Smartcard device, virtual code generating device for authentication, method of generating virtual code for authentication using the same, and server for verifying virtual code for authentication

Abstract

To provide a smart card device, a virtual code generation device for authentication, a virtual code generation method for authentication using the same, and a virtual code verification server for authentication.SOLUTION: A method performed by an authentication virtual code generation device includes transmitting time data to a smart card device, receiving a primary authentication virtual code generated based on the time data from the smart card device, generating a secondary authentication virtual code using the primary authentication virtual code, transmitting at least one of the primary authentication virtual code and the secondary authentication virtual code to a server, and requesting the server to perform at least one verification.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a smart card device, an authentication virtual code generating device, an authentication virtual code generating method using the same, and an authentication virtual code verification server. [Background technology]

[0002] Code form data is used in many fields. Not only card numbers and account numbers used in payment, but also IPIN numbers for user identification and resident registration numbers are virtual code generators for authenticating code form data.

[0003] However, there are many cases of leakage of such code data during its use. In the case of card numbers, the actual card number is printed on the surface of the card, so it can be visually leaked to others, and when making a payment using magnetic stripes, the card number is transmitted as is to the POS device, resulting in leakage.

[0004] There have been many attempts to use virtual codes to prevent actual codes from being leaked, but data to identify the user is required to search for the actual code corresponding to the virtual code.

[0005] However, OTP (One Time Password) requires a separate OTP generating device, which is inconvenient, and especially in the case of a user terminal, there is a security vulnerability due to leakage of seed data used to generate the OTP.

[0006] Therefore, a method is needed to generate an OTP code, such as a virtual security code required for user authentication based on card data of cards held by many users, without requiring a separate OTP generating device, and at the same time, to enhance security by preventing the leakage of seed data. Summary of the Invention [Problem to be solved by the invention]

[0007] The problem to be solved by the present invention is to provide a smart card device, an authentication virtual code generating device, an authentication virtual code generating method using the same, and an authentication virtual code verification server.

[0008] The problems to be solved by the present invention are not limited to those described above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description. [Means for solving the problem]

[0009] To solve the above problem, a method for generating an authentication virtual code performed by an authentication virtual code generating device according to one aspect of the present invention includes a step of transmitting time data to a card having an IC chip built therein when tagging the card, a step of receiving a primary authentication virtual code generated based on the time data from the card, a step of generating a secondary authentication virtual code using the primary authentication virtual code, a step of transmitting at least one of the primary authentication virtual code and the secondary authentication virtual code to a server, and a step of requesting the server to perform at least one verification.

[0010] In the present invention, the virtual code for primary authentication includes a plurality of codes, and among the plurality of codes, a first code is generated based on the time data and a first OTP, and among the plurality of codes, a second code can be generated by excluding a first UID (user identification), which is identification information of the card, from the first code.

[0011] In the present invention, the step of generating the virtual code for secondary authentication can generate a third code by excluding a second UID, which is identification information of the authentication virtual code generating device, from the first code, and combine the first code, the second code and the third code to generate the virtual code for secondary authentication.

[0012] In the present invention, the card is verified based on the first code and the second code, and the authentication virtual code generation device is verified based on the first code and the third code.

[0013] In the present invention, the step of generating a virtual code for secondary authentication comprises: A second OTP is generated based on the virtual code, and the second authentication virtual code can be generated based on the second OTP and 2UID, which is identification information of the authentication virtual code generating device.

[0014] In the present invention, the second authentication virtual code is verified by comparing the second OTP included in the second authentication virtual code with a verification second OTP, and the verification second OTP may be generated by the server based on the same seed data as the seed data used when generating the second OTP.

[0015] In the present invention, the primary authentication virtual code can be used for offline access control and user authentication during online login.

[0016] In the present invention, the secondary authentication virtual code can be used for user authentication during financial settlement.

[0017] In the present invention, the time data may be in a combined form and may be in a form combined with an APDU (Application Protocol Data Unit) command.

[0018] A smart card device according to another aspect of the present invention for solving the above-mentioned problems includes an NFC module that receives time data from an authentication virtual code generating device via card tagging and an IC module that generates a primary authentication virtual code based on the received time data, wherein the primary authentication virtual code is transmitted by itself and used for user authentication or is used to generate a secondary authentication virtual code, the secondary authentication virtual code is generated by the authentication virtual code generating device using the primary authentication virtual code, and at least one of the primary authentication virtual code and the secondary authentication virtual code is transmitted by the authentication virtual code generating device to the server to be verified by the server.

[0019] In order to solve the above-mentioned problems, according to another aspect of the present invention, an authentication virtual code generating device includes: a communication unit that transmits time data to a card having an IC chip built therein when tagging the card, and receives a primary authentication virtual code generated based on the time data from the card; a code generating unit that generates a secondary authentication virtual code using the primary authentication virtual code; and a verification request unit that transmits at least one of the primary authentication virtual code and the secondary authentication virtual code to a server via the communication unit and requests the server to perform verification of at least one of the primary authentication virtual code and the secondary authentication virtual code.

[0020] In another aspect of the present invention for solving the above-mentioned problems, there is provided an authentication virtual code verification method executed by a server, comprising the steps of receiving at least one of a primary authentication virtual code and a secondary authentication virtual code from an authentication virtual code generation device, and performing verification of at least one of the primary authentication virtual code and the secondary authentication virtual code, wherein if the secondary authentication virtual code includes multiple codes, the verification execution step extracts a first UID (user identification), which is identification information of the card, based on a first code and a second code among the multiple codes, to verify the card, and extracts a second UID, which is identification information of the authentication virtual code generation device, based on the first code and a third code among the multiple codes, to verify the authentication virtual code generation device.

[0021] In the present invention, when the secondary authentication virtual code includes a second OTP and the second UID, the verification execution step generates a second verification OTP based on the same seed data as the seed data used when generating the second OTP, compares the second OTP included in the secondary authentication virtual code with the second verification OTP, and if the second OTP and the second verification OTP are identical, verification of the card and the authentication virtual code generation device can be completed.

