Method for operating security system in environment in which user information receiving device and key security device are distinguished

Abstract

A method for operating a security system for authenticating a user on the basis of FIDO according to an embodiment of the present disclosure may comprise the steps of: receiving first user information by a user information receiving device to which a key security device is connected; storing, in the key security device, feature information generated on the basis of the first user information; receiving second user information requested to be authenticated through the user information receiving device; and receiving, from a FIDO server, a token allowing user access in response to a determination by the key security device that authentication feature information generated on the basis of the second user information matches the feature information.

Description

Method of operating a security system in an environment where the user information receiving device and the key security device are separated

[0001] The technical idea of ​​the present disclosure relates to a security system, and more particularly, to a security system in an environment where a user information receiving device and a key security device are separated.

[0002] As cloud-based IT environments rapidly proliferate within companies, changes to user identification and authentication systems are becoming necessary to ensure access security within corporate IT environments. This means that existing access security systems, which maintained security by managing the physical network environment, must change, as access security is crucial in environments where users and assets accessing the IT environment are located outside the company.

[0003] The most critical management element in this changing security environment is establishing a foundation of trust for accessing users while controlling the environment of various user terminals and network connectivity from a zero-trust perspective. The FIDO2 standard, promoted by the FIDO Alliance, is an authentication security technology that ensures user trust in cloud environments. It is already embedded in many terminals and browsers and has been adopted by numerous possessor-based security key manufacturers.

[0004] When using possession-based security keys for FIDO authentication, fingerprint sensors are sometimes integrated to ensure that only users with registered fingerprints can use the security key. While FIDO allows for various methods of user presence verification, possession-based security keys typically require limited hardware implementation, limiting their use to methods such as fingerprint sensors.

[0005] The technical idea of ​​the present disclosure is to provide a security system that supports multiple types of authentication methods.

[0006] An operation method of a security system for authenticating a user based on FIDO according to an embodiment of the present disclosure may include a step of receiving first user information through a user information receiving device to which a key security device is connected, a step of storing characteristic information generated based on the first user information in the key security device, a step of receiving second user information for which authentication is requested through the user information receiving device, and a step of receiving a token for which user access is permitted from a FIDO server in response to a case where it is determined by the key security device that the characteristic information and the authentication characteristic information generated based on the second user information match.

[0007] A security system according to an embodiment of the present disclosure includes a RP (Relying Party) service module that generates characteristic information from first user information received through an authentication device, a key security device that is connected to the RP service module to store the characteristic information, and determines whether authentication characteristic information generated based on second user information requested for authentication through the authentication device matches the characteristic information, and the key security device may be characterized in that access to a storage area where the characteristic information is stored is blocked from an external device.

[0008] The security system according to the embodiment of the present disclosure allows for additional security control based on the location of the terminal, as the user inputs user information from the terminal currently connected. Furthermore, since the key security device is linked to a smartphone or installed as an application through a simple user information input interface such as a fingerprint sensor, camera, or keypad, the FIDO standard security system can be applied even in legacy IT environments.

[0009] In addition, the key security device according to the embodiment of the present disclosure can store security keys through multiple types of authentication methods, thereby expanding the scope of application of FIDO authentication.

[0010] The effects that can be obtained from the exemplary embodiments of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned can be clearly derived and understood by those skilled in the art to which the exemplary embodiments of the present disclosure pertain from the following description. In other words, unintended effects resulting from implementing the exemplary embodiments of the present disclosure can also be derived by those skilled in the art from the exemplary embodiments of the present disclosure.

[0011] FIG. 1 is a block diagram illustrating the configuration of a security system according to an embodiment of the present disclosure.

[0012] FIG. 2 is a block diagram illustrating a configuration of a user information receiving device according to one embodiment.

[0013] Figure 3 is a block diagram illustrating the configuration of a key security device according to one embodiment.

[0014] FIG. 4 is a flowchart illustrating a method for storing feature information in a key security device of a security system according to one embodiment.

[0015] FIG. 5 is a flowchart illustrating a method for registering user authentication information in a FIDO server according to one embodiment.

[0016] FIG. 6 is a flowchart illustrating a method for storing feature information in a key security device according to one embodiment.

[0017] FIG. 7 is a flowchart illustrating a method for performing FIDO authentication by a security system according to an embodiment.

[0018] FIG. 8 is a flowchart illustrating a method for obtaining authentication characteristic information and a matching result of characteristic information from a key security device according to one embodiment.

[0019] FIGS. 9 and 10 are diagrams illustrating an example of registering RP server information and a user in a key management server according to one embodiment.

[0020] FIG. 11 is a diagram illustrating an example of selecting an authentication type in an RP server according to an embodiment.

[0021] FIG. 12 is a diagram illustrating an embodiment of registering characteristic information in a key security device and storing user authentication information corresponding to the characteristic information in a FIDO server according to one embodiment.

