KR20080077786A - Personal authentication method and device using mobile communication terminal and subscriber identification module - Google Patents

Abstract

Disclosed are a personal authentication method and apparatus using a mobile communication terminal and a subscriber identity module. A method for performing personal authentication by a site server connected through an authentication server and a communication network may include requesting authentication information from a user computer connected through the communication network; Receiving authentication information including an authentication key from a user computer through a communication network; Requesting authentication by transmitting authentication information to the authentication server; And receiving an authentication result from an authentication server that has performed personal authentication for the user of the user computer using the authentication information, wherein the authentication key is generated by a mobile communication terminal coupled to the user computer by wire or wirelessly. Provided by a computer, the mobile communication terminal generates an authentication key using the equipped subscriber identification module. According to the present invention, it is possible to perform a more secure and reliable personal authentication of the user in the personal authentication process of the Internet user using a computer.

Description

Method and device for personal authentication using mobile and subscriber identify module and device

1 is a schematic diagram showing an overall system for personal authentication at a specific Internet site using a mobile communication terminal and a subscriber identification module according to an embodiment of the present invention.

2 is a diagram illustrating a personal authentication process of a user using a subscriber identification module installed in a mobile communication terminal of a user according to an embodiment of the present invention.

3 is a diagram illustrating an authentication key generation process in a mobile communication terminal in which a subscriber identification module is combined according to an embodiment of the present invention.

4 is an exemplary view showing a user interface screen for user verification during authentication key generation in a mobile communication terminal according to an embodiment of the present invention.

5 is a functional block diagram of a site server according to an embodiment of the present invention.

6 is a functional block diagram of a mobile communication terminal according to an embodiment of the present invention.

7 is a functional block diagram of a subscriber identification module according to an embodiment of the present invention.

8 is a functional block diagram of an authentication server according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

10: your computer

20: subscriber identification module

30: mobile communication terminal

50: authentication server

Site servers: 70-1, 70-2, ..., 70-n

100: Internet network

The present invention relates to personal authentication, and more particularly, to a personal authentication method and apparatus using a mobile communication terminal and a subscriber identification module.

In general, when a user accesses an Internet site such as daum.net or naver.com by using a PC, the user authenticates the user by entering an ID and password on the web page of the site. This can be done to access the site. According to this method, if a malicious hacking program exists in the user's computer, the user's personal information may be exposed to a third party.

In addition, there is a method for any site to display letters in the form of images in order to prevent unwanted mass access of spam, and to further include the user input of the corresponding information in the personal authentication procedure. However, such a method may be automatically recognized due to the development of image recognition technology, which may lower the effectiveness in the future.

Moreover, user authentication can be a more important issue when providing payment services. Currently, there are methods of providing a payment service on the wired Internet, such as mobile phone payment, credit card payment, bank account deposit.

In the case of mobile phone payment, after inputting a user's mobile phone number, the authentication number is transmitted to the corresponding mobile phone number and then compared with the input authentication number. In the case of credit card payment, authentication is made by inputting user's credit card information and additional information while setting security on the wired Internet. In this case, the payment service is provided in the form of using an official certificate or inputting a password registered in advance to the card company on the payment page provided by the card company.

Recently, the stability of payment service has been improved by separating the information providing site of the wired Internet from the site providing the payment processing. Payment methods through the payment page provided by the card company may be vulnerable to security because information is provided and payment is made on the same wired Internet. That is, a method of inputting personal information such as a password in the input window is possible to steal other people when only the input value is exposed, and there is a security problem that enables access from various places at the same time.

In addition, in the case of using a public certificate in performing the user authentication according to the Internet subscriber authentication and payment, there is an inconvenience that the individual must carry a separate public certificate.

Accordingly, the present invention has been made to solve the above-described problems, and to provide a method and apparatus for more stable personal authentication for a user in the process of personal authentication of an Internet user using a computer.

In addition, the present invention provides an authentication process by using a subscriber identification module coupled to a mobile communication terminal and a mobile communication terminal such as a mobile phone that the user always carries, providing convenience and at the same time the information such as password security is important to the outside It is to provide a personal authentication method and apparatus that is not exposed.

Other objects of the present invention will become more apparent through the preferred embodiments described below.