[0022] In the present invention, when the virtual code for primary authentication is received, the verification execution step can use a first verification algorithm to extract a first UID (user identification), which is the card's identification information, based on the virtual code for primary authentication, and perform verification of the card.

[0023] In addition, other methods and systems for implementing the present invention, and computer-readable recording media having computer programs for carrying out the methods can also be provided. [Effects of the Invention]

[0024] According to the present invention, the authentication virtual code generating device provides time data to the smart card device during card tagging, so that the virtual security code required for user authentication can be generated using the time data acquired based on the NFC method without a separate OTP device.

[0025] When tagging a smart card device to an authentication virtual code generating device, in order to prevent data from being decoded when data is transmitted and received between the two devices, the primary authentication virtual code generated by the smart card device can be reprocessed and a new secondary authentication virtual code can be generated by the authentication virtual code generating device.

[0026] In addition, in offline access control or online login situations, user authentication is performed through verification of a virtual code for primary authentication, and in financial payment situations, user authentication is performed through verification of a virtual code for secondary authentication generated using the virtual code for primary authentication, thereby enabling different security levels to be set depending on the situation.

[0027] Furthermore, since the smart card device can be applied to both offline access restrictions and financial settlement situations, financial cards (personal cards or corporate cards) can be extended and utilized as company access cards.

[0028] The effects of the present invention are not limited to those described above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description. [Brief explanation of the drawings]

[0029] [Figure 1] FIG. 1 is a diagram showing the configuration of a user authentication system based on a virtual code for authentication according to the present invention. [Figure 2] FIG. 2 is a schematic diagram of the smart cart device according to the present invention. [Figure 3] FIG. 3 is a schematic diagram of an authentication virtual code generating device according to the present invention. [Figure 4]FIG. 4 is a flowchart of a method for generating a virtual code for authentication executed by the device for generating a virtual code for authentication according to the present invention. [Figure 5] FIG. 5 is a diagram for explaining time data according to the present invention. [Figure 6] FIG. 6 is a diagram for explaining the verification of the primary authentication virtual code according to the present invention. [Figure 7] FIG. 7 is a diagram for explaining the verification of the virtual code for secondary authentication according to the present invention. [Figure 8] FIG. 8 is a flowchart of a method for generating a virtual code for authentication performed by a smart card device according to the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0030] The advantages and features of the present invention, as well as methods for achieving them, will become more apparent by reference to the following detailed description of the embodiments in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, and can be realized in various different forms. The present embodiments are provided solely to complete the disclosure of the present invention and to fully convey the scope of the present invention to those skilled in the art to which the present invention pertains. The present invention is defined only by the scope of the claims.

[0031] The terms used in this specification are for the purpose of describing embodiments and are not intended to limit the present invention. In this specification, the singular includes the plural unless otherwise specified in the phrase. As used in this specification, "comprises" and / or "comprising" do not exclude the presence or addition of one or more other elements in addition to the elements referenced. The same reference numerals refer to the same elements throughout the specification, and "and / or" includes each and every combination of one or more of the referenced elements. While terms such as "first," "second," etc. are used to describe various elements, it is understood that these elements are not limited by these terms. These terms are used only to distinguish one element from another. Therefore, it is understood that a first element referred to below may also be a second element within the technical spirit of the present invention.

[0032] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in the sense that they can be commonly understood by a person of ordinary skill in the art to which the present invention belongs. Furthermore, terms defined in commonly used dictionaries should not be interpreted ideally or excessively unless otherwise clearly defined.

[0033] Before the explanation, the meanings of the terms used in this specification will be briefly explained. However, it should be noted that the explanations of the terms are intended to aid in the understanding of this specification, and are not intended to limit the technical idea of ​​the present invention unless explicitly stated as a matter limiting the present invention.

[0034] In this specification, "characters" include all or part of uppercase alphabets, lowercase alphabets, numbers, and special characters as components that make up a code.

[0035] In this specification, the term "code" means a string of characters.

[0036] In this specification, "OTP (One Time Password)" is a random code that is temporarily generated for user authentication and is changed every unit time, and may include a code of a specific number of characters.

[0037] In this specification, the term "authentication virtual code" refers to a code generated by an authentication virtual code generating means and verified by an authentication virtual code verifying means. That is, the term "authentication virtual code" refers to a virtual code temporarily assigned to each unit count for verification. Here, the authentication virtual code generating means may be, but is not limited to, a smart card device or an authentication virtual code generating device according to an embodiment.

[0038] In this specification, the term "detailed code" refers to a part of the code included in the virtual code for authentication.

[0039] As used herein, a "unit count" is a unit that is set to a specific time interval and is defined to change as the time interval elapses. For example, 1 count is set to a specific time interval (e.g., 1.5 seconds).

[0040] In this specification, the term "authentication virtual code generation function" refers to a function used to generate an authentication virtual code.

[0041] In this specification, a "user" may be, but is not limited to, a user who uses a smart card device to approach a particular space (offline or online space) that requires security or who uses a smart card device to make financial payments.

[0042] In this specification, "UID (user identification)" refers to a unique code value that is assigned to each user to identify them.

[0043] In this specification, "time data" refers to time data at the current time point. That is, the time data used to generate and verify the authentication virtual code may all refer to time data at the same time point.

[0044] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0045] FIG. 1 is a diagram showing the configuration of a user authentication system based on a virtual code for authentication according to the present invention.

[0046] FIG. 2 is a schematic diagram of the smart cart device according to the present invention.

[0047] FIG. 3 is a schematic diagram of an authentication virtual code generating device according to the present invention.

[0048] FIG. 4 is a flowchart of a method for generating a virtual code for authentication executed by the device for generating a virtual code for authentication according to the present invention.

[0049] FIG. 5 is a diagram for explaining time data according to the present invention.

[0050] FIG. 6 is a diagram for explaining the verification of the primary authentication virtual code according to the present invention.

[0051] FIG. 7 is a diagram for explaining the verification of the virtual code for secondary authentication according to the present invention.

[0052] FIG. 8 is a flowchart of a method for generating a virtual code for authentication performed by a smart card device according to the present invention.

