KR101617875B1 - authentication method for service of providing electronic documents, method and system for service of providing electronic documents - Google Patents

Abstract

An authentication method for an electronic document provision service according to the present invention is characterized in that when an ACS (Access Control Server) receives a login request message including a personal identification alternative key, it generates a one-time authentication key, Transmitting to a user equipment; And a service key generated by a combination of the one-time authentication key and the personal identification alternative key from the user equipment when the ACS receives the service key from the user equipment, the service key is generated using the one-time authentication key transmitted to the user equipment and the personal identification alternative key of the user equipment And performing authentication based on whether the service key is a service key or not, and the personal identification substitution key is an application key assigned to the user device.

Description

Technical Field [0001] The present invention relates to an authentication method for providing an electronic document, a method and a system for providing an electronic document,

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an electronic document providing service technology, and more particularly, to an electronic document providing service technology capable of preventing malicious access to an electronic document providing system, ≪ / RTI >

In order to obtain administrative documents or medical documents, the applicant was able to visit the relevant government office or medical institution or obtain the documents by using the unattended issuing device. However, this method requires a lot of time and expense because the applicant must visit the government office or the medical institution directly. Also, the government office or the medical institution has to issue the paper proof document.

A technique for solving these problems is disclosed in Korean Patent Office No. 1020020084642, entitled " System for Issuing and Receiving Digital Signature Document of Public Key Infrastructure ". The present invention provides a public key certificate authentication system comprising: a public key certificate authority for issuing a certificate including a public key; An electronic signature document issuing server for issuing an electronic signature document; A client server in which a client program for receiving and verifying an electronic signature document issued by an electronic signature document issuing server and signing and sending an electronic document generated by the client is installed; An electronic signature document receiving server for receiving and verifying an electronic signature document sent from a client server and an electronic signature document issuing server starts a system connected through an Internet network.

And the Korean Intellectual Property Office (KIPO), entitled " Electronic Prescription Delivery System and Method ", which is disclosed in Korean Patent No. 1020020041225. The present invention relates to an electronic prescription system that converts a prescription for a transfer subject to an electronic prescription, encrypts and electronically signs and transfers the converted electronic prescription, and confirms the electronic signature value for the transferred electronic prescription, (Pharmacy) and the integrity of an electronic prescription, thereby allowing only a legitimate sender or recipient to send / receive an electronic prescription, and to transfer an electronic prescription safely from the stomach / modulation.

As described above, in the past, a method of performing electronic signature on an electronic document and transmitting and verifying the electronic document has been adopted. However, this requires transmission and reception of personal information for authentication of the user through the network, And the procedure was complicated because a certificate was required to be submitted from the customer terminal every time.

In addition, since the electronic document is directly connected to the server providing the electronic document, there is a problem that the server can not operate normally when malicious users attack and attack the server.

Conventionally, when an administrative document or a medical-related document is transmitted / received as an electronic document, the outflow of personal information for authenticating the user as well as the electronic document is fundamentally limited, and the reliability of the electronic document providing system can be increased Development of technology was required.

Korean Patent Publication No. 1020020084642 Korean Patent Publication No. 1020020041225 Korean Patent Publication No. 1020130093794

According to the present invention, the one-time authentication key for authentication is pushed to the user's own device identified by the application key, and the service is provided based on the pushed one-time authentication key and the application key. The present invention aims to provide an authentication method for an electronic document providing service that basically blocks a malicious access to the electronic document.

According to another aspect of the present invention, there is provided an authentication method for an electronic document providing service, wherein an ACS (Access Control Server) generates a disposable authentication key when a login request message including a personal identification alternate key is received, Transmitting to the user equipment corresponding to the personal identification alternative key; And a service key generated by a combination of the one-time authentication key and the personal identification alternative key from the user equipment when the ACS receives the service key from the user equipment, the service key is generated using the one-time authentication key transmitted to the user equipment and the personal identification alternative key of the user equipment And performing authentication based on whether the service key is a service key or not, and the personal identification substitution key is an application key assigned to the user device.

According to the present invention, the one-time authentication key for authenticating the user is pushed to the user's own device identified by the application key, and the service is provided based on the pushed one-time authentication key and the application key. It causes the effect of blocking the malicious approach to information.

1 is a configuration diagram of an authentication system for an electronic document providing service according to a preferred embodiment of the present invention;
2 is a flow diagram of a membership enrollment method in accordance with a preferred embodiment of the present invention.
3 and 4 are flowcharts of an authentication method for an electronic document provision service according to a preferred embodiment of the present invention.
5 illustrates a personal identification alternate key according to a preferred embodiment of the present invention.
6 is a diagram illustrating a result of providing an electronic document according to a preferred embodiment of the present invention.