[0022] FIG. 13 is a diagram illustrating an embodiment of registering characteristic information in a key security device using an authentication method different from that of FIG. 12.

[0023] FIG. 14 and FIG. 15 are diagrams illustrating examples of authenticating a user according to different embodiments.

[0024] An operation method of a security system for authenticating a user based on FIDO according to an embodiment of the present disclosure may include a step of receiving first user information through a user information receiving device to which a key security device is connected, a step of storing characteristic information generated based on the first user information in the key security device, a step of receiving second user information for which authentication is requested through the user information receiving device, and a step of receiving a token for which user access is permitted from a FIDO server in response to a case where it is determined by the key security device that the characteristic information and the authentication characteristic information generated based on the second user information match.

[0025] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0026] FIG. 1 is a block diagram illustrating the configuration of a security system according to an embodiment of the present disclosure.

[0027] Referring to FIG. 1, a security system according to an embodiment of the present disclosure may include an RP server (2), a user module (1), a FIDO server (3), and a key management server (4). At this time, the user module (1) may include an authentication device (30), a user information receiving device (10), and a key security device (20).

[0028] According to one embodiment, the RP server (2) can be connected to the user information receiving device (10) to perform user identification and authentication through FIDO authentication. When the security system performs authentication based on the WEB, the RP server (2) can perform FIDO registration and authentication on the WEB authentication page in which a processing function for proof of presence (User Presence) is implemented in addition to the FIDO2 function of the WebAuthn API. At this time, the user module (1) is performed by a code (RP service module) implemented to be called from a WEB browser. When the security system does not perform authentication based on the WEB, the user information receiving device (10) can have a FIDO APP installed, and a processing function for proof of presence can be integrated into the FIDO APP to perform FIDO registration and authentication.

[0029] In this specification, the RP service module can be described as a system including an RP server (2) and a user information receiving device (10). The RP service module can mediate user information received from an authentication device (30) and information provided from a key security device (20).

[0030] The user information receiving device (10) can generate characteristic information based on user information. The characteristic information can be information that can identify an individual user, and may be information generated based on biometric information such as fingerprints, face, or voice, or information generated from input information that is considered to be known only to the individual, such as keywords or patterns.

[0031] The key management server (4) can store a public key corresponding to a private key generated during FIDO authentication registration. The public key stored in the key management server (4) can be mapped to and stored in information about the user. The public key stored in the key management server (4) can be used for encryption, distribution of certificates as a means of trust, and verification to counter additional security threats when the existence proof procedure is performed on a device outside the key security device (20). In addition, the public key stored in the key management server (4) can be distributed to a specific user or can be used to check product information of the private key owned, thereby promoting the convenience of asset management.

[0032] Before FIDO authentication is performed, the administrator of the RP service can access the FIDO management function through the RP server (2) as shown in FIGS. 9 and 10 to register information of the RP server (2) or user information receiving device (10) requiring FIDO authentication to the FIDO server (3), and generate connection information and server certificates required for a trusted connection during FIDO authentication.

[0033] When the RP server (2) receives a FIDO authentication request from the user module (1), it transmits the necessary information of the RP server (2) or the user information receiving device (10) to the FIDO server (3) through a registration request process.

[0034] A user can connect a key security device (20) to a user information receiving device (10) and request a FIDO authentication service through a service APP or WEB Page implemented in the user information receiving device (10). The type of the user information receiving device (10) according to the embodiment of the present disclosure can include all types of devices compatible with the key security device (20), and when the user information receiving device (10) and the key security device (20) are connected, the key security device (20) can provide device information to the user information receiving device (10), and the user information receiving device (10) can provide characteristic information that can identify a user to the key security device (20).

[0035] The connection between the user information receiving device (10) and the key security device (20) may mean a wired connection via USB or a cable, but the embodiment of the present disclosure is not limited thereto, and may also be connected via a short-range communication interface such as Bluetooth, NFC, or WiFi. When the user information receiving device (10) and the key security device (20) are connected via a short-range communication interface, the connection can be established simply by the user carrying the key security device (20) without performing a separate connection operation.

[0036] The RP service module that receives a user request can perform FIDO authentication processing according to the established FIDO authentication procedure. The RP service module can detect a key security device (20) possessed by the user, receive user information according to the existence proof method (PIN code, touch, gesture, fingerprint, face recognition, voice recognition, etc.) defined in the key security device (20), and transmit the user information to the key security device (20) as authentication characteristic information. If the key security device (20) matches the previously registered security key and the authentication characteristic information, the key security device (20) can generate response information for FIDO authentication and transmit it to the FIDO server (3).

[0037] If the detected key security device (20) is used for the first time, the security system can first perform a user registration procedure with the FIDO server (3) and then perform FIDO authentication with the registered security key.