[0053] 1, an authentication virtual code-based user authentication system (hereinafter referred to as the system) includes a control server 100, a smart card device 10, an authentication virtual code generating device 20, and a server 30. Here, the system may include fewer or more components than those shown in FIG.

[0054] The smart card device 10 refers to a physical card used by a user. Depending on the embodiment, the surface of the smart card device 10 may display only a portion of the information sufficient to identify the card or the user, or may display no information at all.

[0055] Depending on the embodiment, smart card device 10 may be an access control card or a financial transaction card (eg, credit card, check card, cash card, corporate card, etc.).

[0056] Specifically, if the smart card device 10 is an access control card, the smart card device 10 is used when a user enters or exits a specific space requiring security offline, or when logging in to a specific website or application online. If the smart card device 10 is a financial payment card, the smart card device 10 is used when a user conducts a financial transaction. However, the form, type, and purpose of the card are not limited to those described above. A detailed description of the smart card device 10 will be provided below.

[0057] The authentication virtual code generating device 20 may be an access control device (e.g., a gate reader, a door lock, etc.) or a user terminal used by a user. In this case, the user terminal is any electronic device equipped with an application processor (AP) capable of running an application. The user terminal may include, but is not limited to, a non-portable desktop computer or a portable mobile device (e.g., a smartphone, a tablet PC, a personal digital assistant (PDA), an enterprise digital assistant (EDA), a portable multimedia player (PMP), a personal navigation device (PND), a wearable device, etc.). A detailed description of the authentication virtual code generating device 20 will be provided below.

[0058] The server 30, as an authentication virtual code verification means, verifies the authentication virtual code received from the authentication virtual code generation device 20. However, the present invention is not limited to this, and the authentication virtual code generation device 20 may verify the authentication virtual code instead of the server 30 according to an embodiment.

[0059] In this case, the server 30 may be, but is not limited to, a security-related server or a financial company server that communicates with the authentication virtual code generation device 20. Also, while the server 30 is shown as being configured as one server in FIG. 1, it may be configured as a system in which multiple servers are linked together.

[0060] As shown in FIG. 1, a smart card device 10, an authentication virtual code generating device 20, and a server 30 can transmit and receive various data, signals, or information to and from each other via a communication network.

[0061] Here, various types of communication networks can be used, such as wireless communication methods such as WLAN (Wireless LAN), Wi-Fi, Wibro (Wireless Broadband Internet), WiMAX, and HSDPA (High Speed ​​Downlink Packet Access), or wired communication methods such as Ethernet, xDSL (ADSL, VDSL), HFC (Hybrid Fiber Coax), FTTC (Fiber to the Curb), and FTTH (Fiber to the Home).

[0062] Meanwhile, the communication network is not limited to the communication methods presented above, and may include any other communication methods that are widely known or that will be developed in the future, in addition to the above-mentioned communication methods.

[0063] 2, smart card device 10 may include an NFC module 12 and an IC module 14. Note that smart card device 10 may include fewer or more components than those shown in FIG.

[0064] The NFC (Narrow Frequency Communication) module 12 (i.e., NFC chip) is a communication module that can transmit and receive various data to and from the authentication virtual code generating device 20. Here, the NFC module 12 can be implemented in the form of an applet, but is not limited thereto. When the smart card device 10 is tagged by the authentication virtual code generating device 20, the NFC module 12 can receive time data from the authentication virtual code generating device 20.

[0065] The IC module 14 (i.e., IC chip) can generate a virtual code for primary authentication. Here, the IC module 14 can be implemented in the form of an applet, but is not limited thereto.

[0066] The IC module 14 can generate a virtual code for primary authentication using the received time data. Specifically, the IC module 14 can generate a virtual code for primary authentication using not only the received time data but also card data stored in a memory (not shown) and a virtual code generation function for authentication.

[0067] Here, the card data may include user identification information and card identification information of the user who applied for the issuance of the smart card device 10. Here, the card identification information may include, but is not limited to, a first UID (user identification), which is identification information of the smart card device 10, a secret, a card number, and a serial number, and may include all card-related information. Here, the user identification information may include, but is not limited to, a resident registration number, and may include all user-related personal information.

[0068] In addition to user identification information and card identification information, the IC module 14 may store the URL address of the company that issues and manages the smart card device 10 (e.g., a card manufacturer, a financial company, a security company, an online web or app service company, etc.). For example, if the URL address of a specific financial company is stored in the IC module 14 of the smart card device 10, when the corresponding smart card device 10 is tagged in the authentication virtual code generation device 20, the authentication virtual code generation device 20 can acquire the URL address. In this case, the URL address may be related to installation information or execution information of the program or application of the financial company.

[0069] That is, various information other than user identification information and card identification information is stored in the IC module 14. When the smart card device 10 is tagged to the authentication virtual code generating device 20, the authentication virtual code generating device 20 receives the corresponding information from the smart card device 10.

[0070] The smart card device 10 may further include a processor (not shown) that controls the overall operation of the smart card device 10. The processor (not shown) may process signals, data, information, etc. input or output via the components noted above, or run stored application programs. Here, the processor (not shown) has been described as being distinct from the IC module 14, but depending on the embodiment, the IC module 14 may function as the processor (not shown).

[0071] 3, the authentication virtual code generation device 20 may include a communication unit 22, a memory 24, and a processor 26. Here, the authentication virtual code generation device 20 may include fewer or more components than those shown in FIG.

[0072] When the smart card device 10 is tagged by the authentication virtual code generating device 20, the communication unit 22 can transmit time data to the smart card device 10 via the communication network and receive a primary authentication virtual code generated based on the time data from the smart card device 10. In addition, the two devices can transmit and receive various data to and from each other when tagging.

[0073] The memory 24 may store data supporting various functions of the authentication virtual code generating device 20. The memory 24 may store a plurality of application programs (or applications) run by the authentication virtual code generating device 20, and at least one process, data, and instructions for the operation of the authentication virtual code generating device 20. At least some of such application programs may exist for the basic functions of the authentication virtual code generating device 20.

