Method for managing account information using a user's mobile device

Abstract

The present invention provides an account information management method that utilizes an extension program installed in a web browser, a mobile password manager that is an application program for managing account information installed on a user's mobile device, and a relay server that communicates with the extension program and the mobile password manager. The account information management method allows a user to easily manage and automatically input IDs and passwords set for each online service they wish to access using their own mobile device, and has the effect of solving the problems of vulnerability to data theft due to external attacks caused by storing account information on a server, and the risk of data theft due to leakage of the master password for the account information management software.

Description

[Technical Field]

[0001] The present invention relates to an account information management method that not only allows for easy management and automatic input of IDs and passwords set for each online service that a user wishes to access, but also provides robust protection against theft of account information through external attacks. [Background technology]

[0002] In order to manage accounts for numerous online services, users must manage IDs and passwords for each online service they access. Some users record their IDs and passwords in a paper notebook, others on their smartphones, and still others install account information management software (hereafter referred to as "password manager") on each PC they use.

[0003] Such password managers work by saving the ID and password entered by a user when they access a specific website using a web browser and attempt to log in, and then automatically entering the saved ID and password when the user attempts to log in to the website again.

[0004] Conventional password managers have the following two technical features: First, in preparation for when a user accesses online services using multiple PCs or mobile devices, the password manager uploads the user's password to a password management server, and when the user needs to enter an ID and password, it downloads the ID and password from the password management server and enters them. Second, the user must enter the password manager's master password to prove that they are a legitimate user of the password manager.

[0005] However, due to the way user account information (i.e., IDs and passwords) is stored on the server (i.e., centralized management of account information via the server) and the way the master password is used, if the password management server is attacked from outside, the account information of all users registered with the service may be stolen all at once, or if the master password is leaked to a hacker, all of the account information of the users may be stolen.

[0006] Therefore, there is a need for an alternative technology that realizes decentralization of user account information by not storing it on a server, and at the same time allows users to manage their account information in a safer and more convenient way. Summary of the Invention [Problem to be solved by the invention]

[0007] The present invention provides an account information management method that allows users to easily manage and automatically enter IDs and passwords set for each online service they wish to access using their own mobile devices.

[0008] The present invention also aims to provide an account information management method with enhanced security that can solve the problems of vulnerability to data theft due to external attacks caused by storing account information on a server, and the risk of data theft due to leakage of the master password of the account information management software. [Means for solving the problem]

[0009] According to one aspect of the present invention, there is provided an account information management method that utilizes an extension program installed in a web browser, a mobile password manager that is an application program for managing account information installed on a user's mobile device, and a relay server that communicates with the extension program and the mobile password manager.

[0010] An account information management method according to an embodiment of the present invention may include the steps of: (a) the mobile password manager encrypting and managing account information for each website registered by the user; (b) the mobile password manager acquiring an information recording code generated by the extension program (the information recording code records website connection information corresponding to either domain information or IP information of a website the user wishes to access via the web browser); (c) the mobile password manager acquiring account information corresponding to the domain information recorded in the information recording code based on the account information for each website it manages, and sending the acquired account information to the relay server; (d) the relay server sending the account information received from the mobile password manager to the extension program; and (e) the extension program automatically inputting the account information sent from the relay server into a login window displayed on the web browser so that the account information is used for logging in to a website corresponding to the website connection information. [Effects of the Invention]

[0011] According to the account information management method of an embodiment of the present invention, a user can easily manage and automatically input the ID and password set for each online service they wish to access using their own mobile device.

[0012] The account information management method according to an embodiment of the present invention has the effect of solving the problem of vulnerability to data theft due to external attacks caused by storing account information on a server, and the risk of data theft due to leakage of the master password of the account information management software. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a diagram illustrating a method for managing account information using a user's mobile device according to an embodiment of the present invention. [Figure 2] 10 is a diagram illustrating a method for managing account information using a user's mobile device according to another embodiment of the present invention. [Figure 3] 10 is a diagram illustrating a method for managing account information using a user's mobile device according to another embodiment of the present invention. [Figure 4] 1 is a diagram illustrating an example of a screen of a mobile password manager, which is an application program for managing account information installed on a user's mobile device according to an embodiment of the present invention. [Figure 5] 1 is a diagram illustrating an example of a screen of a mobile password manager, which is an application program for managing account information installed on a user's mobile device according to an embodiment of the present invention. [Figure 6] 10 is a diagram illustrating an example of a login screen when an extension program is installed in a web browser according to an embodiment of the present invention. [Figure 7] 10 is a diagram illustrating an example of a login screen when an extension program is installed in a web browser according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0014] While the present invention may be modified in various ways and may have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description, but this is not intended to limit the present invention to the specific embodiments, and includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention.

