WO2018128237A1 - Identity authentication system and user equipment utilizing user usage pattern analysis - Google Patents

Abstract

An identity authentication system and user equipment utilizing user usage pattern analysis are disclosed. An identity authentication user equipment utilizing user usage pattern analysis according to an embodiment of the present invention can comprise: a usage pattern collection unit for collecting a user's usage pattern with respect to a user equipment; a usage pattern analysis unit for analyzing the usage pattern and determining whether or not the usage pattern is normal; and an authentication level adjustment unit for adjusting an identity authentication level in accordance with a determination result.

Description

User authentication system and user terminal using analysis of user usage pattern

The present invention relates to a user authentication system and a user terminal using analysis of a usage pattern of a user.

With the development of IT technology such as electronic devices and telecommunications, various business processes are made electronically, and financial transactions such as commerce and insurance contracts and account opening such as purchase and sale are also made electronically.

Accordingly, various methods for non-face-to-face identity verification have been studied. Most commonly, a variety of methods are emerging from simple methods of inputting ID and password to methods utilizing various biometric and behavioral authentication such as fingerprint, handwritten signature, and face recognition.

In this regard, Korean Patent Laid-Open No. 10-2015-0096063 (published Aug. 24, 2015) discloses an authentication apparatus and method based on a digital signature.

According to the results of analyzing the usage pattern for the user terminal, such as a smart phone, the present invention is determined to be in possession of the person as usual, and lowers the level of authentication. It is to provide a user authentication system and a user terminal utilizing analysis of a user's usage pattern that can secure the improved accuracy with the ease of authentication.

Other objects of the present invention will become more apparent through the preferred embodiments described below.

According to an aspect of the present invention, a usage pattern collecting unit for collecting a usage pattern for the user terminal of the user; A usage pattern analyzer for analyzing whether the usage pattern is normal or not; According to the determination result, an authentication user terminal using an analysis of a usage pattern of a user, including an authentication level adjustment unit for adjusting an authentication level, is provided.

The usage pattern relates to the location of the user terminal, and at the specific time point, the usage pattern analysis unit according to a result of comparing at least one of GPS information of the user terminal and identification information of the Wi-Fi router connected to the user terminal. It is possible to determine whether it is normal.

The usage pattern relates to the call history through the user terminal, and primarily determines whether the use pattern analysis unit is normal according to a result of analyzing the call counterpart and the call time, and if necessary, According to a result of whether or not the result of STT conversion of the voice includes the designated follow-up for the user, the use pattern analyzer may determine whether it is normal.

The usage pattern relates to the details of SNS usage, and primarily determines whether the usage pattern analysis unit is normal according to a result of analyzing the SNS chat partner and the chat time, and if necessary, a specific emoticon designated for the user. The pattern analysis unit may determine whether the input pattern is normal by analyzing the input deleted by the backspace when the backspace is input or when the character is input. have.

The usage pattern may include at least one of a location of the user terminal, a call history through the user terminal, an SNS usage history, and an application occupancy rate of the application, and the usage pattern analyzer may determine whether it is normal through an OR condition calculation. .

The authentication level adjusting unit may set the authentication level relatively low when the usage pattern is analyzed as normal, and set the authentication level relatively high when the usage pattern is analyzed as abnormal.

The authentication level adjustment unit may include a message transmission unit for transmitting the authentication level adjusted in the form of a message.

The apparatus may further include a key registration unit that registers a private key paired with a public key to be registered in a message authentication server to the user terminal, wherein the message transmission unit encrypts the authentication level message with the private key and transmits the private key to the web server.

On the other hand, according to another aspect of the present invention, a user terminal for collecting and analyzing a user's usage pattern and transmitting a user authentication level message encrypted with a private key of the authentication level adjusted according to whether the usage pattern is normal; A web server configured to receive the encrypted identity authentication level message and perform login for each level according to the identity authentication level included in the identity authentication level message only when message authentication of the identity authentication level message is successful; And a public key corresponding to the private key is registered, decrypts the encrypted user authentication level message with the public key according to a message authentication request from the web server, performs message authentication, and transmits an authentication result to the web server. Provided is a user authentication system utilizing a user pattern analysis, including a message authentication server.

The message authentication server may transmit a message authentication success as the authentication result when the decryption is successful with the public key, and transmit a message authentication failure as the authentication result when decryption with the public key fails.

The message authentication server may transmit the decrypted identity authentication message to the web server in the case of successful message authentication.

The web server may log in by checking only n items, such as handwritten signature, iris recognition, fingerprint authentication, and password input, corresponding to the user authentication level.

Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

According to an embodiment of the present invention, according to a result of analyzing a usage pattern for a user terminal such as a smart phone, if it is the same as usual, it is determined as the possession state of the user and lowers the level of authentication of the person, and if it is different from the usual, Increasing the level of authentication has the effect of simplifying identity verification and ensuring improved accuracy.

1 is a schematic configuration block diagram of a user terminal for user authentication using analysis of a user's usage pattern according to an embodiment of the present invention;

2 is a flow chart of a user authentication method performed in the user terminal of FIG.

3 is a schematic block diagram of a user authentication system using a user pattern analysis according to an embodiment of the present invention and a flow chart of a user authentication method;

4 is a schematic structural block diagram of a financial server included in a personal authentication system;

5 is a schematic structural block diagram of a message authentication server included in a user authentication system.

As the present invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. As used herein, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described on the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

In addition, the components of the embodiments described with reference to the drawings are not limited to the corresponding embodiments, and may be implemented to be included in other embodiments within the scope of the technical spirit of the present invention. Even if the description is omitted, it is obvious that a plurality of embodiments may be reimplemented into one integrated embodiment.

In addition, in the description with reference to the accompanying drawings, the same components regardless of reference numerals will be given the same or related reference numerals and redundant description thereof will be omitted. In the following description of the present invention, if it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

FIG. 1 is a schematic block diagram of a user terminal for user authentication using analysis of a usage pattern of a user according to an embodiment of the present invention, and FIG. 2 is a flowchart of a user authentication method performed in the user terminal of FIG. .

The user terminal 100 for the user authentication using the analysis of the use pattern of the user according to an embodiment of the present invention collects and analyzes the use pattern of the user to determine whether the user possesses the user according to the degree similar to the pattern normally used by the user. It is characterized in that it is possible to adjust the level of identity authentication in the situation where the identity verification is required.

The user terminal 100 for identity verification according to the present embodiment includes a usage pattern collector 110, a usage pattern analyzer 120, and an authentication level adjuster 130. The use pattern collector 110, the use pattern analyzer 120, and the authentication level adjuster 130 may be implemented as software in an application form installed in the user terminal 100 such as a smartphone.

The usage pattern collecting unit 110 collects information on the usage pattern of the user using the user terminal 100 (step S10). The usage pattern collection may be limited to within a predetermined time (for example, 3 hours) from the present time. This is because there may be difficulty in grasping the latest state of the user terminal 100 by information collected in the past despite the change in the recent state of the user terminal 100 due to loss or the like.

The collection time of the usage pattern may be variously set according to at least one of a user attribute such as an age, a place of residence, and the like of the usage pattern.

The usage pattern to be collected may include at least one of location information of the user terminal, call information through the user terminal, social network service (SNS) usage information using the user terminal, and application usage share.

The usage pattern analyzer 120 analyzes the usage patterns collected by the usage pattern collector 110 to determine whether they are normal (step S15). The normal usage pattern means that the usage pattern is expected to be performed by a user designated for the user terminal 100.

The analysis when the usage pattern is location information of the user terminal is as follows.

If the designated user has the corresponding user terminal 100, it is determined whether the user terminal 100 is located at the location where the user is expected to be present.

For example, if the main location of the user is a home and a company, if the location information collected by the user terminal 100 is a home or a company set for the user, it is determined to be normal. It may be determined that the usage pattern of the user terminal is abnormal.

The location information of the user terminal may be used for analysis in association with time information. For example, if the location set for the user is a home or a company, the usage pattern is normal only when the user terminal is located at or near the company if the workday is a weekday (for example, 9:00 AM to 18:00 AM). If the location of the user terminal is at home despite the working hours on weekdays, it may be determined that the usage pattern is abnormal.

In the present embodiment, the location information of the user terminal used to analyze the usage pattern may be a GPS value. To this end, the usage pattern collector 110 may obtain location information of the user terminal from a GPS module separately provided in the user terminal 100.

Alternatively, the location information of the user terminal may be identification information of the Wi-Fi router connected to the corresponding user terminal 100. The GPS value described above indicates the correct location when the user terminal 100 is located outdoors, but cannot be utilized because the GPS signal is not received when the user terminal 100 is located outdoors. Therefore, it is possible to utilize the Wi-Fi (WiFi) communication that is used a lot in the user terminal 100, such as a smart phone.