[0074] In addition to operations related to the application programs, the processor 26 can generally control the overall operation of the authentication virtual code generation device 20. The processor 26 can provide or process information or functions appropriate for the smart card device 10 or the server 30 by processing signals, data, information, etc. input or output via the above components or by running application programs stored in the memory 24.

[0075] 3 to run the application program stored in the memory 24. Furthermore, the processor 26 can control at least some of the components shown in FIG. 3 in order to run the application program. Furthermore, the processor 26 can operate at least two or more of the components included in the authentication virtual code generation device 20 in combination with each other to run the application program.

[0076] 3, the processor 26 may include a code generator 262 and a verification requester 164. Here, the processor 26 may include fewer or more components than those shown in FIG.

[0077] The code generating unit 262 can generate a virtual code for secondary authentication using the virtual code for primary authentication generated by the smart card device 10.

[0078] The verification request unit 264 can transmit at least one of the virtual code for primary authentication and the virtual code for secondary authentication to the server via the communication unit 22 and request the server to verify the at least one of them.

[0079] Although not shown in FIG. 3, the processor 26 may further include components that perform various calculation operations and judgment operations in addition to the code generator 262 and the verification requester 264.

[0080] The authentication virtual code-based user authentication method executed by the authentication virtual code generation device 20 will be described in detail below with reference to FIGS.

[0081] Referring to FIG. 4, the communication unit 22 of the authentication virtual code generating device 20 can transmit time data to the smart card device 10 when tagging a card with an IC chip built in (S110).

[0082] Since the smart card device 10 cannot obtain time data by itself, it can receive time data from the authentication virtual code generating device 20 through tagging.

[0083] In this case, the time data may be combined with an APDU (Application Protocol Data Unit) command. Referring to Fig. 5, the time data may be transmitted to the smart card device 10 in a combined form after the APDU command. However, the combination form is not limited thereto.

[0084] The communication unit 22 of the authentication virtual code generation device 20 can receive the primary authentication virtual code generated based on the time data from the smart card device 10 (S120).

[0085] That is, the smart card device 10 receives time data, generates a virtual code for primary authentication using the received time data together with card data (e.g., secret, first UID) stored in the card, and transmits the virtual code for primary authentication to the authentication virtual code generating device 20.

[0086] The primary authentication virtual code may include a first code and a second code, where the first code and the second code are detailed codes of the primary authentication virtual code, and the primary authentication virtual code may include more detailed codes in addition to the first code and the second code.

[0087] The first code of the primary authentication virtual code may be generated based on the time data and the first OTP. First, the smart card device 10 may generate the first OTP using a first authentication virtual code generation function with the secret value stored in the card and the time data as seed data. In this case, the seed data may further include values ​​other than the secret value and the time data, depending on the embodiment.

[0088] Thereafter, the smartcard device 10 can generate a first code by adding the generated first OTP to the received time data using a first authentication virtual code generation function.

[0089] The smart card device 10 can generate the second code by excluding a first UID (user identification), which is the card's identification information, from the first code using a first authentication virtual code generation function. Here, the first UID is a unique value that can identify the smart card device 10 as data stored in the smart card device 10.

[0090] 1st code = time data + 1st OTP

[0091] 2nd Code = 1st Code - 1st UID

[0092] The smart card device 10 can generate a virtual code for primary authentication by combining the generated detail codes (first code and second code). In one embodiment, the smart card device 10 can generate the virtual code for primary authentication by combining multiple detail codes according to a specific rule using a virtual code generation function for primary authentication. The virtual code generation function for primary authentication can include a rule for combining multiple detail codes (i.e., a detail code combining function).

[0093] Various methods can be applied to combine multiple detail codes to generate one virtual authentication code. As an example of the detail code combining function, the smart card device 10 can generate a virtual authentication code by alternately arranging a first code of M digits and a second code of N digits. As another example, the detail code combining function can be a function that combines the second code after the first code. As the number of detail codes included in the virtual authentication code increases, various detail code combining functions can also be generated.

[0094] The primary authentication virtual code generated in this manner is transmitted to the authentication virtual code generation device 20.

[0095] The code generating unit 262 of the authentication virtual code generating device 20 can generate a secondary authentication virtual code using the primary authentication virtual code (S130).

[0096] Prior to step S130, the code generation unit 262 of the authentication virtual code generation device 20 may first determine whether to generate a secondary authentication virtual code according to the type of the smart card device 10. More specifically, the code generation unit 262 may perform the determination operation based on card data received together with the primary authentication virtual code (although, according to an embodiment, the card data may be received at the time of tagging). That is, the code generation unit 262 may determine whether the smart card device 10 is an access control card or a financial payment card based on the card data. If the smart card device 10 is determined to be an access control card, the code generation unit 262 may not generate a secondary authentication virtual code, but if the smart card device 10 is determined to be a financial payment card based on the card data, the code generation unit 262 may generate a secondary authentication virtual code.

[0097] According to an embodiment, whether or not to generate a secondary authentication virtual code may be determined depending on the type of the authentication virtual code generating device 20. Specifically, if the authentication virtual code generating device 20 is an access control device, the secondary authentication virtual code may not be generated without the determination operation. If the authentication virtual code generating device 20 is a user terminal, the code generating unit 262 may determine whether or not to generate a secondary authentication virtual code depending on the type of the smart card device 10. More specifically, the code generating unit 262 may perform the determination operation based on card data received together with the primary authentication virtual code (according to an embodiment, the card data may be received at the time of tagging). That is, if the smart card device 10 is identified as an access control card based on the card data, the code generating unit 262 may not generate a secondary authentication virtual code, but may generate a secondary authentication virtual code if the smart card device 10 is identified as a financial payment card based on the card data.

[0098] Although the code generator 262 has been described as performing the determination operation, the present invention is not limited to this, and other components of the processor 260 may also perform the determination operation.

[0099] If it is determined through the above process that a secondary authentication virtual code is to be generated, the code generating unit 262 can generate a secondary authentication virtual code using the primary authentication virtual code in step S130. In this case, in order to generate the secondary authentication virtual code, the primary authentication virtual code must first be verified by the server 30. The server 30 can extract multiple detail codes (first and second codes) included in the primary authentication virtual code through the verification and transmit them to the authentication virtual code generating device 20.