The present invention can be applied to an electronic document which can be provided only when the user is authenticated, such as an administrative document such as a copy of a resident registration or a registration certificate, financial documents such as a credit card billing statement or a bank transfer confirmation document, , A portable terminal, and the like through an electronic document providing service application installed in a user device. In particular, the present invention essentially blocks malicious access to authentication information as well as electronic documents provided through the electronic document providing service application.

To this end, according to the present invention, a service key having a combination of a secondary authentication by a personal identification alternative key obtained by acquiring user identification information, a primary authentication by a password, an authentication of a device owned by the user, a one- And provides an electronic document providing service after determining whether to provide the service according to the result of the third authentication.

More specifically, the ACS (Access Control Server) of the present invention generates a one-time authentication key each time an electronic document is provided, pushes the generated one-time authentication key to the user's own device identified by the application key used as the personal identification alternative key, When the service key generated by combining the key and the individual identification alternative key is generated and returned, the service key is determined whether or not the service key is normal, and the service provision is determined.

The personal identification alternative key is an application key, and is provided when the electronic document providing service application is installed through the authentication process. Even if a malicious user composes a request message for the disposable authentication key and transmits the request message to the ACS of the present invention, the ACS provides the disposable authentication key to the user's own device, not the user's device of the malicious user that sent the request message do. This makes it impossible for the malicious user to inherently obtain the disposable authentication key.

In addition, since the service key according to the present invention is generated by combining the personal identification alternative key, which is the application key, with the one-time authentication key, even if the data transmitted and received between the authentication system and the user device, Lt; / RTI >

In addition, the present invention is configured such that the second authentication by the personal identification substitute key for authentication of the user, the third authentication by the service key in which the one-time authentication key and the personal identification alternative key are combined is performed in the background, . That is, the user generates the one-time authentication key every time the ACS requests the digital document service and provides it to the user's own device without inputting any additional information after login by the user identification information and the password, And generates and returns a service key by combining the one-time authentication key and the personal identification substitution key, and determines whether the service key is normal and performs authentication. In this way, a user who has subscribed in a legitimate manner authenticates himself / herself and authenticates his / her own user device without performing any operation for authenticating himself or herself to the user device other than login, .

In addition, since the present invention generates a service key by receiving the one-time authentication key from the authentication system, a user device of a malicious user who is not normally provided with the one-time authentication key can not attempt to access the electronic document providing server. Thus, the stability of the electronic document providing server can be enhanced.

The configuration and operation of the authentication system according to the preferred embodiment of the present invention will be described in detail with reference to the drawings.

<Authentication keys>

First, authentication keys referred to in the description of the present invention will be described.

The authentication keys include a push key, a personal identification alternative key, a one-time authentication key, and a service key.

The push key is a key used for confirming the push target in the Android or iOS phone, which is used in constructing the personal identification alternative key according to the present invention.

And, the personal identification substitution key is an application-specific application key, which is an unintelligible unique value generated by combining the push key and other information whenever an application is installed in the user device and subscribed to the service through the application. This personal identification replacement key is used only for authentication according to the preferred embodiment of the present invention, and does not include the electronic document related information.

And the disposable authentication key is generated at each service access with a unique value that is not duplicated.

The service key is generated by combining the personal identification alternative key and the disposable authentication key.

In particular, the personal identification substitute key and the one-time authentication key used in the present invention can be defined as 16 bytes, i.e., 128 bits, and can be defined as a globally unique identifier (GUID) according to an OSF DCE RPC (Open System Funding Distributed Computing Environment Remote Procedure Call) It can be expressed as a hexadecimal number or higher. In particular, the application key and the disposable authentication key are set to unique values that are not duplicated. That is, the application key and the one-time authentication key can be determined as an eigenvalue by combining the push key of the push server with the current time information and the clock tuning value. Here, the clock tuning value is time information in nanosecond units, and an eigenvalue can be generated by including a clock tuning value at the time of generation of the application key or the one-time authentication key in the application key or the one-time authentication key.

<Configuration of Authentication System>

Now, a configuration of an authentication system according to a preferred embodiment of the present invention will be described with reference to FIG.

The authentication system 100 includes an ACS 100, a membership information database 102, and a push server 104.

The ACS 100 performs authentication according to the preferred embodiment of the present invention and pushes the electronic document provided from the electronic document providing server 300 to the user device 200 according to the authentication result, And connects the path between the server 300 and the user device 200.

