The Master-password based Method to manage authentication media securely and conveniently
Patent Information
- Application Number
- KR1020200054797
- Authority / Receiving Office
- KR · KR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2020-05-07
- Publication Date
- 2026-09-16
- Estimated Expiration
- 2040-05-07
Smart Images
Figure 112020046482055-PAT00003_ABST
Abstract
Description
Technology Field
[0001] The present invention relates to a technology for securely managing personal authentication media, such as passwords, secret keys, and terminal verification codes, without user inconvenience. Background Technology
[0003] Ideally, most online sites require each user to "register a password different from the password registered on other sites" (hereinafter referred to as the "independent password requirement") and to "register a password that cannot be easily inferred from the information registered by oneself" (hereinafter referred to as the "random password requirement").
[0005] However, as the number of sites a user needs to access increases, it becomes difficult to comply with both "independent password requirements" and "random password requirements" due to limitations in memorization ability. Consequently, most users realistically choose one or more of the following three alternatives. First, a method of recording one's password list somewhere and viewing it when needed (hereinafter referred to as the "password recording method"). Second, a method of memorizing only the passwords for a few frequently accessed sites and repeating the "identity verification and password re-registration due to password loss" procedure whenever accessing the remaining sites (hereinafter referred to as the "password loss re-registration repetition method"). Third, a method of memorizing two or three general-purpose passwords and using the same general-purpose password on multiple sites (hereinafter referred to as the "general-purpose password method").
[0007] However, the three practical alternatives mentioned above each entail the following risks or inconveniences. First, in the case of the "password recording method," one must accept the risk that the entire password will be exposed if a third party acquires the recorded medium (file or paper) (hereinafter referred to as the "risk of exposure of the recording medium"). Second, in the case of the "repeated re-registration method for lost passwords," one must accept the inconvenience of having to repeat complex procedures every time one accesses a site that is not frequently accessed (hereinafter referred to as the "inconvenience of repeated re-registration for lost passwords"). Third, in the case of the "universal password method," since the password used on each site is exposed on multiple other sites as well, one must accept the risk that if the aforementioned universal password is exposed or hacked on a site with weak security, even accounts on other sites that use the same universal password, despite having thorough security systems, will be exposed (hereinafter referred to as the "risk of exposure of the universal password").
[0009] Although several existing technologies have been released as methods to resolve the weaknesses associated with realistic alternatives—namely, the "risk of exposure of recording media," the "inconvenience of repeated re-registration due to loss," and the "risk of exposure of universal passwords"—while complying with both the aforementioned ideal "independent password requirement" and "random password requirement," each of these technologies exposes the weaknesses described below; therefore, it is necessary to develop a method to resolve all of these weaknesses of existing technologies.
[0011] First, the method comprises storing all passwords used by each user in an app and registering a 'master password, which is the only password to memorize' in the app, and subsequently, when the user inputs the master password they have memorized to search for a password for a specific site (hereinafter referred to as the “site password”), the app checks whether the input value matches the 'master password previously registered', and if it is confirmed to match, outputting the 'site password stored in the app' to the user terminal so that the user can present the 'outputted site password' to the site (hereinafter referred to as the “password storage app method”). However, since the above “password storage app method” immediately notifies the user whether the entered master password matches, if a hacker takes control of the app, there is a risk (hereinafter referred to as the “stored master password hacking risk”) that the hacker can find the “pre-registered master password” and hack all site passwords stored in the app by trying a “combination of alphabets / numbers / symbols” as the master password one by one until a “signal of match” is received.
[0013] Second, there is the method of entrusting identity verification to a trusted third party (such as Facebook, Kakao, or Naver) (hereinafter referred to as the “Third-Party Verification Method”). However, the aforementioned “Third-Party Verification Method” entails the risk (hereinafter referred to as the “Risk of Hacking by Agency Employees”) that if the security manager of the identity verification agency (such as Facebook) decides to do so (even if discovered later), they can access all of the aforementioned user’s accounts opened on each of the “sites that have entered into a third-party verification contract with the agency” by pretending that “the user has applied for access rights to each site and completed the corresponding identity verification with the agency.” Furthermore, the “Third-Party Verification Method” entails the inconvenience (hereinafter referred to as the “Inconvenience of Unusable Sites with Undeveloped APIs”) that it cannot be used on sites where APIs with the identity verification agency have not been developed (including the majority of offline sites, such as home front door keys and gym locker keys).
[0015] Third, there is a method in which institutions participating in the blockchain network verify the authenticity of information required for identity verification in real time on the blockchain network (hereinafter referred to as the “DID method”). However, the above “DID method” must accept the “inconvenience of not being able to use sites without APIs,” which means it cannot be used on sites where DID apps and APIs have not been developed.
[0017] Fourth, there is the method of using an accredited certificate on all sites (hereinafter referred to as the “accredited certificate method”). However, the above “accredited certificate method” must accept the “inconvenience of not being able to use sites without APIs,” which means it cannot be used on sites where accredited certificates and APIs have not been developed. The problem to be solved
[0019] The objective of the present invention is to provide a method that complies with both the "independent password requirement" and the "random password requirement" while resolving the weaknesses of realistic alternatives, namely the "risk of exposure of recording media," the "inconvenience of repeated re-registration due to loss," and the "risk of exposure of universal passwords," and also resolves the weaknesses associated with each of the existing technologies proposed to resolve the weaknesses of the aforementioned alternatives, namely the "password storage app method," the "Chapter 3 agency authentication method," the "DID method," and the "accredited certificate method," namely the "risk of hacking the stored master password," the "risk of hacking by agency employees," and the "inconvenience of being unable to use sites without APIs." means of solving the problem
[0021] One embodiment of a method according to the features of the present invention for solving such technical problems is a method of installing an authentication app of the present invention on a user terminal of the present invention, wherein when a user inputs a master password at the user terminal, a random value generation module configured in the authentication app generates three random numbers as a first random number, a second random number, and a third random number, respectively, a GPS measurement module configured in the authentication app measures the GPS value of the current terminal location, and a timestamp module calculates a timestamp of the current time; and a step of calculating a first GPS hash, a second GPS hash, and a third GPS hash using the hash value text of the GPS value, and calculating a first timestamp hash, a second timestamp hash, and a third timestamp hash using the hash value text of the timestamp. A step of randomly generating a secret key, an app management server dedicated password, and an initial one-time terminal verification code for the app management server, respectively, in binary code form using the above three random numbers, three GPS hashes, and three timestamp hashes, and generating a public key in binary code form using the generated secret key; a step of generating a hash value of the master password, generating a hash value of the authentication app issuer identification information, and generating an app management server dedicated master key in binary code form using the two hash values; a step of encrypting the secret key and the app management server dedicated password, respectively, with the app management server dedicated master key, and encrypting the 'initial one-time terminal verification code for the app management server' with the public key; A step of storing the ‘encrypted app management server dedicated password’, the ‘encrypted initial one-time terminal verification code for the app management server’, the public key, and the ‘encrypted secret key’, respectively, in the ‘password field, terminal verification code field, public key field, and secret key field’ of the ‘record in the site field where authentication app issuer identification information is stored’ of the secret information DB configured in the above authentication app;A step of searching for the public key field value matched to the authentication app issuer identification information in the site DB configured in the above authentication app as the public key of the app management server, and encrypting the 'public key, the app management server dedicated password, and the initial one-time terminal verification code for the app management server' respectively using the public key of the above app management server; a step of deleting all input or calculated 'information that must not be exposed' and disabling airplane mode; a step of transmitting the 'encrypted public key, the app management server dedicated password, and the initial one-time terminal verification code for the app management server' to the app management server of the present invention by matching it with a 'predetermined code indicating that the authentication app installation is complete' (hereinafter referred to as "app installation completion code") on the user terminal. When the above-mentioned app management server receives the transmitted information, it decrypts the encrypted 'public key, app management server dedicated password, and initial app management server one-time terminal verification code' using its own secret key for app management business, calculates the hash value of the decrypted app management server dedicated password, and stores the 'decrypted public key,' the 'hash value of the app management server dedicated password,' and the 'decrypted initial app management server one-time terminal verification code' respectively in the 'public key field, password field, and terminal verification code field' of one record among the records in the customer DB that is not assigned to a specific user; a step of searching for a serial number, which is the 'ID field value of the stored record,' in the customer DB and transmitting the ID field value to the user terminal; and a step of, when the user terminal receives the ID field value, storing the received 'ID field value' in the ID field of the 'record in which authentication app issuer identification information is stored in the site field' in the secret information DB. Includes.;
[0023] In addition, the above-described embodiment is a method for a user terminal of the present invention to register an authentication medium as a new member on the 'site server of the present invention,' comprising the steps of: searching for a serial number, which is the ID field value of one record among the records not assigned to a specific user in the customer DB on the site server; matching it with 'a code for identifying a password registration method using the API method of the present invention previously announced on the site server' (hereinafter referred to as the "API method password registration code"), and transmitting 'information for identifying the site server from other site servers' (hereinafter referred to as "site identification information") and the ID field value (hereinafter referred to as the "site server customer DB ID field value") to the user terminal; and when the user enters a master password on the user terminal, a random value generation module configured in the authentication app generates a second random number and a third random number, a GPS measurement module configured in the authentication app measures the GPS value of the current terminal location, and a timestamp module configured in the authentication app calculates a timestamp of the current time. A step of calculating a second GPS hash and a third GPS hash using the hash value text of the above GPS value, and calculating a second timestamp hash and a third timestamp hash using the hash value text of the above timestamp; a step of randomly calculating a site password and an initial site-specific one-time terminal verification code in binary code form, respectively, using the two random numbers, two GPS hashes, and two timestamp hashes, and searching for the public key field value of a record in which authentication app issuer identification information is stored in the site field in the secret information DB configured in the above authentication app; a step of calculating a site-specific master key in binary code form using the hash value of the above master password and the hash value of the above site identification information; a step of encrypting the 'above-calculated site password' with the above-calculated site-specific one-time terminal verification code with the 'above-searched public key field value';A step of storing the site identification information, the site server customer DB ID field value, the encrypted site password, and the encrypted initial site-specific one-time terminal verification code, respectively, in the 'site field, ID field, password field, and terminal verification code field' of a 'record in the site field where a default value is stored' of the secret information DB configured in the authentication app; a step of searching for the public key field value matched to the site identification information in the site DB configured in the authentication app as the site's public key, and encrypting the 'calculated site password and the initial site-specific one-time terminal verification code' respectively using the site's public key; a step of transmitting the 'encrypted site password and the initial site-specific one-time terminal verification code' to the site server by matching it with a 'predetermined code signifying an application for registration of site password, etc.' (hereinafter referred to as the "site password, etc. registration application code") at the user terminal; The method includes the step of, upon receiving the transmitted information, decrypting the encrypted 'site password and the initial site-specific one-time terminal verification code' respectively using its own secret key for user authentication business, calculating the hash value of the decrypted site password, and storing the 'hash value of the site password' and the 'decrypted initial site-specific one-time terminal verification code' respectively in the 'password field and terminal verification code field' of the 'record where the ID field value was retrieved' in the customer DB.
[0025] In addition, the above-described embodiment is a method for registering an authentication medium for a site that is not equipped with a site server of the present invention, comprising the step of displaying a predetermined screen (hereinafter referred to as the “main screen”) characterized by, when a user selects identification information of an authentication app (hereinafter referred to as the “authentication app icon”) displayed on a user terminal, menus (hereinafter referred to as “site identification information boxes”) matching “each site identification information stored in the site field of a secret information DB” are displayed by matching them with a modification box and a deletion box, and a site addition box and a setting box are displayed; and the step of, when the user selects the site addition box displayed on the main screen, airplane mode is selected and a predetermined screen (hereinafter referred to as the “password registration screen”) including a site identification information input field, an ID input field, a password input field, a site addition box, and a stop adding box is displayed. A step in which, when a user inputs arbitrary site identification information, an 'ID registered and in use on the site corresponding to the site identification information', and a 'site password registered and in use on the site' into the 'site identification information input field, ID input field, and password input field' respectively, and selects the 'stop adding box', a master password input field is displayed on the user terminal; a step in which, when the user inputs the master password, a site-specific master key in the form of binary code is calculated using the hash value of the master password and the hash value of the 'entered site identification information', and for each ASCII character constituting the 'entered site password', one of one or more binary codes matched to each character is randomly selected from a character matching table in order, and the selected binary codes are combined again in the order of the matched characters to calculate a value in the form of binary code (hereinafter referred to as "binary-coded site password"); and a step in which the 'calculated binary-coded site password' is encrypted with the 'calculated site-specific master key' at the user terminal.The method includes the step of storing the ‘entered site identification information’, the ‘entered ID’, and the ‘encrypted, binary-coded site password’ respectively in the ‘site field, ID field, and password field’ of a ‘single record in the site field where a default value is stored’ of the secret information DB configured in the authentication app.