According to an aspect of the present invention for achieving the above object, a method of performing a personal authentication of the site server connected via the authentication server and the communication network, comprising the steps of: requesting authentication information to the user computer connected through the communication network; Receiving authentication information including an authentication key from the user computer through a communication network; Requesting authentication by transmitting the authentication information to the authentication server; And receiving an authentication result from the authentication server that has performed personal authentication of the user of the user computer using the authentication information, wherein the authentication key is a mobile communication terminal which is wired or wirelessly coupled to the user computer. It is generated by the provided to the user computer, the mobile terminal is provided with a personal authentication method, characterized in that for generating the authentication key using a subscriber identification module mounted.

In addition, a method of performing personal authentication by an authentication server connected through a communication network with a site server, the method comprising: receiving a personal authentication request including authentication information from the site server; Performing personal authentication on a user of the user computer using the authentication information; And transmitting the result information of the personal authentication to the site server, so that the site server performs the authentication result processing on the user computer, wherein the site server authenticates from the user computer connected through a communication network. Personal authentication, characterized in that for receiving authentication information including a key, and generating the authentication key to the user computer using a subscriber identity module equipped with a mobile communication terminal coupled to the user computer by wire or wirelessly A method is provided.

In addition, in a method in which a mobile communication terminal coupled to a site server via a communication network and a wired or wireless connection performs personal authentication, the user computer requested for authentication information for performing personal authentication from the connected site server. Receiving authentication information from the client; Generating an authentication key using the subscriber identification information in association with the combined subscriber identification module; And transmitting the authentication information to the user computer in order for the user computer to transmit authentication information including the authentication key to the site server for performing the personal authentication.

In addition, a method for performing personal authentication by a subscriber identification module mounted in a mobile communication terminal, the method comprising: receiving a request for generating an authentication key from a mobile communication terminal; Generating an authentication key using the stored subscriber identification information; And providing the generated authentication key to the mobile communication terminal so that the mobile communication terminal provides the authentication key to a user computer coupled by wire or wirelessly, wherein the user computer provides the authentication key. Provided to a site server connected through a communication network, the site server is provided with a personal authentication method characterized in that the personal authentication using the authentication key in conjunction with the authentication server coupled through the communication network.

According to another aspect of the present invention for achieving the above object, in the authentication server for performing a personal authentication for the user computer connected to the site server connected via a communication network, a personal authentication request including authentication information from the site server Transmitting and receiving unit for receiving; An authentication performing unit which performs personal authentication on a user of the user computer using the authentication information; And a main control unit for transmitting the result information of the personal authentication to the site server through the transceiver, so that the site server performs the authentication result processing on the user computer, wherein the site server is connected through a communication network. Receiving authentication information including an authentication key from a user computer, and generating and providing the authentication key to the user computer using a subscriber identification module equipped with a mobile communication terminal coupled to the user computer by wire or wirelessly. An authentication server is provided.

A mobile communication terminal equipped with a subscriber identification module, the mobile communication terminal comprising: a communication module for receiving authentication information from the user computer that has requested authentication information for performing personal authentication from the connected site server; A subscriber identity module interface for coupling with a subscriber identity module; And generate an authentication key using subscriber identification information in association with the subscriber identification module coupled through the subscriber identification module interface, and the user computer sends the authentication information including the authentication key to the site server to perform the personal authentication. In order to transmit, a mobile communication terminal including a control module for transmitting the authentication information to the user computer through the communication module.

In addition, the subscriber identification module mounted on the mobile communication terminal, comprising: a terminal interface for receiving a request for generating an authentication key from the mobile communication terminal; A storage unit for storing subscriber identification information; An authentication key generation unit for generating an authentication key using the subscriber identification information; And a control unit for providing the generated authentication key to the mobile communication terminal through the terminal interface so that the mobile communication terminal can provide the authentication key to a wired or wirelessly coupled user computer. The computer provides the authentication key to a site server connected through a communication network, and the site server provides personal authentication using the authentication key in association with the authentication server coupled through the communication network. do.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms including ordinal numbers such as first and second may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and in describing the present invention with reference to the accompanying drawings, the same or corresponding elements are denoted by the same reference numerals regardless of the reference numerals, and duplicates thereof. The description will be omitted.

1 is a block diagram schematically illustrating an entire system for personal authentication at a specific Internet site using a mobile communication terminal and a subscriber identification module according to an embodiment of the present invention.

