Blockchain-based multi-node authentication method and system

Abstract

To provide a blockchain-based multi-node authentication method for improving the security and convenience in authentication on a user terminal or a user.SOLUTION: A blockchain-based multi-node authentication method includes at least: receiving an authentication preparation request from a first user; generating a temporary channel to authenticate a first user terminal and a channel key for identifying the temporary channel in response to the authentication preparation request, the temporary channel including multiple nodes 102-1 to 102-n respectively corresponding to multiple second user terminals which are to be involved in the authentication; collectively transmitting the channel key to the nodes; separately transmitting authentication comparison data to be used for the authentication to the nodes; receiving an authentication request including the channel key and authentication target data regarding the first user terminal, from the first user terminal; and proceeding with the authentication of the first user terminal. The authentication of the first user terminal includes first and second authentication processes.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a blockchain-based multi-node authentication method and system thereof, and more particularly, to a method and system thereof for enhancing security and convenience during authentication of a user terminal or user through blockchain-based multi-node authentication. [Background technology]

[0002] As information is increasingly concentrated online with the development of information and communication technology, the importance of information protection and security is increasing. Public key-based authentication and passwordless authentication methods have been developed to complement traditional password-based authentication, but these methods still have vulnerabilities and are exposed to numerous security threats.

[0003] In particular, conventional authentication methods use authentication information based on unique information belonging to a user to generate a security key, but because they use traditional (or general) security key generation algorithms to generate the security key, there is a risk that if the authentication information is exposed, the security key will also be exposed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Korean Patent No. 10-1809974 [Patent Document 2] Korean Patent No. 10-1809976 [Patent Document 3] Korean Patent No. 10-2094705 Summary of the Invention [Problem to be solved by the invention]

[0005] The technical problem to be solved by some embodiments of the present disclosure is to provide a method for enhancing security and convenience in authentication of a user terminal or user through blockchain-based multi-node authentication, and a system to which the method is applied.

[0006] Another technical problem to be solved by some embodiments of the present disclosure is to provide a method for automatically collecting authentication factors related to multiple user terminals based on distributed ledger technology, and generating a one-time or time-limited security key by randomly extracting and combining the collected authentication factors, and a system to which the method is applied.

[0007] Another technical problem that some embodiments of the present disclosure aim to solve is to provide a method for enhancing security and convenience in authentication of a user terminal or user by randomly selecting multiple user terminals involved in the authentication, and a system to which the method is applied.

[0008] Yet another technical problem to be solved by some embodiments of the present disclosure is to provide a method for enhancing security and convenience in authenticating a user terminal or user by randomly selecting an authentication server that performs the authentication, and a system to which the method is applied.

[0009] The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by a person of ordinary skill in the art of the present disclosure from the following description. [Means for solving the problem]

[0010] A blockchain-based multi-node authentication method according to an embodiment of the present disclosure for solving the technical problem includes the steps of: receiving an authentication preparation request from a first user; generating a temporary channel through which authentication is performed for a first user terminal of the first user in response to the authentication preparation request and a channel key for identifying the temporary channel, the temporary channel including a plurality of nodes corresponding to a plurality of second user terminals involved in the authentication, the second user terminal being randomly selected from among user terminals other than the first user terminal; commonly transmitting the channel key to the plurality of nodes and dividing and transmitting authentication comparison data used for the authentication to the plurality of nodes; transmitting an authentication preparation completion message including the channel key to the first user terminal; and receiving an authentication request from the first user terminal including the channel key and authentication target data related to the first user terminal. receiving a request for authentication, and performing authentication of the first user terminal in response to receiving the authentication request, the authentication of the first user terminal including a first authentication and a second authentication, the first authentication being authentication using a security key transmitted to the first user terminal and a randomly selected part of the plurality of nodes, the security key being generated by randomly extracting and combining authentication elements collected from the first user terminal and the second user terminal, and the second authentication being authentication using the authentication target data divided and transmitted to the plurality of nodes and the authentication comparison data divided and transmitted; receiving a result of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data from the plurality of nodes; and determining whether the authentication of the first user terminal has been successful based on the comparison result. In this case, the authentication comparison data and the authentication elements collected from the second user terminal may be obtained from a distributed ledger.

[0011] In one embodiment, the step of authenticating the first user terminal may include a step of transmitting a security key to the first user terminal and a randomly selected portion of the plurality of nodes in response to receiving the authentication request; receiving a first hash value into which the security key is converted by the first user terminal and a second hash value into which the security key is converted by the portion of the nodes; and determining that the first authentication is successful if the first hash value and the second hash value match. In one embodiment, the security key may be one of a one-time security key and a time-limited security key.

[0012] In one embodiment, the authentication comparison data and the authentication target data are each divided into a plurality of categories, and the step of dividing and transmitting the authentication comparison data to the plurality of nodes may include dividing the authentication comparison data by the categories and transmitting the data to different nodes, and the step of authenticating the first user terminal may include dividing the authentication target data by the categories and transmitting the data to the different nodes and transmitting the data to the same categories as the categories of the authentication comparison data transmitted to each node. In this case, the step of determining whether the authentication of the first user terminal has been successful may include determining that the second authentication has been successful when a result indicating that the divided and transmitted authentication comparison data matches the divided and transmitted authentication target data is received from nodes exceeding a preset ratio.

[0013] In one embodiment, the blockchain-based multi-node authentication method may further include deleting the temporary channel, the channel key, and the security key when a determination is made as to whether authentication for the first user terminal is successful.

[0014] In one embodiment, receiving an authentication preparation request from the first user may include randomly selecting a specific authentication server from a plurality of authentication servers to perform the first authentication and the second authentication.