[0027] In addition, the above embodiment comprises the steps of: a method for a user of the user terminal of the present invention to access the 'site server of the present invention', wherein the site server transmits site identification information of the site to the user terminal by matching it with a 'code requesting identity authentication using the API of the present invention' (hereinafter referred to as the "API method identity authentication request code"); and, when the user enters a master password at the user terminal, a site-specific master key in the form of binary code is calculated using the 'hash value of the master password' and the 'hash value of the site identification information', while an app management server-specific master key in the form of binary code is calculated using the 'hash value of the master password' and the 'hash value of the authentication app issuer identification information'. A step of searching for the secret key field value of a record in the secret information DB configured in the authentication app as an 'encrypted secret key' of a record in which authentication app issuer identification information is stored in the site field, and searching for the 'ID field value, password field value, and terminal verification code field value' of a record in which the site identification information is stored in the site field as 'site ID, encrypted site password, and encrypted one-time terminal verification code' respectively, decrypting the 'encrypted site password' with the 'generated site-specific master key' and decrypting the 'encrypted secret key' with the 'generated app management server-specific master key'; a step of generating an OTP by decrypting the 'encrypted one-time terminal verification code' with the 'decrypted secret key' at the user terminal and encrypting the 'decrypted site password' with the decrypted one-time terminal verification code; and a step of transmitting the OTP to the site server by matching it with the 'searched site ID'.A step of searching the 'password field value, public key field value, and terminal verification code field value' of a record in the customer DB where the site ID is stored in the ID field on the site server as the 'hash value of the site password, public key, and one-time terminal verification code,' respectively, decrypting the OTP with the one-time terminal verification code to calculate the site password, and comparing the hash value of the 'calculated site password' with the 'hash value of the searched site password'; If the above comparison result matches, the site server determines that identity authentication is complete, randomly generates a new one-time terminal verification code in the form of binary code, updates the terminal verification code field in the customer DB matched with the 'received site ID' with the generated one-time terminal verification code, encrypts the 'updated one-time terminal verification code' with the 'searched public key', and transmits the 'site identification information for the user to identify themselves' and the 'encrypted, updated one-time terminal verification code' to the user terminal by matching them with a 'code indicating that user authentication for login has been completed' (hereinafter referred to as the "login authorization authentication completion code"); and the user terminal updates the terminal verification code field matched with the site identification information in the secret information DB configured in the authentication app with the 'encrypted one-time terminal verification code'.
[0029] In addition, the above embodiment is a method for a user of the present invention's user terminal to access a site where the site server of the present invention is not provided, comprising: a step in which the user selects an authentication app icon displayed on the user terminal and the main screen is displayed; a step in which, when the user selects a site identification information box corresponding to the site among the 'site identification information boxes displayed on the main screen,' an 'encrypted binary code site password' matched to the 'site identification information corresponding to the selected site identification information box' is searched in the secret information DB configured in the authentication app and a master password input field is displayed; a step in which, when the user enters the master password, a site-specific master key matching the site identification information in binary code form is calculated using the hash value of the master password and the hash value of the site identification information; and a step in which the user terminal decrypts the 'searched, encrypted binary code site password' using the 'calculated site-specific master key.' The method includes the step of separating the decrypted 'binary code site password' into specific bit units, searching for a matched character for each 'binary code of the separated specific bit units' in a character matching table configured in the authentication app, and concatenating the searched characters in order to produce and output a 'readable site password'. Effects of the invention
[0031] According to the above embodiment, since the user only needs to memorize the master password, it becomes possible to use site passwords that are independent and random for each site in practice. Therefore, it is possible to comply with the ideal "independent password requirement" and "random password requirement."
[0033] At the same time, authentication media such as site passwords, secret keys, and terminal verification codes are encrypted and stored, and the site-specific master key (including the app management server-specific master key), which is the key for decrypting the said encrypted authentication media, is not stored anywhere in the world, including the user terminal. Furthermore, by operating both the site-specific master key, which is the decryption key, and the authentication media to be decrypted in the form of unredable binary code, it becomes impossible for a hacker who has taken over the user terminal to deduce the decryption key by trying 'readable character combinations' one by one until 'authentication media composed of readable characters' appear, thereby eliminating the "risk of exposure of recording media."
[0035] At the same time, if users only memorize their master password, they do not need to memorize site passwords required for each site or secret keys needed for digital signatures, thus resolving the "inconvenience of repeated re-registration due to loss."
[0037] At the same time, for a site where the site server of the present invention is established, the "risk of universal password exposure" is eliminated because a value calculated randomly by combining the hash values of the timestamp at the time of registration of the authentication medium and the GPS value where the user terminal is located as seeds is used as the authentication medium (site password, etc.) to be presented. Furthermore, for a site where the site server is not established, the "risk of universal password exposure" can be eliminated by recommending the value calculated as above as an authentication medium.
[0039] At the same time, since the master password is not stored anywhere on the user terminal, app management server, or site server and is memorized by the user, the "risk of hacking the stored master password" is eliminated.
[0041] In addition, the “risk of hacking by agency employees” is also eliminated because authentication media registered on each site, such as site passwords or one-time verification codes, are not exposed to third parties other than the respective site.
[0043] At the same time, since there is no need to memorize the site password for sites where an API with the authentication app has not been developed, the “inconvenience of not being able to use sites without an API” is also resolved. Brief explanation of the drawing
[0046] FIG. 1 is a block diagram of a device for implementing a safe and convenient authentication medium management and non-repudiation method based on a master password according to one embodiment of the present invention. FIG. 2 is a diagram illustrating an example of an operation in which a user of the present invention installs an authentication app of the present invention on their user terminal, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 3 is a diagram illustrating an example of an operation in which a user of the present invention registers an authentication medium as a new member on a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 4 is a diagram illustrating an example of an operation in which a user of the present invention registers an authentication medium for a site where an API for communicating with the authentication app of the present invention has not been developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 5 is a diagram illustrating an example of an operation in which a user of the present invention accesses a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 6 is a diagram illustrating an example of an operation in which a user of the present invention accesses a site where an API for communicating with the authentication app of the present invention has not been developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 7 is a diagram illustrating an example of an operation in which a user of the present invention changes a master password currently in use in an authentication app installed on their user terminal, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. FIG. 8 is a diagram illustrating an example of an operation in which a user of the present invention authenticates their identity for a transaction on a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention. Specific details for implementing the invention
[0047] The present invention will be described in detail below through preferred embodiments described with reference to the attached drawings.
[0049] Embodiments of the present invention may be modified in various ways without departing from the spirit and scope of the invention. The following detailed description is not intended to limit the invention, and the terms used in the detailed description are selected for readability or convenience of explanation.
[0051] Additionally, the term "node" as used in this specification refers to a computer device capable of creating predetermined transaction data, creating a predetermined block using one or more transaction data and transmitting it to one or more peer nodes, and verifying and storing a block received from a peer node.
[0053] Additionally, the term "root hash value" as used in this specification refers to a hash value obtained by compressing the hash values of each transaction data included in a predetermined block into a Merkle tree structure or other predetermined structure.
[0055] Furthermore, as used in this specification, "master password" refers to a password selected and memorized by the user, which does not need to be exposed or stored to external devices such as servers, user terminals, or anyone else in the world.
[0057] Also, the term “character” as used in this specification refers collectively to the symbols, numbers, uppercase alphabets, and lowercase alphabets that make up the 256 characters of the ASCII character table.
[0059] Furthermore, as used in this specification, the term "input" collectively refers to the operation of inputting specific information into a specific system. Accordingly, the operation of inputting specific information using the input unit of the system and the operation of receiving specific transmission information using the transmission and reception unit of the system may be embodiments of the "input."
[0061] Furthermore, the term "timestamp" as used in this specification refers to information that displays the date and time, etc., of a specific time when a specific operation occurs in a specific format to identify the time when a specific operation occurs. Accordingly, information consisting of a continuous sequence of the date, hours, minutes, and seconds output by a timer at the time when a specific step is operated may be an example of the timestamp.
[0063] Furthermore, as used in this specification, "peer node" refers to a counterpart node among the nodes constituting a blockchain network that specifically stores a connection address in order to propagate "a block written by oneself" from the perspective of a specific node within the blockchain network to which it belongs.
[0065] In addition, the term "OO box" as cited in this specification refers to an area on a screen area displayed on the output unit of the trader terminal of the present invention that displays information signifying "OO," and is configured to allow input of information for selecting the "OO box" by "an action such as touching or clicking the area." Accordingly, an icon area configured to allow input of information for selecting the OO app, a menu area configured to allow input of information for selecting "OO," a box area, a button area, etc., may be embodiments of the "OO box."
[0067] In addition, in this specification, "information matching OO" refers to information that enables the extraction of "OO". Therefore, "OO" itself may also be an example of "information matching OO".
[0069] In addition, the phrase "select OO" in this specification means that the user inputs information for selecting "OO" by actions such as touching or clicking an area where "OO" is displayed among the areas displayed on the output section of the trader terminal.
[0071] In addition, the term "input OO" cited in the specification collectively refers to the action of inputting "OO" into a predetermined input field and the action of selecting an "OO box" among predetermined boxes.
[0073] Furthermore, the designation of "binary code form" cited in the specification is an example of an "unreadable form" for the purpose of clarifying the explanation, and when defining the claims of the present invention, the "unreadable form" is used as a general term unless explicitly or logically excluded.
[0075] Additionally, the term "binary coded" cited in the specification refers to an example of an embodiment that has become unreadable, and when defining the claims of the present invention, it collectively refers to the state of being in an unreadable form.
[0077] Furthermore, the term "readable" cited in the specification refers to a state composed solely of characters that can be used to construct site passwords on "sites that account for a significant proportion among well-known sites." However, "well-known sites" here refers to "sites with 1 million or more users" in the absence of other objective criteria based on social norms, and "a significant proportion" refers to "a proportion of 10% or more" in the absence of other objective criteria based on social norms.
[0079] In addition, the term "unreadable form" cited in the specification collectively refers to forms containing characters that cannot be used in site password composition among "sites that account for a significant proportion of well-known sites," and forms composed only of excessively restricted types of characters. Here, "excessively restricted types" means four or fewer in the absence of other objective criteria according to social norms. Therefore, a binary code form composed only of "0" and "1" corresponds to an "unreadable form."
[0081] The following describes a safe and convenient authentication media management method based on a master password.
[0084] FIG. 1 is a block diagram of a device for implementing a safe and convenient authentication medium management and non-repudiation method based on a master password according to one embodiment of the present invention.
[0086] According to one embodiment of the present invention, a device for implementing a safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention comprises a user terminal (100), an app management server (200), and a site server (300).
[0089] The authentication app (110) of the present invention is installed on the user terminal (100).
[0091] The above authentication app (110) comprises a secret information DB (111), a character matching table (112), a site DB (113), a random value generation module (116), a GPS measurement module (117), and a timestamp module (118).
[0093] The secret information DB (111) is configured with a site field, an ID field, a password field, a terminal verification code field, a public key field, a secret key field, and a connection address field as exemplified in FIG. 15. The site field stores site identification information for distinguishing each site where a user must present an authentication medium from other sites, the ID field stores information used to distinguish the user from other users at the said site, the password field stores an encrypted 'constant password' (hereinafter referred to as "site password") that the user must present to access the said site, the public key field stores the public key of the user registered at the said site, the secret key field stores an encrypted secret key that matches the public key registered at the said site, and the connection address field stores the URL of the login application page of the said site.
[0095] According to an additional aspect of the present invention, the site field and the access address field of the first record of the secret information DB (111) each store information identifying the issuer of the authentication app (110) (hereinafter referred to as "authentication app issuer identification information") and the URL of the issuer.
[0097] In the character matching table (112), 'the decimal representation of the corresponding binary code' and 'one character' are stored by matching each different binary code. According to an additional aspect of the present invention, each binary code is composed of 8 bits, as exemplified in FIGS. 16 and 17, and a series of 256 binary numbers from "00000000" to "11111111" are sequentially stored in the character matching table (112).
[0098] However, other additional aspects are also possible, and generally defined, the character matching table (112) comprises a ‘group of characters and binary codes matched’ (hereinafter referred to as the “basic group”) in which one binary code is matched to each of all inputtable characters, and for ‘a characters (hereinafter referred to as “multiple code matching characters”) constituting some of the all inputtable characters, b binary codes are additionally matched for each multiple code matching character. One embodiment of the method for additional matching described above comprises: binary codes matched to a basic group all forming a sequence number, and a binary codes forming a sequence number starting from 'the binary code next to the binary code corresponding to the last sequence number' each being matched one by one to the a multiple code matching characters to form a first additional group; and for the a multiple code matching characters, a binary codes forming a sequence number starting from 'the binary code next to the binary code corresponding to the last sequence number of the first additional group' are again matched one by one to the a multiple code matching characters to form a second additional group, and multiple additional groups are formed in the same manner.
[0099] The site DB (113) is configured with a site field, a mutual field, a public key field, a connection address field, and N character fields as exemplified in FIG. 18. Whenever the user terminal (100) updates the version of the authentication app (110), the updated version of the site DB (240) is downloaded from the app management server (200) to the user terminal (100), and the site DB (113) is updated.
[0101] According to an additional aspect of the present invention, a site DB (113) can store a predetermined image by matching each site field value.
[0103] According to an additional aspect of the present invention, a code for identifying a self-transaction site and an agency transaction site is stored in the first Character field. According to an embodiment of the additional aspect, if the site corresponding to the value stored in the site field is a "site characterized in that the result of a transaction made by a person who accessed the site belongs to the person who accessed the site and the site" (hereinafter referred to as "self-transaction site"), "0" is stored in the first Character field, and if it is a "site characterized in that the result of a transaction made by a person who accessed the site belongs to the person who accessed the site and the person who acts as an agent for the site" (hereinafter referred to as "agency transaction site"), "1" is stored in the first Character field.