[0015] In describing the present invention, if a detailed description of the related prior art is deemed to unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Furthermore, numbers (e.g., 1, 2, etc.) used in the description of this specification are merely identification symbols for distinguishing one component from another.

[0016] Furthermore, throughout the specification, when a component is referred to as being "connected" to or "accessed" by another component, it means that the component may be directly connected to or directly accessed by the other component, but unless otherwise specified, it may also be connected to or accessed via another component. Furthermore, throughout the specification, when a part "includes" a component, this does not mean that it may exclude other components, but that it may further include other components, unless otherwise specified. Furthermore, the terms "module," "unit," etc. used in the specification mean a unit that processes at least one function or operation, and this means that it may be embodied by one or more pieces of hardware, software, or a combination of hardware and software.

[0017] Figure 1 is a diagram illustrating a method for managing account information using a user's mobile device according to an embodiment of the present invention, Figures 2 and 3 are diagrams illustrating a method for managing account information using a user's mobile device according to another embodiment of the present invention, and Figures 4 and 5 are example screen views of a mobile password manager, which is an application program for managing account information installed on a user's mobile device according to an embodiment of the present invention.

[0018] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0019] According to an embodiment of the present invention, as shown in FIGS. 1 to 3, in order to manage and automatically input account information using a user's mobile device, an extension program 100, which is a function-expanding program installed in a web browser 10, an account information management application program (hereinafter simply referred to as a mobile password manager 200) installed in the user's mobile device, and an intermediate server 300 linked to the extension program 100 and the mobile password manager 200 are used.

[0020] The web browser 10 is a web-based application for searching and browsing internet content and is installed on a terminal used by a user. In this case, the access terminal may be a separate terminal such as a PC or laptop computer, separate from the mobile device, or may be the mobile device itself.

[0021] A method for managing account information using a user's mobile device according to the present invention will be described with reference to FIGS.

[0022] The mobile password manager 200 according to the embodiment of the present invention encrypts and manages account information for each website registered by the user (see FIG. 1(a)).

[0023] As explained in the background art above, conventional password management technologies centralize and manage user account information (i.e., IDs and passwords) on a server, which poses a problem that if the password management server is attacked from the outside, the account information of all users who subscribe to the service can be stolen at once. Therefore, in an embodiment of the present invention, to achieve decentralization in which user account information is not stored on a server, user account information registered for each website is stored and managed by a mobile password manager 200 installed on a mobile device directly owned by the user.

[0024] In one embodiment, when a user accesses a specific website using a web browser and then selects and activates the extension program installed in the browser, the extension program 100 extracts domain information from the website connected to the web browser 100 and generates an asymmetric key (see S11 in Figure 2 or (f) in Figure 1).

[0025] In another embodiment, if the extension program installed in the browser is already activated, it can monitor the user's login access attempt to a website (see S10 in FIG. 2), and if a login access attempt such as the user entering an ID and password is detected, it can extract domain information from the connected website and generate an asymmetric key (see S11 in FIG. 2 or (f) in FIG. 1).

[0026] For example, when a login access screen of a website is displayed via the web browser 10, the extension program 100 can focus and monitor an ID / Password input field on the login access screen. In this case, if the user performs an action such as moving the cursor to the corresponding ID / Password input field, the extension program 100 can determine that the user is attempting to log in to the website.

[0027] As another example, the extension program 100 can utilize eye-tracking technology to determine that if a user's gaze is detected gazing at the ID / Password input field on the login access screen, this indicates that the user is attempting to log in to a website.

[0028] When a login access attempt to such a website is detected, the extension program 100 extracts the domain information (e.g., the site URL, etc.) of the website from the web browser 10, and then generates an asymmetric key (i.e., a public key and a private key) to be used in the encryption and decryption process of the user account information. In this example, the domain information of the website is used as an example, but IP information may also be used as website connection information that can identify the website.

[0029] According to one embodiment, the extension program 100 may newly generate the asymmetric key each time a login access attempt to a website is detected. This method of newly generating an asymmetric key each time a login access attempt to a website is detected may have advantageous security effects. However, depending on the implementation of the system, the asymmetric key may be repeatedly used within a specific validity period.