[0038] The security system of the present disclosure can be expanded to various forms of existence proof methods depending on the type of user information receiving device (10) connected to the RP service environment or the user interface installed therein, and can also perform an enhanced user identification function by simultaneously requesting multiple methods.

[0039] In other words, the security system of the present disclosure can generate distinguishable characteristic information from user information received from different authentication devices (30), and the distinguishable characteristic information is stored in different storage areas of the key security device (20), thereby performing a multi-method user identification function through a single key security device (20).

[0040] For example, the security system of the present disclosure can receive user facial information from a facial photographing device and generate feature point information of the user facial information as feature information. The security system can also receive user fingerprint information from a fingerprint sensing device and generate feature point information of the user fingerprint information as feature information. The key security device (20) stores the feature information generated from the user facial information and the feature information generated from the user fingerprint information in different storage areas, thereby enabling the security system of the present disclosure to support different types of authentication methods through a single key security device (20).

[0041] The user information received through the authentication device (30) may be biometric information including the user's facial information and fingerprint information, but the user information of the present disclosure is not limited thereto and may include fingerprint information, facial information, iris information, and vein information. In addition, the user information is not limited to biometric information, but may also include PIN information and pattern information directly input by the user.

[0042] According to one embodiment, the RP service module can generate characteristic information based on received user information, and after transmitting the characteristic information to the key security device (20), the characteristic information stored at least temporarily in the RP service module can be discarded. In addition, the key security device (20) can prevent the characteristic information from being read by an external device by blocking access to a storage area where the characteristic information is stored by all external devices, including the RP service module.

[0043] Accordingly, the security system of the present disclosure can apply various existence proof methods. While previous security systems could not support various authentication methods due to hardware limitations of the possession-based key security device (20), the security system of the present disclosure performs existence proof in an RP service module combined with a user information receiving device (10), stores characteristic information in a secure key security device (20), and matches the characteristic information with authentication characteristic information in the key security device (20) to provide only the matching result to the RP service module.

[0044] In addition, while the previous security system had a risk of personal information leakage in a shared user work terminal, the security system of the present disclosure provides an input interface that only performs existence proof in the RP service module, and manages the acquired personal information to be stored only in the key security device (20) and then discarded, thereby minimizing the risk of personal information leakage.

[0045] According to one embodiment, the user information receiving device (10) and the key security device (20) of the security system of the present disclosure can be connected through a short-range communication interface, so that the user can perform user authentication simply by carrying the key security device (20), thereby increasing user convenience.

[0046] According to one embodiment, the security system of the present disclosure can minimize the risk of leakage of characteristic information even if characteristic information is stolen during the process of transmitting and receiving characteristic information between the RP service module and the key security device (20), by performing encryption on characteristic information in the RP service module and directly decrypting the characteristic information by the key security device (20).

[0047] Figure 2 is a block diagram illustrating the configuration of a user information receiving device (10) according to one embodiment.

[0048] Referring to FIG. 2, the user information receiving device (10) may include a processor (100), a random access memory (RAM) (200), a storage (300), and a communication unit (400). The user information receiving device (10) may be referred to as a user terminal capable of transmitting and receiving data and information with a plurality of devices when communication is established with the plurality of devices. For example, the user information receiving device (10) may include a mobile phone, a smart phone, a tablet personal computer (PC), a wearable device, a healthcare device, or an Internet of Things (IoT) device.

[0049] The processor (100) can control the overall operation of the user information receiving device (10). The processor (100) may include a single processor (100) core (Single Core) or a CPU (Central Processing Unit) including multiple processor (100) cores (Multi-Core). The user information receiving device (10) may include one or more processors (100).

[0050] The processor (100) can process or execute programs, data, or instructions stored in the storage (300). For example, the processor (100) can generate feature information from user information by executing programs stored in the storage (300). In addition, the processor (100) can also generate data packets so as to communicate with the key security device (20) and the RP server (2) according to a predefined protocol.

[0051] RAM (200) can temporarily store programs, data, or instructions. For example, programs and / or data stored in storage (300) can be temporarily stored in RAM (200) according to the control or booting code of the processor (100). For example, RAM (200) includes DRAM (Dynamic RAM), SRAM (Static RAM), SDRAM (Synchronous DRAM), etc.

[0052] Storage (300) is a storage location for storing data, and can store an operating system (OS), various programs, and various data. Storage (300) includes ROM (Read Only Memory), flash memory, PRAM (Phase-change RAM), MRAM (Magnetic RAM), RRAM (Resistive RAM), FRAM (Ferroelectric RAM), etc. In an embodiment, storage (300) can be implemented as a HDD (Hard Disk Drive), SSD (Solid State Drive), etc.

