[go: up one dir, main page]

WO2015026083A1 - Système et procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par sms - Google Patents

Système et procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par sms Download PDF

Info

Publication number
WO2015026083A1
WO2015026083A1 PCT/KR2014/007331 KR2014007331W WO2015026083A1 WO 2015026083 A1 WO2015026083 A1 WO 2015026083A1 KR 2014007331 W KR2014007331 W KR 2014007331W WO 2015026083 A1 WO2015026083 A1 WO 2015026083A1
Authority
WO
WIPO (PCT)
Prior art keywords
otp
unique logic
main server
user client
confirmation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/KR2014/007331
Other languages
English (en)
Korean (ko)
Inventor
이종일
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
BELLSOFT Co Ltd
Original Assignee
BELLSOFT Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by BELLSOFT Co Ltd filed Critical BELLSOFT Co Ltd
Publication of WO2015026083A1 publication Critical patent/WO2015026083A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements

Definitions

  • the present invention relates to a text message security system and method for preventing mobile phone identity theft and smishing, more specifically, a user's client receives an OTP (ONE TIME PASSWORD; Since the Authenticator authenticates through the changed OTP by sending it to the main server, even if a hacker intercepts the OTP in the middle through a malicious app and authenticates himself, such as micropayment or adult authentication, the modified OTP cannot be sent to the main server. Therefore, the present invention relates to a text message security system and method for preventing identity theft and smishing of a mobile phone without the risk of leaking an authentication number.
  • OTP ONE TIME PASSWORD
  • mobile communication terminals have become an essential means of communication in modern life, such as a considerable amount of communication occurring in human relationships through mobile communication terminals.
  • Mobile communication companies, financial institution servers, portal sites, etc. in the mobile communication network is applying a variety of authentication technologies for identity authentication.
  • the self-identification technology using the mobile phone has been spotlighted after the self-identification using the social security number is prohibited.
  • Existing anti-smashing service is a method of notifying or blocking subscribers (mobile phone owners) by making DB of types and download paths of malicious apps, but effective countermeasures are insufficient due to the continuous appearance of new malicious apps and new download paths. .
  • Authentication SMS which is a means of two-channel authentication, is transmitted through the communication company's SMS closed network, which is much more secure than the open network of the Internet, and is a feature phone connected only to a closed communication network instead of a PC exposed to various malware and virus programs. It was a secure means of two-channel authentication by receiving and confirming through.
  • OTP ONE TIME PASSWORD
  • OTP ONE TIME PASSWORD
  • another object of the present invention is to check the intrinsic logic to change the OTP in real time to change at regular intervals text message security system and method for preventing identity theft and smishing of the mobile phone that there is no risk of leaking the intrinsic logic To provide.
  • Another object of the present invention is to give a unique logic for converting the confirmation OTP to the answer OTP for each client terminal and periodically change the unique logic in a way that works in conjunction with the main server or periodically install the cloned app installed through hacking It is to provide a text message security system and method for preventing mobile phone identity theft and smishing to dramatically increase the security through such methods as checking.
  • the security system in the personal authentication and micropayment system that proceeds with the user authentication and micropayment through the user terminal,
  • a user terminal including an authentication request signal generator for generating an authentication request signal and a first communication unit for transmitting the authentication request signal to an agent server and receiving approval information and rejection information from the agent server;
  • a confirmation OTP detection unit for detecting a confirmation OTP (ONE TIME PASSWORD (hereinafter referred to as OTP)) received from the main server and an answer OTP generation unit for substituting the detected confirmation OTP into a first unique logic to generate an answer OTP, and from the main server
  • OTP ONE TIME PASSWORD
  • a user client including a second communication unit configured to receive the confirmation OTP and send the reply OTP to a main server;
  • Confirming OTP generation unit for confirming the authentication request signal, and generates a confirmation OTP corresponding to the MDN through the MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal, the authentication request signal
  • Agent server And converts the confirmation OTP received from the agent server by a second unique logic, compares the converted OTP with the response OTP received from the user client, determines whether to match, and generates approval information if there is a match. And a matching unit for generating rejection information, transmitting the confirmation OTP received from the agent to the user client, receiving the reply OTP from the user client, and transmitting the approval information or rejection information to the agent server. It includes; main server including a communication unit.
  • first unique logic and the second unique logic characterized in that the one or more first unique logic and the second unique logic including each unique logic change code number is stored in the user client and the main server
  • the main server may change the first unique logic and the second unique logic at predetermined time intervals, and transmits a first unique logic change code to the user client to transmit the second unique logic of the main server and the first client logic. It is characterized in that the unique logic is matched.
  • the main server may include: a main DB storing MDNs of at least one user client in which a client application for converting a confirmation OTP into an answer OTP through a first unique logic; And receiving the confirmation OTP and the authentication request signal from the agent server, comparing the MDN included in the authentication request signal with MDNs of one or more user clients in which a client application pre-stored in the main DB is installed.
  • the MDN information check unit characterized in that for transmitting to the user client belonging to the MDN including a specific code, and to the user client that does not belong to the MDN does not include a specific code; It is characterized by.