[0030] Thereafter, the extension program 100 generates a QR code (Quick Response code) recording predetermined link information for executing the account information management service according to an embodiment of the present invention (see S15 of FIG. 2), and displays a pop-up window so that the generated QR code is displayed on the web browser screen. For example, when a user clicks on reference numeral 21 of FIG. 6 on the login screen, a pop-up window of reference numeral 22 of FIG. 7 may be displayed.

[0031] Thereafter, the user runs the mobile password manager 200 installed on the mobile device he or she owns (i.e., runs the app) and is able to scan the QR code using the QR scanning function of the mobile password manager 200. As a result, the mobile password manager 200 can obtain the QR code generated by the extension program 100 and thereby acquire the association information recorded in the QR code (see (b) in FIG. 1 or S16 in FIG. 2).

[0032] In this case, to ensure security during the application usage process, a biometric authentication procedure (e.g., smartphone-based face authentication, fingerprint authentication, etc.) for user authentication may be added before the application of the mobile password manager 100 is executed.

[0033] In this specification, a case where a QR code is generated and displayed as a pop-up is taken as an example, but it goes without saying that various other information recording codes may be used. However, for the sake of convenience and focus in explaining the invention, the following description will focus on the case where a QR code is used.

[0034] In the present invention, the link information recorded in the QR code for executing the account information management service may include the following data.

[0035] In the first embodiment, the link information recorded in the QR code may include at least one of the domain information of the website to which the user is attempting to log in and information corresponding to the public key of the asymmetric key generated by the extension program 100.

[0036] Depending on the system design method, if the mobile password manager 200 does not store server information or relay channel information regarding the relay server 300 that relays the process of transmitting the user's account information to the extension program 100, the link information may further include server information or relay channel information regarding the relay server 300 that operates in linkage with the extension program 100 to execute the account information management service. Here, the relay channel information is determined depending on the type of communication protocol used for transmitting and receiving data between the extension program 100 and the relay server 300, and may be, for example, a web push ID, a web socket ID, or a Firebase Cloud Messaging (FCM) ID.

[0037] As described above, when domain information and public key information are recorded in a QR code, the mobile password manager 200 can refer to the account information or account information list for each website it manages to obtain the account information corresponding to the domain information recorded in the QR code (see (c-1) in Figure 1 or S17 in Figure 2).

[0038] At this time, if there is no account information corresponding to the domain information, the account information may be added to the mobile password manager 200 via an account information addition input window such as the example screen of FIG.

[0039] As described above, once the account information corresponding to the domain information is obtained, the mobile password manager 200 may display the corresponding account information or a list on the application screen, allowing the user to select the account information they wish to use (see S19 in FIG. 2).

[0040] At this time, the account information is originally encrypted and is displayed on the app screen in a decrypted state. Therefore, depending on the app design or security reasons, a biometric authentication procedure for user authentication (e.g., smartphone-based facial recognition or fingerprint authentication) may be added before the account information is decrypted or before the user approves the transmission of the account information.

[0041] This allows the mobile password manager 200 to transmit the account information selected by the user to the relay server 300 (see (c-2) in FIG. 1 or S23 in FIG. 3). An example of a related app screen is shown in FIG. 4.

[0042] In this case, mobile password manager 200 can encrypt the account information selected by the user and transmit it to relay server 300. That is, mobile password manager 200 can encrypt the account information selected by the user using the public key recorded in the QR code (see S22 in FIG. 3), and then transmit the account information in an encrypted state to relay server 300.

[0043] Thereafter, the relay server 300 transmits the encrypted account information received from the mobile password manager 200 to the extension program 100 (see (d) in FIG. 1 or S24 in FIG. 3).

[0044] As a result, the extension program 100 decrypts the encrypted account information transmitted from the mobile password manager 200 via the relay server 300 using the private key of the asymmetric keys (see S25 of FIG. 3). In addition, the extension program 100 automatically inputs the decrypted account information into a login window displayed in the web browser so that the decrypted account information can be used for login access to the corresponding website (see (e) of FIG. 1 or S26 of FIG. 3).

[0045] Once the account information has been automatically entered through the above process, the result can be notified to the mobile password manager 200 via the relay server 300 (see S27 and S28 in FIG. 3).

[0046] In addition, if the website is changed or the ID / Password input field disappears from the screen (i.e., if the screen changes from the website login access screen to another screen), the extension program 100 can delete the QR code that is displayed as a pop-up and terminate the channel with the relay server 300.