In order to perform Wi-Fi communication, the user terminal needs to access a Wi-Fi router installed at an arbitrary location in the room, and the Wi-Fi router to be connected has identification information (eg, a Mac address) that can be distinguished from other Wi-Fi routers. In this case, when the identification information of the Wi-Fi router which is currently connected to the user terminal is one of the identification information of the Wi-Fi router having a previously accessed history registered in the database, it may be determined that the usage pattern of the user terminal is normal. However, when the identification information of the currently connected Wi-Fi router is compared with the identification information of the previously-connected Wi-Fi router registered in the database, when there is no identical information, the place where the user terminal has not been previously located As seen from, it may be determined that the usage pattern of the user terminal is abnormal.

Next, the analysis when the usage pattern is call information through the user terminal is as follows.

As a result of checking the latest call history of the user terminal, when it is analyzed that the user talks to the other party to which the user frequently talks, it may be determined that the usage pattern of the user terminal is normal. Here, the frequency of the call is designated by the user, or according to the result of analyzing the past history, the top few persons having a large number of calls may be set as a reference for determining the normal pattern when analyzing the usage pattern.

However, as a result of confirming the latest call history of the user terminal, when the user is not the first call or a frequent call partner compared with the past history registered in the database, it may be determined that the usage pattern of the user terminal is abnormal. In addition, as a result of analyzing the latest call history, even if the talk time with a specific counterpart is abnormally long or short compared to the past history registered in the database, it can be determined that the usage pattern of the user terminal is abnormal.

In addition, by analyzing the results of speech to text (STT) conversion of the voice of the latest call history of the user terminal, it may be determined whether the usage pattern of the user terminal is normal according to whether or not the speech corresponding to the user is included. .

Corresponding to a user is not only a keyword that is important for conversation through analysis of past call history registered in the database, but a distinctive feature that frequently appears more than a predetermined number of times for the user (e.g. ',' Ah ', etc.).

Next, the analysis when the usage pattern is the usage history of the SNS using the user terminal is as follows.

As a result of analyzing the contents of the recently used SNS in the user terminal, it is possible to determine whether the usage pattern of the user terminal is normal by analyzing who the SNS counterpart is and when the chat time is performed when chatting through the user terminal. . Based on the past history registered in the database, it may be determined whether the usage pattern is normal according to whether the person frequently chats at a predetermined threshold or more, or whether the chat time with the corresponding party is a normal chat time. .

In addition, when replying to the posts of the SNS, if there is a specific phrase or emoticon frequently used by the user, it may be determined that the usage pattern of the user terminal is normal.

Or, you can analyze previous input deleted by backspace when a backspace is entered to correct a typo while typing a character to chat or reply. If the deleted previous input is included in the typo data registered in the database corresponding to the user, it may be determined that the usage pattern of the user terminal is normal. The typo data may be a result of collecting a previous input deleted for a predetermined period of time according to the backspace input. This is based on the character input result that is frequently different for each user in the character input process.

Next, the analysis when the usage pattern is the application usage share of the user terminal is as follows.

By analyzing the usage share of recently executed applications in the user terminal, it may be determined that the usage pattern of the user terminal is normal when the user share has a similarity or more than a predetermined ratio. For example, applications that are frequently used for each user may be different, and even if the same applications are used, the usage time for each application may be different according to the user's inclination. Therefore, it is possible to estimate the propensity for the user of the user terminal from the type of applications used and the usage occupancy in recent years.

The usage pattern analyzer 120 may be used as a usage pattern for analyzing at least one of the above-described location of the user terminal, call history through the user terminal, SNS usage history, and usage share of the application. It is possible to determine whether it is normal through OR condition operation. That is, if at least one of the usage patterns is determined to be a normal pattern, the current user terminal is considered to be possessed by a normal user. This is because even a true user cannot satisfy a normal condition (a threshold value for making a normal pattern) at every moment, and if any one of the usage patterns satisfies the normal condition, it is sufficient to be determined as a true user.

The authentication level adjusting unit 130 may adjust the authentication level according to the result analyzed by the use pattern analyzer 120.

If the usage pattern is analyzed to be normal, the authentication level is set relatively low (step S20). If the usage pattern is analyzed to be abnormal, the authentication level is set relatively high (step S25).

The low level of identity verification means that if identity verification is required when running a particular application or performing a specific action within an application, it means that the identity verification requirements have been relaxed. For example, when there is a handwritten signature, iris recognition, fingerprint authentication, password input, etc. as a requirement for identity verification for financial transactions, the identity verification may be performed by checking only n or less of them.

In contrast, a high level of identity means that the identity verification requirement has been strengthened to verify at least n of the multiple identity requirements described above.