[0015] A blockchain-based multi-node authentication system according to another embodiment of the present disclosure for solving the technical problem may include a memory into which a computer program is loaded and a processor that executes the computer program, wherein the computer program includes instructions for receiving an authentication preparation request from a first user, instructions for generating a temporary channel through which authentication is performed for a first user terminal of the first user in response to the authentication preparation request and a channel key for identifying the temporary channel, the temporary channel including a plurality of nodes corresponding to a plurality of second user terminals involved in the authentication, the second user terminal being randomly selected from among user terminals other than the first user terminal, instructions for commonly transmitting the channel key to the plurality of nodes and dividing and transmitting authentication comparison data used for the authentication to the plurality of nodes, instructions for transmitting an authentication preparation completion message including the channel key to the first user terminal, and instructions for receiving an authentication request from the first user terminal including the channel key and authentication target data related to the first user terminal. and in response to receiving the authentication request, performing authentication for the first user terminal, the authentication for the first user terminal including a first authentication and a second authentication, the first authentication being authentication using a security key transmitted to the first user terminal and a randomly selected portion of the plurality of nodes, the security key being generated by randomly extracting and combining authentication elements collected from the first user terminal and the second user terminal, and the second authentication being authentication using the authentication target data divided and transmitted to the plurality of nodes and the authentication comparison data divided and transmitted; instructions for receiving from the plurality of nodes a result of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data; and instructions for determining whether authentication for the first user terminal is successful based on the comparison result.In this case, the authentication comparison data and the authentication factors collected from the second user terminal may be obtained from a distributed ledger.

[0016] In one embodiment, the instructions to authenticate the first user terminal may include instructions to transmit a security key to the first user terminal and a randomly selected portion of the plurality of nodes in response to receiving the authentication request, instructions to receive a first hash value into which the security key is converted by the first user terminal and a second hash value into which the security key is converted by the portion of the nodes, and instructions to determine that the first authentication is successful if the first hash value and the second hash value match.

[0017] In one embodiment, the authentication comparison data and the authentication target data are each divided into a plurality of categories, the instruction to divide and transmit the authentication comparison data to the plurality of nodes includes an instruction to divide the authentication comparison data by category and transmit it to different nodes, and the instruction to authenticate the first user terminal may include an instruction to divide the authentication target data by category and transmit it to the different nodes, and transmit it in the same category as the category of the authentication comparison data transmitted to each node.

[0018] In one embodiment, the instructions to receive an authentication preparation request from the first user may include instructions to randomly select a particular authentication server from a plurality of authentication servers to perform the first authentication and the second authentication. [Brief description of the drawings]

[0019] [Figure 1] FIG. 1 is a conceptual diagram of an overall system according to one embodiment of the present disclosure. [Diagram 2] FIG. 1 is a conceptual diagram of an overall system according to one embodiment of the present disclosure. [Diagram 3]FIG. 1 conceptually illustrates a process of a blockchain-based multi-node authentication method according to one embodiment of the present disclosure. [Figure 4] 1 is a flowchart illustrating some steps of a blockchain-based multi-node authentication method according to an embodiment of the present disclosure. [Diagram 5] 11 is a diagram illustrating an example of a process of randomly extracting and combining authentication elements collected from a user terminal to generate a security key. [Figure 6] FIG. 2 illustrates an exemplary configuration of authentication elements for security keys generated according to some embodiments of the present disclosure. [Figure 7] FIG. 2 illustrates an exemplary configuration of authentication elements for security keys generated according to some embodiments of the present disclosure. [Figure 8] FIG. 2 is a hardware configuration diagram of a computing system described in some embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, as well as methods for achieving the same, will become apparent from the following detailed embodiments in conjunction with the accompanying drawings. However, the technical idea of ​​the present invention is not limited to the following embodiments, and may be realized in various different forms. The following embodiments are provided merely to complete the technical idea of ​​the present invention and to fully inform those skilled in the art of the present invention of the scope of the present invention, and the technical idea of ​​the present invention is defined only by the scope of the claims.

[0021] In describing various embodiments of the present disclosure, detailed descriptions of related known structures or functions will be omitted if they are considered to obscure the gist of the present invention. Unless otherwise defined, the terms (including technical and scientific terms) used in the following embodiments are used in the sense commonly understood by those having ordinary knowledge in the technical field to which the present disclosure belongs, but this may change depending on the intention or precedent of a technician engaged in a related field, the emergence of a new technology, etc. The terms used in the present disclosure are intended to describe the embodiments and are not intended to limit the scope of the present disclosure.

[0022] In the following embodiments, the singular expressions include the plural concepts unless otherwise clearly specified in the context. In addition, the plural expressions include the singular concepts unless otherwise clearly specified in the context.

[0023] In addition, terms such as 1st, 2nd, A, B, (a), (b) etc. used in the following embodiments are used only for the purpose of distinguishing one component from another, and the terminology does not limit the essence, order or sequence of the corresponding components.

[0024] Various embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. 1 and 2 are conceptual diagrams of an overall system according to one embodiment of the present disclosure.

[0025] The configuration and operation of the entire system according to an embodiment of the present disclosure will be described below with reference to FIGS.

[0026] 1 and 2, an overall system according to an embodiment of the present disclosure may include an authentication system 100, and in some embodiments, may further include a first user terminal 101 that is the subject of authentication and a plurality of nodes 102-1 to 102-n involved in the authentication, for example, at least some of a plurality of nodes 102-1 to 102-n corresponding respectively to a plurality of second user terminals 102 involved in the authentication of the first user terminal 101. Note that it should be understood that the first user terminal 101 described in the present disclosure may refer to a node corresponding to the first user terminal 101 depending on the context and / or implementation.