The membership information database 102 stores membership subscription information under the control of the ACS 100. In addition to the basic information such as the member identification information and the password for log-in, the membership subscription information also includes an application key acquired after authentication as a personal identification alternative key.

The push server 104 receives the disposable authentication key and the application key from the ACS 100 under the control of the ACS 100 and pushes the disposable authentication key to the user device 200 according to the application key do.

The push server 104 receives the electronic document data and the application key from the ACS 100 under the control of the ACS 100 and pushes the electronic document data to the user device 200 according to the application key, send.

The electronic document providing server 300 is connected to the user equipment 200 through the ACS 100 and provides the electronic document providing service to the user equipment 200.

In addition, when the electronic document providing server 300 receives and generates an electronic document for a specific user subscribed to the electronic document providing service according to the preferred embodiment of the present invention, the electronic document providing server 300 transmits the electronic document data for the user to the ACS (100) to the corresponding user equipment (200).

Now, the operation of the authentication system for the electronic document providing service configured as described above will be described with reference to the drawings.

<Installation of electronic document service application and subscription>

An electronic document provision service application installation and membership subscription procedure according to a preferred embodiment of the present invention will be described with reference to FIG.

The user can request downloading of the electronic document providing service application installation file through the application installation file providing system such as Google Play or the App Store or the web page of the ACS 100 through the user device 200 owned by the user step).

In step 404, when the electronic document providing service application installation file is downloaded according to the request, the user device 200 executes the electronic document providing service application installation file to install the electronic document providing service application.

When the installation of the electronic document providing service application is completed, the electronic document providing service application guides the input of the user authentication information, and when the user authentication information is input by the user, the authentication information is provided to the ACS 100 (Step 406). In step 408, the ACS 100 receives the authentication information and performs authentication of the user. Here, the user authentication can be performed through an external authorized authentication system.

If the authentication is successful (step 410), the ACS 100 requests membership information to the electronic document providing service application of the user device 200 (step 412). Here, the ACS 100 provides a push key to a user device when requesting membership subscription information.

In response to the request, the user device 200 generates an application key including a push key, receives user basic information from a user, generates membership subscription information by combining the application key and the user information, And provides the subscription information to the ACS 100 (step 414). Here, the application key is used as a personal identification substitute key according to the present invention. The application key is generated as an eigenvalue including the push key of the push server, the current time, and the clock tuning value.

The application key is generated as a globally unique identifier (GUID) consisting of 16 bytes, that is, a 128-bit number. The application key is composed of 4 bytes, 2 bytes, 2 bytes, 8 bytes based on the Open Software Foundation It is divided into bytes and separated by hi-phon, and is generated in hexadecimal or more hexadecimal number.

Also, the application key is generated as an eigenvalue including the current time and the clock tuning value, and is not duplicated with the existing key even after re-installation after reinstalling the electronic document providing service application. FIG. 5 shows an example of the application key.

When the ACS 100 receives the membership subscription information from the user device 200, the ACS 100 stores the subscription information in the member information database 110 and registers it in step 416.

Also, after the ACS 100 registers the membership subscription information, the ACS 100 generates subscription result information and transmits the subscription result information to the user device 200. The subscription result information may be pushed through the push server 108. [ The user device 200 receives and displays the membership subscription result and guides the subscriber to the user, thereby completing installation of the electronic document provision service application.

&Lt; Electronic document providing service according to user request >

A method of providing an electronic document according to a user request according to a preferred embodiment of the present invention will be described with reference to FIG.

The user device 200 generates a login request message including login information including an application key according to a user's request, and transmits the login request message to the ACS 100 (operation 500). The login information includes user identification information and a password input by the user, and a personal identification alternative key, which is an application key previously stored in the internal memory of the user device.

The ACS 100 performs authentication for the user using the login information (operation 502). That is, the subscription information corresponding to the login information is inquired to confirm whether the user identification information, the password, and the personal identification substitute key are identical and authenticate.

If the authentication is successful according to the login information, the ACS 100 reads the application key from the subscription information according to the login information and generates a disposable authentication key in step 504. Here, the disposable authentication key is generated as an eigenvalue including the push key of the push server, the current time, and the clock tuning value. In addition, the one-time authentication key is generated as a globally unique identifier (GUID) composed of 16 bytes, that is, a 128-bit or more number or symbol, divided into 4 bytes, 2 bytes, 2 bytes and 8 bytes based on the OSF algorithm, And the like, and it is composed of hexadecimal or more hexadecimal numbers or the like. In addition, since the disposable authentication key includes the current time and the clock tuning value, it is not duplicated.