When an application requiring identity authentication is executed, the identity level adjusted by the authentication level adjusting unit 130 may be provided as an API (application platform interface). Alternatively, the authentication level may be transmitted in the form of a message to a web server such as a financial server to be described later.

In the present embodiment, the usage pattern collector 110 may process the collected usage patterns into a data format that is easy to analyze. In addition, the usage pattern collected by the usage pattern collector 110 may be stored in a database and used as a past history for future usage pattern analysis.

In addition, the usage pattern collector 110 may be activated and operate from time to time whenever the usage pattern occurs. In addition, the use pattern analysis unit 120 and the authentication level adjusting unit 130 may be activated and operate only when identity authentication is required.

Referring to the identity authentication process in the user terminal according to the embodiment as an example.

Smartphone users usually listen to music using the music app from 8:00 to 9 o'clock, and analyze the patterns such as socializing with friends during lunchtime, and suddenly use an app that they do not use. Or, if you see an abnormal pattern such as not using the music app at work, if you need to verify your identity, such as mobile banking by the judgment that you may not be able to use a stronger authentication means, but the pattern of the user In this case, you can finish the authentication by simple login.

For another example of the present invention. In the case of mobile banking, remittances with people who frequently trade can be made by a simple log-in by seeing a certain usage pattern, but in the case of a new person or a new account number, the usage pattern has been changed and must go through stronger security measures. It can be authenticated.

3 is a schematic block diagram of a user authentication system utilizing a user pattern analysis according to an embodiment of the present invention and a flow chart of a user authentication method, and FIG. 4 is a schematic diagram of a financial server included in a user authentication system. 5 is a schematic block diagram of a message authentication server included in an identity authentication system.

The user authentication system 1 utilizing the user pattern analysis according to the present embodiment uses the user authentication level required for login in a web server such as a financial server using the user authentication level message transmitted from the user terminal described above. It can apply differently according to a pattern. In this process, authentication of the authentication level message is additionally performed through message authentication through the message authentication server, thereby preventing errors in authentication due to possible problems such as hacking in the message transmission process.

The identity authentication system 1 according to the present embodiment includes a user terminal 100, a message authentication server 300, and a web server 200.

The user terminal 100 has been described with reference to FIG. 1 and may further include a key register 140 and a message transmitter 150 which are additional components for message transmission.

The web server 200 includes a message receiver 210, an authentication requester 220, an authentication result receiver 230, and a login performer 240 for each level. The message authentication server 300 includes a public key register 310. , The request receiving unit 320, the message authenticating unit 330, and the authentication result transmitting unit 340.

The key registration unit 140 generates and registers a paired private key and public key for security in the process of transmitting the authentication level adjusted by the authentication level adjusting unit 130 in the form of a message.

The private key generated by the key registration unit 140 is registered in the security area of the user terminal 100, and the public key is transmitted to the message authentication server 300, and the public key registration unit 310 in the message authentication server 300. It is registered (step S50).

The message transmitter 150 transmits the user authentication level adjusted by the authentication level adjusting unit 130 in the form of a message in order to deliver it to the web server 200 (step S55). The message transmission unit 150 may encrypt and transmit the authentication level message using the private key registered in the key registration unit 140.

The message receiving unit 210 of the web server 200 receives the identity authentication level message. At this time, the received authentication level message is encrypted with the private key and cannot be decrypted. Therefore, the authentication request unit 220 of the web server 200 requests authentication while transmitting the authentication level message received from the message authentication server 300 (step S60). The message authentication request may include a content request for decryption when the message is from a legitimate user terminal.

The request receiving unit 320 of the message authentication server 300 receives a message authentication request from the authentication requesting unit 220 of the web server 200, and in this case, the message authentication unit 330 performs message authentication (step S65). ).

The message authentication may be performed by using the public key registered in the message authentication server 300 to determine whether the user authentication level message encrypted with the private key can be decrypted.

If the public key registered in the message authentication server 300 is not decrypted, the private key used for encryption and the public key registered in the message authentication server 300 do not match each other, and the message does not come from a legitimate user terminal. It can be seen as. In this case, the authentication result transmitter 340 may transmit the authentication result due to the message authentication failure (step S70).

When decrypted with the public key registered in the message authentication server 300, the private key used for encryption and the public key registered in the message authentication server 300 are matched with each other. have. In this case, the authentication result transmitter 340 may transmit the authentication result with the successful message authentication. The decrypted identity authentication message can be sent along with the authentication result.