[0105] According to an additional aspect of the present invention, a code is stored in the second Character field to identify a policy regarding whether the site requires a site password as authentication information and, if the site password is required, whether a hash value of which degree is required. According to an embodiment of the additional aspect, if the site does not require a site password, "0" is stored in the second Character field; if the site password is required in a state other than a hash value, "9" is stored in the second Character field; if the hash value of the site password (hereinafter referred to as the "first hash value of the site password") is required, "1" is stored in the second Character field; and if the hash value of the first hash value of the site password (hereinafter referred to as the "second hash value of the site password") is required, "2" is stored in the second Character field.
[0107] According to an additional aspect of the present invention, a code is stored in the third Character field to identify whether the site requires an electronic signature as authentication information and, if an electronic signature is required, a policy regarding the type of electronic signature accepted. According to one embodiment of this additional aspect, "0" is stored in the third Character field if the site does not require an electronic signature; "1" is stored in the third Character field if the site requires an electronic signature using an accredited certificate; "2" is stored in the third Character field if the site requires an electronic signature using a private certificate designated by the site; and "3" is stored in the third Character field if the site requires an electronic signature using either an accredited certificate or a private certificate selected from among them.
[0109] According to an additional aspect of the present invention, a code is stored in the fourth character field to identify a policy regarding whether terminal verification is required during the authentication process and, if so, the specific method for requiring it. According to an embodiment of the additional aspect, "0" is stored in the fourth character field when the site does not require terminal verification; "1" is stored in the fourth character field when the carrier CI value is required; "2" is stored in the fourth character field when an OTP generated from a separate terminal with media separation is required; and "3" is stored in the fourth character field when an OTP generated using the one-time terminal verification code of the present invention is required.
[0111] The random value generation module (116) generates random numbers.
[0113] The GPS measuring module (117) measures the GPS value of the current user terminal (100) location.
[0115] The timestamp line (118) calculates the timestamp of the current time.
[0118] The app management server (200) is a server that provides version update services for the authentication app (110), and consists of a customer DB (210), a transaction data DB (220), a public hash DB (230), and a site DB (240).
[0120] The customer DB (210) comprises an ID field, a public key field, a password field, and a terminal verification code field. According to an additional aspect of the present invention, a serial number is stored in advance in the ID field.
[0122] In the transaction data DB (220), a timestamp, sender identification information, hash value of the transaction data, transaction data, and digital signature are stored by matching a predetermined serial number (hereinafter referred to as "transaction data serial number").
[0124] In the public hash DB (230), a timestamp and a root hash value (hereinafter referred to as "transaction-specific root hash value") of 'standardized information including the timestamp at the time when arbitrary transaction data was created, the hash value of the transaction data, and the digital signature of the creator of the transaction data' are stored by matching a predetermined serial number (hereinafter referred to as "public hash serial number").
[0126] The site DB (240) is configured with a site field, a company field, a public key field, a connection address field, and N character fields. The site field stores information for identifying a specific site from other sites (hereinafter referred to as "site identification information"), the company name of the site is stored in the company field, the public key field stores the public key for authentication business of the site, and the connection address field stores the URL of the login page of the site.
[0128] According to an additional aspect of the present invention, images can be stored in the site DB (240) by matching each site field value.
[0130] According to an additional aspect of the present invention, the first Character field, the second Character field, the third Character field, and the fourth Character field store information stored in the corresponding fields of the site DB (113).
[0133] The site server (300) is a system of a site that the user of the present invention accesses to use a specific service, and it is configured with a customer DB (310).
[0135] The customer DB (310) is configured with an ID field, a password field, a public key field, and a terminal verification code field. According to an additional aspect of the present invention, a serial number is stored in advance in the ID field.
[0138] FIG. 2 is a diagram illustrating an example of an operation in which a user of the present invention installs an authentication app of the present invention on their user terminal, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0140] In step 101, the user terminal (100) receives an authentication app (110) from the app management server (200).
[0142] According to another aspect of the present invention, in step 101, the user terminal (100) may receive the authentication app (100) from one of a predetermined app store (not shown), an email server (not shown), and a messenger server (not shown) by replacing the app management server (200).
[0144] In step 102, the authentication app (110) is installed on the user terminal (100) and airplane mode is selected, and as illustrated in FIG. 10, two master password input fields and a confirmation box are displayed on the user terminal (100).
[0146] According to an additional aspect of the present invention, step 102 includes: storing the authentication app (110) on a user terminal (100) and outputting a box agreeing to the installation of the authentication app (110) (hereinafter referred to as the "authentication app installation confirmation box"); when the user selects the authentication app installation confirmation box, outputting a box indicating consent (hereinafter referred to as the "consent box") by matching it to a "terms window equipped with a scrollbar" on the user terminal (100) where the user can read "terms for using the authentication app"; the user selecting the consent box; selecting an airplane mode according to the control of the authentication app (110), and outputting two master password input fields and a confirmation box to the user terminal (100) as exemplified in FIG. 10.
[0148] In step 103, when the user enters the same master password into the two master password input fields output above and selects the confirmation box, the two entered master passwords are checked for a match. If they match, the random value generation module (116) generates three random numbers as the first random number, the second random number, and the third random number, respectively, the GPS measurement module (117) measures the GPS value of the current terminal location, and the timestamp module (118) calculates the timestamp of the current time.
[0150] In step 104, the hash value of the GPS value is calculated, and three hash values are calculated using the hash value text as the first GPS hash, the second GPS hash, and the third GPS hash, respectively; and the hash value of the timestamp is calculated, and three hash values are calculated using the hash value text as the first timestamp hash, the second timestamp hash, and the third timestamp hash, respectively.
[0152] An example of a method for calculating the first GPS hash, the second GPS hash, and the third GPS hash using the hash value text of the GPS value is a method of dividing the hash value text of the GPS value into three parts and calculating the first GPS hash, the second GPS hash, and the third GPS hash in order.
[0154] An example of a method for calculating a first timestamp hash, a second timestamp hash, and a third timestamp hash using a timestamp hash value text is a method of dividing the timestamp hash value text into three parts and calculating the first timestamp hash, the second timestamp hash, and the third timestamp hash in order.
[0156] In step 105, the secret key, the app management server dedicated password, and the initial one-time terminal verification code for the app management server are each randomly generated in binary code form using the three random numbers, three GPS hashes, and three timestamp hashes, and the public key is generated in binary code form using the generated secret key.
[0158] The formulas for each variable calculated in Step 105 are as follows.
[0159] * Secret Key = f(1st Random Number, 1st GPS Hash, 1st Timestamp Hash)
[0160] * Public key = f(private key)
[0161] * App Management Server Exclusive Password = f(2nd Random Number, 2nd GPS Hash, 2nd Timestamp Hash)
[0162] * Initial one-time device verification code for app management server = f(third random number, third GPS hash, third timestamp hash)
[0164] In step 106, the hash value of the 'master password entered in step 103' is calculated, the hash value of the authentication app issuer identification information is calculated, and the two hash values are used to calculate the master key for the app management server in the form of binary code.
[0166] The formula for the App Management Server exclusive master key calculated in Step 106 is as follows.
[0167] * App Management Server Dedicated Master Key = h[h(Master Password), h(Authentication App Issuer Identification Info)]
[0169] In step 107, the 'secret key calculated in step 105' and the 'app management server dedicated password calculated in step 105' are each encrypted with the 'app management server dedicated master key calculated in step 106', and the 'initial one-time terminal verification code for the app management server calculated in step 105' is encrypted with the 'public key calculated in step 105'.
[0171] In step 108, the ‘password field, terminal verification code field, public key field, and secret key field’ of the ‘record in which authentication app issuer identification information is stored in the site field’ of the secret information DB (111) are respectively stored as the ‘password for the app management server encrypted in step 107’, the ‘one-time terminal verification code for the app management server encrypted in step 107’, the ‘public key calculated in step 105’, and the ‘secret key encrypted in step 107’.
[0173] According to an additional aspect of the present invention, when the authentication app (110) is downloaded to a user terminal (100), the authentication app issuer identification information is stored in the site field of the first record of the secret information DB (111).
[0175] In step 109, the public key field value matched to the authentication app issuer identification information in the site DB (113) is searched as the public key of the app management server, and the public key of the app management server, the public key, the app management server dedicated password, and the initial one-time terminal verification code for the app management server, which were calculated in step 105, are each encrypted using the public key of the app management server.
[0177] In step 110, 'the master password entered in step 103', 'the first random number, the second random number, the third random number, the GPS value, and the timestamp calculated in step 103', 'the hash value of the GPS value, the first GPS hash, the second GPS hash, the third GPS hash, the hash value of the timestamp, the first timestamp hash, the second timestamp hash, and the third timestamp hash calculated in step 104', 'the secret key, the public key, the password for the app management server, and the one-time terminal verification code for the initial app management server calculated in step 105', and 'the hash value of the master password, the hash value of the authentication app publisher identification information, and the master key for the app management server calculated in step 106' are all deleted and airplane mode is disabled.
[0179] In step 111, the app installation completion code from the user terminal (100) is matched with the ‘public key, app management server dedicated password, and initial app management server one-time terminal verification code’ encrypted in step 109 and transmitted to the app management server (200).
[0181] When the app management server (200) receives the encrypted public key, the encrypted password for the app management server, and the encrypted one-time terminal verification code for the app management server, which are transmitted in step 111 and matched with the app installation completion code, it decrypts the encrypted public key, the password for the app management server, and the one-time terminal verification code for the app management server using its own secret key for app management business, calculates the hash value of the decrypted password for the app management server, and stores the decrypted public key, the hash value of the password for the app management server, and the decrypted one-time terminal verification code for the app management server in the public key field, the password field, and the terminal verification code field of one of the records in the customer DB (210) that are not assigned to a specific user.
[0183] According to an additional aspect of the present invention, a serial number is stored in advance in the ID field of the customer DB (210), and the ‘record among the records not assigned to a specific user’ is the first record among the records in which the ‘public key field, password field, and terminal verification code field’ of the record are all default values.
[0185] In step 113, the ID field value of a record stored in the customer DB (210) in the app management server (200) in step 112, in which the public key, the password field, and the terminal verification code field respectively contain the public key, the app management server-specific password, and the initial one-time terminal verification code for the app management server, is searched, and the ID field value is transmitted to the user terminal (100) as a response to the reception in step 112.
[0187] When the user terminal (100) receives the 'ID field value transmitted in step 113' in step 114, the received 'ID field value' is stored in the ID field of the 'record in which authentication app issuer identification information is stored in the site field' in the secret information DB (111).
[0190] FIG. 3 is a diagram illustrating an example of an operation in which a user of the present invention registers an authentication medium as a new member on a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0192] In step 201, the ID field value of one of the records in the customer DB (310) that is not assigned to a specific user is retrieved from the site server (300), and the ID field value (i.e., "site server customer DB ID field value") as one of the temporary ID and account ID is matched with the API method password registration code and transmitted to the user terminal (100).
[0194] According to an additional aspect of the present invention, a serial number is stored in advance in the ID field of the customer DB (310), and the ‘record among the records not assigned to a specific user’ is the first record among the records in which both the ‘password field and terminal verification code field’ of the record have default values.
[0196] According to an additional aspect of the present invention, prior to step 201, the user terminal (100) accesses a new member registration page provided by the site server (300); and the user selects a box (hereinafter referred to as the "password registration box using the API of the present invention") displayed on the "new member registration page provided by the site server (200)" using the user terminal (100).
[0198] When the user terminal (100) receives the ‘site identification information and site server customer DBID field value, which is transmitted in step 201 and matched with the API method password registration code’ in step 202, the authentication app (110) is activated by the API method password registration code, and an airplane mode is selected under the control of the authentication app (110), and a master password input field and a confirmation box as exemplified in FIG. 11 are displayed.
[0200] In step 203, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the random value generation module (116) generates three random numbers as the first random number, the second random number, and the third random number, respectively, the GPS measurement module (117) measures the GPS value of the current terminal location, and the timestamp module (118) calculates the timestamp of the current time.
[0202] In step 204, the hash value of the GPS value is calculated, and three hash values are calculated using the hash value text as the first GPS hash, the second GPS hash, and the third GPS hash, respectively, and three hash values are calculated using the hash value text of the timestamp as the first timestamp hash, the second timestamp hash, and the third timestamp hash, respectively.
[0204] The embodiments exemplified in Step 104 also apply to Step 204.
[0206] In step 205, two of the three random numbers, two of the three GPS hashes, and two of the three timestamp hashes are used to randomly generate a site password and an initial site-specific one-time terminal verification code in the form of binary code, and the public key field value of a record in which authentication app issuer identification information is stored in the site field is searched in the secret information DB (111).
[0208] The formulas for each variable calculated in Step 205 are as follows.
[0209] * sitepassword = f(second random number, second GPS hash, second timestamp hash)
[0210] * Initial site-specific one-time terminal verification code = f(third random number, third GPS hash, third timestamp hash)
[0212] In step 206, the hash value of the 'master password entered in step 203' is calculated, the hash value of the 'site identification information received in step 202' is calculated, and a site-specific master key in the form of binary code is calculated using the two hash values.