1, the overall system according to the present embodiment is a user computer 10, the Internet network 100, one or more site servers 70-1, 70-2, ..., 70-n, 70 or less Collectively), authentication server 50 and mobile communication terminal 30. The mobile communication terminal 30 may be equipped with a subscriber identification module 20.

The subscriber identification module 20 embeds subscriber unique information that the mobile communication network can recognize the subscriber, that is, the user. The subscriber identification module 20 may include a basic encryption algorithm, an international mobile subscriber identity (IMSI), information for providing mobility of the mobile communication terminal 30 (eg, a location area ID), basic information of accessible services, and various It stores its own executable program to run the application.

In the second generation communication method, the subscriber identification module 20 uses a subscriber identify module (SIM) in GSM and a removable user identify module (RUIM) in CDMA, and a universal subscriber identify module (USIM) in a third generation mobile communication method such as WCDMA. ) Is used.

In the past, the mobile communication terminal was designed to operate only in a mobile communication network established at the time of opening, and the subscriber identification module 20 used according to the mobile communication network was specified, but recently, the roaming technology can be used in development and one or more communication methods. With the advent of multi-mode multi-band terminals (MM-MB terminals), the possibility of mounting a subscriber identification module 20 capable of operating in multiple networks is increased in one mobile communication terminal 30.

In particular, in recent years, a universal integrated circuit card (UICC) in the form of an integrated circuit including various applications for providing electronic commerce functions, mobile banking, and various additional services to a mobile communication terminal is provided in the mobile communication terminal 30. Although it is mounted, the subscriber identification module 20 embedding the subscriber identification information in the UICC may be included.

The user computer 10 may not only be a desktop computer, but also all communication devices capable of communicating through the Internet network 100 such as a laptop computer such as a notebook computer.

A user may access any site server 70 that provides an Internet site through the Internet network 100 using the user computer 10, and may receive and output a web page or the like from the site server 70. have. Since a technique for accessing an arbitrary site through the Internet network 100 using a computer is common, a detailed description thereof will be omitted.

The site server 70 according to the present embodiment is a mobile communication terminal coupled to the user computer 10 by wire or wirelessly in connection with the user authentication of the user personal authentication of the user computer 10 connected to the authentication server 50 ( It may be performed using the subscriber identification module 20 mounted in 30).

That is, the site server 70 transmits the authentication key received from the mobile communication terminal 30 equipped with the subscriber identification module 20 and coupled to the user computer 10 by wire / wireless to the authentication server for authentication request. The authentication result is received by the authentication server which has been authenticated using the authentication key. Of course, the site server 70 may additionally request identification information (eg, a phone number) of the corresponding mobile communication terminal 30 and use it for authentication.

For convenience of understanding, for example, a method of performing subscriber authentication in a specific portal server or the like, in the related art, a user who can input an ID (ID) and password (password) into the user computer 10 connected to the site server 70. An authentication page was provided and user authentication was performed using the ID and password received from the user computer 10. In contrast, according to the present embodiment, the authentication server 50 processes authentication using the subscriber identification module 20 of the user who uses the user computer 10, and provides the result to the site server 70. As a result, personal authentication of the subscriber is performed. The authentication process using the subscriber identification module 20 mounted on the user's mobile communication terminal 30 according to the present embodiment will be described later with reference to the related drawings (FIG. 2).

Here, the mobile terminal 30 is equipped with a subscriber identification module 20, such as a mobile phone, a personal digital assistant (PDA), all devices capable of providing a mobile communication service based on the subscriber identification module 20 are the same. Can be applied. In addition, the mobile communication network may be a communication network such as a code division multiple access network (CDMA) and an IMT-2000 network (for example, a wide-band CDMA network, etc.). All communication networks in which 30 provides a mobile communication service based on the subscriber identification module 20 may be equally applied.

As described above, the mobile communication terminal 30 may be connected to the user computer 10 by wire through a universal serial bus (USB) cable or the like, and also may include Bluetooth, Zigbee, and ultra wide. -band: may be connected wirelessly by a wireless communication scheme such as UWB).

2 is a diagram illustrating a personal authentication process of a user using a subscriber identification module installed in a mobile communication terminal of a user according to an embodiment of the present invention, and FIG. 3 is a subscriber identification module according to an embodiment of the present invention. 4 is a diagram illustrating a process of generating an authentication key in a combined mobile communication terminal, and FIG. 4 is an exemplary view illustrating a user interface screen for user verification during authentication key generation in a mobile communication terminal according to an embodiment of the present invention.