[0047] The above mainly describes the case where the public key is directly recorded in the QR code together with the domain information, but according to the second embodiment of the present invention, a different method may be used due to limitations on the data capacity of the QR code. This will be described with reference to S12, S13, S14, S20, and S21 in Figure 2.

[0048] According to the second embodiment, the extension program 100 can transmit the public key of the asymmetric key generated in S11 of Fig. 2 to the relay server 300 (see S12 of Fig. 2). As a result, the relay server 300 can store the public key received from the extension program 100 (see S13 of Fig. 2) and transmit channel URL information that enables confirmation of the storage location of the public key to the extension program 100 (S14 of Fig. 2).

[0049] As a result, the extension program 100 can generate a QR code that records the website domain information and the channel URL information by step S15 of Figure 2, and display a pop-up window in which the generated QR code is displayed on the web browser screen.

[0050] In this case, the mobile password manager 200 requests public key information from the relay server 300 based on the channel URL information recorded in the QR code (see S20 in FIG. 2), obtains the public key information provided by the relay server 300 (see S21 in FIG. 2), and uses the obtained public key information to encrypt the user's account information in step S22 in FIG. 2, after which it can transmit the information to the extension program via the relay server.

[0051] Although the present invention has been described above with reference to an embodiment thereof, it will be readily apparent to those skilled in the art that the present invention can be modified and changed in various ways without departing from the spirit and scope of the present invention as set forth in the claims below.

Claims

1. An account information management method that uses an extension program installed in a web browser, a mobile password manager that is an application program for managing account information installed in a user's mobile device, and a relay server that communicates with the extension program and the mobile password manager, (a) the mobile password manager encrypts and manages account information for each website registered by the user; (b) the mobile password manager acquires an information recording code generated by the extension program (the information recording code records website connection information corresponding to either domain information or IP information of a website that the user wants to access via the web browser); (c) the mobile password manager acquires account information corresponding to the website connection information recorded in the information recording code based on the account information for each managed website, and transmits the acquired account information to the relay server; (d) the relay server transmitting the account information received from the mobile password manager to the extension program; (e) the extension program automatically inputs the account information sent from the relay server into a login window displayed on the web browser so that the account information can be used to log in to a website corresponding to the website connection information.

1. An account information management method comprising:

2. Before step (b), (f) the extension program is activated according to a user's selection, or if already activated, monitors a user's login access attempt to a website using the web browser, and if a login access attempt to a website by the user is detected, extracts the website connection information or generates an asymmetric key. The account information management method according to claim 1 .

3. The information recording code is a QR code (registered trademark) (Quick Response code), After step (f) and before step (b), The extension program further includes generating a QR code in which the website connection information and the public key information of the asymmetric key are recorded, and displaying a pop-up window so that the generated QR code is displayed on a web browser screen. The account information management method according to claim 2 .

4. The information recording code is a QR code (Quick Response code), After step (f) and before step (b), a step in which the extension program transmits a public key of the generated asymmetric key to the relay server; the relay server stores the public key received from the extension program and transmits channel URL information that allows the public key storage location to be confirmed to the extension program; The extension program further includes generating a QR code in which the website connection information and the channel URL information are recorded, and displaying a pop-up window so that the generated QR code is displayed on a web browser screen; After step (b), The mobile password manager further includes a step of acquiring the public key generated by the extension program based on the channel URL information recorded in the QR code. The account information management method according to claim 2 .

5. In the step (c), The mobile password manager encrypts the account information corresponding to the website connection information recorded in the QR code using the public key generated by the extension program, and then transmits the encrypted account information to the relay server.

5. The account information management method according to claim 3 or 4.

6. In the step (e), The extension program receives the encrypted account information from the mobile password manager via the relay server, decrypts the encrypted account information using a private key of the asymmetric keys, and automatically inputs the decrypted account information into a login window displayed in the web browser. The account information management method according to claim 5.

7. In the step (f), The extension program recognizes an ID and password input window in the activation selection of the user's extension program or the body content of a website, and generates a new asymmetric key each time a login access attempt to the website is detected. The account information management method according to claim 2 .

8. A biometric authentication procedure for authenticating a user using the mobile password manager is added before at least one of the following points: a point at which the mobile password manager application is executed; a point at which the account information is displayed on an app screen via the mobile password manager; and a point at which the user approves the transmission of the account information. The account information management method according to claim 1 .

Images