[0027] In some embodiments, the authentication system 100 may be connected to various service provider systems (not shown) such as portals, platforms, banking, etc., and in such cases, the service provider system may use the blockchain-based multi-node authentication method according to an embodiment of the present disclosure in performing user authentication such as logging in to receive the corresponding service. In some cases, at least a portion of the functions of the authentication system 100 may be included in the service provider system in the form of a program module.

[0028] In the following description, it is assumed that the first user terminal 101 and the second user terminals 102 are mainly smartphones. However, the type of the user terminal is not limited thereto, and may be realized as various types of computing systems such as desktops and laptops within a scope that can achieve the object of the present disclosure. The first user terminal 101 and the second user terminals 102 can communicate with the authentication system 100 via a communication network (not shown). The communication network may be realized as any kind of wired / wireless network such as a local area network (LAN), a wide area network (WAN), a mobile radio communication network, Wibro (Wireless Broadband Internet), etc.

[0029] In some embodiments, the authentication system 100 may include one or more authentication servers 100-1 to 100-n, and each of the authentication servers 100-1 to 100-n may act as a node on a blockchain, for example, a private blockchain network. In some embodiments, each of the authentication servers 100-1 to 100-n may store or have the authority to access a distributed ledger (20). Each of the authentication servers 100-1 to 100-n may have an authentication module (not shown) in the form of a library that performs a blockchain-based multi-node authentication method according to an embodiment of the present disclosure.

[0030] The multiple blocks constituting the distributed ledger 20 may include information related to a first user terminal 101 and multiple second user terminals 102. For example, a specific block may include information related to a specific user terminal. Since the information related to the user terminal is stored in a block on the blockchain network, it may be impossible to forge / alter the information.

[0031] In some embodiments, the information related to the user terminal may refer to authentication data registered by a user when subscribing to authentication system 100 or another service using authentication system 100 using the user terminal. In this disclosure, such information related to the user terminal may be referred to as authentication factors in connection with the first authentication, and as authentication comparison data or authentication target data in connection with the second authentication, as described below.

[0032] The information related to the user terminal may include at least one of area detection information, knowledge base information, device information, and ownership information. In some embodiments, the information related to the user terminal may include biometric information. The area detection information may include information such as an RFID tag, a WIFI SSID, a beacon, and a sensor (proximity sensor, illuminance sensor, vibration sensor, etc.) value. The knowledge base information is information set and stored based on the knowledge of the user, and may include information such as a user's email address, ID, password, and pattern. In this case, the ID may be an Android ID. The device information may include information such as a serial number unique to the user terminal, a sensor identifier, a UUID (Universal Unique Identifier), status information, a MAC address, and a Bluetooth address. In this case, the status information is various information for checking the status of the user terminal, and may include a volume, a vibration / bell status, etc. The ownership information may include a phone number, an NFC tag, a QR code, a barcode, etc., designated when the user uses the user terminal. The biometric information may include information related to a fingerprint, iris, etc., that is registered by the user through biometric recognition.

[0033] The authentication system 100 may perform authentication of a user terminal or a user by a blockchain-based multi-node authentication. For example, the authentication system 100 may receive an authentication preparation request from a first user, and generate a temporary channel through which authentication of the first user terminal 101 of the first user is performed in response to the authentication preparation request, and a channel key for identifying the temporary channel. At this time, the temporary channel may include a plurality of nodes 102-1 to 102-n corresponding to a plurality of second user terminals 102 involved in the authentication. Also, the second user terminal 102 may be randomly selected from among user terminals other than the first user terminal 101.

[0034] Next, the authentication system 100 may commonly transmit the channel key to the multiple nodes 102-1 to 102-n, and divide and transmit authentication comparison data used for the authentication to the multiple nodes 102-1 to 102-n. Then, the authentication system 100 may transmit an authentication preparation completion message including the channel key to the first user terminal 101. Here, the authentication comparison data may be obtained from the distributed ledger 20.

[0035] Next, the authentication system 100 may receive an authentication request including the channel key and authentication target data related to the first user terminal 101 from the first user terminal 101, and perform authentication for the first user terminal 101 in response to receiving the authentication request. At this time, the authentication for the first user terminal 101 may include a first authentication and a second authentication. Here, the first authentication is authentication using a security key transmitted to the first user terminal 101 and some nodes randomly selected from the plurality of nodes 102-1 to 102-n, and the security key may be generated by randomly extracting and combining authentication elements collected from the first user terminal 101 and the second user terminal 102. Here, the authentication element collected from the second user terminal 102 may be acquired from the distributed ledger 20. And the second authentication may be authentication using the authentication target data divided and transmitted to the plurality of nodes 102-1 to 102-n and the authentication comparison data divided and transmitted.

[0036] Next, authentication system 100 receives the results of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data from the multiple nodes 102-1 to 102-n, and can determine whether or not authentication of first user terminal 101 has been successful based on the comparison results.

[0037] The configuration and operation of the entire system according to one embodiment of the present disclosure have been described above. In particular, the operation of the authentication system 100 will be more deeply understood from the embodiments described below. That is, the operation of the authentication system 100 can be supplemented by the embodiments described below.

[0038] Next, a blockchain-based multi-node authentication method according to an embodiment of the present disclosure will be described with reference to Figures 3 to 7. The blockchain-based multi-node authentication method according to the present embodiment may be performed by one or more computing systems. Also, in the blockchain-based multi-node authentication method according to the present embodiment, some operations may be performed by a first computing system and the remaining operations may be performed by a second computing system.