Referring to FIG. 2, in operation 210, the user computer 10 requests a personal authentication of a user to the site server 70. That is, after the user accesses the site server 70 by using the user computer 10, the user requests personal authentication for subscriber authentication, payment authentication, and the like.

Here, the user computer 10 may transmit identification information (for example, a telephone number, etc.) of the mobile communication terminal 30 input by the user to the site server 70 at the time of the authentication request.

In step 215, the site server 70 requests the user computer 10 for authentication information for authentication processing. Here, since different authentication information may be used for each site, the site server 70 transmits site identification information (for example, a domain name and URL) to the user computer 10 when the authentication information is requested. Can be. In addition, for more stable security, the site server 70 may provide additional additional information (for example, any key value that the subscriber identification module 20 mounted on the mobile communication terminal 30 will use in generating an authentication key). (Eg, a specific number), etc.) can be transmitted to the user computer 10.

In operation 220, the user computer 10 transmits information necessary for generating authentication information received from the site server 70 to the mobile communication terminal 30, which is wired or wirelessly coupled, to request authentication information.

In step 225, the mobile communication terminal 30 generates an authentication key as the authentication information. That is, the subscriber identification module 20 installed in the mobile communication terminal 30 may identify the subscriber's identification information (for example, the subscriber's name, the subscriber's identification number (for example, the identification number registered in the mobile carrier, the terminal IMSI). Key identification information), which is stored in the subscriber identification module 20, which is still used to authenticate a subscriber in a mobile communication network. The method of generating an authentication key can be used without limitation for any method that can generate unique information using subscriber identification information. 30 may encrypt the authentication key generated by applying a predetermined encryption method between the authentication server 50, the authentication server 50 is decrypted in advance That decrypts the authorization key encrypted by the formula may be used for authentication, it is obvious to those skilled in the art.

As described above, the authentication key may be generated using the site server identification information, the arbitrary key value, and the like received from the site server 70. Here, although the subscriber identification module 20 has been described as generating the authentication key, of course, the subscriber identification module 20 provides only the identification information of the subscriber to the mobile communication terminal 30, and the mobile communication terminal 30 directly authenticates. You can also generate a key. In the following description, it is assumed that the mobile communication terminal 30 generates an authentication key for convenience of description.

In addition, in generating the authentication key, the mobile communication terminal 30 may receive a password or the like from the user, and may process the authentication to determine whether to generate the authentication key. That is, the mobile communication terminal 30 may perform a user verification procedure for generating an authentication key.

Referring to FIG. 3, which illustrates a process thereof, in step 310, the mobile communication terminal 30 receiving the authentication information request from the user computer 10 receives a user interface (UI) screen for inputting a password from the user (FIG. 4). Reference).

In step 320, the mobile communication terminal 30 receives a password (any one of numbers, letters, symbols, and a combination thereof) from the user, and determines whether the password input in step 330 matches a preset authentication value to authenticate the user. Process. Here, the authentication value compared with the password may be stored in advance in the mobile terminal 30 or the subscriber identification module 20 (for example, the terminal password), or previously received from the site server 70 It can be any key value (e.g., a password registered in advance at the site server 70).

If the input password matches the authentication value, in step 340, the mobile communication terminal 30 generates an authentication key. If there is no match, in step 350, the mobile communication terminal 30 may transmit an error message to the user computer 10 without generating an authentication key. Of course, it is also possible to allow the user to enter a password a predetermined number of times (for example, three times), if the wrong password is entered more than the above number is converted to the locked (lock) state so that you can not perform a phone call, etc. It may be.

Referring back to FIG. 2, in step 230, the mobile communication terminal 30 transmits authentication information including the generated authentication key to the user computer 10, and in step 235, the user computer 10 receives the received authentication information. It is transmitted to the site server 70.

Here, the site server 70 allows the user computer 10 to request authentication information from the mobile communication terminal 30 and transmits the authentication information received from the mobile communication terminal 30 to the site server 70. Software may be provided to user computer 10 at step 215 or in advance (eg, prior to an authentication request). Accordingly, the user computer 10 may perform the above functions by executing the above software.

In operation 240, the site server 70 transmits authentication information including the authentication key received from the user computer 10 to the authentication server and requests personal authentication for the user who uses the user computer 10. Here, the site server 70 is not only the authentication key, but also the site server identification information, the telephone number of the mobile communication terminal 30 (received in step 210), and additional additional information (for example, a pre-assigned request number, etc.). ) Can be provided as an authentication server.