In step 506, the ACS 100 pushes the disposable authentication key to the user device 100 according to the application key, which is an alternative identification key of the user, through the push server 104.

The user equipment 200 generates a service key by combining the disposable authentication key provided in the push method and the personal identification substitute key of the user in step 508 and transmits the service key to the ACS 100 step). Here, the personal identification replacement key is allocated and stored in advance as an application key.

The ACS 100 verifies whether the service key provided by the user equipment 200 is a combination of the generated one-time authentication key and the application key of the user equipment that has transmitted the disposable authentication key to perform authentication Step 512).

If the authentication by the service key is successful, the ACS 100 connects the path between the user equipment 200 and the electronic document providing server 300 in step 514. In this case,

The user device 200 requests an electronic document to the electronic document providing server 300 according to a request of the user in step 516 and the electronic document providing server 300 transmits the request to the user device 200 (Step 518 and Step 520). The transmission of the electronic document may be directly performed through the web, but may be performed through the push server 104 connected to the ACS 100 for protecting the electronic document. In this case, the electronic document providing server 300 provides the electronic document data requested by the user to the ACS 100. The ACS 100 obtains the application key for the user from the member information database 102, And provides the application key and the electronic document data to the push server 108. The push server 108 transmits electronic document data to the user device 200 according to the application key.

Upon receiving the electronic document data, the user device 200 stores the electronic document, displays the electronic document, and guides the electronic document (step 522). The storage and guidance of the electronic document is performed through an electronic document providing service application according to the present invention, and is illustrated in FIG.

After the electronic document data is transmitted, the ACS 100 requests the ACS 100 to disconnect the digital document providing server 300 and the user equipment 200 are disconnected.

As described above, according to the present invention, after the login information for authentication is input, the user equipment 200 owned by the user according to the user identification information of the login information can input the disposable authentication key The service key is generated and transmitted to the ACS 100 to connect to the electronic document providing server 300 in the background, thereby minimizing the hassle of the user for multiple authentication.

In addition, the present invention is not only consistent with the registered membership information, but also attempts to access the electronic document providing server 300 only when the login information is the login request from the user's own device, It is possible not only to prevent a malicious user from accessing the electronic document providing server 300 but also to protect the electronic document of the user.

&Lt; Electronic document providing service according to request of electronic document providing system >

A method of providing an electronic document according to a request of an electronic document providing system according to a preferred embodiment of the present invention will be described with reference to FIG.

First, if the electronic document providing service application according to the preferred embodiment of the present invention is in operation, the user device 200 and the authentication system 100 are maintained in the login state.

In this state, when the electronic document to be transmitted to a specific user is generated, the electronic document providing server 300 transmits the electronic document data to be transmitted to the ACS 100 (steps 600 and 604). The electronic document data to be transmitted includes user identification information.

The ACS 100 reads out the application key corresponding to the user identification information included in the notification data from the database 102 and generates the disposable authentication key and transmits the disposable authentication key to the user device 200 (Steps 606, 608, and 610).

The user device 200, which has received the disposable authentication key in a push manner, generates a service key by combining the received disposable authentication key with a personal identification alternative key, which is an application key previously stored in the user device 200, And transmits the service key to the ACS 100 (steps 612 and 614).

The ACS 100 determines whether the service key provided by the user equipment 200 is normal and performs authentication in step 616. That is, it is determined whether the service key is generated by combining the one-time authentication key transmitted to the user device 200 and the personal identification alternative key assigned to the user, and performs authentication.

If the authentication by the service key is successful, the ACS 302 transmits the electronic document data of the corresponding user to the user equipment 200 through the push server 104 in a pushing manner (step 618).

The user equipment 200 receiving the electronic document data stores the electronic document data, displays the electronic document data, and guides the electronic document data in operation 620. The storage and guidance of the electronic document are performed through an electronic document providing service application according to the present invention.

As described above, according to the present invention, even when providing an electronic document according to a request of the electronic document providing server 300, the electronic document can be protected by transferring the user device owned by the user after authentication.

<Electronic document history service>

The electronic document providing service application according to the present invention stores electronic document data and provides the stored electronic document data to the user so that the user can obtain the electronic document history information through the accumulated electronic document data. Such electronic document history information is guided to the user or transmitted to other equipment, so that the user can easily manage the electronic document history information. The transmission of the electronic document history information may be performed by a scanner or an NFC sensing method.