The authentication result receiver 230 of the web server 200 receives the authentication result from the message authentication server 300. If the received authentication result is a message authentication failure, the authentication level message itself may be regarded as a problem, and the login itself may be impossible.

If the received authentication result is a message authentication success level login performing unit 240 may be performed to log in by the level according to the decrypted identity authentication level message received with the authentication result (step S75).

If the authentication level is set relatively low, the user can log in through a simple authentication process. If the authentication level is set relatively high, the user can log in only through a stronger authentication process.

The degree of identity verification procedure for login according to the identity verification level may be set as needed.

The authentication method according to the present embodiment described above can be embodied as computer readable codes on a computer readable recording medium. Computer-readable recording media include all kinds of recording media having data stored thereon that can be decrypted by a computer system. For example, there may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, and the like. The computer readable recording medium can also be distributed over computer systems connected over a computer network, stored and executed as readable code in a distributed fashion.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art to which the present invention pertains without departing from the spirit and scope of the present invention as set forth in the claims below It will be appreciated that modifications and variations can be made.

Claims (12)

A usage pattern collection unit which collects usage patterns of the user terminal of the user; A usage pattern analyzer for analyzing whether the usage pattern is normal or not; Identity authentication user terminal utilizing the user pattern analysis, including an authentication level adjustment unit for adjusting the identity level according to the determination result. The method of claim 1, The usage pattern relates to the location of the user terminal, In accordance with a result of comparing at least one of GPS information of the user terminal and identification information of the Wi-Fi router connected to the user terminal at a specific time point, the use pattern analysis unit determines whether the user pattern is normal or not. Identity user terminal. The method of claim 1, The usage pattern relates to the call history through the user terminal, The use pattern analyzer determines whether it is normal according to the result of analyzing the call partner and the call time. According to a result of whether or not the STT conversion of the voice for the call history as needed, whether or not the specified pattern for the user includes the user pattern analysis unit, it is possible to determine whether or not normal User authentication user terminal utilizing. The method of claim 1, The usage pattern relates to the history of SNS usage, The use pattern analysis unit determines whether or not normal based on the results of analyzing the SNS chat partner and the chat time. If necessary, depending on whether the user uses a specific emoticon designated for the user or if the character is inputted by analyzing the input deleted by the backspace when the backspace is input when the character is input. User authentication user terminal utilizing the user's usage pattern analysis, which can determine whether the normal use pattern analysis unit. The method of claim 1, The usage pattern includes at least one of the location of the user terminal, the call history, the SNS usage history, the usage share of the application through the user terminal, The use pattern analysis unit is a user authentication user terminal using the analysis of the use pattern of the user to determine whether or not normal through the OR condition calculation. The method of claim 1, The authentication level adjusting unit uses the user's usage pattern analysis to set the user authentication level relatively low when the usage pattern is analyzed to be normal and to set the user authentication level relatively high when the usage pattern is analyzed as abnormal. Identity user terminal. The method of claim 1, Self-authentication user terminal utilizing a user pattern analysis, including a message transmission unit for making and transmitting the authentication level adjusted by the authentication level adjustment unit in the form of a message. The method of claim 7, wherein A key registration unit for registering a private key paired with a public key to be registered in the message authentication server to the user terminal, The message transmission unit is a user authentication user terminal utilizing the analysis of the use pattern of the user, encrypting the authentication level message with the private key and transmits to the web server. A user terminal for collecting and analyzing a user's usage pattern and transmitting a user authentication level message encrypted with a private key of the user authentication level adjusted according to whether the usage pattern is normal; A web server configured to receive the encrypted identity authentication level message and perform login for each level according to the identity authentication level included in the identity authentication level message only when message authentication of the identity authentication level message is successful; And A message for registering a public key corresponding to the private key, decrypting the encrypted user authentication level message according to the message authentication request from the web server with the public key, performing message authentication, and transmitting an authentication result to the web server. Self-authentication system utilizing a user pattern analysis, including an authentication server. The method of claim 9, The message authentication server transmits a message authentication success as the authentication result when the decryption with the public key is successful, and transmits a message authentication failure as the authentication result when the decryption with the public key fails. Authentication system. The method of claim 10, The message authentication server is a user authentication system that utilizes the analysis of the usage pattern of the user, in case of successful message authentication transmits the decrypted identity authentication message to the web server. The method of claim 10, The web server is a user authentication system that utilizes the analysis of the user's usage pattern, so that the log-in only by confirming the specified n of the handwritten signature, iris recognition, fingerprint authentication, password corresponding to the identity authentication level.

Images