In step 245, the authentication server performs personal authentication according to the authentication request from the site server 70. Since information (ie, mobile terminal identification information, authentication key information, and the like) of the user is registered in advance in the authentication server, the authentication server may process personal authentication for the user by using the received authentication information. Here, the authentication server may process the site server 70 that requests the personal authentication of the user. That is, the authentication server authenticates using the site server identification information (for example, UAL, domain name, etc.) received from the site server 70, the time value at the time of connection (serviceable time information for each site server 70). The authentication process).

In step 250, the authentication server transmits the authentication processing result to the site server 70, and in step 255, the site server 70 performs a procedure corresponding to the authentication processing result. For example, if authentication is successful, a corresponding web page or the like may be provided to the user computer 10. For example, in the case of subscriber authentication, a web page according to the subscriber's menu (e.g., a mailbox, etc.) (i.e., a page after login) is provided, and in the case of user authentication according to payment, a corresponding payment success page Can be. If authentication fails, the site server 70 may process the authentication failure by sending an authentication failure message or the like to the user computer 10.

Therefore, according to the present embodiment, only the phone number of the mobile communication terminal 30 is input to the site server 70 through the user computer 10, and information such as security that is important for security is the mobile communication terminal 30. Is entered only. Therefore, compared to the conventional authentication method for inputting an ID / password, it is possible to provide more secure security by additionally using a physical authentication element called a mobile communication terminal 30 without being authenticated only by a password.

Hereinafter, the configurations of the site server 70, the mobile communication terminal 30, and the subscriber identification module 20 for performing personal authentication using the mobile communication terminal 30 according to the present embodiment will be described.

5 is a functional block diagram of a site server according to an embodiment of the present invention.

Referring to FIG. 5, the site server 70 may include a web page providing unit 510 for providing a web page to the user computer 10, a communication unit 520 for communicating with the authentication server and the user computer 10, and each of the site servers 70. And a main control unit 530 for controlling the component and processing personal authentication of the user of the user computer 10.

Since there are many Internet sites that provide web pages, a detailed description of the functions of the web page providing unit 510 is omitted. However, although the web page providing unit 510 may directly generate a web page, at least one web page created by an administrator is stored in a storage means (not shown) provided in the web page providing unit 510. ) May be implemented by extracting and providing a web page corresponding to a request from the user computer 10 from the storage means.

As described above, the main processing unit 530 communicates with the user computer 10 to the user computer 10 to process personal authentication of the user connected by using the user computer 10, such as personal authentication according to subscriber authentication or payment. The controller 520 controls the communication unit 520 to request authentication information and to transmit authentication information including the received authentication key to the authentication server.

In addition, the main controller 530 controls the web page providing unit 510 so as to provide a web page according to the authentication result to the user computer 10 so as to correspond to the authentication result received from the authentication server. To).

Although not shown in the drawing, the site server 70 is a separate component for performing the above-described functions by the site server 70 such as a storage unit for storing subscriber information / web page information, etc., in addition to the above-described components. The component of may be further included.

6 is a functional block diagram of a mobile communication terminal according to an embodiment of the present invention, Figure 7 is a functional block diagram of a subscriber identification module according to an embodiment of the present invention.

Referring to FIG. 6, the mobile communication terminal 30 includes a subscriber identity module interface 610, a communication module 620, an input module 630, a storage module 640, a display module 650, and a control module 660. It includes.

The subscriber identification module interface 610 is for transmitting and receiving data with the combined subscriber identification module 20. Since the mobile communication terminal 30 in which the subscriber identification module 20 is mounted is widely used, a detailed description of the subscriber identification module interface 610 will be omitted.

The communication module 620 communicates with the user computer 10 by wire or wirelessly. The communication module 620 may be connected with the user computer 10 through a wire such as a USB connector. The data can be transmitted and received with the user computer 10.

The input module 630 is for receiving a password or the like from a user and may be, for example, a keypad.

The storage module 640 stores information about a preset password for user confirmation. As described above, the information about the password may be stored in the subscriber identification module 20.

The display module 650 is for displaying a user interface screen as shown in FIG. 4 and may be, for example, a liquid crystal.