[0100] In the above description, the verification of the primary authentication virtual code for generating the secondary authentication virtual code is performed by the server 30. However, depending on the embodiment, the relevant verification may be performed by the authentication virtual code generating device 20 instead of the server 30. A method for verifying the authentication virtual code will be described later.

[0101] In this specification, the method of generating a virtual code for secondary authentication can be divided into a method of performing an OTP calculation once and a method of performing an OTP calculation twice.

[0102] In the method (first method) of performing the OTP calculation once, the OTP calculation is performed only when the smart card device 10 generates the virtual code for primary authentication, and the code length of the virtual code for secondary authentication becomes long.

[0103] In the first method, the code generating unit 262 can generate a third code by using a second authentication virtual code generating function to exclude the second UID, which is identification information of the authentication virtual code generating device 20, from the received first code. Here, the second UID is a unique value that can identify the authentication virtual code generating device 20 as data stored in the authentication virtual code generating device 20.

[0104] 3rd Code = 1st Code - 2nd UID

[0105] Then, the code generation unit 262 can generate a virtual code for secondary authentication by combining the first code generated by the smart card device 10, the second code generated by the smart card device 10, and the third code generated by the authentication virtual code generation device 20 using a second authentication virtual code generation function.

[0106] The code generation unit 262 can generate a virtual code for secondary authentication by combining the generated multiple detail codes (first code, second code, and third code). In one embodiment, the code generation unit 262 can generate the virtual code for secondary authentication by combining the multiple detail codes according to a specific rule using a virtual code generation function for second authentication. The virtual code generation function for second authentication can include a rule for combining the multiple detail codes (i.e., a detailed code combining function). The above-mentioned method can be applied as a method for combining the multiple detail codes to generate one virtual code for authentication.

[0107] In the first method, the first and second codes included in the virtual code for primary authentication and the first and second codes included in the virtual code for secondary authentication are both generated by the smart card device 10 and are the same code. A third code is newly generated by the smart authentication device 20 and is combined with the first and second codes to generate the virtual code for secondary authentication.

[0108] In the method (second method) of performing the OTP calculation twice, the OTP calculation is performed when the smart card device 10 generates the virtual code for primary authentication, and then the OTP calculation is performed again when the authentication virtual code generating device 20 generates the virtual code for secondary authentication, and the code length of the secondary authentication virtual code does not change (i.e., it is the same as the length of the primary authentication virtual code).

[0109] In the second method, the code generating unit 262 generates a second OTP based on the first authentication virtual code, and generates the second authentication virtual code based on the second OTP and a second UID, which is identification information of the authentication virtual code generating device. Here, the second UID is a unique value that can identify the authentication virtual code generating device 20 as data stored in the authentication virtual code generating device 20.

[0110] The code generation unit 262 generates the time data and the second authentication virtual code using a second authentication virtual code generation function. In addition to the secret value, the first authentication virtual code can be further utilized as additional seed data to generate the second OTP.

[0111] Thereafter, the code generating unit 262 may generate a first code by adding the generated second OTP to the time data (the time data may be a time point at which generation of a second authentication virtual code is requested) included in the first code generated by the smart card device 10 using a second authentication virtual code generating function. The code generating unit 262 may generate a second code by excluding a second UID (user identification), which is identification information of the authentication virtual code generating device 20, from the first code using a second authentication virtual code generating function. Here, the second UID is a unique value that can identify the authentication virtual code generating device 20 as data stored in the authentication virtual code generating device 20.

[0112] 1st code = time data + 2nd OTP

[0113] 2nd Code = 1st Code - 2nd UID

[0114] Here, the time data is the current time data, and the time data used to generate the primary authentication virtual code and the time data used to generate the secondary authentication virtual code may be the same. That is, since the first OTP and the second OTP are generated at the same time, the same current time data can be used.

[0115] The code generating unit 262 may generate a virtual code for secondary authentication by combining the generated detail codes (first code and second code). In one embodiment, the code generating unit 262 may generate the virtual code for secondary authentication by combining a plurality of detail codes according to a specific rule using a virtual code generating function for second authentication. The virtual code generating function for second authentication may include a rule for combining a plurality of detail codes (i.e., a detail code combining function). The above-described method may be applied to combine a plurality of detail codes to generate one virtual code for authentication.

[0116] In the second method, the first and second codes included in the virtual code for primary authentication and the first and second codes included in the virtual code for secondary authentication are different codes that are generated by the smart card device 10 and the authentication virtual code generating device 20, respectively. That is, the first and second codes included in the virtual code for primary authentication are generated using the first OTP and the first UID, and the first and second codes included in the virtual code for secondary authentication are generated using the second OTP and the second UID, so they are different from each other.

[0117] The first and second authentication virtual code generation functions are stored in the smart card device 10 and the authentication virtual code generation device 20, respectively, but may be initially driven at the same time. That is, when a user is issued a smart card device 10 and completes user registration for the smart card device 10 with the server 30 through initial tagging of the authentication virtual code generation device 20, the first and second authentication virtual code generation functions stored in the smart card device 10 and the authentication virtual code generation device 20, respectively, can start to be driven. That is, the first and second authentication virtual code generation functions may be the same.

[0118] When user registration is completed in this manner, the server 30 may store at least one of a first UID, which is identification information of the smart card device 10, and a second UID, which is identification information of the authentication virtual code generation device 20. That is, the server 30 may store at least one of the first UID and the second UID in an area assigned to the user in a verification algorithm during user registration. According to an embodiment, the server 30 may store the first UID in one area and match the second UID with the first UID and store them. According to an embodiment, the server 30 may store the second UID in one area and match the first UID with the second UID and store them. According to an embodiment, the server 30 may store the first UID and the second UID in each of two areas.

[0119] In addition, when registering a user, the server 30 can store not only the first UID and the second UID, but also the card data associated with the smart card device 10 and the terminal data associated with the authentication virtual code generating device 20.

[0120] The communication unit 22 of the authentication virtual code generation device 20 can transmit at least one of the primary authentication virtual code and the secondary authentication virtual code to the server (S140).

