine service server (i.e., the authenticity of the service server) by comparing the verification authentication number displayed in this manner with the simple authentication number displayed on the online service site screen.

As a result of the comparison, if the simple authentication number and the verification authentication number match, the user can complete the approval process for the relevant service (i.e., complete the verification process that the relevant online service server is a genuine service server) by selecting the approval button on the app screen as shown in Fig. 5 [see step S12 of Fig. 1].

In Fig. 5, an approval button is provided at the bottom of the verification authentication number displayed on the app screen to allow approval of the service, but of course, various other variations are possible. For example, approval or cancellation of the service may be performed by a specific gesture of the user. For example, approval may be performed when the user makes a touch gesture of sliding the app screen of the mobile device upward, and cancellation may be performed when the user makes a touch gesture of sliding the app screen downward.

As described above, when approval is given for the service, the additional verification value generation unit (225) of the simple authenticator (220) generates an additional verification value and transmits it to the authentication server (250) through the communication interface unit (221) [see steps S12 and S13 of FIG. 1].

Here, the additional verification value is used for the purpose of user authentication. That is, in the embodiment of the present invention, the authenticity of the corresponding service is first confirmed through verification of the simple authentication number, and then the user who wants to use the corresponding service is confirmed through the additional verification value whether the user is a legitimate user. What is special is that, in the embodiment of the present invention, the additional verification value for user authentication is automatically generated by the simple authenticator (220) at the same time as the approval process through verification of the preceding simple authentication number is completed, and is immediately transmitted to the authentication server (250). According to this, the inconvenience of the user having to directly input the user authentication value into the online service server during the user authentication process can be eliminated.

At this time, the additional verification value can be generated in various ways. Since the method of generating the additional verification value is not essentially different from the methods of generating the simple authentication number described above, a detailed description thereof will be omitted. Of course, the generation of the additional verification value does not have to follow the method of generating the simple authentication number described above, and may be generated according to the predefined conditions defined by the system. The generation method will be equally applied to the generation of the verification value for confirmation in the authentication server (250) described below (i.e., the verification value generated corresponding to the additional verification value above). Therefore, if information not stored in the authentication server (250) is utilized in the process of generating the additional verification value, the information also needs to be transmitted to the authentication server (250) through step S13 of FIG. 1.

In addition, although the transmission of the additional verification value according to step S13 is illustrated in FIG. 1 as being performed via a push server (260), it is not necessarily required to do so, and a method of directly transmitting to the authentication server (250) may also be used.

Accordingly, the verification value generation unit (255) of the authentication server (250) generates a verification value for verifying the transmitted additional verification value, and the authentication processing unit (257) of the authentication server (250) compares whether the generated verification value matches the transmitted additional verification value, thereby performing user authentication for the corresponding service user [see step S14 of FIG. 1]. At this time, the authentication result is notified to the online service server (230) [see step S15 of FIG. 1], and if the authentication is normally performed, the online service server (230) can initiate the corresponding service to the corresponding service user [see step S16 of FIG. 1].

According to the embodiment of the present invention as described above, a service user only needs to verify the service using a simple authentication number, and the subsequent user authentication process is performed automatically, so the user authentication number input process can be omitted, thereby making the entire authentication process simple and convenient.

In the above, the explanation is centered on the case where the service is normally approved through step S12 of Fig. 1. However, if the service is not approved by the user through step S12 of Fig. 1, the simple authenticator (220) can issue a notification of disapproval through step S13 of Fig. 1.

In addition, according to an embodiment of the present invention, after a simple authentication number is generated in response to a connection attempt by a service user to an online service server, the authentication server (250) can maintain the generated simple authentication number for a verification validity period (e.g., 60 seconds) for the simple authentication number or until the service verification by the user is completed. This will be described with reference to FIG. 6 as follows.

Referring to FIG. 6, if a subsequent access is made by a hacker who has stolen the user account information of a normal user after a simple authentication number is generated upon service access by the user [refer to step S21 of FIG. 6], even if an additional request for the generation of a simple authentication number is received by the online service server (230) [refer to step S22 of FIG. 6], the authentication server (250) prohibits the regeneration of the authentication number [refer to step S23 of FIG. 6].

In this way, the authentication server (250) can maintain the simple authentication number generated according to the first-priority connection as it is during the verification validity period of the simple authentication number or until the verification of the online service server is completed, or can prohibit the new generation of the simple authentication number according to the second-priority connection. For such a second-priority connection user, a screen (see reference numeral 30C of FIG. 7) that informs that duplicate connection is not possible can be displayed on the screen of the online service site as shown in FIG. 7. According to this, illegal user authentication and information theft due to second-priority connection by hackers can be prevented.

The above description focuses on the case where a user accesses an online service server through a client terminal separate from his or her own mobile device. However, as previously described, it is also possible to access an online service server directly using a mobile device on which a simple authenticator is installed. In this case, the simple authentication number and the verification authentication number can be displayed on the screen of the mobile device as shown in FIGS. 8 and 9. Referring to FIG. 8, the app screen by the simple authenticator (220) is displayed on the upper part (40A) of the screen of the mobile device, and the site screen provided by the online service server (230) is displayed on the lower part (40B) of the screen of the mobile device. In addition, the simple authentication number (40C) is displayed on the bottom part (40B) of the screen. In addition, referring to FIG. 9, the verification authentication number (40D) generated by the simple authenticator (220) is displayed on the upper part (40A) of the screen. In this way, when directly accessing an online service server using a mobile device with a simple authenticator installed, the app screen by the simple authenticator and the site screen by the online service server can be displayed separately in different screen areas. As an example of this, in particular, FIGS. 8 and 9 illustrate a case where the app screen is displayed in a form that floats on top of the site screen (i.e., a layered type screen display), but it is obvious that various other methods of screen division can be applied.

The method and device according to the embodiment of the present invention may be implemented in the form of program commands that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program commands, data files, data structures, etc., singly or in combination.

The program instructions recorded on a computer-readable medium may be those specially designed and configured for the present invention, or may be those known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions such as ROMs, RAMs, flash memories, and the like. Examples of the program instructions include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter, etc.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described above with reference to embodiments thereof, it will be readily understood by those skilled in the art that various modifications and changes may be made to the present invention without departing from the spirit and scope of the present invention as set forth in the claims below.

Claims (1)

A computer implemented method for performing mutual authentication between an online service server and a service user,
(a) a step of generating a simple authentication number when an authentication server receives a request for generating a simple authentication number including user account information of a service user accessing the online server from the online server;
(b) a step in which the authentication server transmits the generation conditions used to generate the simple authentication number to the user's simple authenticator corresponding to the user account information;
(c) a step in which the simple authentication device generates a verification authentication number corresponding to the simple authentication number using the generation conditions of the simple authentication number; and
(d) a step for performing authentication on a user of the service by generating a corresponding verification value in response to an additional verification value transmitted from the simple authenticator upon completion of verification of the online service server using the simple authentication number and the verification authentication number, and comparing whether the additional verification value matches the corresponding verification value.
A computer-implemented method for mutual authentication comprising: