KR100548638B1 - Creating and authenticating one time password using smartcard and the smartcard therefor - Google Patents

Abstract

The present invention implements the one-time password generation function on the smart card, thereby reducing the size of the system for the one-time password generation and authentication, and at the same time reducing the cost of the system construction, one-time password using the smart card The purpose is to provide a method of creation and authentication.

According to an aspect of the present invention, a terminal requests a security service after a terminal accesses and logs in to a host server, and the terminal receives a predetermined input request message including request information from the host server. And obtaining, by the terminal, response information corresponding to the request information from the user, and transmitting the response information to the smart card, generating, by the smart card, the response information as an initial value, and transmitting the response information to the terminal. The step of transmitting the password to the host server, the host server requesting authentication of the one-time password to the authentication server, and the authentication server performs the authentication of the one-time password.

Smart card, one time password, ONE TIME PASSWORD, authentication, security

Description

One-time password generation and authentication method using smart card and smart card for it {CREATING AND AUTHENTICATING ONE TIME PASSWORD USING SMARTCARD AND THE SMARTCARD THEREFOR}

1 is a block diagram showing a system for one-time password generation and authentication using a smart card according to a first embodiment of the present invention.

2 is a schematic structural diagram illustrating an OTP application according to the present invention.

3 is a block diagram showing a system for generating and authenticating a one-time password using a smart card according to a second embodiment of the present invention.

4 is a flowchart illustrating a one-time password generation and authentication method according to the present invention.

<Description of Symbols for Main Parts of Drawings>

SC: Smart Card R: Reader

100, 100 ': terminal M: connection module

200: host server 210: member DB

300: authentication server 400: mobile communication company server

HSM: Hardware Security Module

The present invention relates to a one-time password generation and authentication method using a smart card and a smart card therefor.

As a user identification and authentication method in various content servers through a wired / wireless information communication network (Internet network), an ID / password method is mainly used. In this case, in order to prevent ID / password theft, the ID / password input on the corresponding terminal is displayed in the form of '********' rather than the actual input information. However, the security processing method has a fatal problem that in case of a terminal where a hacking program (eg, 'phishing') is installed by a fraudulent user, an ID / password input by the user may be transmitted to the fraudulent user in real time. That is, since a predetermined password (large number of random numbers) can be repeatedly used, there is a risk that it will be used for an illegal purpose by an unauthorized user who has obtained an ID / password through hacking. Therefore, if you need to maintain a high level of security, there is a need to apply a one-time ID / password that can not be used repeatedly.

 Recently, various services that require strict security, such as electronic banking and electronic payment, are being made. Accordingly, users can set a somewhat complicated password or issue a certificate from a bank or an accredited certification authority to use these services. After receiving and installing the card, a predetermined number of passwords (multiple random numbers), etc., must be passed through the identity verification process several times to use the service. Of course, such a series of identity verification process provides a positive effect to the user in terms of security of personal information, but the process was rather cumbersome and inconvenient to use the service.

Recently, a one-time password system using a time synchronization method, a CHALLENGE / RESPONSE method, or a host random number input method has been widely adopted as a security solution that frequently changes a password when a user requests authentication. Specifically, the one-time password system has the advantage that even if the password is inadvertently leaked, the number of times the password can be used is limited to only one time and cannot be reused by malicious others. Because of these unique advantages, they have been in the spotlight from electronic banking, electronic payment, and various content providers.

In relation to the one-time password system described above, a number of applications and registrations other than the Republic of Korea Patent Publication No. 10-2004-0000078 (name of the invention: one-time password system and method) (hereinafter referred to as 'prior patent') to be.

More specifically, the preceding patent is a base station for wireless section communication with a mobile communication terminal, a base station controller for controlling the base station, a packet data service node and a data core network connected to the base station controller to provide a packet data service Is connected to the data core network of the mobile communication system configured to include, the mobile communication terminal is issued to the mobile communication terminal by issuing a one-time password for authentication in the CP (Contents Provider) server accessible through the data core network A system configured to include an OTP server, the OTP server comprising: a random number generator for generating a time-synchronized random number generated by setting time as an initial value every predetermined time; OTP generation unit for generating an OTP by using the time-synchronized random number generated by the random number generator and personal identification information when the issuance of the OTP is requested from the mobile communication terminal; And an OTP transmitter for transmitting the generated OTP and random number generation time information to the mobile communication terminal. It is configured to include, characterized in that the mobile communication terminal to use the CP server using the OTP received from the OTP server.

However, in the prior patent as described above, the OTP server for generating a one-time password must be provided separately, there is a problem that the system is enlarged and the cost required to build the system increases.