[0121] The verification request unit 264 of the authentication virtual code generating device 20 may request the server 30 to perform at least one verification (S150).

[0122] According to an embodiment, when the smart card device 10 is an entrance / exit card for access control, i.e., when a user uses the smart card device 10 to enter a specific space requiring security offline or to log in to a specific website or app online, the server 30 may receive a request to verify the primary authentication virtual code. Specifically, the primary authentication virtual code generated by the smart card device 10 is transmitted to the server 30 and used for user authentication.

[0123] Referring to FIG. 6, the authentication virtual code generating device 20 (more specifically, the verification request unit 264) can transmit the primary authentication virtual code generated in the smart card device 10 to the server 30 to request verification. The server 30 can verify the primary authentication virtual code based on a verification algorithm and transmit the verification result to the authentication virtual code generating device 20.

[0124] At this time, the authentication virtual code generating device 20 can directly transmit the primary authentication virtual code to the server 30 to request verification, or can output the primary authentication virtual code to a display unit (not shown) so that the user can visually check the primary authentication virtual code or copy it and input or paste it into another program or web page. The authentication virtual code generating device 20 can transmit the primary authentication virtual code input or copied and pasted by the user to the server 30 to request verification.

[0125] The authentication virtual code generating device 20 can perform offline access control and user authentication during online login depending on the verification result. That is, if the primary authentication virtual code is a valid code, the user can be allowed to enter the specific space requiring security or can be allowed to log in to the specific website or app.

[0126] According to an embodiment, when the smart card device 10 is a card for financial settlement, i.e., when a user conducts a financial transaction using the smart card device 10, the server 30 can receive a request to verify the virtual code for secondary authentication. That is, the virtual code for primary authentication generated in the smart card device 10 can be transmitted to the virtual code generation device for authentication 20 and used to generate a virtual code for secondary authentication.

[0127] Referring to FIG. 7, the authentication virtual code generating device 20 (more specifically, the code generating unit 262) can generate a secondary authentication virtual code using the primary authentication virtual code generated in the smart card device 10. The authentication virtual code generating device 20 (more specifically, the verification requesting unit 264) can transmit the generated secondary authentication virtual code to the server 30 to request verification. The server 30 can verify the secondary authentication virtual code based on a verification algorithm and transmit the verification result to the authentication virtual code generating device 20.

[0128] In this case, the authentication virtual code generation device 20 may request the server 30 to verify the primary authentication virtual code in order to obtain seed data for generating a secondary authentication virtual code. The server 30 may extract at least one of the first code, the second code, time data, a secret value, and a first UID from the primary authentication virtual code based on a verification algorithm and transmit the extracted data to the authentication virtual code generation device 20. The authentication virtual code generation device 20 may generate a secondary authentication virtual code using at least one of the first code, the second code, time data, a secret value, the first UID, and the primary authentication virtual code as seed data. As described above, the primary authentication virtual code for generating a secondary authentication virtual code may be verified by the server 30, but according to an embodiment, the authentication virtual code generation device 20 may directly perform the verification.

[0129] The authentication virtual code generation device 20 can perform user authentication during financial settlement according to the verification result. That is, if the secondary authentication virtual code is a valid code, the user can proceed with the financial transaction.

[0130] The method for verifying the authentication virtual code will be specifically described below.

[0131] According to an embodiment, when the server 30 receives a verification request for a virtual code for primary authentication, it can use a verification algorithm corresponding to a virtual code generation function for primary authentication to search the area where the primary UID is stored based on the virtual code for primary authentication and extract the primary UID.

[0132] In this case, as described above, the virtual code for primary authentication includes a plurality of detailed codes, which may be composed of a first code that sets a starting point for searching the storage area of ​​the first UID and a second code that sets a search path from the starting point to the storage area of ​​the first UID according to a specific search method.

[0133] The first code and the second code have a correlation for verifying the primary authentication virtual code within the server 30 equipped with an authentication virtual code verification means, but the smart card device 10 equipped with an authentication virtual code generation means only includes a first function for generating the first code and a second function for generating the second code as detailed code generation functions in order to improve security, and may not include data regarding the correlation between the first code and the second code.

[0134] Furthermore, in one embodiment, when the primary authentication virtual code is generated by combining the first code and the second code according to a specific rule, the first code and the second code can each play a role in searching the storage area of ​​the actual value (first UID) in the verification algorithm. For example, the first code sets the starting point for searching the storage location, and the second code sets a search path from the starting point to the storage area of ​​the first UID according to a specific search method. Therefore, when the smart card device 10 subsequently provides a successfully generated authentication virtual code for each unit count, the server 30 determines that the location traveled from the starting point corresponding to the first code along the search path corresponding to the second code is the area where the first UID is stored.

[0135] Specifically, the server 30 can extract multiple detail codes included in the primary authentication virtual code using a verification algorithm. The primary authentication virtual code is generated by combining multiple detail codes according to a specific rule. The server 30 can extract multiple detail codes from the primary authentication virtual code by applying the same detail code combining function as that used when generating the primary authentication virtual code. For example, when a primary authentication virtual code is generated by combining two detail codes (i.e., a first code and a second code), the server 30 can separate the first code and the second code by applying the detail code combining function to the character sequence of the primary authentication virtual code. In this case, a correlation may be included between the detail codes.

[0136] In one embodiment where the virtual code for primary authentication includes a first code and a second code and there is a correlation between the detailed codes, the server 30 determines the search starting point corresponding to the first code, and can regard the value corresponding to the point moved from the search starting point along the search path corresponding to the second code as the first UID.

[0137] Furthermore, as another embodiment, the smart card device 10 provides a new virtual code for primary authentication for each unit account, so that the server 30 can search for the first UID by setting a starting point and search path based on the first code and second code that change for each account.

[0138] Furthermore, in one embodiment, the server 30 may include a verification algorithm for finding the first UID using multiple correlated detail codes. The verification algorithm is an algorithm that enables the first UID search when each detail code included in the primary authentication virtual code is applied. For example, if the primary authentication virtual code includes a first code that determines the starting point of the search for the first UID and a second code that indicates the direction of the storage area from the starting point, the verification algorithm is an algorithm that adjusts the first UID to be located at a position corresponding to the first code when the direction corresponding to the second code is indicated at the point corresponding to the first code. By using the verification algorithm, the server 30 can find the first UID even if the first code and the second code included in the primary authentication virtual code are changed.