[0214] According to an additional aspect of the present invention, the site-specific master key is calculated as the hash value of the combined value of the 'hash value of the master password' and the 'hash value of the site identification information'.
[0216] In step 207, the user terminal (100) encrypts the ‘site password calculated in step 205’ with the ‘site-specific master key calculated in step 206’, and encrypts the ‘first site-specific one-time terminal verification code calculated in step 205’ with the ‘public key field value retrieved in step 205’.
[0218] In step 208, the ‘site identification information received in step 202’, the ‘site server customer DBID field value received in step 202’, the ‘site password encrypted in step 207’, and the ‘first site-specific one-time terminal verification code encrypted in step 207’ are stored respectively in the ‘site field, ID field, password field, and terminal verification code field’ of the ‘one record in the secret information DB (111) in the user terminal (100) where the default value is stored in the site field’.
[0220] According to an additional aspect of the present invention, the ‘one record in which a default value is stored in a site field’ is the first record among the ‘records in which the site field of the record is a default value’.
[0222] In step 209, the public key field value matched to the 'site identification information received in step 202' in the site DB (113) is searched as the site's public key, and the 'site password and the first site-specific one-time terminal verification code' calculated in step 205 are each encrypted with the site's public key.
[0224] In step 210, 'the master password entered in step 203', 'the first random number, the second random number, the third random number, the GPS value, and the timestamp calculated in step 203', 'the hash value of the GPS value, the first GPS hash, the second GPS hash, the third GPS hash, the hash value of the timestamp, the first timestamp hash, the second timestamp hash, and the third timestamp hash calculated in step 204', 'the site password and the initial site-specific one-time terminal verification code calculated in step 205', and 'the hash value of the master password, the hash value of the site identification information, and the site-specific master key calculated in step 206' are all deleted and airplane mode is disabled.
[0226] In step 211, the site password, etc. registration application code is matched with the site password, etc. registration application code from the user terminal (100), and the ‘site password and the first site-specific one-time terminal verification code encrypted in step 209’ is transmitted to the site server (300) as a reply that can be matched with the ‘reception in step 202’.
[0228] In step 212, when the site server (300) receives the ‘encrypted site password and the encrypted first site-dedicated one-time terminal verification code’ that is transmitted in step 211 and matched with the site password registration application code, etc., it decrypts the encrypted ‘site password and the first site-dedicated one-time terminal verification code’ respectively using its own secret key for user authentication business, calculates the hash value of the decrypted site password, and stores the ‘hash value of the site password’ and the ‘decrypted first site-dedicated one-time terminal verification code’ respectively in the ‘password field and terminal verification code field’ of the ‘record from which the site server customer DBID field value was searched in step 201’ in the customer DB (310).
[0231] Meanwhile, in the case of a site using a site-specific public key as another embodiment of the present invention, steps 205-1 to 212-1 below are operated in place of steps 205 to 212.
[0233] In step 205-1, the site-specific secret key, site password, and initial site-specific one-time terminal verification code are each randomly generated in binary code form using the three random numbers, three GPS hashes, and three timestamp hashes, and the site-specific public key is generated in binary code form using the generated site-specific secret key.
[0235] The formulas for each variable calculated in Step 205-1 are as follows.
[0236] * Site-specific secret key = f(1st random number, 1st GPS hash, 1st timestamp hash)
[0237] * Site-specific public key = f(site-specific private key)
[0238] * sitepassword = f(second random number, second GPS hash, second timestamp hash)
[0239] * Initial site-specific one-time terminal verification code = f(third random number, third GPS hash, third timestamp hash)
[0241] In step 206-1, the hash value of the 'master password entered in step 203' is calculated, the hash value of the 'site identification information received in step 202' is calculated, and a site-specific master key in the form of binary code is calculated using the two hash values.
[0243] In step 207-1, the user terminal (100) encrypts the ‘site-specific secret key’ and the ‘site password’ calculated in step 205-1 with the ‘site-specific master key’ calculated in step 206-1, and encrypts the ‘first site-specific one-time terminal verification code’ calculated in step 205-1 with the ‘site-specific public key’ calculated in step 205-1.
[0245] In step 208-1, the 'site identification information received in step 202', the 'site server customer DBID field value received in step 202', the 'site password encrypted in step 207-1', the 'original site-specific one-time terminal verification code encrypted in step 207-1', the 'site-specific public key calculated in step 205-1', and the 'site-specific secret key encrypted in step 207-1' are stored respectively in the 'site field, ID field, password field, terminal verification code field, public key field, and secret key field' of the 'one record in the site field where the default value is stored' of the secret information DB (111) in the user terminal (100).
[0247] In step 209-1, the public key field value matched to the 'site identification information received in step 202' in the site DB (113) is searched as the site's public key, and the 'site-specific public key, site password, and initial site-specific one-time terminal verification code' calculated in step 205-1 are each encrypted using the site's public key.
[0249] In step 210-1, 'the master password entered in step 203', 'the first random number, the second random number, the third random number, the GPS value, and the timestamp calculated in step 203', 'the hash value of the GPS value, the first GPS hash, the second GPS hash, the third GPS hash, the hash value of the timestamp, the first timestamp hash, the second timestamp hash, and the third timestamp hash calculated in step 204', 'the site-specific secret key, the site-specific public key, the site password, and the initial site-specific one-time terminal verification code calculated in step 205-1', and 'the hash value of the master password, the hash value of the site identification information, and the site-specific master key calculated in step 206-1' are all deleted and airplane mode is disabled.
[0251] In step 211-1, the site password and other registration application code from the user terminal (100) is matched and the 'site-dedicated public key, site password, and initial site-dedicated one-time terminal verification code encrypted in step 209-1' is transmitted to the site server (300) as a response to 'reception in step 202'.
[0253] When the site server (300) receives the ‘encrypted site-dedicated public key, encrypted site password, and encrypted first site-dedicated one-time terminal verification code’ that is transmitted in step 211 and matched with the site password registration application code, etc., it decrypts the ‘encrypted site-dedicated public key, site password, and first site-dedicated one-time terminal verification code’ respectively using its own secret key for user authentication business, calculates the hash value of the decrypted site password, and stores the ‘decrypted site-dedicated public key,’ the ‘hash value of the site password,’ and the ‘decrypted first site-dedicated one-time terminal verification code’ respectively in the ‘public key field, password field, and terminal verification code field’ of the ‘record from which the site server customer DBID field value was searched in step 201’ in the customer DB (310).
[0256] FIG. 4 is a diagram illustrating an example of an operation in which a user of the present invention registers an authentication medium for a site where an API for communicating with the authentication app of the present invention has not been developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0258] When the user selects the authentication app icon displayed on the user terminal (100) in step 301, the main screen is displayed as exemplified in FIG. 13.
[0260] According to an additional aspect of the present invention, the 'menus matching each site identification information stored in the site field of the secret information DB (111)' are one or more of the 'boxes in which each site identification information is recorded' and 'images matching the site identification information in the site DB (113)'.
[0262] In step 302, when the user selects the Add Site box displayed on the main screen, airplane mode is selected and a password registration screen is displayed as exemplified in FIG. 9.
[0264] According to an additional aspect of the present invention, the password registration screen further comprises a password recommendation box that matches the password input field.
[0267] In step 303, when the user inputs arbitrary site identification information, 'ID registered and in use on the site corresponding to the site identification information' and 'site password registered and in use on the site' into the 'site identification information input field, ID input field, and password input field' respectively and selects the 'stop adding box', a master password input field and a confirmation box as exemplified in Figure 23 are displayed on the user terminal (100).
[0269] According to another aspect of the present invention, in step 303, the user may enter a ‘site password to be newly registered on the site’ instead of a ‘site password currently in use registered on the site.’
[0271] In step 304, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the hash value of the master password and the hash value of the 'site identification information entered in step 303' are each calculated, and the two calculated hash values are used to calculate the site-specific master key in the form of binary code (i.e., "site-specific master key"), and for each ASCII character constituting the 'site password entered in step 303', one of the one or more binary codes matched to each character in the character matching table (112) is randomly selected, and the selected binary codes are combined again in the order of each matched character to produce a value in the form of binary code (i.e., "binary code site password").
[0273] In the first embodiment of the character matching table (112) as partially illustrated in FIG. 16, for binary codes "0010001" to "01111110" corresponding to decimal numbers "33" to "126", one of the alphabets, numbers, and symbols from "!" to "~" corresponding to 'ASCII characters matching the same decimal number' is matched, for binary codes "01111111" to "10001000" corresponding to decimal numbers "127" to "136", one number from "0" to "9" is matched, for each binary code corresponding to decimal numbers "137" to "162", one uppercase alphabet letter from "A" to "Z" is matched in order, and for each binary code corresponding to decimal numbers "163" to "188", one lowercase alphabet letter from "a" to "z" is matched in order, and decimal Each binary code corresponding to decimal numbers from "189" to "198" is matched one by one with the digits "0" through "9" in order; each binary code corresponding to decimal numbers from "199" to "224" is matched one by one with the uppercase letters "A" through "Z" in order; each binary code corresponding to decimal numbers from "225" to "250" is matched one by one with the lowercase letters "a" through "z" in order; each binary code corresponding to decimal numbers from "251" to "255" is matched one by one with the digits "0" through "4" in order; each binary code corresponding to decimal numbers from "0" to "4" is matched one by one with the digits "5" through "9" in order; each binary code corresponding to decimal numbers from "5" to "30" is matched one by one with the lowercase letters "a" through "z" in order; and each binary code corresponding to decimal numbers from "31" to "32" In code, uppercase letters from "A" through "B" are matched one by one in order.
[0275] In the case of the first embodiment above, symbols belonging to ASCII characters are each matched to only one binary code, numbers, lowercase alphabets, and uppercase alphabets "A" through "B" are each matched to four binary codes, and uppercase alphabets and "C" through "Z" are each matched to three binary codes. Therefore, while a definite value can be produced for uppercase and lowercase alphabets, numbers, or symbols that match any binary code, a definite value cannot be produced for binary codes that match any uppercase and lowercase alphabets or numbers.
[0277] An embodiment of the method for matching a binary code to each character constituting the 'site password entered in step 303' in step 304 of the first embodiment above comprises: a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "33" to "126" respectively if each character is a symbol; a step of converting the last two binary digits of the 'site-dedicated master key in binary code form calculated in step 304' into decimal numbers; a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "33" to "126" respectively if the converted decimal value is "0" and each character corresponds to either an alphabet or a number; and a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "127" to "188" respectively if the converted decimal value is "1" and each character corresponds to either an alphabet or a number. The method includes: a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "199" to "250" respectively, if the value converted to the decimal number is "2" and each character corresponds to one of an alphabet and a number; a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "251" to "255" and decimal numbers from "0" to "32" respectively, if the value converted to the decimal number is "3" and each character corresponds to one of uppercase alphabets from "C" to "Z"; and a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "67" to "90".
[0280] Meanwhile, in the second embodiment of the character matching table (112) as partially illustrated in FIG. 17, for binary codes "00000000" to "00000111" corresponding to decimal numbers "0" to "7", one of the "8 symbols that are relatively frequently used in passwords among symbols belonging to ASCII characters" (hereinafter referred to as "8 major symbols") is matched to each; for binary codes "00001000" to "01000101" corresponding to decimal numbers "8" to "69" (hereinafter referred to as "1st group"), one of the "numbers, lowercase alphabets, and uppercase alphabets" is matched to each in their respective order; for binary codes corresponding to decimal numbers "70" to "131" (hereinafter referred to as "2nd group"), one of the "numbers, lowercase alphabets, and uppercase alphabets" is matched to each in their respective order; and for binary codes corresponding to decimal numbers "132" to "193" In the code (hereinafter referred to as "Group 3"), 'numbers, lowercase letters, and uppercase letters' are each matched one by one in their respective order, and in the binary code corresponding to decimal numbers "194" through "255" (hereinafter referred to as "Group 4"), 'numbers, lowercase letters, and uppercase letters' are each matched one by one in their respective order.
[0282] In the case of the second embodiment above, the user composes the site password using only eight major symbols, uppercase and lowercase alphabets, and numbers, wherein each of the eight major symbols is matched to only one binary code, and the numbers, lowercase alphabets, and uppercase alphabets are each matched to one of four binary codes, for a total of four binary codes. Therefore, while a definitive value can be produced for uppercase and lowercase alphabets, numbers, or symbols that match any binary code, a definitive value cannot be produced for binary codes that match any uppercase and lowercase alphabets or numbers.
[0284] One embodiment of the method for matching a binary code for each uppercase and lowercase alphabet or number constituting the 'site password entered in step 303' in step 304 of the above second embodiment includes the following steps 304a-1 to 304a-(n+1). provided that "n" is the number of characters constituting the site password.
[0287] In step 304a-1, the 2-digit binary number consisting of the 1st and 2nd binary numbers from the front of the 'site-only master key in binary code form produced in step 304' is converted into the 1st decimal number, the 2-digit binary number consisting of the 2nd and 3rd binary numbers from the front is converted into the 2nd decimal number, and the 2-digit binary number consisting of the nth and n+1th binary numbers from the front is converted into the nth decimal number.