  • the user client may search for all SMS messages or MMS messages received by the user client, search for a specific code included in the SMS message or MMS message, and, if the specific code is confirmed, classify it as a confirmation OTP.
  • OTPN OTP NUMBER; hereinafter OTPN
  • OTPN OTP NUMBER
  • an authentication request signal generation unit for generating an authentication request signal, the authentication request signal And answering OTP input from the OTP input unit to the agent server, and outputting an OTP input window to the first communication unit and the output unit receiving the approval information and rejection information from the agent server, and answering OTP (ONE TIME PASSWORD).
  • a user terminal including an OTP input unit for receiving an OTP input; A confirmation OTP detection unit for detecting the confirmation OTP received from the main server, an answer OTP generation unit for generating the response OTP by converting the detected confirmation OTP into a first unique logic, and a second receiving the confirmation OTP from the main server
  • a user client including a communication unit and an answer OTP output unit for outputting an answer OTP generated by the answer OTP generator; Confirmation OTP generation unit for confirming the authentication request signal, and generates a confirmation OTP corresponding to the MDN through the MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal, the authentication request signal from the user terminal and Receive the response OTP, send the confirmation OTP and the response OTP to the main server, receive the approval information or rejection information from the main server, and send the approval information or the rejection information received from the main server to the user terminal.
  • MDN MDN
  • An agent server including a third communication unit; And converts the confirmation OTP received from the agent server by a second unique logic, compares the converted OTP with the response OTP received from the user client, determines whether to match, and generates approval information if there is a match.
  • a matching unit for generating rejection information transmitting the confirmation OTP received from the agent to the user client, receiving the reply OTP from the user terminal, and transmitting the approval information or rejection information to the agent server. It includes; main server including a communication unit.
  • the second unique logic is generated at a predetermined time in the main server and transmitted to the user client, and the first unique logic stored in the user client is changed to the second unique logic to change the first unique logic and the first unique logic. And synchronizing the second unique logic.
  • first unique logic and the second unique logic characterized in that the one or more first unique logic and the second unique logic including each unique logic change code number is stored in the user client and the main server
  • the main server may change the first unique logic and the second unique logic at predetermined time intervals, and transmits a first unique logic change code to the user client to transmit the second unique logic of the main server and the first client logic. It is characterized in that the unique logic is matched.
  • the main server may include: a main DB storing MDNs of at least one user client in which a client application for converting a confirmation OTP into an answer OTP through a first unique logic; And receiving the confirmation OTP and the authentication request signal from the agent server, comparing the MDN included in the authentication request signal with MDNs of one or more user clients in which a client application pre-stored in the main DB is installed.
  • the MDN information check unit characterized in that for transmitting to the user client belonging to the MDN including a specific code, and to the user client that does not belong to the MDN does not include a specific code; It is characterized by.
  • the user client may search for all SMS messages or MMS messages received by the user client, search for a specific code included in the SMS message or MMS message, and, if the specific code is confirmed, classify it as a confirmation OTP.
  • OTPN OTP NUMBER; hereinafter OTPN
  • OTPN OTP NUMBER
  • a method for providing a self-authentication and micropayment through a user authentication and a micropayment through a user terminal (A) A user terminal generates an authentication request signal to an agent server. Transmitting; (b) In step (a), the agent server confirms the authentication request signal received from the user terminal, and corresponds to the MDN through a MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal.
  • MDN MOBILE DIRECTORY NUMBER
  • step (b) the main server receives the authentication request signal and the confirmation OTP, and receives the confirmation OTP to the user client corresponding to the MDN included in the authentication request signal.
  • step (c) detecting, by the user client, the confirmation OTP received from the main server;
  • step (d) converting, by the user client, the detected OTP into a first unique logic to generate an answer OTP;
  • step (e) in the step (e), the user client transmitting the reply OTP to the main server;
  • step (g) in the step (f), the main server converting the received confirmation OTP by a second unique logic, and comparing the received confirmation OTP with the received response OTP to determine whether there is a match;
  • step (h) the main server compares the converted OTP and the received OTP to determine whether or not a match is generated, and if it is matched, generates approval information and sends it to the agent server. Generating information and transmitting the generated information to the agent server; And (i) in step (h), the agent server transmitting the approval information or the rejection information received from the main server to the user terminal.
  • the second unique logic is generated at a predetermined time in the main server and transmitted to the user client, and the first unique logic stored in the user client is changed to the second unique logic to change the first unique logic and the first unique logic. And synchronizing the second unique logic.
  • first unique logic and the second unique logic characterized in that the one or more first unique logic and the second unique logic including each unique logic change code number is stored in the user client and the main server
  • the main server may change the first unique logic and the second unique logic at predetermined time intervals, and transmits a first unique logic change code to the user client to transmit the second unique logic of the main server and the first client logic. It is characterized in that the unique logic is matched.