[0039] For example, some operations of the blockchain-based multi-node authentication method according to the present embodiment may be performed by an on-premise physical server, and the remaining operations may be performed by a cloud server. Hereinafter, when the execution subject of each operation is omitted, it can be understood that the execution subject is the computing system.

[0040] FIG. 3 is a diagram conceptually illustrating a process of performing a blockchain-based multi-node authentication method according to one embodiment of the present disclosure.

[0041] 3, in an authentication preparation procedure (S301), the first user may request authentication preparation from the authentication system 100. At this time, the first user may directly request authentication preparation from the authentication system 100 using an application client installed in the first user terminal 101 of the first user, or may indirectly request authentication preparation from the authentication system 100 via a web client on a terminal other than the user terminal 101, for example, a PC. When the first user indirectly requests authentication preparation from the authentication system 100 in this manner, the first user terminal 101 may need to directly transmit an authentication request to the authentication system 100 after authentication preparation is completed, so that the authentication system 100 can receive authentication target data related to the first user terminal 101 from the first user terminal 101.

[0042] The authentication system 100 that has received the authentication preparation request may randomly select a plurality of second user terminals 102 involved in the authentication of the first user terminal 101 from among the plurality of currently connected terminals, and generate a temporary channel 40 including a plurality of nodes 102-1 to 102-n corresponding respectively to the plurality of second user terminals 102. Then, the authentication system 100 may commonly transmit a channel key for identifying the temporary channel 40 to the plurality of nodes 102-1 to 102-n, and may divide and transmit authentication comparison data used in authentication of the first user terminal 101 to the plurality of nodes 102-1 to 102-n.

[0043] In some embodiments, in the authentication preparation procedure (S301), a security key may be transmitted to the first user terminal 101 and some randomly selected nodes among the plurality of nodes 102-1 to 102-n. However, the time at which the security key is transmitted is not limited thereto, and the security key may be transmitted in response to receiving an authentication request from the first user terminal 101 after the authentication preparation is completed.

[0044] When the authentication preparation procedure (S301) is completed, the authentication system 100 may receive an authentication request including a channel key of the temporary channel 40 and authentication target data, which is data to be authenticated, from the first user terminal 101 that has requested authentication, and may divide and transmit such authentication target data to the multiple nodes 102-1 to 102-n of the temporary channel 40 in the same manner / category as the authentication comparison data (S302). In some embodiments, the authentication system 100 may also divide and transmit the authentication target data to the multiple nodes 102-1 to 102-n after the first authentication described below is successful.

[0045] In the authentication procedure (S302), some nodes, for example one node, that are randomly selected from the multiple nodes 102-1 to 102-n on the temporary channel 40 and receive the security key may perform the first authentication for the first user terminal 101 using the security key. Then, in an authentication procedure (S302), the plurality of nodes 102-1 to 102-n of the temporary channel 40 may perform a second authentication for the first user terminal 101 by comparing the authentication comparison data divided and transmitted from the authentication system 100 with the authentication target data divided and transmitted, and may transmit the comparison result to the authentication system 100. At this time, a predetermined consensus algorithm 50 may be used to determine whether the second authentication is successful.

[0046] Meanwhile, each of the multiple nodes 102-1 to 102-n of the temporary channel 40 may obtain authentication comparison data from multiple blocks 20-1 to 20-n that constitute the distributed ledger 20. Each of the multiple blocks 20-1 to 20-n may store information related to the second user terminal.

[0047] The authentication system 100 may complete authentication of the first user terminal 101 based on the comparison results received from the multiple nodes 102-1 to 102-n (S303). The authentication system 100 may allow the first user terminal 101 to connect if the authentication of the first user terminal 101 is successful, and may not allow the first user terminal 101 to connect if the authentication is unsuccessful.

[0048] The authentication preparation procedure (S301) and the authentication procedure (S302) will be described in more detail below with reference to FIG.

[0049] FIG. 4 is a flowchart illustrating some steps of a blockchain-based multi-node authentication method according to an embodiment of the present disclosure.

[0050] 4, first, the authentication system 100 may receive an authentication preparation request from the first user (S410). At this time, the authentication system 100 may randomly select a specific authentication server from among the multiple authentication servers 100-1 to 100-n to perform authentication for the first user terminal 101. The specific authentication server selected at random in this manner may generate a temporary channel 40 to perform an authentication procedure, as described below. However, since the time during which the temporary channel 40 is generated is very short, for example, about 2 seconds, it becomes even more difficult for an attacker to identify a target server to be attacked during such a short period of time and to further affect the authentication procedure in the temporary channel 40, thereby further enhancing security. In the following, the entity that performs the blockchain-based multi-node authentication method according to the present disclosure will be mainly described in terms of authentication system 100, but it should be understood that when a specific authentication server that performs authentication for first user terminal 101 is randomly selected from the multiple authentication servers 100-1 to 100-n as described above, that specific authentication server may be the entity that performs the execution.

[0051] Next, the authentication system 100 may randomly select a plurality of second user terminals 102 involved in the authentication of the first user terminal 101 from among user terminals other than the first user terminal 101 of the first user. Then, the authentication system 100 may generate a temporary channel 40 including a plurality of nodes 102-1 to 102-n corresponding to the plurality of second user terminals 102, respectively, and a channel key for identifying the temporary channel 40 (S420).

[0052] Next, the authentication system 100 may "commonly" transmit the channel key to the multiple nodes 102-1 to 102-n included in the temporary channel 40, and "divide" and transmit the authentication comparison data (S430). That is, the authentication system 100 may transmit the same channel key to all of the nodes 102-1 to 102-n of the temporary channel 40, while dividing the authentication comparison data into pieces equal to the number of the nodes 102-1 to 102-n of the temporary channel 40, and transmit the divided authentication comparison data to different nodes. As a result, each of the nodes 102-1 to 102-n of the temporary channel 40 receives only a portion of the authentication comparison data, and the data received by each node of the temporary channel 40 may be different from one another.

[0053] The divided transmission of the authentication comparison data can also be performed in response to a first authentication for the first user terminal 101 being successful, which will be described later.

[0054] The authentication comparison data may be divided according to various embodiments, but the present disclosure proposes an embodiment in which the authentication comparison data is divided based on "authentication category (or attribute)". Here, the authentication category may be classified according to the type of information related to the user terminal described above. For example, the authentication category may be classified into RFID tag, WIFI SSID, beacon, sensor value, user's email address, ID, password, pattern, sensor identifier, UUID, status information, MAC address, Bluetooth address, phone number, NFC tag, QR code, barcode, fingerprint, iris, etc. That is, each of the nodes 102-1 to 102-n of the temporary channel 40 receives / stores authentication comparison data of different authentication categories, and can use it to compare with authentication target data received later. At this time, the nodes 102-1 to 102-n of the temporary channel 40 may store a channel key together with the authentication comparison data.

[0055] Next, the authentication system 100 may complete the authentication preparation procedure by transmitting an authentication preparation completion message including the channel key to the first user terminal 101 (S440). Next, the authentication system 100 may receive an authentication request including a channel key of the temporary channel 40 and authentication target data related to the first user terminal 101 from the first user terminal 101 (S450).

[0056] Next, in response to receiving the authentication request, the authentication system 100 may randomly select some nodes, for example one node, from the first user terminal 101 and the multiple nodes 102-1 to 102-n on the temporary channel 40. Then, the authentication system 100 may transmit a security key to the selected some nodes and the first user terminal 101, and perform a first authentication for the first user terminal 101 using the security key (S460). However, in some embodiments, the node to which the security key is to be transmitted may be selected and the security key may be transmitted before the authentication system 100 receives the authentication request.

[0057] The authentication system 100 may generate a security key by randomly extracting and combining authentication factors collected from the first user terminal 101 and the second user terminal 102. As described above, information related to the first user terminal 101 and the second user terminal 102 may be stored in multiple blocks constituting the distributed ledger 20, so the authentication factors may be obtained from the distributed ledger 20. In some embodiments, the authentication factors related to the first user terminal 101 may be obtained directly from the first user terminal 101 when an authentication preparation request or an authentication request is received from the first user terminal 101.

[0058] The authentication factors used to generate the security key may include at least one of the area sensing information, knowledge base information, device information, and ownership information described above. In some embodiments, the authentication factors may include biometric information. In some embodiments, the type of authentication factor used to generate the security key may be set by an operator (or administrator) of authentication system 100 or another service that uses authentication system 100. The operator may ensure that an appropriate type of authentication factor is used depending on the characteristics of the service being provided. In some cases, a user may specify the type of authentication factor used to generate the security key during the process of signing up as a user.

[0059] The authentication system 100 may randomly extract authentication elements collected from the first user terminal 101 and the second user terminal 102, and generate a security key by combining the extracted authentication elements. In some cases, it may be possible to generate two or more security keys to be used in the first authentication for the first user terminal 101.

[0060] FIG. 5 is a diagram illustrating an example of a process of randomly extracting and combining authentication elements collected from a user terminal to generate a security key.

[0061] As shown in Fig. 5, the authentication system 100 can generate a security key by randomly extracting and combining some authentication factors among the authentication factors stored for each user terminal in multiple blocks constituting the distributed ledger 20 without any predetermined rules. In Fig. 5, various types of authentication factors collected for each user terminal (A, B, C, and D) of four users are represented as A(N), B(N), C(N), and D(N).

[0062] 5 shows that four (or types) authentication factors are collected for each user terminal, the number of user terminals and the number of authentication factors may be changed depending on the situation. Furthermore, user terminals with a relatively large number of authentication factors and user terminals with a small number of types of authentication factors may coexist.

[0063] 5 shows an example in which one security key including four authentication factors is generated by randomly extracting one authentication factor for each user terminal, but the number of authentication factors extracted for each user terminal may be different. In this case, the number of authentication factors extracted for each user terminal may be determined randomly.

[0064] Fig. 6 is a diagram showing an example of the configuration of authentication elements related to a security key generated by the security key generation method shown in Fig. 5. And Fig. 7 is a diagram showing an example of the configuration of authentication elements related to a security key generated when the number of authentication elements extracted varies for each user terminal, unlike the method shown in Fig. 5.

[0065] 4, the first user terminal 101 and some of the nodes 102-1 to 102-n of the temporary channel 40 that have received the security key generated by the above method may convert the security key into a hash value using a separate algorithm. Then, in step S460, the authentication system 100 receives a first hash value into which the security key is converted by the first user terminal 101 and a second hash value into which the security key is converted by the some of the nodes, and if the first hash value and the second hash value match, may determine that the first authentication of the first user terminal 101 has been successful (S470).

[0066] In some cases, the authentication system 100 may also use the separate algorithm to convert the security key into a hash value and compare it with the first and second hash values ​​to determine whether there is a match and whether the first authentication was successful.

[0067] The security key may be temporarily stored, and may be set to be deleted when the security key is used for the first authentication for the first user terminal 101 or when a predetermined usage period has elapsed. When the security key is deleted in the first user terminal 101 and / or the partial node, a deletion status value may be transmitted to the authentication system 100 to recognize the fact of deletion.