[0139] Furthermore, in one embodiment, if the virtual code for primary authentication is generated by combining a first code that adds a first OTP to time data and a second code that excludes the first UID from the first code, the server 30 can extract the actual value (i.e., the first UID) by subtracting the second code value from the first code value.

[0140] Furthermore, in one embodiment, the server 30 may search the storage area to compare the first UID extracted with the first UID extracted by subtracting the second code value from the first code value, and if the two values ​​are the same, determine that the primary authentication virtual code is a valid code. However, even without such a comparison process, the server 30 may determine whether the corresponding primary authentication virtual code is a valid code based on each value alone (e.g., by determining whether the extracted value matches information stored in the DB of the server 30).

[0141] According to an embodiment, when the server 30 receives a request to verify a virtual code for secondary authentication, it can search at least one of the areas where the first UID based on the virtual code for secondary authentication is stored and the areas where the second UID is stored using a verification algorithm corresponding to a virtual code generation function for second authentication, and extract at least one of the first UID and the second UID.

[0142] In the first method, the second authentication virtual code is generated by combining the first code, the second code, and the third code, as described above. The server 30 can search the area where the first UID is stored and extract the first UID based on the second authentication virtual code using a verification algorithm corresponding to the second authentication virtual code generation function, and can search the area where the second UID is stored and extract the second UID.

[0143] The server 30 can extract multiple detail codes included in the virtual code for secondary authentication using a verification algorithm. The virtual code for secondary authentication is generated by combining multiple detail codes according to specific rules. The server 30 can extract multiple detail codes from the virtual code for secondary authentication by applying the same detail code combining function as that used when generating the virtual code for secondary authentication. For example, if a virtual code for secondary authentication is generated by combining three detail codes (i.e., a first code, a second code, and a third code), the server 30 can separate the first code, the second code, and the third code by applying the detail code combining function to the character sequence of the virtual code for secondary authentication. In this case, correlations can be included between the detail codes.

[0144] When the secondary authentication virtual code includes a first code, a second code, and a third code, in one embodiment where there is a correlation between the detailed codes, the server 30 can determine a search start point corresponding to the first code, and regard a value corresponding to a point moved from the search start point along a search path corresponding to the second code as a first UID.Then, the server 30 can determine a search start point corresponding to the first code, and regard a value corresponding to a point moved from the search start point along a search path corresponding to the third code as a second UID.

[0145] In another embodiment, the authentication virtual code generating device 20 provides a new secondary authentication virtual code for each unit count, and the server 30 can search for the first UID and second UID by setting a starting point and a search path based on the first code, second code, and third code that change for each count.

[0146] Furthermore, in one embodiment, the server 30 may include a verification algorithm for finding the first UID and the second UID using a plurality of correlated detail codes. The verification algorithm is an algorithm for enabling the first UID search and the second UID search when each detail code included in the virtual code for secondary authentication is applied. For example, the verification algorithm may include a first code for determining a starting point for searching the first UID and the second UID from the virtual code for secondary authentication, a second code for indicating the direction of the first UID storage area from the starting point, and When the virtual code for secondary authentication includes a third code indicating the direction of the second UID storage area from the starting point, the verification algorithm adjusts the location of the first UID when the direction corresponding to the second code is indicated at the location corresponding to the first code, and adjusts the location of the second UID when the direction corresponding to the third code is indicated at the location corresponding to the first code. By using the verification algorithm, the server 30 can find the first UID and the second UID even if the first code, second code, and third code included in the virtual code for secondary authentication are changed.

[0147] In addition, as one embodiment, when the virtual code for secondary authentication is generated by combining a first code obtained by adding a first OTP to the time data, a second code obtained by excluding a first UID from the first code, and a third code obtained by excluding a second UID from the first code, the server 30 can extract the actual value (i.e., the first UID) by subtracting the second code value from the first code value, and can extract the actual value (i.e., the second UID) by subtracting the third code value from the first code value.

[0148] That is, the server 30 can extract the first UID based on the first code and the second code to verify the smart card device 10, and can extract the second UID based on the first code and the third code to verify the authentication virtual code generating device 20.

[0149] Furthermore, in one embodiment, the server 30 compares the first UID extracted by searching the storage area with the first UID extracted by subtracting the second code value from the first code value, and if the two values ​​are the same, completes the first verification of the secondary authentication virtual code (i.e., verification of the smart card device), compares the second UID extracted by searching the storage area with the second UID extracted by subtracting the third code value from the first code value, and if the two values ​​are the same, completes the second verification of the secondary authentication virtual code (i.e., verification of the authentication virtual code generation device), and determines that the secondary authentication virtual code is a valid code. However, even without such a comparison process, the server 30 can determine whether the corresponding secondary authentication virtual code is a valid code based on each value alone (e.g., by determining whether the extracted value matches information stored in the DB of the server 30).

[0150] In the second method, the second authentication virtual code is generated by combining the second OTP generated based on the first authentication virtual code and the first and second codes generated based on the second UID, as described above. The server 30 can verify the second authentication virtual code by comparing the second OTP included in the received second authentication virtual code with a verification second OTP. Here, the verification second OTP can be generated by the server 30 based on the same seed data as the seed data used to generate the second OTP.

[0151] Specifically, the server 30 separates the first code and the second code from the virtual code for secondary authentication, searches for the second UID based on the separated first code and second code, and can confirm the card data (e.g., secret value) stored together. Here, the method of separating the detail code and searching for the actual value using the detail code is as described above.

[0152] The server 30 can then search for a first UID that matches the searched second UID.

[0153] The server 30 generates a virtual code for primary authentication using the value extracted through the second UID, i.e., the secret value, the first UID, and the current time data, and can generate a second OTP for verification using the generated virtual code for primary authentication, the secret value, and the time data as seed data.