[0053] The communication unit (400) can transmit and / or receive data from the user information receiving device (10). For example, the communication unit (400) can transmit and receive data through various communication methods. For example, the communication unit (400) can perform communication through, for example, 3G, LTE, Wi-Fi, Bluetooth, BLE (Bluetooth Low Energy), Zigbee, NFC (Near Field Communication), ultrasonic communication, etc., and can include wired communication, wireless communication, short-range communication, and long-range communication.

[0054] Accordingly, the user information receiving device (10) of the present disclosure can perform operations by the above configurations, temporarily store data or commands, or perform data transmission and / or reception with other user information receiving devices (10).

[0055] The user information receiving device (10) of the present disclosure is a device controlled by a user, and the RP server (2) is a device controlled by a security manager. The RP server (2) may be composed of components that perform the same operation as the user information receiving device (10) except that there is a difference in the management entity.

[0056] Figure 3 is a block diagram illustrating the configuration of a key security device (20) according to one embodiment.

[0057] Referring to FIG. 3, the key security device (20) can transmit and receive information via a bus. The key security device (20) can include a controller (500), a storage module (600), an SRAM (700), an encryption engine (800), and an eFuse (900), and each component can be connected to at least one bus to transmit and receive information.

[0058] Specifically, the controller (500), storage module (600), SRAM (700), encryption engine (800), and eFuse (900) can transmit and receive data and control information to each other through the bus. For example, the protocol of the bus can be implemented as any one of AHB (Advanced High Performance Bus), ASB (Advanced System Bus), APB (Advanced Peripheral Bus), and AXI (Advanced eXtensible Interface), but the protocol of the bus is not limited thereto and can include all types of bus protocols that can transmit and receive data and control information bidirectionally.

[0059] The AHB can be a bus that connects high-speed devices, and can operate based on a multiplex bus that shares address lines, control lines, and data lines. The ASB can be a bus that operates at high speed, uses both rising and falling edges, and has separate address lines, control lines, and data lines. The APB is a bus that controls relatively slow-speed peripheral devices, and can be characterized by having a simple interface to reduce power consumption of the key security device (20).

[0060] The controller (500) may be referred to as a processing unit and may include a core capable of executing any instruction set (e.g., IA-32 (Intel Architecture-32), 64-bit extended IA-32, x86-64, PowerPC, Sparc, MIPS, ARM, IA-64, etc.), such as a microprocessor, an application processor (AP), a digital signal processor (DSP), or a graphic processing unit (GPU).

[0061] The controller (500) of the key security device (20) can control the device to store characteristic information in the storage module (600) transmitted from the user information receiving device (10). In addition, the controller (500) can load the characteristic information stored in the storage module (600) and compare the characteristic information with the authentication characteristic information received from the user information receiving device (10) to determine whether to transmit an ACK signal or a NACK signal to the user information receiving device (10).

[0062] The storage module (600) can store characteristic information. At this time, the characteristic information may be characteristic information decrypted from encrypted characteristic information based on device information of the key security device (20). The storage module (600) can transmit and receive data with the bus through the QSPI cache. The QSPI cache may have four data transmission lines in a half-duplex manner. That is, since it transmits in parallel through four data lines at a time, it can have a transmission speed (40 Mbps) four times faster than SPI. This faster transmission speed can particularly speed up the booting speed.

[0063] SRAM (700) can temporarily store data. According to an embodiment of the present disclosure, the key security device (20) can temporarily store data through SRAM (700), but is not limited thereto, or can include volatile memory such as DRAM (Dynamic Random Access Memory), RRAM (Resistive RAM), MRAM (Magnetic RAM), or PRAM (Phase change RAM). SRAM (700) can receive and temporarily store encrypted characteristic information and encrypted authentication characteristic information from user information receiving device (10), and can transmit encrypted characteristic information and encrypted authentication characteristic information to an encryption module through a bus. SRAM (700) can receive decrypted characteristic information and authentication characteristic information through an encryption module, and can provide the decrypted characteristic information and authentication characteristic information to the storage module (600).

[0064] The encryption module generates authentication data according to the FIDO standard, and transmits a public key generated according to an asymmetric key generation algorithm at the time of user registration as a response to a FIDO registration request. In addition, the encrypted characteristic information and authentication characteristic information by the RP service module can be decrypted. At this time, the encryption module can perform a decryption operation using the device information of the key security device (20) as a decryption key value. For example, the encryption module can perform encryption and decryption using AES (Advanced Encryption Standard), which performs encryption and decryption based on an encryption key value and a decryption key value.

[0065] The eFuse (900) may be referred to as an electronic fuse and may store device information of the key security device (20). The device information of the key security device (20) may be an identification number generated for each key security device (20) or a unique number assigned in advance during the manufacturing process of the key security device (20). When the eFuse (900) detects an attempt to steal device information from an external device, the eFuse (900) may delete all data stored in the eFuse (900), including the device information. The eFuse (900) may further include a user key value and a platform key value in addition to the device information of the key security device (20). The user key value may be information about a user who stores user information in the key security device (20), and may be information registered in the key security device (20) so that the user can be identified by the FIDO server (3). The platform key value may be information that can identify the RP service module.