[0068] The security key used in the first authentication procedure for the first user terminal 101 is generated by cross-combining randomly extracted authentication elements as described above, and does not have a fixed rule. Therefore, even if the authentication elements or the security key generation algorithm are leaked, it is almost impossible to generate the same security key.

[0069] Furthermore, some of the nodes involved in the first authentication for the first user terminal 101 using such a security key, i.e., some of the nodes to which the security key is transmitted, are also randomly determined, making it impossible for an attacker to identify the target of attack, thereby ensuring even stronger security.

[0070] Next, referring again to FIG. 4, the authentication system 100 may perform a second authentication for the first user terminal 101 using the authentication target data divided and transmitted to the multiple nodes 102-1 to 102-n and the authentication comparison data divided and transmitted (S460).

[0071] More specifically, in step S460, the authentication system 100 may identify which temporary channel 40 is used to authenticate the first user terminal 101 based on the channel key received from the first user terminal 101, and may divide and transmit the authentication target data to the nodes 102-1 to 102-n of the corresponding channel 40. At this time, the authentication system 100 may divide and transmit the authentication target data by category, similar to the method of transmitting the authentication comparison data in step S430. In particular, the authentication system 100 may divide and transmit the authentication target data into the same categories as the categories transmitted to each node in step S430.

[0072] Next, authentication system 100 may receive a result of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data from nodes 102-1 to 102-n on temporary channel 40, and may determine whether or not the second authentication for first user terminal 101 has been successful based on the received comparison result (S470). For example, a node that receives authentication comparison data and authentication target data corresponding to the "MAC address" category may determine whether or not the first MAC address data received as authentication comparison data and the second MAC address data received as authentication target data match each other, and may transmit the comparison result to authentication system 100.

[0073] Here, the authentication system 100 may determine that the second authentication of the first user terminal 101 has been successful when receiving a result indicating that the divided and transmitted authentication comparison data match the divided and transmitted authentication target data from more than a preset ratio of all nodes included in the temporary channel 40. The preset ratio may be set to, for example, 50%, but may of course be set to a higher ratio when it is desired to strengthen the authentication security level.

[0074] On the other hand, although not shown in this flowchart, when authentication of the user terminal 101 is completed, the authentication system 100 can delete all of the temporary channel 40, the channel key, and the security key. According to the present disclosure, every time authentication of a user terminal is completed, all of the information / data used for authentication is discarded, and a new temporary channel is generated every time authentication is performed, which has the effect of providing an extremely high level of security.

[0075] According to the present disclosure, authentication is performed by multi-nodes 102-1 to 102-n, not authentication system 100, thereby reducing the system complexity and authentication overhead of authentication system 100. In addition, since authentication is performed via multi-nodes 102-1 to 102-n, security is extremely high and it is difficult to forge / alter data used for authentication, thereby minimizing the risk of hacking into authentication requesting terminal 101.

[0076] Meanwhile, the first authentication and the second authentication for the first user terminal 101 can be performed substantially simultaneously, i.e., in parallel, but in another embodiment, the second authentication can be performed when the first authentication is determined to be successful, or the first authentication can be performed when the second authentication is determined to be successful.

[0077] According to the blockchain-based multi-node authentication method proposed by , a temporary security key is generated by random cross-combination based on distributed ledger technology, so that the possibility of encryption leakage or hacking can be fundamentally prevented. In addition, the hassle of using passwords is eliminated, and the time required for authentication can be reduced because there is no need to go through a tedious step of selecting a certificate for authentication. This enhances both security and convenience during authentication.

[0078] Furthermore, since a distributed server system using distributed ledger technology is used, institutions using the blockchain-based multi-node authentication method disclosed herein can reduce the costs incurred in managing cryptography.

[0079] FIG. 8 is an example hardware diagram illustrating a computing system 1000 according to some embodiments of the present disclosure.

[0080] As shown in FIG. 8, the computing system 1000 of FIG. 8 may include one or more processors 1100, a system bus 1600, a communication interface 1200, a memory 1400 for loading a computer program 1500 executed by the processor 1100, and a storage 1300 for storing the computer program 1500. However, FIG. 8 shows only components related to the embodiment of the present disclosure. Therefore, it can be understood by a person skilled in the art to which the present disclosure belongs that other general-purpose components may be further included in addition to the components shown in FIG. 8. That is, the computing system 1000 may further include various components in addition to the components shown in FIG. 8. In addition, the computing system 1000 may be configured in a form in which some of the components shown in FIG. 8 are omitted depending on the case. Each component of the computing system 1000 will be described below.

[0081] The processor 1100 may control the overall operation of each component of the computing system 1000. The processor 1100 may include at least one of a central processing unit (CPU), a micro processor unit (MPU), a micro controller unit (MCU), a graphic processing unit (GPU), a neural processing unit (NPU), or any other type of processor well known in the art of the present disclosure. The processor 1100 may also perform calculations for at least one application or program for performing operations / methods according to various embodiments of the present disclosure. The computing system 1000 may include one or more processors.

[0082] In turn, the memory 1400 may store various data, instructions and / or information. The memory 1400 may load the computer program 1500 from the storage 1300 to perform the methods / operations according to various embodiments of the present disclosure. The memory 1400 may be implemented as a volatile memory such as a RAM, although the scope of the present disclosure is not limited in this respect.

[0083] The system bus 1600 may then provide a communication function between the components of the computing system 1000. The system bus 1600 may be implemented as a bus of various types, such as an address bus, a data bus, and a control bus.