  • the main server may include: a main DB storing MDNs of at least one user client in which a client application for converting a confirmation OTP into an answer OTP through a first unique logic; And receiving the confirmation OTP and the authentication request signal from the agent server, comparing the MDN included in the authentication request signal with MDNs of one or more user clients in which a client application pre-stored in the main DB is installed.
  • the MDN information check unit characterized in that for transmitting to the user client belonging to the MDN including a specific code, and to the user client that does not belong to the MDN does not include a specific code; It is characterized by.
  • a method for providing self-authentication and micropayment through user authentication and micropayment through a user terminal wherein (a) the user terminal generates an authentication request signal to the agent server. Transmitting; (b) In step (a), the agent server confirms the authentication request signal received from the user terminal, and corresponds to the MDN through a MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal.
  • MDN MOBILE DIRECTORY NUMBER
  • step (b) the main server receives the authentication request signal and the confirmation OTP, and receives the confirmation OTP to the user client corresponding to the MDN included in the authentication request signal.
  • step (c) detecting, by the user client, the confirmation OTP received from the main server;
  • step (d) in step (d), converting, by the user client, the detected OTP into a first unique logic to generate an answer OTP;
  • step (e) in the step (e), outputting an answer OTP generated by the user client, and inputting the output answer OTP to the answer OTP input window output to the user terminal;
  • step (g) in the step (f), the user terminal transmitting the reply OTP input in the reply OTP input window to the agent server, and the agent server sending the reply OTP to the main server;
  • step (i) In step (h), the main server compares the converted OTP and the received OTP to determine whether or not it is matched, and if it is matched, generates approval information and sends it to the
  • the first unique logic and the second unique logic may be generated at a predetermined time in the main server and transmitted to the user client, and the first unique logic stored in the user client may be changed to the second unique logic. And synchronizing the first unique logic and the second unique logic.
  • the second unique logic may include one or more first unique logics and a second unique logic including respective unique logic change code numbers in the user client and the main server.
  • the first unique logic and the second unique logic are changed at preset time intervals, but the first unique logic change code is transmitted to the user client so that the second unique logic of the main server matches the first unique logic of the user client. It is characterized by that.
  • the user client may search for all SMS messages or MMS messages received by the user client, search for a specific code included in the SMS message or MMS message, and, if the specific code is confirmed, classify it as a confirmation OTP.
  • OTPN OTP NUMBER; hereinafter OTPN
  • OTPN OTP NUMBER
  • OTP ONE TIME PASSWORD
  • OTP ONE TIME PASSWORD
  • hackers Intercepts OTP in the middle through a malicious app, but even if the user authenticates, such as micropayment or adult authentication, the modified OTP cannot be sent to the main server, so there is no risk of leaking the authentication number. It can provide a text message security system and method.
  • the unique logic to change the OTP in real time checks and changes at regular intervals, there is provided a text message security system and method for preventing identity theft and smishing of the mobile phone without any risk of leakage of the unique logic. can do.
  • every client terminal is given a unique logic for converting the confirmation OTP to the answer OTP and periodically check whether or not the installation of the duplicated app installed through the hacking method in a way that interlocks with the main server in real time. It can provide a text message security system and method for preventing theft of the mobile phone identity authentication and smishing to significantly increase the security through such methods.
  • FIG. 1 is a block diagram illustrating a text message security system and method for preventing mobile phone identity authentication and smishing according to a first embodiment of the present invention.
  • FIGS. 2 to 3 are exemplary views showing a text message security system and method for preventing mobile phone identity authentication and smishing according to a first embodiment of the present invention.
  • Figure 4 is a block diagram showing a text message security system and method for preventing mobile phone identity authentication and smishing according to a second embodiment of the present invention
  • 5 to 6 is an exemplary view showing a text message security system and method for preventing theft of the mobile phone identity authentication and smishing according to a second embodiment of the present invention
  • FIG. 7 is a flowchart illustrating a text message security system and method for preventing mobile phone identity authentication and smishing according to a first embodiment of the present invention.
  • FIG. 8 is a flowchart illustrating a text message security system and method for preventing mobile phone identity theft and smishing according to a second embodiment of the present invention.
  • the present invention is a text message security system and method for preventing identity theft and smishing of mobile phones, and is for a personal authentication and micropayment security system that performs personal authentication and micropayment through the user terminal 100.
  • Authentication SMS which is a means of two-channel authentication, is transmitted through the communication company's SMS closed network, which is much more secure than the open network of the Internet, and is a feature phone connected only to a closed communication network instead of a PC exposed to various malware and virus programs. It was a secure means of two-channel authentication by receiving and confirming through.
  • FIG. 1 is a block diagram showing a text message security system and method for preventing cell phone identity theft and smishing according to a first embodiment of the present invention
  • Figures 2 to 3 are according to a first embodiment of the present invention. It is an exemplary view showing a text message security system and method for preventing theft and smishing of cell phone authentication.
  • the first embodiment of the present invention text message security system and method for preventing the identity of the mobile phone identity theft smisting, the user terminal 100, the user client 200, the agent server ( 300 and the main server 400.