When the control module 660 receives a request for authentication information from the user computer 10, which is wired / wirelessly coupled, the control module 660 receives a password from the user to confirm the user, and transmits the generated authentication key to the user computer 10. The subscriber identification module interface 610, the communication module 620, the input module 630, the storage module 640, and the display module 650 are controlled. Here, the control module 660 of the mobile communication terminal 30 may directly generate the authentication key using the specific information (eg, subscriber identification information) obtained from the subscriber identification module 20.

According to another exemplary embodiment, the subscriber identification module 20 that obtains specific information (eg, corresponding site server identification information, arbitrary key value, etc.) from the mobile communication terminal 30 may generate an authentication key. The configuration of the subscriber identification module 20 according to the embodiment in which the subscriber identification module 20 directly generates an authentication key is illustrated in FIG. 7.

Referring to FIG. 7, the subscriber identification module 20 includes a terminal interface unit 710, a storage unit 720, an authentication key generator 730, and a controller 740.

The terminal interface unit 710 is for data transmission and reception with the combined mobile communication terminal 30. As described above, since the subscriber identification module 20 mounted on the mobile communication terminal 30 is still widespread, the terminal interface unit Detailed description of 710 is omitted.

The storage unit 720 stores subscriber identification information.

The authentication key generation unit 730 functions to generate the authentication key using the subscriber identification information stored in the storage unit 720. Of course, when generating the authentication key, additional information such as corresponding site server identification information and an arbitrary key value may be used.

When the authentication key generation command is input from the combined mobile communication terminal 30, the controller 740 causes the authentication key generation unit 730 to generate an authentication key, and transmits the generated authentication key to the mobile communication terminal 30. The terminal interface unit 710, the storage unit 720 and the authentication key generation unit 730 to control.

Hereinafter, the configuration of the authentication server 50 will be described.

8 is a functional block diagram of an authentication server according to an embodiment of the present invention.

Referring to FIG. 8, the authentication server 50 includes a database unit 810, a transceiver 820, an authentication performer 830, and a main controller 840.

The database unit 810 is for storing registration information corresponding to a specific user. The registration information is information that can be authenticated using an authentication key, and may be identification information of the corresponding user, mobile communication terminal identification information, and information corresponding to subscriber identification information stored in the subscriber identification module 20.

The transceiver 820 is a communication means for communicating with the site server 70.

The authentication performing unit 830 functions to process personal authentication using the authentication information received from the site server 70. That is, the authentication performing unit 830 performs personal authentication of the user of the user computer 10 connected to the site server 70 by using the authentication key of the received authentication information.

The main control unit 840 functions to control each component of the authentication server 50 to perform its respective functions. In particular, the main control unit 840 transmits the result information authenticated by the authentication performing unit 830 to the site through the transceiver 820. Provided to server 70.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention is not limited to the above embodiments, and many variations are possible by those skilled in the art within the spirit of the present invention.

As described above, according to the present invention, it is possible to provide a method and apparatus capable of performing more secure and reliable personal authentication for a user in a personal authentication process of an Internet user using a computer.

In addition, the present invention authenticates by using a subscriber identification module coupled to a mobile communication terminal and a mobile communication terminal, such as a mobile phone that the user always carry, and inputs a password, etc. only to the mobile communication terminal to expose information important to security to the outside. Can eliminate the risk of

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art that various modifications of the present invention without departing from the spirit and scope of the invention described in the claims below And can be changed.

Claims (18)