[0084] Next, the communication interface 1200 may support wired or wireless Internet communication of the computing system 1000. The communication interface 1200 may also support various communication methods other than Internet communication. To this end, the communication interface 1200 may be configured to include a communication module well known in the technical field of the present disclosure. In turn, the storage 1300 may non-transiently store one or more computer programs 1500. The storage 1300 may include a non-volatile memory such as a flash memory, a hard disk, a removable disk, or any other form of computer-readable recording medium well known in the art to which the present disclosure pertains.

[0085] In turn, the computer program 1500 may include one or more instructions that, when loaded into the memory 1400, cause the processor 1100 to perform operations / methods according to various embodiments of the present disclosure. That is, when the computer program 1500 is loaded into the memory 1400, the processor 1100 can execute the one or more instructions to perform the methods / operations according to various embodiments of the present disclosure.

[0086] In some embodiments, the computer program 1500 includes instructions for receiving an authentication preparation request from a first user, and in response to the authentication preparation request, generating a temporary channel on which authentication of a first user terminal of the first user is performed and a channel key for identifying the temporary channel, the temporary channel including a plurality of nodes corresponding to a plurality of second user terminals involved in the authentication, the second user terminal being randomly selected from among user terminals other than the first user terminal, instructions for commonly transmitting the channel key to the plurality of nodes and dividing and transmitting authentication comparison data used in the authentication to the plurality of nodes, instructions for transmitting an authentication preparation completion message including the channel key to the first user terminal, and instructions for receiving an authentication request from the first user terminal including the channel key and authentication target data related to the first user terminal. and instructions for receiving, in response to receiving the authentication request, an authentication for the first user terminal, the authentication for the first user terminal including a first authentication and a second authentication, the first authentication being an authentication using a security key transmitted to the first user terminal and a randomly selected part of the plurality of nodes, the security key being generated by randomly extracting and combining authentication elements collected from the first user terminal and the second user terminal, and the second authentication being an authentication using the authentication target data divided and transmitted to the plurality of nodes and the authentication comparison data divided and transmitted, instructions for receiving from the plurality of nodes a result of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data, and instructions for determining whether the authentication for the first user terminal has been successful based on the comparison result. In this case, the authentication comparison data and the authentication elements collected from the second user terminal may be obtained from a distributed ledger.

[0087] In one embodiment, the instructions to authenticate the first user terminal may include instructions to transmit a security key to the first user terminal and a randomly selected portion of the plurality of nodes in response to receiving the authentication request, instructions to receive a first hash value into which the security key is converted by the first user terminal and a second hash value into which the security key is converted by the portion of the nodes, and instructions to determine that the first authentication is successful if the first hash value and the second hash value match.

[0088] In one embodiment, the authentication comparison data and the authentication target data are each divided into a plurality of categories, the instruction to divide and transmit the authentication comparison data to the plurality of nodes includes an instruction to divide the authentication comparison data by category and transmit it to different nodes, and the instruction to authenticate the first user terminal may include an instruction to divide the authentication target data by category and transmit it to the different nodes, and transmit it in the same category as the category of the authentication comparison data transmitted to each node.

[0089] In one embodiment, the instructions to receive an authentication preparation request from the first user may include instructions to randomly select a particular authentication server from a plurality of authentication servers to perform the first authentication and the second authentication.

[0090] Meanwhile, in some embodiments, the computing system 1000 illustrated in FIG 8 may refer to a virtual machine implemented based on cloud technology. For example, the computing system 1000 may be a virtual machine running on one or more physical servers included in a server farm. In this case, at least a part of the processor 1100, memory 1400, and storage 1300 illustrated in FIG 8 may be virtual hardware, and the communication interface 1200 may also be implemented as a virtualized networking element such as a virtual switch.

[0091] An exemplary computing system 1000 capable of implementing an authentication system 100 according to some embodiments of the present disclosure has been described above with reference to FIG.

[0092] Various embodiments of the present disclosure and the effects of the embodiments have been described above with reference to Figures 1 to 8. The effects of the technical ideas of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the above description.

[0093] In addition, although the above embodiments have been described as a combination of multiple components or a combination that operates in combination, the technical idea of ​​the present disclosure is not necessarily limited to such embodiments. That is, within the scope of the objectives of the technical idea of ​​the present disclosure, all components may be selectively combined into one or more components and operated.

[0094] The technical ideas of the present disclosure described above can be realized as computer readable codes on a computer readable medium. The computer program recorded on the computer readable recording medium can be transmitted to another computing system via a network such as the Internet, installed in the other computing system, and used in the other computing system.

[0095] In the figures, operations are shown in a particular order, but this should not be understood as necessarily requiring the particular order shown, or sequential order, or as requiring all of the operations shown to achieve desired results. In certain situations, multitasking and parallel processing may be advantageous.

[0096] Although various embodiments of the present disclosure have been described above with reference to the accompanying drawings, those skilled in the art to which the present disclosure pertains can understand that the technical ideas of the present disclosure can be embodied in other specific forms without changing the technical ideas or essential features thereof. Therefore, it should be understood that the above embodiment is illustrative in all respects and is not limiting. The scope of protection of the present disclosure should be analyzed according to the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of rights of the technical ideas defined by the present disclosure.