[0289] According to an additional aspect of the present invention, when the number of binary numbers constituting the site-dedicated master key (hereinafter referred to as "m") is less than or equal to "n," the m-th decimal number is calculated by converting a 2-digit binary number consisting of the m-th binary number and the 1st binary number from the front of the site-dedicated master key into a decimal number, the m+1-th decimal number is calculated as the remainder of dividing the value obtained by adding 1 to the 1-th decimal number by 4, and the m+i-th decimal number is calculated as the remainder of dividing the value obtained by adding 1 to the i-th decimal number by 4.
[0291] For example, in the second embodiment of the character matching table (112), if the 'site-exclusive master key in binary code form calculated in step 304' is "011" and the site password is "4gH!", then the site password consists of 4 characters (i.e., n=4), so it is necessary to derive the 4th decimal number from the 1st decimal number, and the site-exclusive master key in binary code form consists of 3 binary numbers (i.e., m=3 <n). 사이트전용마스터키의 앞에서부터 1번째 이진수인 "0"과 2번째 이진수인 "1"로 구성되는 2자리수 이진수 "01"를 제1십진수인 '0x2 +1x1 = 1'로 변환하고, 앞에서부터 2번째 이진수인 "1"과 3번째 이진수인 "1"로 구성되는 2자리수 이진수 "11"을 제2십진수인 '1x2 + 1x1 =3'으로 변환하고, 앞에서부터 3번째 이진수인 "1"과 1번째 이진수인 "0"로 구성되는 2자리수 이진수 "10"을 제3십진수인 '1x2 + 0x1 =2'로 변환하고, m+1십진수인 제4십진수는 제1십진수인 "1"에 1을 더한 값인 "2"를 4로 나눈 나머지인 "2"로 산출한다.
[0294] In step 304a-2, if the 'first decimal number converted in step 304a-1' is "0" and the first character constituting the site password is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the first group; if the first decimal number is "1" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the second group; if the first decimal number is "2" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the third group; and if the first decimal number is "3" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the fourth group.
[0296] In the example exemplified in step 304a-1, the first decimal number was "1", and the first character of the site password "4gH!" is "4", not the eighth character. Therefore, the "4" is converted into "01001001", which is the binary code matched to "4" among the "binary codes corresponding to decimal numbers 70 to 131", which are "binary codes belonging to the second group" in the character matching table (111) exemplified in FIG. 17.
[0299] In step 304a-3, if the 'second decimal number converted in step 304a-1' is "0" and the second character constituting the site password is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the first group; if the second decimal number is "1" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the second group; if the second decimal number is "2" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the third group; and if the second decimal number is "3" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the fourth group.
[0301] In the example exemplified in step 304a-1, the second decimal number was "3", and the second character of the site password "4gH!" was "g", not the eighth character. Therefore, the "g" is converted into "11010010" (corresponding to the decimal number "210"), which is the binary code matched to the second character "g" among the "binary codes corresponding to decimal numbers 194 to 255", which are "binary codes belonging to the fourth group" in the character matching table (111) exemplified in FIG. 17.
[0303] In the example exemplified in step 304a-1, the third decimal number was "2", and the third character of the site password "4gH!" is "H", not the eighth character. Therefore, the "H" is converted into the binary code "10101111" (corresponding to the decimal number "175"), which is matched to "H" in the "binary codes corresponding to decimal numbers 132 to 193", which are "binary codes belonging to the third group" in the character matching table (111) exemplified in FIG. 17.
[0306] In step 304a-'n+1', if 'the nth decimal number converted in step 304a-1' is "0" and the nth character constituting the site password is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the first group; if the nth decimal number is "1" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the second group; if the nth decimal number is "2" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the third group; and if the nth decimal number is "3" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the fourth group.
[0308] In the example given in step 304a-1, n=4 and m=3. 'nm = 4-3 = 1', and the first decimal number was "1". Therefore, the fourth decimal number is the remainder of dividing 'first decimal number + 1' by 4, which is "2", the remainder of dividing '1+1=2' by 4. However, the fourth character of the site password "4gH!" is "!", which belongs to the eight major characters. Therefore, the above "!" is converted to "00000000" (corresponding to the decimal number "0") in the character matching table (111) exemplified in FIG. 17.
[0310] Since the first character of the site password is converted to "01001001", the second character is converted to "11010010", the third character is converted to "10101111", and the fourth character is converted to "00000000", in step 304, "010010011101010101011100000000" is produced by combining the four 8-bit binary numbers in order as the "binary code site password".
[0311] An example of the operation in which one or more binary codes matched to each character in the character matching table (112) are randomly selected in order for each ASCII character constituting the 'site password entered in step 303' in step 304 is further generalized to include the following steps: identifying p binary numbers (bits) following the first binary number (bit) of the 'site-dedicated master key in binary code form calculated in step 304' (provided that if the number of consecutive binary numbers of the site-dedicated master key is less than p, the missing binary numbers start again from the first binary number), and converting the identified p binary numbers (bits) into a first decimal number; identifying p binary numbers (bits) following the second binary number (bit) of the site-dedicated master key in the same way, and converting the identified p binary numbers (bits) into a second decimal number; A step of deriving the i-th decimal number (where i is a natural number from 1 to n) equal to the number of each ASCII character (i.e., "n") constituting the 'site password entered in step 303': if the i-th ASCII character constituting the site password is configured in an additional group in the character matching table (112), a binary code matched to the i-th ASCII character in the 'additional group among the additional groups that matches the i-th decimal number' is searched as the 'binary code matched to the i-th ASCII character'; and if the i-th ASCII character constituting the site password is not configured in an additional group in the character matching table (112), a binary code matched to the i-th ASCII character in the basic group is searched as the 'binary code matched to the i-th ASCII character'; the method is included. And the character matching table (112) contains 2 pAdditional groups are formed, and in each additional group, consecutive binary codes are matched for each of the a multiple code-matching characters, and the j-th (where j is from 1 to 2 p The first binary code of the additional group (natural number up to) is the binary code that follows the order of the last binary code of the j-1th additional group, and the first binary code of the 1st additional group is the binary code that follows the order of the last binary code of the basic group. Therefore, in the above character matching table (112), the ASCII character that matches an arbitrary binary code is unique, but the binary code that matches an arbitrary ASCII character is unique (in the case where the above ASCII character is a multiple code matching character), 2 p (in cases where the above ASCII character is not a multiple code matching character). Therefore, even if a site password in binary code form is exposed, it is not possible to reverse-calculate the site password in ASCII character form using that binary code form site password.
[0313] In step 307, the user terminal (100) encrypts the 'binary-coded site password calculated in step 304' using the 'site-specific master key calculated in step 304'.
[0315] In step 308, the ‘site identification information entered in step 303’, the ‘ID entered in step 303’, and the ‘site password encrypted and encoded in step 307’ are stored respectively in the ‘site field, ID field, and password field’ of the ‘one record in the site field where the default value is stored’ of the secret information DB (111) at the user terminal (100).
[0317] According to an additional aspect of the present invention, the ‘one record in which a default value is stored in a site field’ is the first record among the ‘records in which the site field of the record is a default value’.
[0319] In step 310, delete all of the 'site identification information and ID entered in step 303', 'master password entered in step 304', and 'has value of the master password and hash value of the site identification information, site-specific master key and binary-coded site password calculated in step 304', and disable airplane mode.
[0322] Meanwhile, according to another embodiment of the present invention, a password recommendation box is further configured in the password registration screen output in step 302 to match the password input field, and steps 303-1 to 310-1 below are operated in place of steps 303 to 310.
[0324] In step 303-1, when the user enters ‘arbitrary site identification information’ and ‘an ID registered and in use on the site corresponding to the site identification information’ into the ‘site identification information input field and ID input field’ respectively and selects the password recommendation box, a master password input field and a confirmation box are displayed as exemplified in FIG. 11.
[0326] In step 304-1, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the random value generation module (116) generates three random numbers as the first random number, the second random number, and the third random number, respectively; the GPS measurement module (117) measures the GPS value of the current terminal location; the timestamp module (118) calculates the timestamp of the current time; calculates the hash value of the GPS value; and uses the hash value text to calculate three hash values as the first GPS hash, the second GPS hash, and the third GPS hash, respectively; and calculates the hash value of the timestamp; and uses the hash value text to calculate three hash values as the first timestamp hash, the second timestamp hash, and the third timestamp hash, respectively.
[0328] The embodiments exemplified in Step 104 also apply to Step 304-1.
[0330] In Step 305-1, a site password is randomly generated in the form of binary code using one of the three random numbers, one of the three GPS hashes, and one of the three timestamp hashes.
[0332] The formula for the site password in binary code form calculated above is as follows.
[0333] l SitePassword in binary code form = f(second random number, second GPS hash, second timestamp hash)
[0335] In step 306-1, the hash value of the 'master password entered in step 304-1' is calculated, and the hash value of the 'site identification information entered in step 303-1' is calculated, and a site-specific master key in the form of binary code is calculated using the two hash values.
[0337] The additional work aspect in step 206 also applies to step 306-1.
[0339] In step 307-1, the user terminal (100) encrypts the ‘site password in binary code form calculated in step 305-1’ using the ‘site-specific master key calculated in step 306-1’.
[0341] In step 308-1, the ‘site identification information entered in step 303-1’, the ‘ID entered in step 303-1’, and the ‘site password in the form of encrypted binary code from step 307-1’ are stored respectively in the ‘site field, ID field, and password field’ of the ‘one record in the site field where a default value is stored’ of the secret information DB (111) at the user terminal (100).
[0343] The additional work aspect in step 208 also applies to step 308-1.
[0345] In step 309-1, the 'site password in binary code form calculated in step 305-1' is divided into specific bit units, and a matched character is searched for each of the 'binary codes in the divided specific bit units' in a character matching table (112) as exemplified in FIG. 16 or FIG. 17, and the searched characters are combined in order to calculate and output a 'readable site password', and 'site identification information and ID entered in step 303-1', 'master password entered in step 304-1', 'first random number, second random number, and third random number calculated in step 304-1, GPS value, timestamp, hash value of GPS value, first GPS hash, second GPS hash, third GPS hash, and hash value of timestamp, respectively, first timestamp hash, second timestamp hash, and third timestamp hash', and 'binary Delete all of the 'site password in code form', 'the hash value of the master password and the hash value of the site identification information and the site-specific master key calculated in Step 306-1', and 'the readable site password calculated in Step 309-1'.
[0347] According to an additional aspect of the present invention, the certain bit unit is an 8-bit unit, and the 'readable site password' is output to the 'password input field configured on the password registration screen output in step 302'.
[0349] In one embodiment, if the 'site password in binary code form calculated in step 305-1' is "01010000 11011101 01001001 00010001" and the character matching table exemplified in FIG. 17 is used, then in FIG. 17, the character matched to "01010000" (corresponding to decimal "80") is "a", the character matched to "11011101" (corresponding to decimal "221") is "r", the character matched to "01001001" (corresponding to decimal "73") is "3", and the character matched to "00010001" (corresponding to decimal "17") is "9". When the above characters are combined in order, "ar37" is obtained. Therefore, in step 309-1, "ar37" is output as a 'readable site password'.
[0351] According to an additional aspect of the present invention, a user updates the 'readable site password' output in step 309-1 as their own password on the site using a known method.
[0353] When the authentication app (110) is closed on the user terminal (100) in step 310-1, or when a certain amount of time (e.g., 3 minutes) has elapsed after step 309-1 is executed, the 'readable site password output in step 309-1' is deleted and airplane mode is disabled.
[0356] FIG. 4 is a diagram illustrating an example of an operation in which a user of the present invention registers an authentication medium for a site where an API for communicating with the authentication app of the present invention has not been developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0358] When the user selects the authentication app icon displayed on the user terminal (100) in step 301, the main screen is displayed as exemplified in FIG. 13.
[0360] According to an additional aspect of the present invention, the 'menus matching each site identification information stored in the site field of the secret information DB (111)' are one or more of the 'boxes in which each site identification information is recorded' and 'images matching the site identification information in the site DB (113)'.
[0362] In step 302, when the user selects the Add Site box displayed on the main screen, airplane mode is selected and a password registration screen is displayed as exemplified in FIG. 9.
[0364] According to an additional aspect of the present invention, the password registration screen further comprises a password recommendation box that matches the password input field.
[0367] In step 303, when the user inputs arbitrary site identification information, 'ID registered and in use on the site corresponding to the site identification information' and 'site password registered and in use on the site' into the 'site identification information input field, ID input field, and password input field' respectively and selects the 'stop adding box', a master password input field and a confirmation box as exemplified in Figure 23 are displayed on the user terminal (100).
[0369] According to another aspect of the present invention, in step 303, the user may enter a ‘site password to be newly registered on the site’ instead of a ‘site password currently in use registered on the site.’
[0371] In step 304, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the hash value of the master password and the hash value of the 'site identification information entered in step 303' are each calculated, and the two calculated hash values are used to calculate the site-specific master key in the form of binary code (i.e., "site-specific master key"), and for each ASCII character constituting the 'site password entered in step 303', one of the one or more binary codes matched to each character in the character matching table (112) is randomly selected, and the selected binary codes are combined again in the order of each matched character to produce a value in the form of binary code (i.e., "binary code site password").