[0066] FIG. 4 is a flowchart illustrating a method for storing feature information in a key security device (20) of a security system according to one embodiment.

[0067] Referring to FIG. 4, the security system of the present disclosure can perform user authentication while transmitting and receiving data and information from a user module (1) to a FIDO server (3). At this time, the FIDO server (3) can instruct the user module (1) to store characteristic information in a key security device (20).

[0068] In step (S110), the user module (1) may request user registration to the RP server (2) in order to register the key security device (20) and the user with the FIDO server (3). When the user runs a browser on his / her terminal and calls a specific service URL, the service can confirm the requested session. At this time, in the case of a session that is not logged in, the request can be re-requested to the FIDO RP service URL that performs login authentication. The user module (1) may display a screen for entering user personal information according to the instructions on the registration request page. The user module (1) may perform a user registration request by transmitting the user personal information entered by the user to the RP server (2). The RP server (2) may receive a request from the user module (1) and perform a registration procedure. At this time, the RP server (2) transmits the necessary information of the RP server (2) or the user information receiving device (10) to the FIDO server (3) through a registration request process.

[0069] In step (S120), the FIDO server (3) can transmit a randomly generated OTP for user authentication, and in step (S130), if the same OTP is returned from the user module (1), the FIDO server (3) can register the user. The OTP can be sent as an SMS OTP to the phone number received as the user's personal information, and user registration can be performed by entering the corresponding OTP number.

[0070] In step (S140), the FIDO server (3) may request the user module (1) to register characteristic information in the key security device (20), and in step (S150), the user module (1) may transmit an ACK signal or a NACK signal depending on whether the characteristic information registration is successful. For example, the user module (1) may transmit a first ACK signal if the characteristic information is successfully registered in the key security device (20), and may transmit a first NACK signal if the characteristic information is not successfully registered in the key security device (20).

[0071] Hereinafter, a method of registering characteristic information in a key security device (20) in FIG. 7 will be described.

[0072] FIG. 5 is a flowchart illustrating a method for registering user authentication information in a FIDO server (3) according to one embodiment.

[0073] Referring to FIG. 5, the user module (1) can register authentication information about the user to the FIDO server (3) by requesting FIDO registration to the FIDO server (3).

[0074] In step (S210), the user module (1) can request FIDO registration to the RP server (2), and in step (S220), the RP server (2) can request FIDO registration to the FIDO server (3). At this time, step (S210) may be a step that is performed in response to the generation of the first ACK signal in step (S150). That is, the security system of the present disclosure can automatically request FIDO registration when the registration of characteristic information in the key security device (20) is successful.

[0075] In step (S230), the FIDO server (3) may transmit a challenge, user registration information, and RP server (2) information to the RP server (2) along with a response to the FIDO registration request. The challenge may be any value of at least 16 bytes and may be information generated by the FIDO server (3). The user registration information may be identification information about the user provided in advance to the FIDO server (3) according to the embodiment of FIG. 4.

[0076] In step (S240), the RP server (2) may request a public key from the user module (1). At this time, the RP server (2) may transmit a challenge, user registration information, RP server (2) information, and client data hash information. The challenge, user registration information, RP server (2) information, and client data hash information may be information required for the user module (1) to generate a pair of private keys and public keys. The pair of private keys and public keys may be referred to as a credential key pair.

[0077] According to the FIDO authentication protocol, a pair of private keys and public keys may be information generated by a key security device (20) only when the user information input by the user matches the user information stored in the device. In the embodiment of the present disclosure, the step of recognizing user information may be omitted when registering for FIDO authentication.

[0078] At this time, according to the embodiment of FIG. 4, the user information can be identified as matching by storing the characteristic information previously acquired from the user as user information input by the user and user information stored in the device. For example, the user information receiving device (10) can temporarily store the characteristic information in the first storage area, and distinguish the characteristic information stored in the first storage area as user information stored in the device, and the characteristic information received from the key security device (20) as user information input by the user. Accordingly, the user can omit the process of entering user information during the FIDO authentication registration process.

[0079] According to one embodiment, if it takes more than a standard time from the time of storing characteristic information in the key security device (20) to the time of generating the public key and private key, user information can be re-received from the user, and characteristic information can be re-extracted from the re-received user information to determine whether it matches the characteristic information stored in the key security device (20).

[0080] That is, the security system of the present disclosure can perform a judgment as to whether a key pair can be generated using the characteristic information stored in the devices if a short time elapses from the time of storing characteristic information in the key security device (20) to the time of generating a key pair, and can perform a judgment as to whether a key pair can be generated by re-receiving user information if a long time elapses from the time of storing characteristic information in the key security device (20) to the time of generating a key pair.