Meanwhile, an electronic calculator-type portable terminal having a one-time password generation function has been released, but this is not only cumbersome to carry individually, but also relatively expensive and inconvenient to use.

The present invention has been made to solve the above problems, by implementing a function related to the one-time password generation on the smart card, reducing the size of the system for the one-time password generation and authentication, it is necessary to build the system The purpose is to provide a one-time password generation and authentication method using a smart card, and to provide a smart card for this, which can reduce the cost.

In order to achieve the above objects, a one-time password generation and authentication method using a smart card according to the present invention includes: (a) requesting a security service after the terminal accesses and logs in to the host server; (b) receiving, by the terminal, a predetermined input request message including request information generated based on the member information from the host server; (c) the terminal obtaining response information corresponding to the request information from the user and transmitting the response information to the smart card; (d) the smart card generating the one-time password as an initial value and transmitting the response information to a terminal; (e) the terminal transmitting a one-time password to a host server; (f) requesting the host server to authenticate the one-time password to the authentication server; And (g) the authentication server performing authentication on the one-time password; It consists of.

On the other hand, the smart card for generating a one-time password according to the present invention, the terminal 100 (100 ') of the user, and the member DB 210 is stored the member information of the user, wired and wireless Internet network (N) When the terminal connected through the request for a security service, the host server 200 for transmitting the request information generated based on the member information to the terminal, and the one-time password transmitted from the terminal in conjunction with the host server A smart card (SC) connected to a terminal of a system consisting of an authentication server 300 that performs authentication for the member DB 210 and performs one-time password generation, corresponding to the request information. It includes an OTP application that receives the response information from the terminal and generates a one-time password by using this as an initial value.

Referring to FIG. 1, a system for generating and authenticating a one-time password using a smart card according to a first embodiment of the present invention (hereinafter, referred to as a “first system”) may include a smart card (SC), The terminal 100 is configured to include a reader (R, R), a host server 200 and an authentication server 300.

The smart card SC is a contact type, contact-less type or hybrid type smart card, and is used to generate a one-time password (hereinafter referred to as 'OTP') that is executed internally. Related application (hereinafter, referred to as 'OTP application').

More specifically, as shown in FIG. 2, an OTP application basically includes an OTP generation algorithm 10 for generating a first OTP, personal identification information 20 for access authentication of an OTP application, and an OTP application. Application information composed of the unique information (preferably serial number) 30 to be provided is included. In other words, the OTP generation algorithm 10 may be set differently for each OTP application and is an algorithm for generating a first OTP with initial values of response information to be described below. Here, the OPT generation algorithm may be an algorithm in which a predetermined secret key encryption method including a hashing algorithm is implemented, and the encryption method may be variously set including DES, T-DES, and ARIA. . The personal identification information 20 may be set to biometric information such as PIN information (Personal Identification Number) or fingerprint information.

In addition, the terminal 100 is a communication terminal including a general user computer and a PDA that can be connected to a wired / wireless Internet network (Network, N), etc., and requests security services from the host server 200 described below according to an aspect of the present invention. In this case, an input screen or messages related to the security service transmitted from the host server 200 are displayed, and the personal identification information 20 is received from the user and transmitted to the smart card SC. In addition, when the authentication for the personal identification information 20 is normally performed in the smart card (SC), the smart card (SC) after acquiring the response information corresponding to the predetermined request information transmitted from the host server 200 from the user Receive the first OTP and the unique information 30 generated by using the response information as an initial value from the smart card (SC) to transmit the basic information and / or other information to the host server 200 below Perform the function.

In other words, the basic information is the user's account information, other information is payment information related to the amount, and the request information is randomized information generated by the host server 200 based on the following member information, the user Information that can be estimated. For example, the information may be variously set such as an account number, a social security number, a credit card number, or a phone number. The request information may be information related to the response information in a tabular format. For example, it may be a card-shaped table (hereinafter referred to as "relation table") consisting of a number of indices INDEX as the request information and numbers / letters having a predetermined digit as the response information corresponding to the index. Such a relationship table is issued to the user with the smart card (SC), it is preferable to be included in the information state in the following member information.

In addition, the reader R is connected to the terminal 100 and provides a function as a medium for reading and writing data to the smart card SC. Here, the reader (R) is preferably set to support at least one of the operating method of the smart card (SC), that is, contact, contactless or hybrid. In the present embodiment, the reader R is set to be connected to the terminal 100 through a USB (Universal Serial Bus) connection means, but the present invention is not limited to the method of the connection means.