[0373] In the first embodiment of the character matching table (112) as partially illustrated in FIG. 16, for binary codes "0010001" to "01111110" corresponding to decimal numbers "33" to "126", one of the alphabets, numbers, and symbols from "!" to "~" corresponding to 'ASCII characters matching the same decimal number' is matched, for binary codes "01111111" to "10001000" corresponding to decimal numbers "127" to "136", one number from "0" to "9" is matched, for each binary code corresponding to decimal numbers "137" to "162", one uppercase alphabet letter from "A" to "Z" is matched in order, and for each binary code corresponding to decimal numbers "163" to "188", one lowercase alphabet letter from "a" to "z" is matched in order, and decimal Each binary code corresponding to decimal numbers from "189" to "198" is matched one by one with the digits "0" through "9" in order; each binary code corresponding to decimal numbers from "199" to "224" is matched one by one with the uppercase letters "A" through "Z" in order; each binary code corresponding to decimal numbers from "225" to "250" is matched one by one with the lowercase letters "a" through "z" in order; each binary code corresponding to decimal numbers from "251" to "255" is matched one by one with the digits "0" through "4" in order; each binary code corresponding to decimal numbers from "0" to "4" is matched one by one with the digits "5" through "9" in order; each binary code corresponding to decimal numbers from "5" to "30" is matched one by one with the lowercase letters "a" through "z" in order; and each binary code corresponding to decimal numbers from "31" to "32" In code, uppercase letters from "A" through "B" are matched one by one in order.
[0375] In the case of the first embodiment above, symbols belonging to ASCII characters are each matched to only one binary code, numbers, lowercase alphabets, and uppercase alphabets "A" through "B" are each matched to four binary codes, and uppercase alphabets and "C" through "Z" are each matched to three binary codes. Therefore, while a definite value can be produced for uppercase and lowercase alphabets, numbers, or symbols that match any binary code, a definite value cannot be produced for binary codes that match any uppercase and lowercase alphabets or numbers.
[0377] An embodiment of the method for matching a binary code to each character constituting the 'site password entered in step 303' in step 304 of the first embodiment above comprises: a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "33" to "126" respectively if each character is a symbol; a step of converting the last two binary digits of the 'site-dedicated master key in binary code form calculated in step 304' into decimal numbers; a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "33" to "126" respectively if the converted decimal value is "0" and each character corresponds to either an alphabet or a number; and a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "127" to "188" respectively if the converted decimal value is "1" and each character corresponds to either an alphabet or a number. The method includes: a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "199" to "250" respectively, if the value converted to the decimal number is "2" and each character corresponds to one of an alphabet and a number; a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "251" to "255" and decimal numbers from "0" to "32" respectively, if the value converted to the decimal number is "3" and each character corresponds to one of uppercase alphabets from "C" to "Z"; and a step of matching the binary code corresponding to the character by matching each character to decimal numbers from "67" to "90".
[0380] Meanwhile, in the second embodiment of the character matching table (112) as partially illustrated in FIG. 17, for binary codes "00000000" to "00000111" corresponding to decimal numbers "0" to "7", one of the "8 symbols that are relatively frequently used in passwords among symbols belonging to ASCII characters" (hereinafter referred to as "8 major symbols") is matched to each; for binary codes "00001000" to "01000101" corresponding to decimal numbers "8" to "69" (hereinafter referred to as "1st group"), one of the "numbers, lowercase alphabets, and uppercase alphabets" is matched to each in their respective order; for binary codes corresponding to decimal numbers "70" to "131" (hereinafter referred to as "2nd group"), one of the "numbers, lowercase alphabets, and uppercase alphabets" is matched to each in their respective order; and for binary codes corresponding to decimal numbers "132" to "193" In the code (hereinafter referred to as "Group 3"), 'numbers, lowercase letters, and uppercase letters' are each matched one by one in their respective order, and in the binary code corresponding to decimal numbers "194" through "255" (hereinafter referred to as "Group 4"), 'numbers, lowercase letters, and uppercase letters' are each matched one by one in their respective order.
[0382] In the case of the second embodiment above, the user composes the site password using only eight major symbols, uppercase and lowercase alphabets, and numbers, wherein each of the eight major symbols is matched to only one binary code, and the numbers, lowercase alphabets, and uppercase alphabets are each matched to one of four binary codes, for a total of four binary codes. Therefore, while a definitive value can be produced for uppercase and lowercase alphabets, numbers, or symbols that match any binary code, a definitive value cannot be produced for binary codes that match any uppercase and lowercase alphabets or numbers.
[0384] One embodiment of the method for matching a binary code for each uppercase and lowercase alphabet or number constituting the 'site password entered in step 303' in step 304 of the above second embodiment includes the following steps 304a-1 to 304a-(n+1). provided that "n" is the number of characters constituting the site password.
[0387] In step 304a-1, the 2-digit binary number consisting of the 1st and 2nd binary numbers from the front of the 'site-only master key in binary code form produced in step 304' is converted into the 1st decimal number, the 2-digit binary number consisting of the 2nd and 3rd binary numbers from the front is converted into the 2nd decimal number, and the 2-digit binary number consisting of the nth and n+1th binary numbers from the front is converted into the nth decimal number.
[0389] According to an additional aspect of the present invention, when the number of binary numbers constituting the site-dedicated master key (hereinafter referred to as "m") is less than or equal to "n," the m-th decimal number is calculated by converting a 2-digit binary number consisting of the m-th binary number and the 1st binary number from the front of the site-dedicated master key into a decimal number, the m+1-th decimal number is calculated as the remainder of dividing the value obtained by adding 1 to the 1-th decimal number by 4, and the m+i-th decimal number is calculated as the remainder of dividing the value obtained by adding 1 to the i-th decimal number by 4.
[0391] For example, in the second embodiment of the character matching table (112), if the 'site-exclusive master key in binary code form calculated in step 304' is "011" and the site password is "4gH!", then the site password consists of 4 characters (i.e., n=4), so it is necessary to derive the 4th decimal number from the 1st decimal number, and the site-exclusive master key in binary code form consists of 3 binary numbers (i.e., m=3 <n). 사이트전용마스터키의 앞에서부터 1번째 이진수인 "0"과 2번째 이진수인 "1"로 구성되는 2자리수 이진수 "01"를 제1십진수인 '0x2 +1x1 = 1'로 변환하고, 앞에서부터 2번째 이진수인 "1"과 3번째 이진수인 "1"로 구성되는 2자리수 이진수 "11"을 제2십진수인 '1x2 + 1x1 =3'으로 변환하고, 앞에서부터 3번째 이진수인 "1"과 1번째 이진수인 "0"로 구성되는 2자리수 이진수 "10"을 제3십진수인 '1x2 + 0x1 =2'로 변환하고, m+1십진수인 제4십진수는 제1십진수인 "1"에 1을 더한 값인 "2"를 4로 나눈 나머지인 "2"로 산출한다.
[0394] In step 304a-2, if the 'first decimal number converted in step 304a-1' is "0" and the first character constituting the site password is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the first group; if the first decimal number is "1" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the second group; if the first decimal number is "2" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the third group; and if the first decimal number is "3" and the first character is not one of the eight major symbols, the first character is converted into a binary code that matches the first character among the binary codes belonging to the fourth group.
[0396] In the example exemplified in step 304a-1, the first decimal number was "1", and the first character of the site password "4gH!" is "4", not the eighth character. Therefore, the "4" is converted into "01001001", which is the binary code matched to "4" among the "binary codes corresponding to decimal numbers 70 to 131", which are "binary codes belonging to the second group" in the character matching table (111) exemplified in FIG. 17.
[0399] In step 304a-3, if the 'second decimal number converted in step 304a-1' is "0" and the second character constituting the site password is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the first group; if the second decimal number is "1" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the second group; if the second decimal number is "2" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the third group; and if the second decimal number is "3" and the second character is not one of the eight major symbols, the second character is converted into a binary code that matches the second character among the binary codes belonging to the fourth group.
[0401] In the example exemplified in step 304a-1, the second decimal number was "3", and the second character of the site password "4gH!" was "g", not the eighth character. Therefore, the "g" is converted into "11010010" (corresponding to the decimal number "210"), which is the binary code matched to the second character "g" among the "binary codes corresponding to decimal numbers 194 to 255", which are "binary codes belonging to the fourth group" in the character matching table (111) exemplified in FIG. 17.
[0403] In the example exemplified in step 304a-1, the third decimal number was "2", and the third character of the site password "4gH!" is "H", not the eighth character. Therefore, the "H" is converted into the binary code "10101111" (corresponding to the decimal number "175"), which is matched to "H" in the "binary codes corresponding to decimal numbers 132 to 193", which are "binary codes belonging to the third group" in the character matching table (111) exemplified in FIG. 17.
[0406] In step 304a-'n+1', if 'the nth decimal number converted in step 304a-1' is "0" and the nth character constituting the site password is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the first group; if the nth decimal number is "1" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the second group; if the nth decimal number is "2" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the third group; and if the nth decimal number is "3" and the nth character is not an 8-character symbol, the nth character is converted into a binary code that matches the nth character among the binary codes belonging to the fourth group.
[0408] In the example given in step 304a-1, n=4 and m=3. 'nm = 4-3 = 1', and the first decimal number was "1". Therefore, the fourth decimal number is the remainder of dividing 'first decimal number + 1' by 4, which is "2", the remainder of dividing '1+1=2' by 4. However, the fourth character of the site password "4gH!" is "!", which belongs to the eight major characters. Therefore, the above "!" is converted to "00000000" (corresponding to the decimal number "0") in the character matching table (111) exemplified in FIG. 17.
[0410] Since the first character of the site password is converted to "01001001", the second character is converted to "11010010", the third character is converted to "10101111", and the fourth character is converted to "00000000", in step 304, "010010011101010101011100000000" is produced by combining the four 8-bit binary numbers in order as the "binary code site password".
[0413] In step 307, the user terminal (100) encrypts the 'binary-coded site password calculated in step 304' using the 'site-specific master key calculated in step 304'.
[0415] In step 308, the ‘site identification information entered in step 303’, the ‘ID entered in step 303’, and the ‘site password encrypted and encoded in step 307’ are stored respectively in the ‘site field, ID field, and password field’ of the ‘one record in the site field where the default value is stored’ of the secret information DB (111) at the user terminal (100).
[0417] According to an additional aspect of the present invention, the ‘one record in which a default value is stored in a site field’ is the first record among the ‘records in which the site field of the record is a default value’.
[0419] In step 310, delete all of the 'site identification information and ID entered in step 303', 'master password entered in step 304', and 'has value of the master password and hash value of the site identification information, site-specific master key and binary-coded site password calculated in step 304', and disable airplane mode.
[0422] Meanwhile, according to another embodiment of the present invention, a password recommendation box is further configured in the password registration screen output in step 302 to match the password input field, and steps 303-1 to 310-1 below are operated in place of steps 303 to 310.
[0424] In step 303-1, when the user enters ‘arbitrary site identification information’ and ‘an ID registered and in use on the site corresponding to the site identification information’ into the ‘site identification information input field and ID input field’ respectively and selects the password recommendation box, a master password input field and a confirmation box are displayed as exemplified in FIG. 11.
[0426] In step 304-1, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the random value generation module (116) generates three random numbers as the first random number, the second random number, and the third random number, respectively; the GPS measurement module (117) measures the GPS value of the current terminal location; the timestamp module (118) calculates the timestamp of the current time; calculates the hash value of the GPS value; and uses the hash value text to calculate three hash values as the first GPS hash, the second GPS hash, and the third GPS hash, respectively; and calculates the hash value of the timestamp; and uses the hash value text to calculate three hash values as the first timestamp hash, the second timestamp hash, and the third timestamp hash, respectively.
[0428] The embodiments exemplified in Step 104 also apply to Step 304-1.
[0430] In Step 305-1, a site password is randomly generated in the form of binary code using one of the three random numbers, one of the three GPS hashes, and one of the three timestamp hashes.
[0432] The formula for the site password in binary code form calculated above is as follows.
[0433] * Site password in binary code form = f(second random number, second GPS hash, second timestamp hash)
[0435] In step 306-1, the hash value of the 'master password entered in step 304-1' is calculated, and the hash value of the 'site identification information entered in step 303-1' is calculated, and a site-specific master key in the form of binary code is calculated using the two hash values.
[0437] The additional work aspect in step 206 also applies to step 306-1.
[0439] In step 307-1, the user terminal (100) encrypts the ‘site password in binary code form calculated in step 305-1’ using the ‘site-specific master key calculated in step 206’.
[0441] In step 308-1, the ‘site identification information entered in step 303-1’, the ‘ID entered in step 303-1’, and the ‘site password in the form of encrypted binary code from step 307-1’ are stored respectively in the ‘site field, ID field, and password field’ of the ‘one record in the site field where a default value is stored’ of the secret information DB (111) at the user terminal (100).
[0443] The additional work aspect in step 208 also applies to step 308-1.
[0445] In step 309-1, the 'site password in binary code form calculated in step 305-1' is divided into specific bit units, and a matched character is searched for each of the 'binary codes in the divided specific bit units' in a character matching table (112) as exemplified in FIG. 16 or FIG. 17, and the searched characters are combined in order to calculate and output a 'readable site password', and 'site identification information and ID entered in step 303-1', 'master password entered in step 304-1', 'first random number, second random number, and third random number calculated in step 304-1, GPS value, timestamp, hash value of GPS value, first GPS hash, second GPS hash, third GPS hash, and hash value of timestamp, respectively, first timestamp hash, second timestamp hash, and third timestamp hash', and 'binary Delete all of the 'site password in code form', 'the hash value of the master password and the hash value of the site identification information and the site-specific master key calculated in Step 306-1', and 'the readable site password calculated in Step 309-1'.