[0081] In step (S250), the user module (1) can reply with the generated public key to the RP server (2). At this time, the user module (1) can provide the RP server (2) not only with the public key, but also with a credential ID and attestation information. The public key may be information electronically signed by an attestation private key, and the attestation information may include an attestation certificate issued by a CA agency.

[0082] In step (S260), the RP server (2) can provide user authentication information to the FIDO server (3). The user authentication information can include client information and proof information provided in JSON format.

[0083] In steps (S270) and (S280), when the FIDO server (3) completes verification of the user authentication information, it can return the result to the user module (1) via the RP server (2). At this time, the FIDO server (3) can verify the authenticity of the certificate itself and verify the electronically signed information using the proof public key included in the certificate. When the verification is complete, the FIDO server (3) can complete the FIDO authentication registration by mapping the public key, credential ID, and client data received from the user module (1) to the user's account.

[0084] FIG. 6 is a flowchart illustrating a method for storing feature information in a key security device (20) according to one embodiment.

[0085] Referring to FIG. 6, the user module (1) may be composed of an authentication device (30), a user information input device, and a key security device (20), and may store characteristic information in the key security device (20) by transmitting and receiving data and information between each component.

[0086] In step (S310), the authentication device (30) can receive a PIN from the user and transmit it to the user information input device. The authentication device (30) can be any type of device capable of receiving user information, and the PIN can be received through an input interface such as a keyboard, touchpad, or mouse.

[0087] In step (S320), the user information input device can transmit the PIN to the key security device (20) to request confirmation of whether the PIN is identical to a previously stored PIN. When the key security device (20) is initialized, the user information input device and the key security device (20) can perform an operation of presetting the PIN.

[0088] In step (S330), the key security device (20) can transmit a PIN verification result. If the PIN entered by the user is the same as a previously stored PIN, an ACK signal can be transmitted, and if the PIN is different from the previously stored PIN, a NACK signal can be transmitted.

[0089] When an ACK signal is transmitted as a result of PIN verification, in step (S340), the user information input device can request device information from the key security device (20), and in step (S350), the key security device (20) can reply with device information of the key security device (20) to the user information input device.

[0090] In step (S360), the user information input device can request user information from the authentication device (30), and in step (S370), the authentication device (30) can obtain user information from the user and send it back to the user information input device. For example, if the user information is facial information, the authentication device (30) can be a camera configured in the user information input device. That is, the authentication device (30) and the user information input device may be physically separate devices, but according to an embodiment of the present disclosure, the authentication device (30) and the user information input device may be hardware that is included in a single housing and performs different functions.

[0091] The user information input device can extract characteristic information from user information. The user information input device can encode the characteristic information according to the example procedure of the API of the key security device (20). In a web-based service environment, the characteristic information can be encoded using a protocol that can interface with a USB device in a web browser, such as WebUSB or WebHID. It may be convenient in terms of compatibility to implement the transmission and reception data format according to the CBOR (RFC8949) format, which is the same as the CTAP standard.

[0092] According to one embodiment, the user information receiving device (10) can encrypt feature information based on a PIN and device information. For example, the device information may be a serial number of a key security device (20), and the user information receiving device (10) can input the PIN and device information into a preset function formula to obtain an encryption key value. The user information receiving device (10) can encrypt feature information based on the encryption key value, and the encryption key value can be deleted after encryption is completed.

[0093] The feature information of the present disclosure is generated based on device information and user information, thereby linking a user and a key security device (20). That is, while previous security authentication systems did not provide a method for linking a user with a key security device (20), according to an embodiment of the present disclosure, feature information can be generated by linking user information and device information.

[0094] In step (S380), the user information receiving device (10) can transmit characteristic information to the key security device (20). At this time, the transmitted characteristic information may be encrypted characteristic information, and the key security device (20) can decrypt the encrypted characteristic information and store it in a storage area.

[0095] In step (S390), the key security device (20) can reply to the user information receiving device (10) that the characteristic information has been stored. If the user information receiving device (10) identifies that the characteristic information has been stored, it can perform the FIDO authentication registration procedure according to the embodiment of FIG. 5.

[0096] FIG. 7 is a flowchart illustrating a method for performing FIDO authentication by a security system according to an embodiment.

[0097] Referring to FIG. 7, the security system of the present disclosure can complete FIDO authentication for a user by transmitting and receiving data and information with an RP server (2) and a FIDO server (3) when authentication for a user is requested from a user module (1).

[0098] In step (S410), when a service access request is made to the RP server (2) by a user, the RP server (2) may request matching of characteristic information with the user module (1). The characteristic information request may be an operation of receiving new user information through an authentication device (30), extracting characteristic information from the received user information, and then determining whether the characteristic information stored in the key security device (20) corresponds to the newly extracted characteristic information.