Claims

1. 1. A method performed by a computing system, comprising: receiving an authentication preparation request from a first user; generating a temporary channel in response to the authentication preparation request for authenticating the first user terminal of the first user and a channel key for identifying the temporary channel, the temporary channel including a plurality of nodes respectively corresponding to a plurality of second user terminals involved in the authentication, the second user terminals being randomly selected from among user terminals other than the first user terminal; transmitting the channel key to the plurality of nodes in common, and transmitting authentication comparison data used in the authentication to the plurality of nodes in a divided manner; transmitting an authentication preparation completion message including the channel key to the first user terminal; receiving an authentication request from the first user terminal, the authentication request including the channel key and authentication target data related to the first user terminal; performing authentication on the first user terminal in response to receiving the authentication request, the authentication on the first user terminal including a first authentication and a second authentication, the first authentication being authentication using a security key transmitted to the first user terminal and a randomly selected part of the plurality of nodes, the security key being generated by randomly extracting and combining authentication elements collected from the first user terminal and the second user terminal, and the second authentication being authentication using the authentication target data transmitted in a divided manner to the plurality of nodes and the authentication comparison data transmitted in a divided manner; receiving, from the plurality of nodes, a comparison result between the divided and transmitted authentication comparison data and the divided and transmitted authentication target data; and determining whether authentication of the first user terminal has been successful based on the comparison result; The authentication comparison data and the authentication factors collected from the second user terminal are obtained from a distributed ledger.

2. The step of authenticating the first user terminal includes: transmitting the security key to the first user terminal and a randomly selected portion of the plurality of nodes in response to receiving the authentication request; receiving a first hash value obtained by converting the security key by the first user terminal and a second hash value obtained by converting the security key by the part of nodes; and 2. The blockchain-based multi-node authentication method of claim 1, further comprising determining that the first authentication is successful if the first hash value and the second hash value match.

3. 2. The blockchain-based multi-node authentication method of claim 1, wherein the security key is one of a one-time security key and a time-limited security key.

4. The authentication comparison data and the authentication target data are each divided into a plurality of categories; The step of dividing and transmitting the authentication comparison data to the plurality of nodes comprises: dividing the authentication comparison data by the categories and transmitting the divided authentication comparison data to different nodes; The step of authenticating the first user terminal includes:

2. The blockchain-based multi-node authentication method of claim 1, further comprising: dividing the data to be authenticated by the category and transmitting the data to the different nodes, and transmitting the data to the same category as the category of the authentication comparison data transmitted to each node.

5. The step of determining whether authentication of the first user terminal has been successful includes:

5. The blockchain-based multi-node authentication method of claim 4, further comprising: determining that the second authentication is successful when a result is received from nodes exceeding a preset ratio that the divided and transmitted authentication comparison data matches the divided and transmitted authentication target data.

6. 2. The blockchain-based multi-node authentication method of claim 1, further comprising deleting the temporary channel, the channel key, and the security key when a determination is made as to whether authentication of the first user terminal is successful.

7. The step of receiving the authentication preparation request from the first user includes: The blockchain-based multi-node authentication method of claim 1 , further comprising: randomly selecting a specific authentication server from among a plurality of authentication servers to perform the first authentication and the second authentication.

8. Communication interface; A memory into which a computer program is loaded; and a processor for executing the computer program; The computer program comprises: instructions for receiving an authentication preparation request from a first user; instructions for generating a temporary channel in response to the authentication preparation request for the first user terminal of the first user and a channel key for identifying the temporary channel, the temporary channel including a plurality of nodes respectively corresponding to a plurality of second user terminals involved in the authentication, the second user terminals being randomly selected from among user terminals other than the first user terminal; instructions for commonly transmitting the channel key to the plurality of nodes and for dividing and transmitting authentication comparison data used in the authentication to the plurality of nodes; instructions for transmitting an authentication preparation message including the channel key to the first user terminal; instructions for receiving an authentication request from the first user terminal, the authentication request including the channel key and authentication target data related to the first user terminal; instructions for performing authentication on the first user terminal in response to receiving the authentication request, the authentication on the first user terminal including a first authentication and a second authentication, the first authentication being authentication using a security key transmitted to the first user terminal and a randomly selected part of the plurality of nodes, the security key being generated by randomly extracting and combining authentication elements collected from the first user terminal and the second user terminal, and the second authentication being authentication using the authentication target data transmitted in a divided manner to the plurality of nodes and the authentication comparison data transmitted in a divided manner; instructions for receiving, from the plurality of nodes, a result of comparing the divided and transmitted authentication comparison data with the divided and transmitted authentication target data; and and determining whether authentication of the first user terminal has been successful based on the result of the comparison. A blockchain-based multi-node authentication system, wherein the authentication comparison data and the authentication factors collected from the second user terminal are obtained from a distributed ledger.

9. The instruction to perform authentication on the first user terminal includes: instructions for transmitting the security key to the first user terminal and a randomly selected portion of the plurality of nodes in response to receiving the authentication request; instructions for receiving a first hash value into which the security key is converted by the first user terminal and a second hash value into which the security key is converted by the portion of nodes; and 9. The blockchain-based multi-node authentication system of claim 8, further comprising instructions for determining that the first authentication is successful if the first hash value and the second hash value match.

10. The authentication comparison data and the authentication target data are each divided into a plurality of categories; The instruction to split and transmit the authentication comparison data to the plurality of nodes includes: instructions for dividing the authentication comparison data by the categories and transmitting the divided data to different nodes, The instruction to perform authentication on the first user terminal includes: The blockchain-based multi-node authentication system of claim 8, further comprising instructions for dividing the authentication target data by category and transmitting the data to the different nodes, and transmitting the data to each node in the same category as the category of the authentication comparison data transmitted to the node.

11. The instructions for receiving the authentication preparation request from the first user include:

9. The blockchain-based multi-node authentication system of claim 8, further comprising instructions for randomly selecting a particular authentication server from among a plurality of authentication servers to perform the first authentication and the second authentication.

Images