In addition, the host server 200 is a server of a financial institution, for example, a bank, which the user wants to access through a wired or wireless Internet network (N), issues a smart card (SC) to the user and checks the balance from an account opened in the bank. Provides services requiring security (hereinafter referred to as "security services"), such as payment, payment, or transfer. In this case, as in the general Internet banking service, it is preferable that a user registration or login (Log IN) procedure is performed between the user and the bank, and the information for logging in and the application information of the issued smart card (SC) are members. The information is collected and stored in the member DB 210 .

In addition, the authentication server 300 is a server interworking with the above-described host server 200 or a server operated by the host server 200. When authentication for the first OTP is requested from the host server 200, the member Finds the response information corresponding to the request information in the member information previously stored in the DB 210 and generates a second OTP with the initial value, compares the first OTP with the second OTP, and determines the validity of the first OTP, If this is valid, the terminal 100 performs a characteristic function of the present invention such that the terminal 100 receives a security service procedure through the host server 200.

On the other hand, the authentication server 300 according to an aspect of the present invention, preferably sharing the member DB 210 of the host server 200 shown in Figure 1, a series of OPT validity determination procedures as described above A dedicated hardware security module (HSM) 310 may be further included.

A more detailed procedure for the one-time password generation and authentication method performed through the first system of the present invention described above will be described later. Hereinafter, referring to FIG. 3, the smart card according to the second embodiment of the present invention is used. We will look at a system for one-time password generation and authentication. Referring to FIG. 3, a system for generating and authenticating a one-time password using a smart card (hereinafter referred to as a “second system”) may include a smart card SC, a terminal 100, a host server 200, It consists of the authentication server 300 and the mobile communication company server 400.

The second system having the above-described configuration performs the same functions and procedures as a whole compared to the first system, but the terminal 100 'detachably accommodates the smart card SC and reads and writes data of the smart card SC. The mobile communication terminal for a mobile banking is provided with a connection module (M), which enables the mobile communication company server 400 to connect the terminal 100 'to the host server 200 or the authentication server 300. It performs the function.

Hereinafter, the one-time password generation and authentication method through the first or second system of the present invention having the above-described characteristic configuration and function will be described in detail with reference to FIG. 4. First, referring to FIG. 4, after the terminal 100, 100 ′ of the user accesses and logs in to the host server 200 through the wired / wireless Internet network N (S401), and requests a security service, the authentication server ( In step S403, a predetermined input request message for the security service is received. Here, before the step S401, a series of registration procedures including a smart card (SC) is issued between the user and the host server 200, and the input request message of the step S403 includes the host server (as described above). Request information transmitted from 200) is included.

Subsequently, the terminal 100, 100 ′ receives the personal identification information 20 from the user and transmits it to the smart card SC (S405), and operates the smart card SC operating according to the OTP application as described above. When the authentication is made on the personal identification information 20 through (S407), and the validity of the personal identification information 20 is authenticated, the terminal 100 (100 ') obtains response information according to the request information from the user. This is transmitted to the smart card (SC) (S409).

Next, the smart card (SC) generates the first OTP as an initial value of the received response information (S411), and then transmits the unique information 30 to the terminals 100 and 100 '(S413).

Thereafter, the terminal 100 or 100 ′ receives basic information and other information from the user and transmits it to the host server 200 together with the unique information 30 and the first OTP received in step S413 (S415). The host server 200 receiving this request the authentication server 300 for authentication for the first OTP (S417).

After the step S417, the authentication server 300 finds response information corresponding to the request information of the step S403 in the member DB 210 and generates a second OTP as an initial value (S419). It is determined whether or not the OTP and the first OTP are the same (S421 and S423). Here, the second OTP is generated through the same algorithm as the OTP generation algorithm used in the smart card (SC). In the present embodiment, since the OTP generation algorithm may be set differently for each smart card SC, the authentication server 300 may select a corresponding OTP generation algorithm based on the member information before step S419. Further, before step S419, the authentication server 300 compares the received unique information 30 with the unique information of the member information to confirm whether the first OTP is generated by the user logged in at step S401. Additional steps may be further included, but the present invention is not limited thereto.

Subsequently, if the first OTP and the second OTP are the same as the determination result of step S423, the authentication server 300 allows the terminal 100, 100 ′ to receive the security service procedure of the host server 200 (S425). In operation S427, a predetermined result screen or message is transmitted to the terminal 100 or 100 '. On the other hand, if it is not the same as the determination result of step S423, the authentication server 300 transmits a predetermined failure screen or message to the terminal 100 (100 ') (S429).