In addition, the above-mentioned electronic document may also include financial documents such as a resident registration copy or a registered copy, a financial document such as a credit card bill or a bank transfer confirmation document, or a health related document such as a prescription or a medical record recorder, It is also possible to store data from the health management device and other personal history information management devices in cooperation with the management device so as to manage the history.

The ACS includes a data receiving unit that receives data from an external user equipment or an electronic document providing server, a data processing unit that processes the received data according to a preferred embodiment of the present invention, a data transmitting unit that externally transmits data processing results, .

100: ACS
102: Member information database
104: push server
200: User device
300: electronic document providing server

Claims (11)

An authentication method for an electronic document providing service,
Generating a one-time authentication key when the ACS (Access Control Server) receives the login request message including the personal identification alternative key, and transmitting the generated one-time authentication key to the user device corresponding to the corresponding personal identification substitute key;
When the ACS returns a service key generated by combining the one-time authentication key and the personal identification substitution key from the user equipment, the service key is generated using the one-time authentication key transmitted to the user equipment and the personal identification alternative key of the user equipment And performing authentication based on whether the service key is a service key,
Wherein the personal identification substitution key is an application key assigned to the user device,
The ACS transmits the disposable authentication key to the user device identified by the application key, which is the personal identification alternative key,
Transmits the disposable authentication key and the application key to a push server,
Wherein the push server receives the disposable authentication key and the application key, and transmits the disposable authentication key to a user device according to the application key. delete The method according to claim 1,
And connecting the path between the user equipment and the electronic document providing server when the ACS succeeds in authenticating the electronic document. The method according to claim 1,
When the ACS receives electronic document data for a specific user from the electronic document providing server, stores the electronic document data, generates a one-time authentication key, reads the personal identification alternative key for the specific user from the database, Transmitting the disposable authentication key to a user equipment corresponding to the personal identification alternate key;
When the service key generated by combining the one-time authentication key and the personal identification alternative key is returned from the user equipment, the ACS generates the one-time authentication key transmitted to the corresponding user equipment and the personal identification substitute key of the corresponding user equipment Performing authentication based on whether the received service key is a service key; And
And transmitting the stored electronic document data to the user equipment when the ACS succeeds in authenticating the electronic document. 5. The method of claim 4,
Wherein the ACS transmits the disposable authentication key or the application key or the electronic document data to the user device identified by the application key which is the personal identification alternative key by pushing the disposable authentication key or the electronic document data, To the push server,
Wherein the push server receives the disposable authentication key and the application key, transmits the disposable authentication key to the user device according to the application key,
Receiving the electronic document data and the application key, and transmitting the electronic document data to a user device according to the application key. A method of providing an electronic document,
The ACS generates a one-time authentication key according to a user request through the user equipment or a request from the electronic document providing server and transmits the generated one-time authentication key to the user equipment of the corresponding user;
Each time the one-time authentication key from the ACS is pushed through the push server, the user equipment generates a service key by combining the disposable authentication key and the personal identification alternative key, and transmits the service key to the ACS ;
The ACS performs authentication based on whether a service key returned from the user equipment is generated by a combination of the one-time authentication key generated by the service device and the personal identification alternate key of the user, and if the authentication is successful, Connecting electronic document providing servers;
Receiving the electronic document of the user from the electronic document providing server when the user device has a route to the electronic document providing server by the ACS;
Wherein the personal identification substitution key is an application key assigned to the user equipment. The method according to claim 6,
Further comprising receiving and storing an electronic document from the electronic document providing server when the path between the electronic document providing server is connected to the user device,
And the stored electronic documents are provided to the user as history information. delete An ACS for performing authentication for an electronic document provisioning service,
A data receiving unit for receiving data from outside;
A data transmission unit for transmitting data to the outside;
When the login request message including the personal identification alternative key is received through the data receiving unit, the one-time authentication key is generated and transmitted to the user equipment corresponding to the corresponding personal identification alternative key through the data transmission unit,
If the service key corresponding to the transmission of the one-time authentication key is returned from the user equipment through the data receiver, the service key transmits the disposable authentication key using the one-time authentication key transmitted to the user equipment and the personal identification alternate key of the user equipment And a data processing unit for determining whether the generated service key is a generated service key, and performing authentication based on the determination result,
Wherein the personal identification substitution key is an application key assigned to the user device,
Wherein the data processing unit transmits the disposable authentication key to the user equipment corresponding to the application key in a push manner,
And transmits the disposable authentication key and the application key to a push server. The ACS performs authentication for an electronic document providing service.
delete delete

Images