  • the user terminal 100 and the user client 200 will generally be a portable terminal such as a mobile phone terminal, a smart phone terminal, a PDA terminal, a navigation terminal, but is not limited thereto. That is, regardless of the type of a terminal such as a user's personal computer, an Internet TV, and the like, if the main server 400 and the agent server 300 can communicate in a wired or wireless manner, they may be used as the user terminal and the user client 200. .
  • the user client 200 is preferably a recording medium recorded in the terminal corresponding to the MDN (MOBILE DIRECTORY NUMBER) included in the authentication request signal, the MDN may correspond to the terminal 100 of the user It is desirable to have.
  • MDN MOBILE DIRECTORY NUMBER
  • the user terminal 100 includes an authentication request signal generator 110 and a first communication unit 120.
  • the authentication request signal generation unit 110 generates an authentication request signal.
  • the authentication request signal is preferably generated in all cases requiring user's authentication, such as micropayment and identity verification.
  • micropayment or identity verification when the user proceeds with micropayment or identity verification, if the user clicks the micropayment or identity verification progress button displayed on the user terminal 100, MDN and required personal identification elements (resident number, account number, etc.) necessary for the identity verification procedure ), An authentication request signal containing the entered MDN and required personal identification elements is generated.
  • the first communication unit 120 transmits the authentication request signal to the agent server 300 and receives the approval information and the rejection information from the agent server 300.
  • the approval information and rejection information is preferably transmitted to the user terminal and displayed on the screen, but is transmitted in the form of an SMS message or MMS message transmitted to the MDN included in the authentication request signal or transmitted in the form of data through the Internet network. It is preferable.
  • the user client 200 includes a confirmation OTP detector 210 and a second communication unit 230.
  • the user client 200 is preferably a recording medium recorded in the user terminal 100 or another terminal of the user corresponding to the MDN included in the authentication request signal.
  • the confirmation OTP detection unit 210 detects the confirmation OTP (ONE TIME PASSWORD; hereinafter OTP) received from the main server 400.
  • the user client 200 searches for all received MMS or SMS to detect the confirmation OTP. do.
  • the second communication unit 230 receives the confirmation OTP from the answer OTP generation unit 220 and the main server 400 to generate the response OTP by substituting the detected confirmation OTP into the first unique logic and answer OTP. To the main server 400.
  • the verification OTP is converted into the first unique logic to generate the answer OTP
  • 'OK' and 'deny' are displayed as icons on the screen of the user client 200, and the user clicks 'OK'. If a check OTP is assigned to the first unique logic, the answer OTP is generated and converted, and if the user clicks 'decline', the answer OTP is not generated.
  • the OTPN of the detected confirmation OTP OTP NUMBER; hereinafter OTPN
  • the answer OTP is preferably 654321.
  • the second unique logic is generated at a predetermined time in the main server 400 and transmitted to the user client 200, and the first unique logic stored in the user client 200 is changed to the second unique logic to generate the second unique logic.
  • the first unique logic and the second unique logic is characterized in that the synchronization.
  • At least one second unique logic stored in the main server is stored with a different second unique logic for each user client 200, and the first unique logic of each user client 200 is different from each other. desirable.
  • the smashing of the hacker to intercept the authentication SMS (OTP) received by installing a malicious app on the user's mobile phone can be prevented at the source.
  • the security system according to the present invention is not a method in which authentication or payment is completed even if the authentication SMS (OTP) stolen by the hacker is input into the authentication window or payment window of the user terminal.
  • the security system inputs an authentication SMS (confirmation OTP) converted by the unique logic into the authentication window or the payment window of the user terminal 100 (second embodiment) or the user client 200 This is because the authentication or payment is completed by transmitting the response OTP converted by the intrinsic logic to the main server 400 only when the user presses the approval button output to the recorded terminal.
  • an authentication SMS confirmation OTP
  • the security or payment is completed by transmitting the response OTP converted by the intrinsic logic to the main server 400 only when the user presses the approval button output to the recorded terminal.
  • the first unique logic and the second unique logic is stored in the user client 200 and the main server 400, one or more first unique logic and the second unique logic including the unique logic change code number
  • the main server 400 may change the first unique logic and the second unique logic at predetermined time intervals, and transmit the first unique logic change code to the user client 200 to transmit the first unique logic change code. It is characterized in that the two unique logic and the first unique logic of the user client 200 to match.
  • the confirmation OTP is always changed to the answer OTP through the first unique logic and the second unique logic of the main server 400 and the user client 200, and the first By always changing and synchronizing the intrinsic logic and the second inherent logic, it prevents damage.
  • the hacker will be able to smash only when the user client 200 uses a new smishing technique that hacks the answer OTP converted by the unique logic of the security system according to the present invention used in the recorded terminal.
  • OTP authentication SMS
  • the unique logic of the security system according to the present invention is in the form of a user client 200 app and will be installed with the security level of each bank app currently being used in a smartphone, a new constraint of hacking a bank app will occur.
  • the security system provides a unique logic for converting the confirmation OTP to the answer OTP for each terminal recorded by the user client 200, and change the unique logic at any time in a way that works with the main server 400 in real time or hacks. It can be said that the security has been dramatically increased by periodically checking whether the installed duplicated app is installed through the system.
  • the unique logic of the present invention is not only periodically changed, but whether or not there is a replication app for hacking in real time with the main server 400. Since the hackers must continue to hack the terminal itself for smishing, but at the same time, the constraint that the system avoids the duplicate app check system by the main server occurs.