[0447] According to an additional aspect of the present invention, the certain bit unit is an 8-bit unit, and the 'readable site password' is output to the 'password input field configured on the password registration screen output in step 302'.
[0449] In one embodiment, if the 'site password in binary code form calculated in step 305-1' is "01010000 11011101 01001001 00010001" and the character matching table exemplified in FIG. 17 is used, then in FIG. 17, the character matched to "01010000" (corresponding to decimal "80") is "a", the character matched to "11011101" (corresponding to decimal "221") is "r", the character matched to "01001001" (corresponding to decimal "73") is "3", and the character matched to "00010001" (corresponding to decimal "17") is "9". When the above characters are combined in order, "ar37" is obtained. Therefore, in step 309-1, "ar37" is output as a 'readable site password'.
[0451] According to an additional aspect of the present invention, a user updates the 'readable site password' output in step 309-1 as their own password on the site using a known method.
[0453] When the authentication app (110) is closed on the user terminal (100) in step 310-1, or when a certain amount of time (e.g., 3 minutes) has elapsed after step 309-1 is executed, the 'readable site password output in step 309-1' is deleted and airplane mode is disabled.
[0456] FIG. 5 is a diagram illustrating an example of an operation in which a user of the present invention accesses a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0458] In step 401, the site server (300) matches the API method identity verification request code and transmits the site identification information of the above site to the user terminal (100).
[0460] According to an additional aspect of the present invention, prior to step 401, the user terminal (100) accesses a login page provided by the site server (300); and the user selects a box displayed on the login page that is selected when wanting to authenticate oneself using the API of the present invention (hereinafter referred to as the "API of the present invention authentication box") using the user terminal (100).
[0462] When the user terminal (100) receives ‘site identification information matched to the API method identity verification request code transmitted in step 401’ in step 402, the authentication app (110) is activated by the API method identity verification request code, and airplane mode is selected under the control of the authentication app (110), and a master password input field and a confirmation box are displayed as exemplified in FIG. 11.
[0464] In step 403, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the hash value of the master password is calculated, the hash value of the 'site identification information received in step 402' is calculated, the hash value of the authentication app publisher identification information is calculated, and a site-specific master key in the form of binary code is calculated using the 'has value of the master password' and the 'has value of the site identification information', while an app management server-specific master key in the form of binary code is calculated using the 'has value of the master password' and the 'has value of the authentication app publisher identification information'.
[0466] According to an additional aspect of the present invention, the site-specific master key is calculated as the hash value of the combined value of the 'hash value of the master password' and the 'hash value of the site identification information', and the app management server-specific master key is calculated as the hash value of the combined value of the 'hash value of the master password' and the 'hash value of the authentication app issuer identification information'.
[0468] According to an additional aspect of the present invention, step 403 includes the operation of searching for the site field value of the first record of the secret information DB (111) as authentication app issuer identification information.
[0470] In step 404, the secret key field value of a record in the secret information DB (111) in the user terminal (100) that stores authentication app issuer identification information in the site field is searched as an 'encrypted secret key', and the 'ID field value, password field value, and terminal verification code field value' of the record in the site field that stores the site identification information are searched as 'site ID, encrypted site password, and encrypted one-time terminal verification code', respectively, and the 'encrypted site password' is decrypted with the 'site-dedicated master key calculated in step 403', and the 'encrypted secret key' is decrypted with the 'app management server-dedicated master key calculated in step 403'.
[0472] In step 405, the user terminal (100) decrypts the ‘encrypted one-time terminal verification code’ using the ‘secret key decrypted in step 404’, and encrypts the ‘site password decrypted in step 404’ using the decrypted one-time terminal verification code to generate an OTP.
[0474] In step 406, the 'master password entered in step 403', 'has value of the master password and site identification information and hash value of authentication app issuer identification information and site-specific master key and app management server-specific master key calculated in step 403', 'site password and secret key decrypted in step 404', and 'one-time terminal verification code decrypted in step 405' are deleted from the user terminal (100), and after disabling airplane mode, the 'OTP generated in step 405' is matched with the 'site ID searched in step 404' and transmitted to the site server (300) as a response to the 'reception in step 402'.
[0477] Meanwhile, according to another aspect of the present invention, which is characterized in that the above-mentioned site server (300) is a site server (300) of a site that encrypts a one-time terminal verification code with a public key exclusive to the site, steps 403-1 to 406-1 below may be operated in place of steps 403 to 406.
[0479] In step 403-1, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the master password is input into a hash function to calculate the hash value of the master password, the 'site identification information received in step 402' is input into a hash function to calculate the hash value of the site identification information, and a site-specific master key in the form of binary code is calculated using the 'hash value of the master password' and the 'hash value of the site identification information'.
[0481] In step 404-1, the 'ID field value, password field value, terminal verification code field value, and secret key field value' of the record in which the site identification information is stored in the site field of the secret information DB (111) at the user terminal (100) are searched as the site ID, encrypted site password, encrypted one-time terminal verification code, and encrypted site-specific secret key, respectively, and the 'encrypted site password and encrypted site-specific secret key' are decrypted using the 'site-specific master key calculated in step 403-1'.
[0483] In step 405-1, the user terminal (100) decrypts the ‘encrypted one-time terminal verification code’ using the ‘site-specific secret key decrypted in step 404-1’, and encrypts the ‘site password decrypted in step 404-1’ using the decrypted one-time terminal verification code to generate an OTP.
[0485] In step 406-1, the 'master password entered in step 403-1', 'the hash value of the master password and the hash value of the site identification information and the hash value of the authentication app issuer identification information and the site-specific master key calculated in step 403-1', 'the site password and site-specific secret key decrypted in step 404-1', and 'the one-time terminal verification code decrypted in step 405-1' are deleted from the user terminal (100), and the 'OTP generated in step 405-1' is matched with the 'site ID searched in step 404-1' and transmitted to the site server (300) as a reply to 'reception in step 402'.
[0488] In step 407, when the site server (300) receives the 'OTP matched to the site ID transmitted in step 406 (or step 406-1),' the 'password field value, public key field value, and terminal verification code field value' of the record in the customer DB (310) where the site ID is stored in the ID field are searched as the 'hash value of the site password, public key, and one-time terminal verification code,' respectively, and the site password is calculated by decrypting the OTP with the one-time terminal verification code, and the hash value of the 'calculated site password' is compared with the 'hash value of the searched site password.'
[0490] If the comparison result in step 407 matches, steps 408 and below are executed.
[0492] In step 408, it is determined that identity verification is completed at the site server (300), and a new one-time terminal verification code in the form of a random binary code is generated. The terminal verification code field in the customer DB (310) that matches the 'site ID received in step 407' is updated with the generated one-time terminal verification code. The 'updated one-time terminal verification code' is encrypted with the 'public key retrieved in step 407'. As a response to the 'reception in step 407', the 'site identification information for the user to identify themselves' and the 'encrypted, updated one-time terminal verification code' are transmitted to the user terminal (100) by matching them with the login authorization authentication completion code.
[0494] In step 409, when the user terminal (100) receives the ‘site identification information and encrypted one-time terminal verification code matched to the login authorization authentication completion code transmitted in step 408,’ the terminal verification code field matched to the site identification information in the secret information DB (111) is updated with the ‘encrypted one-time terminal verification code.’
[0497] FIG. 6 is a diagram illustrating an example of an operation in which a user of the present invention accesses a site where an API for communicating with the authentication app of the present invention has not been developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0499] In step 501, when the user selects the authentication app icon displayed on the user terminal (100), a main screen as exemplified in FIG. 13 is displayed.
[0501] In step 502, when the user selects one of the 'site identification information boxes displayed on the main screen in step 501', the 'encrypted binary code site password' matched to the 'site identification information corresponding to the selected site identification information box' is searched in the secret information DB (111) of the user terminal (100), and after selecting airplane mode, a master password input field and a confirmation box are displayed on the user terminal (100) as exemplified in FIG. 11.
[0503] One embodiment of the operation in step 502 includes the action of a user selecting site identification information listed as “gym locker” on the main screen illustrated in FIG. 13.
[0505] In step 503, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the hash value of the master password is calculated and the hash value of the 'site identification information in step 502' is calculated, and a site-specific master key matching the site identification information in binary code form is calculated using the two calculated hash values.
[0507] In step 504, the user terminal (100) decrypts the ‘encrypted binary code site password retrieved in step 502’ using the ‘site-specific master key calculated in step 503’.
[0509] In step 505, the 'binary code site password decrypted in step 504' at the user terminal (100) is divided into specific bit units, and a matching character is searched for for each 'binary code of the divided specific bit units' in a character matching table (112) as exemplified in FIG. 16 or FIG. 17, and the searched characters are connected in order to produce and output a 'readable site password'.
[0511] One embodiment exemplified in step 309-1 may be one embodiment of step 505.
[0513] Figure 12 is an example of a screen displaying the above-mentioned readable site password.
[0515] According to an additional aspect of the present invention, a user can input the ‘readable site password output in step 505’ into a password input field configured on the ‘login page of the corresponding site’.
[0517] In step 507, when the authentication app (110) is closed on the user terminal (100) or after a certain amount of time (e.g., 3 minutes) has elapsed after step 505 is executed, the ‘readable site password output in step 505’ is deleted and airplane mode is disabled.
[0520] FIG. 7 is a diagram illustrating an example of an operation in which a user of the present invention changes a master password currently in use in an authentication app installed on their user terminal, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0522] In step 601, when the user selects the authentication app icon displayed on the user terminal (100), a main screen as exemplified in FIG. 13 is displayed.
[0524] In step 602, when the user selects a settings box on the main screen displayed above, one or more settings menu boxes, including a “Change Master Password” box, are displayed.
[0526] In step 603, at the user terminal (100), if the user selects the “Change Master Password” box among the setting menu boxes displayed in step 602, airplane mode is selected, and a predetermined screen (hereinafter referred to as the “Change Master Password Screen”) including the “Input field for Master Password before change,” the “Confirm input field for Master Password before change,” the “Input field for Master Password after change,” the “Confirm input field for Master Password after change,” and a confirmation box is displayed as exemplified in FIG. 14.
[0528] In step 604, on the 'master password change screen displayed on the user terminal (100) in step 603', if the 'currently used master password' is entered into both the 'master password input field before change' and the 'master password confirmation input field before change', and the 'master password to be used in the future' is entered into both the 'master password input field after change' and the 'master password confirmation input field after change', and then the confirmation box is selected, it is determined whether the two pieces of information entered in the 'master password input field before change' and the 'master password confirmation input field before change' match each other (hereinafter referred to as "master password verification determination before change"), and it is determined whether the two pieces of information entered in the 'master password input field after change' and the 'master password confirmation input field after change' match each other (hereinafter referred to as "master password verification determination after change").
[0530] If it is determined that the master password verification judgment before change and the master password verification judgment after change in step 604 both match each other, steps 605 and below are executed.
[0532] In step 605, the hash value of the ‘information entered in the matching pre-change master password input field’ (hereinafter referred to as “matching confirmation pre-change master password”) is calculated, and all site field values are searched in the secret information DB (111) to calculate each hash value, and the ‘pre-change site-specific master keys’ corresponding to each site field value are calculated using the calculated ‘hash value of the matching confirmation pre-change master password’ and the calculated ‘hash value of each site field value’.
[0534] According to the additional work aspect in Step 605, the 'previous site-specific master keys produced in Step 605' are calculated using the following formula: 'previous site-specific master key' corresponding to the i-th site field value = h[h(match-verified previous master password), h(i-th site field value)]
[0536] In step 606, each password field value (i.e., encrypted site password) matched to 'each site field value searched in step 605' in the secret information DB (111) is decrypted using 'the site-specific master key before change calculated in step 605 by matching it to the site field value'.
[0538] In step 607, the hash value of the ‘information entered in the matching modified master password input field’ (hereinafter referred to as “matching verified modified master password”) is calculated, and the ‘hash value of the matching verified modified master password’ and the ‘hash value of each site field value calculated in step 605’ are used to calculate the ‘modified site-specific master keys’ corresponding to each site field value.
[0540] According to the additional work aspect in Step 607, the 'modified site-specific master keys produced in Step 607' are calculated using the following formula: 'modified site-specific master key' corresponding to the i-th site field value = h[h(match-verified modified master password), h(i-th site field value)]
[0542] In step 608, at the user terminal (100), the password field value decrypted in step 606 (i.e., the decrypted site password) corresponding to the site identification information is encrypted using the ‘each modified site-specific master key calculated in step 607’.
[0544] In step 609, the password field matched to each site identification information in the secret information DB (111) is updated with the 'site password corresponding to each site identification information encrypted in step 608'.
[0546] In step 610, the airplane mode is deactivated after deleting all of the following from the user terminal (100): 'the four master passwords entered in step 604', 'the hash value of the master password before the change verification calculated in step 605', 'the site-specific master keys before the change calculated in step 605', 'the site passwords decrypted in step 606', and 'the hash value of the master password after the change verification and the site-specific master keys after the change calculated in step 607'.