[0099] An embodiment of matching feature information in the user module (1) will be described later with reference to FIG. 8.

[0100] In step (S420), the user module (1) can process an operation to compare the characteristic information already registered in the key security device (20) with the newly received characteristic information, and transmit a processing completion response to the RP server (2). At this time, the processing completion response can include a second ACK signal indicating a matching success result or a second NACK signal indicating a matching failure result.

[0101] At step (S430), the RP server (2) may request FIDO authentication to perform FIDO authentication when receiving the second ACK signal, and at step (S440), the FIDO server (3) may respond to the FIDO authentication request. At this time, the RP server (2) and the FIDO server (3) may send and receive challenges.

[0102] In step (S450), the RP server (2) can request FIDO matching to the user module (1). At this time, the RP server (2) can transmit RP server (2) information and client data hash information to the user module (1). The user module (1) can verify that it is the owner of the private key matching the RP server (2) information. If the verification is successful, the user module (1) can generate an assertion signature by electronically signing the challenge using the private key.

[0103] According to the FIDO authentication protocol, an assertion signature may be information generated by a key security device (20) only when the user information input by the user matches the user information stored in the device. In the embodiment of the present disclosure, when performing FIDO authentication, the step of recognizing user information may be omitted.

[0104] At this time, the user information can be identified as matching by storing the characteristic information previously acquired from the user as user information input by the user and user information stored in the device. For example, the user information receiving device (10) can temporarily store the characteristic information in the first storage area, and distinguish the characteristic information stored in the first storage area as user information stored in the device, and the characteristic information received from the key security device (20) as user information input by the user. Accordingly, the user can omit the process of entering user information during the FIDO authentication process.

[0105] According to one embodiment, if it takes more than a standard time from the time of determining whether there is a match in the key security device (20) to the time of generating the assertion signature, user information can be re-received from the user, and feature information can be re-extracted from the re-received user information to determine whether it matches the feature information stored in the key security device (20).

[0106] That is, the security system of the present disclosure can determine whether an assertion signature can be generated using characteristic information stored in devices when a short time elapses from the time when the key security device (20) determines whether there is a match to the time when FIDO authentication is performed according to the FIDO protocol, and can determine whether an assertion signature can be generated by re-receiving user information when a long time elapses from the time when the key security device (20) determines whether there is a match to the time when FIDO authentication is performed.

[0107] In step (S460), the user module (1) can reply with a matching result and transmit an assertion signature and authenticator data to the RP server (2). In step (S470), the RP server (2) can transmit client data, an assertion signature, and authenticator data to the FIDO server (3), and the FIDO server (3) can perform verification on the received data. For example, the FIDO server (3) can decrypt the assertion signature using a public key matched to the user account and determine whether it corresponds to the challenge transmitted from the FIDO server (3).

[0108] If verification is successful, in step (S480), the FIDO server (3) can return a FIDO authentication result in response to the request. At this time, a token or cookie for authorization can be transmitted to the user module (1) via the RP server (2) as the FIDO authentication result. The token for authorization can be referred to as an access token that allows the user to access the RP server (2).

[0109] FIG. 8 is a flowchart illustrating a method for obtaining authentication characteristic information and a matching result of characteristic information from a key security device (20) according to one embodiment.

[0110] Referring to FIG. 8, the user module (1) can be composed of an authentication device (30), a user information receiving device (10), and a key security device (20), and can determine whether the characteristic information and the authentication characteristic information correspond by transmitting and receiving data and information between each component.

[0111] In step (S510), the user information receiving device (10) can request device information from the key security device (20), and in step (S520), the key security device (20) can reply with the device information of the key security device (20) to the user information input device.

[0112] In step (S530), the user information receiving device (10) may request user information from the authentication device (30), and in step (S540), the authentication device (30) may obtain user information from the user and send it back to the user information receiving device (10). For example, if the user information is facial information, the authentication device (30) may be a camera configured in the user information receiving device (10). That is, the authentication device (30) and the user information receiving device (10) may be physically separate devices, but according to an embodiment of the present disclosure, the authentication device (30) and the user information receiving device (10) may be hardware that is included in one housing and performs different functions.

[0113] The user information receiving device (10) can extract authentication characteristic information from user information. The user information receiving device (10) can encode the authentication characteristic information according to the exemplary procedure of the API of the key security device (20). In a web-based service environment, the authentication characteristic information can be encoded using a protocol that can interface with a USB device in a web browser, such as WebUSB or WebHID. It may be convenient in terms of compatibility to implement the transmission and reception data format according to the CBOR (RFC8949) format, which is the same as the CTAP standard.