  • the user client 200 searches all SMS messages or MMS messages received by the user client 200 to search for a specific code included in the SMS message or MMS message, and if the specific code is confirmed, classifies it as a confirmation OTP.
  • OTPN OTP NUMBER; hereinafter OTPN
  • the confirmation OTP is detected, and the OTPN is substituted into the first unique logic, and the converted OTPN is included in the answer OTP.
  • the agent server 300 includes a confirmation OTP generation unit 310 and a third communication unit 320.
  • the confirmation OTP generation unit 310 confirms the authentication request signal and generates a confirmation OTP corresponding to the MDN through the MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal.
  • MDN MOBILE DIRECTORY NUMBER
  • the confirmation OTP is preferably generated in arbitrary numbers according to the received authentication request signal.
  • the third communication unit 320 receives the authentication request signal from the user terminal 100, transmits the confirmation OTP to the main server 400, receives the approval information or rejection information from the main server 400, and receives the main server 400. Authorization information or rejection information received from the user terminal 100 is transmitted.
  • the main server 400 includes a match check unit 410, a fourth communication unit 420, a main DB 430, and an MDN information check unit 440.
  • the confirmation OTP received by the main server 400 is 123456 and the second unique logic stored in the main server 400 changes the first and sixth digits, the second and fifth digits, the third and fourth digits,
  • the verification OTP converted by the server 400 is 654321, and it is preferable to check whether the matching OTP is matched by comparing the received OTP value with 654321.
  • the received answer OTP was 654321 and generated through the first unique logic that changes the first and sixth digits, the second and fifth digits, the third and fourth digits, it is confirmed that the confirmation OTP is 123456, It is also preferable that the confirmed confirmation OTP matches with the confirmation OTP received from the agent server 300.
  • the fourth communication unit 420 transmits the confirmation OTP received from the agent to the user client 200, receives the response OTP from the user client 200, and transmits the approval information or rejection information to the agent server 300. .
  • the main DB 430 stores MDNs of one or more user clients 200 installed with a client application for converting the confirmation OTP to the answer OTP through the first unique logic.
  • the MDN information check unit 440 when receiving the confirmation OTP and the authentication request signal from the agent server 300, one or more user client with a client application that is previously stored in the main DB (430) MDN included in the authentication request signal In comparison with the MDN of 200, when transmitting the confirmation OTP to the user client 200, the specific client code 200 is transmitted to the user client 200 belonging to the MDN, and the specific code is transmitted to the user client 200 not belonging to the MDN. Send without including.
  • the MDN included in the authentication request signal of the authentication OTP received from the agent server 300 is included in the main DB 430, it is transmitted by including the specific code in the confirmation OTP, and if not included, the specific code. It is preferable not to include it.
  • All of the first communication unit 120 to the fourth communication unit 420 are wirelessly or wired and preferably transmit and receive to each other.
  • FIGS. 5 to 6 are views according to the second embodiment of the present invention. It is an exemplary view showing a text message security system and method for preventing theft and smishing of cell phone authentication.
  • the second embodiment of the present invention text message security system and method for preventing identity theft and smishing of the mobile phone, the user terminal 100, the user client 200, the agent server ( 300 and the main server 400.
  • the user terminal 100 includes an authentication request signal generation unit 110, a first communication unit 120, and a response OTP input unit 130.
  • the first communication unit 120 transmits the authentication request signal and the input response OTP to the agent server 300, and receives the approval information and the rejection information from the agent server 300.
  • the answer OTP input unit 130 outputs an answer OTP input window to the output unit and receives an answer OTP (ONE TIME PASSWORD; hereinafter OTP) from the user.
  • OTP ONE TIME PASSWORD
  • the user checks the answer OTP output from the answer OTP output 230 of the user client 200, writes the answer OTP in the reply OTP input window output to the user terminal, and sends it to the agent server.
  • the user client 200 includes a confirmation OTP detector 210, an answer OTP generator 220, and an answer OTP output unit 230.
  • the confirmation OTP detection unit 210 detects the confirmation OTP received from the main server 400.
  • the answer OTP generator 220 substitutes the detected confirmation OTP into the first unique logic to generate the answer OTP.
  • the answer OTP output unit 230 outputs the answer OTP generated by the answer OTP generator.
  • the second unique logic is generated at a predetermined time in the main server 400 and transmitted to the user client 200, and the first unique logic stored in the user client 200 is changed to the second unique logic to generate the second unique logic.
  • the first unique logic and the second unique logic is characterized in that the synchronization.
  • the first unique logic and the second unique logic is stored in the user client 200 and the main server 400, one or more first unique logic and the second unique logic including the unique logic change code number
  • the main server 400 may change the first unique logic and the second unique logic at predetermined time intervals, and transmit the first unique logic change code to the user client 200 to transmit the first unique logic change code. It is characterized in that the two unique logic and the first unique logic of the user client 200 to match.
  • the answer OTP output unit 240 outputs the answer OTP generated by the second communication unit 230 and the answer OTP generation unit 220 receiving the confirmation OTP from the main server 400.
  • the user client 200 searches all SMS messages or MMS messages received by the user client 200 to search for a specific code included in the SMS message or MMS message, and if the specific code is confirmed, classifies it as a confirmation OTP.
  • OTPN OTP NUMBER; hereinafter OTPN