As described above and illustrated with reference to a preferred embodiment for illustrating the technical idea of the present invention, the present invention is not limited to the configuration and operation as described and described as such, it departs from the scope of the technical idea It will be apparent to those skilled in the art that many modifications and variations can be made to the present invention without this. Accordingly, all such suitable changes and modifications and equivalents should be considered to be within the scope of the present invention.

According to the present invention discussed through the first and second embodiments, the function related to the one-time password generation is implemented in the smart card as a program, and thus the one-time password generation and the authentication process for the security service are conventionally performed. Compared to the above, the size and size of the system are reduced.

In addition, the smart card according to the characteristic aspect of the present invention can be easily connected or adopted to a mobile communication terminal or a computer, it is not necessary to separately provide an expensive portable terminal.

Claims (16)

A smart card (SC) having a one-time password (OTP) generation function implemented in a program format, a terminal 100 (100 ') of a user connected with the smart card, and a member DB 210 storing the user's member information. And a host server 200 for providing a predetermined security service to the terminal through a wired / wireless internet network (N), interworking with the host server, and performing authentication on a one-time password generated by a smart card. In the one-time password generation and authentication method of the system consisting of the authentication server 300 to share the, (a) requesting a security service after the terminal accesses and logs in to the host server; (b) receiving, by the terminal, a predetermined input request message including request information generated based on the member information from the host server; (c) the terminal obtaining response information corresponding to the request information from the user and transmitting the response information to the smart card; (d) the smart card generating the one-time password as an initial value and transmitting the response information to a terminal; (e) the terminal transmitting a one-time password to a host server; (f) the host server requesting authentication of the one-time password to an authentication server; And (g) the authentication server performing authentication on the one-time password; One time password generation and authentication method using a smart card, characterized in that the security service is provided to the terminal. The method of claim 1, Before step (a), (a-1) a series of joining steps including issuing a smart card (SC) between the user and the host server 200; One-time password generation and authentication method using a smart card, characterized in that it further comprises. The method of claim 1, Before step (b), (b-1) the terminal receiving the personal identification information from the user and transmitting it to the smart card (SC); And (b-2) the smart card performing authentication on personal identification information; One-time password generation and authentication method using a smart card, characterized in that it further comprises. The method of claim 1, The authentication of step (g) is Characterized in that the authentication server compares the one-time password generated by using the response information of the member information corresponding to the request information of step (b) as an initial value with the one-time password transmitted from the host server. One-time password generation and authentication method using a card. The method of claim 3, wherein The personal identification information, One-time password generation and authentication method using a smart card, characterized in that the PIN information or biometric information. delete The method according to claim 1 or 4, The request information, One-time password generation and authentication method using a smart card, characterized in that the account number, social security number, credit card number, or a telephone number of information that requires a portion or a combination thereof. The method according to claim 1 or 4, The request information, One-time password generation and authentication method using a smart card, characterized in that the information to derive the response information by the relationship table. The method of claim 8, The relationship table, A card-shaped table consisting of a number of indices as the request information and a number / letter of predetermined digits as response information corresponding to the index, issued to the user together with the smart card SC, and included in the information in the member information. One-time password generation and authentication method using a smart card, characterized in that. The method of claim 1, If the terminal is a user computer, The system, One-time password generation and authentication method using a smart card, characterized in that it further comprises a reader (R) for providing a connection function between the smart card and the user computer. The method of claim 1, If the terminal is a mobile communication terminal, The mobile communication terminal, A one-time password generation and authentication method using a smart card characterized in that it comprises a detachable accommodating smart card and connected to the smart card (M). The method of claim 1, The step (e) is The terminal receives the basic information and other information from the user and the one-time password generation and authentication method using a smart card, characterized in that for transmitting to the host server. And a user DB (100, 100 ') and a member DB (210) in which the user information of the user is stored, and when the terminal connected to the wired / wireless Internet network (N) requests a security service, the member information. The host server 200 for transmitting the generated request information to the terminal and the one-time password transmitted from the terminal in association with the host server, the authentication for sharing the member DB (210) In the smart card (SC) connected to the terminal of the system consisting of the server 300 to perform one-time password generation, And an OTP application which receives response information corresponding to the request information from the terminal and generates a one-time password with an initial value as the initial value. The method of claim 13, The OTP application, Smart card for the one-time password generation, characterized in that it comprises an application information consisting of OTP generation algorithm (10), personal identification information (20) for access authentication of the OTP application and unique information (30) given for each user. The method of claim 14, The personal identification information 20, Smart card for one-time password generation, characterized in that the PIN information or biometric information. The method of claim 14, The OTP generation algorithm 10, Smart card for one-time password generation, characterized in that the algorithm implemented secret key encryption method.

Images