[0154] When the generated second OTP for verification is compared with the second OTP included in the second virtual code for authentication, if the two values ​​are equal, the server 30 can determine that the second virtual code for authentication is a normal code. That is, if the second OTP and the second OTP for verification are the same, the values ​​used as seed data (the virtual code for primary authentication, the secret value, and time data) are all the same, and if the virtual codes for primary authentication are equal, the virtual code for secondary authentication generated from the corresponding values ​​is also the same, so it can be verified that the smartcard device 10 and the virtual code for authentication generation device 20 are normal.

[0155] In the following, the authenticating virtual code-based user authentication method executed by the smart card device 10 will be described in detail with reference to FIG.

[0156] 8, the smart card device 10 receives time data from the authentication virtual code generating device through card tagging (S210), and generates a primary authentication virtual code based on the received time data (S220).

[0157] The smart card device 10 generating a virtual code for primary authentication, the user authentication device 20 generating a virtual code for secondary authentication, and the server 30 verifying at least one of the virtual code for primary authentication and the virtual code for secondary authentication are the same as those explained with reference to Figures 1 to 7, so detailed explanations will be omitted.

[0158] Meanwhile, the smart card device 10 of the present invention can perform both financial settlement and access control functions. That is, if the smart card device 10 is a company's corporate card or an employee's personal card, each user can use the card as an access card for the company.

[0159] Although the steps shown in Figures 4 and 8 are described as being executed sequentially, this is merely an illustrative explanation of the technical idea of ​​this embodiment, and a person having ordinary knowledge in the technical field to which this embodiment belongs can apply various modifications and variations by changing the order of the steps described in Figures 4 and 8 or by executing one or more steps in parallel, within the scope that does not deviate from the essential characteristics of this embodiment, and therefore the steps described in Figures 4 and 8 are not limited to a chronological order.

[0160] The present invention as described above can further provide a computer-readable recording medium having a computer program recorded thereon for executing the method for generating a virtual code for authentication.

[0161] The above-mentioned program is written in C, C++, JAVA, etc. that can be read by the processor (CPU) of the computer via a device interface of the computer so that the computer reads the program and executes the method realized as the program. (registered trademark) The method may include code coded in a computer language such as a machine language, where such code defines the functions required to execute the method. The code may include functional code related to functions, etc., and may also include execution procedure-related control code necessary for the computer processor to execute the function in a predetermined order. Furthermore, such code may further include memory reference-related code regarding the location (address) of the computer's internal or external memory at which additional information or media necessary for the computer processor to execute the function should be referenced. Furthermore, if the computer processor needs to communicate with any other remote computer, server, etc. to execute the function, the code may further include communication-related code, such as how to communicate with any other remote computer, server, etc. using the computer's communication module, and what information or media should be sent and received during communication.

[0162] The steps of a method or algorithm described in connection with the embodiments of the present invention may be embodied directly in hardware, in a software module executed by hardware, or in a combination thereof, which may reside in Random Access Memory (RAM), Read Only Memory (ROM), Erasable Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), Flash Memory, a hard disk, a removable disk, a CD-ROM, or any other form of computer-readable storage medium well known in the art to which the present invention pertains.

[0163] Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art will understand that the present invention can be embodied in other specific forms without changing the technical spirit or essential characteristics thereof. Therefore, it should be understood that the embodiments described above are illustrative in all respects and are not limiting.

Claims

1. A method performed by a device (20) for the generation of a virtual code for authentication, comprising: transmitting time data to a card (10) having an IC chip embedded therein when tagging the card; A first OTP (One Time Password), A first UID (User Identification) which is identification information of the card (10); receiving a first virtual code generated based on the the first virtual chord; A second UID, which is identification information of the device (20); generating a second virtual code based on the sending the second virtual code to a server (30) and requesting the server (30) to verify the second virtual code; Including, The first OTP is generated by the card (10) using a secret value stored in the card (10) and the time data as seed data. How to generate a virtual code for authentication.

2. the first virtual chord includes a first chord and a second chord, the first code is generated based on the time data and the first OTP; The second code is generated based on the first code and the first UID. The method for generating a virtual code for authentication according to claim 1 .

3. the second virtual chord is generated based on the first chord, the second chord, and the third chord, the third code is generated based on the first code and the second UID; The method for generating a virtual code for authentication according to claim 2 .

4. the second virtual code is generated based on the second OTP and the second UID; the second OTP is generated based on the time data and the first virtual code; The method for generating a virtual code for authentication according to claim 2 .

5. The first virtual code is used for offline access control and user authentication during online login. The method for generating a virtual code for authentication according to claim 1 .

6. The second virtual code is used for user authentication during financial settlement. The method for generating a virtual code for authentication according to claim 1 .

7. The time data is in the form of a combination with an APDU (Application Protocol Data Unit) command. The method for generating a virtual code for authentication according to claim 1 .

8. A program stored on a computer-readable recording medium for, in combination with a computer, executing the method of any one of claims 1 to 7.

9. A smart card device (10) comprising: an NFC module for receiving time data from a device (20) for generating a virtual code for authentication by card tagging; A first OTP (One Time Password), A first UID (User Identification) which is identification information of the smart card device (10); an IC module for generating a first virtual code based on the Including, the first virtual code is itself transmitted and used to generate a second virtual code; The second virtual code is generated based on the first virtual code and a second UID that is identification information of the device (20), the second virtual code is transmitted from the device (20) to the server (30) so that the server (30) verifies the second virtual code; The first OTP is generated by the smart card device (10) using a secret value stored in the smart card device (10) and the time data as seed data. Smart card device.

10. A device (20) for generating a virtual code for authentication, comprising: Transmitting time data to a card (10) having an IC card built therein when tagging the card (10); receiving, from the card (10), a first virtual code generated based on a first OTP and a first UID, which is identification information of the card (10); The Communications Department and generating a second virtual code based on the first virtual code and a second UID that is identification information of the device (20); Sending the second virtual code to a server (30) and requesting the server (30) to verify the second virtual code; a processor; Including, The first OTP is generated by the card (10) using a secret value stored in the card (10) and the time data as seed data. A virtual code generator for authentication.

Images