[0549] FIG. 8 is a diagram illustrating an example of an operation in which a user of the present invention authenticates their identity for a transaction on a site where an API for communicating with the authentication app of the present invention is developed, in a preferred embodiment of the safe and convenient authentication medium management and non-repudiation method based on a master password of the present invention.
[0551] In step 701, the user terminal (100) accesses the 'site server (300) of the representative merchant with API developed' (hereinafter referred to as "API developed PG") by a redirection method according to the online seller's redirection.
[0553] In step 702, the API development PG (300) matches its own site identification information and transmits its own public key for identity verification business, 'a specified transaction information subject to consent request encrypted with its own private key for identity verification business' and a specified authentication app activation code to the 'user terminal (100) connected in step 501'.
[0555] One example of the transaction information subject to the consent request above is information regarding a predetermined payment promised by the user of the user terminal (100) to the online seller.
[0557] When the user terminal (100) receives the site identification information, public key, encrypted transaction information, and authentication app activation code transmitted in step 702 in step 703, the authentication app (110) is activated by the authentication app activation code, and the mutual field value, public key field value, first character field value, second character field value, third character field value, and fourth character field value matched to the site identification information are searched in the site DB (113) of the authentication app (110), and the 'searched public key field value' is compared with the 'received public key'.
[0559] If the above comparison result matches, steps 704 and below are executed.
[0561] In step 704, the user terminal (100) decrypts the 'encrypted transaction information received in step 703' using the 'public key that matched the comparison result in step 703', and outputs the 'mutual field value found in step 703', the 'decrypted transaction information', and a confirmation box.
[0563] In step 705, when the user selects the 'confirmation box output in step 704', airplane mode is selected under the control of the authentication app (110), and a master password input field and a confirmation box are displayed on the user terminal (100) as exemplified in FIG. 11.
[0565] In step 706, when the user remembers and enters the 'master password entered in step 103' into the master password input field and selects the confirmation box, the 'second character field value, third character field value, and fourth character field value found in step 703' are identified.
[0567] When the above 'second Character field value, third Character field value, and fourth Character field value' are "0", "2", and "0", respectively, steps 708 to 723 are executed.
[0569] In step 708, the ID field value of the record in the secret information DB (111) where the 'mutual field value found in step 703' is stored in the site field is searched as 'API development PG payment account ID', and the public key field value and secret key field value of the record where the authentication app issuer identification information is stored in the site field are searched as 'public key and encrypted secret key', respectively.
[0571] In step 709, the site-specific master key and the app management server-specific master key are calculated using the 'master password entered in step 706', the 'mutual field value retrieved in step 703', and the authentication app issuer identification information.
[0573] According to an additional aspect of the present invention, the site-specific master key and the app management server-specific master key are calculated using the following formula.
[0574] * Site-specific master key = h[h(master password), h(mutual field value)]
[0575] * App Management Server Dedicated Master Key = h[h(Master Password), h(Authentication App Issuer Identification Info)]
[0577] In step 710, the 'encrypted secret key retrieved in step 708' is decrypted using the 'master key for the app management server derived in step 709'.
[0579] In step 713, a prescribed transaction consent text is prepared that includes 'transaction information output in step 704' as the transaction information subject to consent and 'API development PG payment account ID retrieved in step 708' as consenter identification information.
[0581] In step 714, a predetermined consent transaction data is created that includes 'the public key retrieved in step 708 as sender identification information', 'the public key field value retrieved by matching it with the site identification information in step 703 as recipient identification information', and 'the transaction consent message created in step 713'.
[0583] In step 715, an electronic signature for the 'consent transaction data created in step 714' is created using the 'secret key decrypted in step 710'.
[0585] In step 716, under the control of the authentication app (110), the ‘master password entered in step 706’, the ‘site-only master key and app management server-only master key calculated in step 709’, and the ‘secret key decrypted in step 710’ are all deleted, and airplane mode is disabled.
[0588] Meanwhile, according to another aspect of the present invention, which is characterized by being a site that digitally signs with a public key exclusive to the site, steps 708-1 to 716-1 below may be operated in place of steps 708 to 716.
[0590] In step 708-1, the ID field value, public key field value, and secret key field value of the record in the secret information DB (111) where the 'mutual field value searched in step 703' is stored in the site field are searched as the 'API development PG payment account ID, API development PG dedicated public key, and encrypted API development PG dedicated secret key', respectively.
[0592] In Step 709-1, a site-specific master key is calculated using the 'master password entered in Step 706' and the 'mutual field value retrieved in Step 703'.
[0594] According to an additional aspect of the present invention, the site-specific master key is calculated using the following formula.
[0595] * Site-specific master key = h[h(master password), h(mutual field value)]
[0597] In Step 710-1, the 'encrypted API development PG private secret key retrieved in Step 708-1' is decrypted using the 'site-specific master key produced in Step 709-1'.
[0599] In step 713-1, a prescribed transaction consent message is created that includes 'transaction information output in step 704' as the transaction information subject to consent and 'API development PG payment account ID retrieved in step 708-1' as consenter identification information.
[0601] In step 714-1, a predetermined consent transaction data is created that includes 'the API development PG dedicated public key retrieved in step 708-1 as sender identification information', 'the public key field value retrieved by matching with the site identification information in step 703 as recipient identification information', and 'the transaction consent message created in step 713-1'.
[0603] In Step 715-1, an electronic signature for the 'consent transaction data created in Step 714-1' is created using the 'API development PG exclusive secret key decrypted in Step 710-1'.
[0605] In step 716-1, under the control of the authentication app (110), the 'master password entered in step 706', the 'site-specific master key calculated in step 709-1', and the 'API development PG-specific secret key decrypted in step 710-1' are all deleted, and airplane mode is disabled.
[0608] In step 717, the 'consent transaction data created in step 713 (or step 713-1)' and the 'digital signature created in step 715 (or step 715-1)' are matched with each other and transmitted to the 'API development PG (300) in step 701' as a reply to the 'transaction information subject to consent request received in step 702'.
[0610] In step 718, when the API development PG (300) receives the consent transaction data and digital signature transmitted in step 717, it verifies the digital signature using the sender identification information included in the consent transaction data.
[0612] If the verification at step 718 is successful, steps 719 and below are executed.
[0614] In step 719, the API development PG (300) calculates a hash value for the consent transaction data.
[0616] In step 720, the API development PG (300) stores the 'time stamp at the time when step 720 is performed', the consent transaction data, and the electronic signature by matching a predetermined serial number (i.e., the serial number of the consent transaction data) in the transaction data DB (not shown), and transmits the serial number of the consent transaction data, the 'sender identification information included in the consent transaction data', the timestamp, and the 'hash value for the consent transaction data calculated in step 719' to the app management server (200).
[0618] When the app management server (200) receives the 'serial number, sender identification information, timestamp, and hash value of the consent transaction data transmitted in step 720' at step 721, it matches the received information with each other and stores it in the transaction data hash DB (220).
[0620] In step 722, the root hash value ("transaction-specific root hash value") of the timestamp and hash value stored in step 721 is calculated, and the timestamp and transaction-specific root hash value are stored in the public hash DB (230) by matching them to a predetermined serial number.
[0622] According to an additional aspect of the present invention, a value stored in a public hash DB (230) is shared in real time with a blockchain network (not shown), and a block containing the root hash value of the transaction-specific root hash values disclosed within the corresponding period (hereinafter "block-specific root hash value") is created and distributedly stored in the blockchain network for each block generation period in the blockchain network (not shown).
[0625] Meanwhile, according to another aspect of the present invention, steps 720-1 to 723-1 below may be operated in place of steps 720 to 723.
[0627] In step 720-1, the API Development PG stores the 'time stamp at the time when step 720 is performed', the consent transaction data, and the digital signature by matching a predetermined serial number (i.e., the serial number of the consent transaction data) in the transaction data DB (not shown), and transmits the serial number of the consent transaction data, the 'sender identification information included in the consent transaction data', the timestamp, and the 'hash value for the consent transaction data calculated in step 519' to the peer nodes (not shown) of the API Development PG.
[0629] In step 721-1, when the peer nodes (not shown) receive 'the serial number, sender identification information, timestamp, and hash value of the consent transaction data transmitted in step 720-1', they match the received information with each other and store it in the transaction data hash DB (not shown).
[0631] According to an additional aspect of the present invention, values stored in the transaction data hash DB (not shown) of the peer nodes (not shown) are shared among the peer nodes (not shown) of each peer node (not shown) and consequently shared in the blockchain network.
[0633] In step 723-1, for each block generation cycle, a block is generated for the 'serial number of the consent transaction data, sender identification information, timestamp, and hash value' shared within the cycle, and is distributed and stored on the blockchain network. Explanation of the symbols
[0636] 100: User terminal 110: Authentication App 111: Secret Information DB 112: Character Matching Table 113: Site DB 116: Random value generation module 117: GPS measuring module 118: TimestampMojul 200: App Management Server 210: Customer DB 220: Transaction Data DB 230: Public Hash DB 240: Site DB 300: Site Server 310: Customer DB
Claims
Claim 1 delete Claim 2 delete Claim 3 delete Claim 4 delete Claim 5 delete Claim 6 delete Claim 7 A step (A) in which a ‘readable string’ is input to a single user terminal; a step (B) in which, using one or more of the binary bits constituting the ‘readable string’ input in step (A), one binary code among the ‘multiple binary codes matched to the i-th character in a character matching table’ for each character constituting the string (hereinafter referred to as the “i-th character”); and a step (C) in which the ‘readable string’ input in step (A) is converted into a binary code form by combining the ‘binary codes determined in step (B)’. A safe and convenient authentication medium management method based on a master password, characterized in that the character matching table in step (B) stores only one 'readable character' corresponding to each different binary code, so that the 'readable character' matching any binary code can be determined as one, whereas multiple binary codes matching at least some 'readable characters' are stored, so that the 'matching binary code' for at least some 'readable characters' cannot be determined without knowing the 'readable string input in step (A)'. Claim 8 A safe and convenient authentication medium management method based on a master password, comprising: a step (A1) of inputting one site identification information into one user terminal; a step (A2) of selecting a password recommendation box that matches the site identification information; a step (A3) of calculating one site password using one or more of 'a GPS value of the terminal location measured by the user terminal' and 'a timestamp measured by the user terminal'; a step (B) of inputting a master password into the user terminal; a step (C) of the user terminal calculating a site-specific master key that matches the site identification information using the master password and the site identification information; a step (D) of encrypting the site password with the site-specific master key; and a step (E) of storing the encrypted site password in a DB at the user terminal by matching it with the site identification information; wherein the master password is 'a password that the user memorizes, which does not need to be stored in external devices such as a server, nor in the user terminal'. Claim 9 (A) A step in which a user terminal receives site identification information from a server to which it is connected; (B) A step in which one or more character field values matched to the site identification information are searched in a DB configured in the user terminal; (C) A step in which a master password is entered into the user terminal; (D) A step in which the user terminal decrypts 'one or more of an encrypted password and an encrypted secret key stored in the user terminal' using the master password and the site identification information; (E) A step in which authentication information matched to the character field value is calculated using the decrypted 'one or more of the password and secret key'; and (F) A step in which the user terminal transmits the calculated authentication information to the server. A safe and convenient authentication medium management method based on a master password, comprising, wherein the Character field value is one or more of 'a code for identifying self-transaction sites and agency transaction sites', 'a code for identifying a policy regarding whether a site password is required', 'a code for identifying a policy regarding whether an electronic signature as authentication information is required', and 'a code for identifying a policy regarding whether terminal verification is required'. Claim 10 A step (A) in which a master password before change and a master password after change are entered into a single user terminal; a step (B) in which all 'each site identification information stored' in a single DB, characterized in that site identification information and 'encrypted site passwords' are matched and stored in the user terminal; a step (C) in which, using the 'master password before change entered in step (A)' and 'each site identification information searched in step (B)' at the user terminal, 'a master key before change dedicated to the site's own site identification information' is calculated for each site identification information; a step (D) in which, at the user terminal, 'encrypted site passwords' matched to 'each site identification information searched in step (B)' in the DB are decrypted for each site identification information before change dedicated to the site's own site identification information calculated using the site identification information in step (C); and, using the 'master password after change entered in step (A)' and 'each site identification information searched in step (B)' at the user terminal A safe and convenient authentication medium management method based on a master password, characterized by comprising: a step (E) of calculating a modified site-specific master key corresponding to each of the above-mentioned site identification information; a step (F) of encrypting the 'site passwords decrypted in step (D)' corresponding to the above-mentioned site identification information using the 'modified site-specific master key corresponding to each of the above-mentioned site identification information' calculated in step (E) at the user terminal; and a step (G) of updating the 'encrypted site passwords' corresponding to each of the above-mentioned site identification information in the DB at the user terminal with the 'site password corresponding to each of the above-mentioned site identification information' encrypted in step (F) at the user terminal.
Citation Information
Patent Citations
Character code encryption processing program and method
JP2007065253A
System and method for keyword-based automatic login
KR1020180060189A
The Method for convenient remittance utilizing Master-password, Public-key, and Private-key
KR1020190142682A
The Convenient and Safe Method to intermediate Direct Financing utilizing Public key
KR1020200037469A