  • the confirmation OTP is detected, and the OTPN is substituted into the first unique logic, and the converted OTPN is included in the answer OTP.
  • the agent server 300 includes a confirmation OTP generation unit 310 and a third communication unit 320.
  • Confirmation OTP generation unit 310 confirms the authentication request signal, and generates a confirmation OTP corresponding to the MDN through the MDN (MOBILE DIRECTORY NUMBER; MDN) included in the authentication request signal.
  • MDN MOBILE DIRECTORY NUMBER
  • the third communication unit 320 receives the authentication request signal and response OTP from the user terminal, transmits the confirmation OTP and the response OTP to the main server 400, receives the approval information or the rejection information from the main server 400, and receives the main server.
  • the approval information or rejection information received from the 400 is transmitted to the user terminal 100.
  • the main server 400 includes a match check unit 410, a fourth communication unit 420, a main DB 430, and an MDN information check unit 440.
  • the confirmation OTP received from the agent server 300 is converted by the second unique logic, and the acknowledgment OTP is compared with the response OTP received from the user client 200 to determine whether there is a match. If information is generated and disagreements are generated, rejection information is generated.
  • the fourth communication unit 420 transmits the confirmation OTP received from the agent to the user client 200, receives the response OTP from the agent server 300, and transmits the approval information or rejection information to the agent server 300.
  • the main DB 430 stores MDNs of one or more user clients 200 installed with a client application for converting the confirmation OTP to the answer OTP through the first unique logic.
  • the MDN information check unit 440 when receiving the confirmation OTP and the authentication request signal from the agent server 300, one or more user client with a client application that is previously stored in the main DB (430) MDN included in the authentication request signal In comparison with the MDN of 200, when transmitting the confirmation OTP to the user client 200, the specific client code 200 is transmitted to the user client 200 belonging to the MDN, and the specific code is transmitted to the user client 200 not belonging to the MDN. It is characterized in that the transmission without including.
  • FIG. 7 is a flowchart illustrating a text message security system and method for preventing mobile phone identity authentication and smishing according to a first embodiment of the present invention.
  • the first embodiment of the present invention provides a text message security system and method for preventing identity theft and smishing of a mobile phone, and a user terminal generates an authentication request signal and transmits it to an agent server 300. (S110).
  • the agent server 300 confirms the authentication request signal received from the user terminal, and MOT (MOBILE DIRECTORY NUMBER; hereinafter MDN) included in the authentication request signal to confirm the MOT corresponding to the MOTOT (ONE TIME PASSWORD; hereinafter) OTP) to generate an authentication request signal and confirmation OTP to the main server 400 (S120).
  • MOT MOBILE DIRECTORY NUMBER; hereinafter MDN
  • MOTOT ONE TIME PASSWORD; hereinafter
  • the main server 400 receives the authentication request signal and the confirmation OTP, and transmits the confirmation OTP to the user client 200 with the MDN included in the authentication request signal (S130).
  • the user client 200 detects the confirmation OTP received from the main server 400 (S140).
  • the user client 200 substitutes the detected confirmation OTP into the first unique logic to generate a reply OTP (S150).
  • the verification OTP is converted into the first unique logic to generate the answer OTP
  • 'OK' and 'deny' are displayed as icons on the screen of the user client 200, and the user clicks 'OK'. If a check OTP is assigned to the first unique logic, the answer OTP is generated and converted, and if the user clicks 'decline', the answer OTP is not generated.
  • the user client 200 transmits the answer OTP to the main server 400 (S160).
  • the main server 400 converts the received confirmation OTP by the second unique logic, and compares the received confirmation OTP with the received answer OTP to determine whether or not it matches (S170).
  • the main server 400 compares the converted OTP and the received OTP to determine whether there is a match, and if it matches, generates approval information and sends it to the agent server.
  • the agent server 300 transmits the approval information or the rejection information received from the main server 400 to the user terminal (S180).
  • FIG. 8 is a flowchart illustrating a text message security system and method for preventing mobile phone identity theft and smishing according to a second embodiment of the present invention.
  • the second embodiment of the present invention provides a text message security system and method for preventing identity theft and smishing of a mobile phone, and a user terminal generates an authentication request signal and transmits it to an agent server 300. (S210).
  • the agent server 300 confirms the authentication request signal received from the user terminal, and MOT (MOBILE DIRECTORY NUMBER; hereinafter MDN) included in the authentication request signal confirmation OTP corresponding to MDN (ONE TIME PASSWORD; hereinafter) OTP) to generate an authentication request signal and confirmation OTP to the main server 400 (S220).
  • MOT MOBILE DIRECTORY NUMBER; hereinafter MDN
  • OTP OTP
  • the main server 400 receives the authentication request signal and the confirmation OTP, and transmits the confirmation OTP to the user client 200 by using the received confirmation OTP as the MDN included in the authentication request signal (S230).
  • the user client 200 detects the confirmation OTP received from the main server 400 (S240).
  • the user client 200 substitutes the detected confirmation OTP into the first unique logic to generate an answer OTP (S250).
  • the answer OTP generated by the user client 200 is output, and the output answer OTP is input to the answer OTP input window output to the user terminal 100 (S260).
  • the user terminal 100 transmits the answer OTP input in the answer OTP input window to the agent server 300, and the agent server 300 transmits the answer OTP to the main server 400 (S270).
  • the main server 400 converts the acknowledgment OTP received by the main server by the second unique logic, and compares the acknowledgment OTP and the received answer OTP to determine whether the main server 400 matches (S280).
  • Agent server 300 transmits the approval information or rejection information received from the main server 400 to the user terminal (S290).
  • OK OTP generation unit 320 third communication unit
  • fourth communication unit 430 main DB