In the method of the personal authentication of the site server connected via the authentication server and the communication network, Requesting authentication information from a user computer connected through a communication network; Receiving authentication information including an authentication key from the user computer through a communication network; Requesting authentication by transmitting the authentication information to the authentication server; And Receiving an authentication result from the authentication server that has performed personal authentication for the user of the user computer using the authentication information, The authentication key is generated by a mobile communication terminal coupled to the user computer in a wired or wireless manner and provided to the user computer, wherein the mobile communication terminal generates the authentication key by using an attached subscriber identification module. Personal authentication method. The method of claim 1, And in the requesting of the authentication information, the site server transmits site server identification information and any key value for generating the authentication key to the user computer. The method of claim 1, When the identification information of the mobile communication terminal is further received from the user computer, the site server provides identification information of the mobile communication terminal to the authentication server when an authentication request is made to the authentication server. Authentication method. The method of claim 3, wherein Personal identification method, characterized in that the identification information for the mobile communication terminal is a telephone number. In a method in which an authentication server connected through a communication network with a site server performs personal authentication, Receiving a personal authentication request including authentication information from the site server; Performing personal authentication on a user of the user computer using the authentication information; And Transmitting the result of performing the personal authentication to the site server, so that the site server performs the authentication result processing for the user computer. The site server receives authentication information including an authentication key from a user computer connected through a communication network, and generates the authentication key using a subscriber identification module equipped with a mobile communication terminal coupled to the user computer by wire or wirelessly. Personal authentication method characterized in that it is provided to the user computer. The method of claim 5, And wherein the authentication information includes identification information of the mobile communication terminal. In a method of performing personal authentication by a mobile communication terminal combined with a user computer connected to a site server through a communication network by wire or wireless, Receiving authentication information from the user computer that has requested authentication information for performing personal authentication from a connected site server; Generating an authentication key using the subscriber identification information in association with the combined subscriber identification module; And And transmitting the authentication information to the user computer to cause the user computer to transmit authentication information including the authentication key to the site server to perform the personal authentication. The method of claim 7, wherein Generating the authentication key, Displaying a user interface screen for receiving a password; And Determining whether the user verification is successful by comparing the input password with a predetermined authentication value; And And if it is determined that the user verification succeeds, generating an authentication key using the subscriber identification information in association with the combined subscriber identification module. The method of claim 7, wherein And site key identification information for generating the authentication key and any key value for generating the authentication key from the site server through the user computer. The method of claim 9, Generating the authentication key, Sending the site server identification and the arbitrary key value to the subscriber identification module; And And receiving, by the subscriber identification module, an authentication key generated using the site server identification information, the arbitrary key value, and the subscriber identification information. The method of claim 9, Generating the authentication key, Requesting the subscriber identification information from the subscriber identification module; And And generating an authentication key using the site server identification information, the arbitrary key value, and the subscriber identification information. In the subscriber identification module mounted on the mobile communication terminal to perform personal authentication, Receiving a request for generating an authentication key from a mobile communication terminal; Generating an authentication key using the stored subscriber identification information; And And providing the generated authentication key to the mobile communication terminal so that the mobile communication terminal can provide the authentication key to a user computer coupled by wire or wirelessly. The user computer provides the authentication key to a site server connected through a communication network, and the site server performs personal authentication using the authentication key in association with an authentication server coupled through a communication network. . An authentication server for performing personal authentication on a user computer connected to a site server connected through a communication network, A transceiver for receiving a personal authentication request including authentication information from the site server; An authentication performing unit which performs personal authentication on a user of the user computer using the authentication information; And And a main control unit for transmitting the result information of the personal authentication to the site server through the transceiver, so that the site server performs the authentication result processing for the user computer. The site server receives authentication information including an authentication key from a user computer connected through a communication network and generates the authentication key using a subscriber identification module equipped with a mobile communication terminal coupled to the user computer by wire or wirelessly. Authentication server, characterized in that provided to the user computer. The method of claim 13, And the authentication information includes identification information of the mobile communication terminal. A mobile communication terminal equipped with a subscriber identity module, A communication module for receiving authentication information from the requested user computer for authentication information for performing personal authentication from the connected site server; A subscriber identity module interface for coupling with a subscriber identity module; And Generates an authentication key using subscriber identification information in association with the subscriber identification module coupled through the subscriber identification module interface, and transmits the authentication information including the authentication key to the site server by the user computer for performing the personal authentication. And a control module for transmitting the authentication information to the user computer through the communication module. The method of claim 15, Further includes an input module for receiving a password, And comparing the input password with a predetermined authentication value to determine whether or not the user verification succeeded, and wherein the authentication key is generated only when it is determined that the user verification succeeded. The method of claim 16, And a display module for displaying a user interface screen for receiving the password. In the subscriber identification module mounted on the mobile communication terminal, A terminal interface unit for receiving a request for generating an authentication key from a mobile communication terminal; A storage unit for storing subscriber identification information; An authentication key generation unit for generating an authentication key using the subscriber identification information; And And a control unit for providing the generated authentication key to the mobile communication terminal through the terminal interface so that the mobile communication terminal can provide the authentication key to a wired or wirelessly coupled user computer. The user computer provides the authentication key to a site server connected through a communication network, and the site server performs personal authentication using the authentication key in association with an authentication server coupled through a communication network. .

Images