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Telephonic Communication Services (AREA)

Abstract

Selon les caractéristiques de la présente invention, la présente invention concerne un système et un procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par SMS. Un système d'authentification utilisateur et de micropaiement permettant d'exécuter une authentification utilisateur et un micropaiement par l'intermédiaire d'un terminal utilisateur comprend les étapes suivantes : le terminal utilisateur comporte une unité de génération de signal de requête d'authentification destinée à générer un signal de requête d'authentification et une première unité de communication destinée à transmettre le signal de requête d'authentification à un serveur agent et à recevoir des informations d'acceptation et des informations de rejet à partir du serveur agent ; un client utilisateur comporte une unité de détection de mot de passe à utilisation unique (OTP) d'identification destinée à détecter un OTP d'identification reçu à partir d'un serveur principal, une unité de génération d'OTP de réponse destinée à générer un OTP de réponse en substituant l'OTP d'identification détecté en une première logique unique pour convertir la première logique unique, et une deuxième unité de communication destinée à recevoir l'OTP d'identification à partir du serveur principal et à transmettre l'OTP de réponse au serveur principal ; le serveur agent comporte une unité de génération d'OTP d'identification destinée à identifier le signal de requête d'authentification et à générer un OTP d'identification correspondant à un numéro d'abonné mobile (MDN) par l'intermédiaire du MDN inclus dans le signal de requête d'authentification, et une troisième unité de communication destinée à recevoir le signal de requête d'authentification à partir du terminal utilisateur, transmettre l'OTP d'identification au serveur principal, recevoir des informations d'acceptation ou des informations de rejet à partir du serveur principal, et transmettre les informations d'acceptation ou les informations de rejet reçues à partir du serveur principal au terminal utilisateur ; et le serveur principal comporte une unité d'identification de comparaison destinée à convertir l'OTP d'identification reçu à partir du serveur agent par une deuxième logique unique, comparer l'OTP d'identification converti à l'OTP de réponse reçu à partir du client utilisateur pour déterminer s'ils correspondent, générer des informations d'acceptation lorsqu'ils correspondent, et générer des informations de rejet lorsqu'ils ne correspondent pas, et une quatrième unité de communication destinée à transmettre l'OTP d'identification reçu à partir du serveur agent au client utilisateur, recevoir l'OTP de réponse à partir du client utilisateur, et transmettre les informations d'acceptation ou les informations de rejet au serveur agent. Selon la présente invention, comme le client utilisateur reçoit un OTP, modifie l'OTP reçu par l'intermédiaire d'une logique unique prédéfinie, et transmet l'OTP modifié au serveur principal, afin de mettre en oeuvre une authentification utilisateur par l'intermédiaire de l'OTP modifié, même si un pirate informatique intercepte l'OTP au moyen d'une application malveillante pour exécuter un micropaiement ou une authentification utilisateur telle qu'une authentification adulte, le pirate informatique ne peut pas transmettre l'OTP modifié au serveur principal. En conséquence, la présente invention peut fournir un système et un procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher un hameçonnage par SMS sans risque de divulguer un numéro d'authentification.
PCT/KR2014/007331 2013-08-19 2014-08-07 Système et procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par sms Ceased WO2015026083A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR1020130097595A KR101339723B1 (ko) 2013-08-19 2013-08-19 휴대폰 본인인증 도용방지와 스미싱 방지를 위한 문자메시지 보안시스템 및 방법
KR10-2013-0097595 2013-08-19

Publications (1)

Publication Number Publication Date
WO2015026083A1 true WO2015026083A1 (fr) 2015-02-26

Family

ID=49987928

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2014/007331 Ceased WO2015026083A1 (fr) 2013-08-19 2014-08-07 Système et procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par sms

Country Status (2)

Country Link
KR (1) KR101339723B1 (fr)
WO (1) WO2015026083A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105844144A (zh) * 2016-03-23 2016-08-10 惠州Tcl移动通信有限公司 一种基于触摸屏的移动终端输入检测方法及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101358375B1 (ko) 2013-12-04 2014-02-11 주식회사 벨소프트 스미싱 방지를 위한 문자메시지 보안 시스템 및 방법
WO2019031715A1 (fr) * 2017-08-09 2019-02-14 주식회사 센스톤 Système, procédé et programme de commande fondés sur un code virtuel, dispositif de commande et moyen de génération de signal de commande
KR101978812B1 (ko) 2017-08-09 2019-05-15 주식회사 센스톤 가상카드번호 기반의 금융거래제공시스템, 가상카드번호생성장치, 가상카드번호검증장치, 가상카드번호 기반의 금융거래제공방법 및 가상카드번호 기반의 금융거래제공프로그램

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100751428B1 (ko) * 2006-01-16 2007-08-23 (주)에이티솔루션 일회용 비밀번호 생성방법과 일회용 비밀번호 인증 시스템
KR20090108501A (ko) * 2008-04-11 2009-10-15 박현원 무결성코드를 포함하는 일회용암호 기반의 인증방법과 그시스템
US20110270751A1 (en) * 2009-12-14 2011-11-03 Andrew Csinger Electronic commerce system and system and method for establishing a trusted session
KR20120023265A (ko) * 2010-09-01 2012-03-13 한국전자통신연구원 유무선 인터넷 환경에서 다중 인터페이스 사용자 단말을 이용하여 안전한 결제를 수행하기 위한 클라이언트/서버 기반 고신뢰 세션을 제어하는 네트워크 관리 방법
KR20120079044A (ko) * 2012-05-29 2012-07-11 주식회사 비즈모델라인 모바일 일회용코드를 이용한 금융거래 제공 시스템
US20130159195A1 (en) * 2011-12-16 2013-06-20 Rawllin International Inc. Authentication of devices

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20070077569A (ko) * 2006-01-24 2007-07-27 삼성전자주식회사 휴대폰을 이용한 일회용 패스워드 서비스 시스템 및 방법
KR101214864B1 (ko) * 2010-09-29 2012-12-28 김진우 네트웍 스토리지를 이용한 컨텐츠 다운로드 방법

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100751428B1 (ko) * 2006-01-16 2007-08-23 (주)에이티솔루션 일회용 비밀번호 생성방법과 일회용 비밀번호 인증 시스템
KR20090108501A (ko) * 2008-04-11 2009-10-15 박현원 무결성코드를 포함하는 일회용암호 기반의 인증방법과 그시스템
US20110270751A1 (en) * 2009-12-14 2011-11-03 Andrew Csinger Electronic commerce system and system and method for establishing a trusted session
KR20120023265A (ko) * 2010-09-01 2012-03-13 한국전자통신연구원 유무선 인터넷 환경에서 다중 인터페이스 사용자 단말을 이용하여 안전한 결제를 수행하기 위한 클라이언트/서버 기반 고신뢰 세션을 제어하는 네트워크 관리 방법
US20130159195A1 (en) * 2011-12-16 2013-06-20 Rawllin International Inc. Authentication of devices
KR20120079044A (ko) * 2012-05-29 2012-07-11 주식회사 비즈모델라인 모바일 일회용코드를 이용한 금융거래 제공 시스템

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105844144A (zh) * 2016-03-23 2016-08-10 惠州Tcl移动通信有限公司 一种基于触摸屏的移动终端输入检测方法及系统

Also Published As

Publication number Publication date
KR101339723B1 (ko) 2013-12-10

Similar Documents

Publication Publication Date Title
WO2020050424A1 (fr) SYSTÈME ET PROCÉDÉ BASÉS SUR UNE CHAÎNE DE BLOCS POUR UNE AUTHENTIFICATION DE SÉCURITÉ MULTIPLE ENTRE UN TERMINAL MOBILE ET UN DISPOSITIF D'IdO
WO2015093734A1 (fr) Système et procédé d'authentification utilisant un code qr
WO2018012747A1 (fr) Système mandataire d'authentification à deux canaux permettant de détecter l'altération frauduleuse d'une application et procédé associé
WO2017188610A1 (fr) Procédé et système d'authentification
WO2017119548A1 (fr) Procédé d'authentification d'utilisateur à sécurité renforcée
WO2018008800A1 (fr) Système d'authentification de certificat accrédité basé sur une chaîne de blocs, et procédé d'authentification de certificat accrédité basé sur une chaîne de blocs, utilisant ce système
WO2020189926A1 (fr) Procédé et serveur permettant de gérer une identité d'utilisateur en utilisant un réseau à chaîne de blocs, et procédé et terminal d'authentification d'utilisateur utilisant l'identité d'utilisateur basée sur un réseau à chaîne de blocs
WO2015126037A1 (fr) Système et procédé d'identification personnelle et antivol utilisant une clé aléatoire jetable
WO2014104507A1 (fr) Système et procédé d'ouverture de session sécurisée et appareil correspondant
WO2017171165A1 (fr) Système d'émission de certificat public en fonction d'une chaîne de blocs et procédé d'émission de certificat public en fonction d'une chaîne de blocs utilisant ledit système
WO2013025060A2 (fr) Dispositif et procédé pour l'authentification de sécurité entre dispositifs basée sur une puf lors de la communication entre machines
WO2014175538A1 (fr) Appareil permettant d'utiliser un otp matériel basé sur puf et procédé permettant une authentification à 2 facteurs l'utilisant
WO2014030911A1 (fr) Appareil et procédé pour le traitement de données d'authentification
WO2019027139A1 (fr) Procédé d'authentification d'utilisateur à auto-vérification basé sur une chaîne de blocs dépendant du temps
WO2015069018A1 (fr) Système d'ouverture de session sécurisée et procédé et appareil pour celui-ci
WO2019039865A1 (fr) Terminal d'authentification, dispositif d'authentification et procédé et système d'authentification utilisant un terminal d'authentification et un dispositif d'authentification
WO2020091525A1 (fr) Procédé de paiement à l'aide d'une authentification biométrique et dispositif électronique associé
WO2020235733A1 (fr) Dispositif et procédé permettant d'authentifier un utilisateur et d'obtenir une signature d'utilisateur grâce à la biométrie de l'utilisateur
WO2014148854A1 (fr) Système et procédé pour la confirmation de la légitimité d'un message d'authentification
WO2021071116A1 (fr) Procédé et système d'authentification simple au moyen d'un stockage web d'un navigateur
WO2015026083A1 (fr) Système et procédé de sécurisation de message texte permettant d'empêcher l'utilisation illégale d'une authentification utilisateur par un téléphone mobile et d'empêcher le hameçonnage par sms
WO2022211436A1 (fr) Procédés, dispositif de point d'accès et dispositif de station pour réseau de point d'accès wi-fi fermé
WO2021080316A1 (fr) Procédé et dispositif permettant d'effectuer une commande d'accès en utilisant un certificat d'authentification sur la base d'informations d'autorité
WO2020032351A1 (fr) Procédé permettant d'établir une identité numérique anonyme
WO2020122368A1 (fr) Système et procédé de sécurisation et de gestion de données dans un dispositif de stockage au moyen d'un terminal sécurisé

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14838043

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14838043

Country of ref document: EP

Kind code of ref document: A1