[0114] According to one embodiment, the user information receiving device (10) can encrypt authentication characteristic information based on device information. For example, the device information may be the serial number of the key security device (20), and the user information receiving device (10) can input the device information into a preset function formula to obtain an encryption key value. The user information receiving device (10) can encrypt authentication characteristic information based on the encryption key value, and the encryption key value can be deleted after encryption is completed.

[0115] In step (S550), the user information receiving device (10) can transmit authentication characteristic information to the key security device (20). At this time, the transmitted authentication characteristic information may be encrypted characteristic information, and the key security device (20) can decrypt the encrypted authentication characteristic information and compare it with characteristic information stored in the storage area. For example, if a plurality of characteristic information are stored separately in the storage area of ​​the key security device (20), the key security device (20) can compare each characteristic information code with the code of the received authentication characteristic information. If there is a characteristic information code identical to the authentication characteristic information, it can be determined that there is characteristic information matching the authentication characteristic information.

[0116] In step (S560), the key security device (20) can return the matching result to the user information receiving device (10). If the matching is successful, the key security device (20) can transmit a second ACK signal to the user information receiving device (10), and if the matching is unsuccessful, the key security device (20) can transmit a second NACK signal to the user information receiving device (10). If the user information receiving device (10) receives the second ACK signal, it can perform FIDO authentication according to the FIDO protocol.

[0117] FIG. 9 and FIG. 10 are drawings illustrating an example of registering RP server (2) information and a user in a key management server (4) according to one embodiment.

[0118] According to Fig. 9, the RP server (2) can receive information required for registration from the security manager and register the information and user of the RP server (2) in the key management server (4). At this time, the RP server (2) corresponds to a client based on the key management server (4), and the client ID and client secret may be pre-designated as information corresponding to the RP server (2). The security manager registers information (service login URL, secret key, etc.) of the RP server that will perform the FIDO authentication request in advance and sets a server certificate or security key to verify that the request is from a trusted RP server.

[0119] According to Fig. 10, the key management server (4) can receive the user's ID / password and user personal information.

[0120] Fig. 11 is a drawing illustrating an example of selecting an authentication type in an RP server (2) according to one embodiment.

[0121] Referring to FIG. 11, if a specific user attempts to access the URL of the RP server (2) registered according to FIG. 9, the user can be authenticated first by entering the registered user's ID / password on the login page, and secondarily by authenticating the user through the key security device (20). At this time, if the key security device (20) is not connected to the user information receiving device (10) or if the key security device (20) is initialized, authentication (FIDO2 token) through the key security device (20) may not be activated.

[0122] FIG. 11 may be a WEB screen output to a user information receiving device (10) according to an embodiment of the present disclosure, and may be a WEB screen for performing an authentication function of an RP service module through an RP server function applied to a service login page. A user may connect his / her key security device (20) to the user information receiving device (10) on the screen, select an authentication method, and perform identity verification.

[0123] FIG. 12 is a drawing illustrating an embodiment of registering characteristic information in a key security device (20) and storing user authentication information corresponding to the characteristic information in a FIDO server (3) according to one embodiment.

[0124] Referring to FIG. 12, when authentication via a key security device (20) is selected by a user, the token name of the key security device (20) may be input. According to one embodiment, the key security device (20) may be configured as a single housing with an authentication device (30). For example, the key security device (20) may be configured as a single device with an authentication device (30) that receives fingerprint information.

[0125] When fingerprint information is input as user information from a user, the security system of the present disclosure can register FIDO authentication for the user information using the method described above with reference to FIGS. 4 to 6.

[0126] Fig. 13 is a drawing illustrating an embodiment of registering characteristic information in a key security device (20) using an authentication method different from that of Fig. 12.

[0127] Referring to FIG. 13, a key security device (20) is connected to a user information receiving device (10), and may receive user information of FIG. 12 and other types of user information through an authentication device (30) to register characteristic information in the key security device (20).

[0128] For example, the user information receiving device (10) can extract first characteristic information from fingerprint information and store the first characteristic information in the key security device (20), and can extract second characteristic information from facial information and store the second characteristic information in the key security device (20).

[0129] FIG. 14 and FIG. 15 are diagrams illustrating examples of authenticating a user according to different embodiments.

[0130] According to FIGS. 14 and 15, the user information receiving device (10) can receive any one of different types of user information and compare authentication characteristic information extracted from the user information with characteristic information stored in the key security device (20). If, as a result of the comparison, characteristic information matching the authentication characteristic information is stored, the user can log in to the service.

[0131] An embodiment in which a user performs FIDO authentication by providing user information for service login has been described above with reference to FIGS. 7 and 8, so a detailed description thereof will be omitted.

[0132] As described above, exemplary embodiments have been disclosed in the drawings and specification. While specific terminology has been used to describe embodiments herein, it is intended solely to illustrate the technical concept of the present disclosure and is not intended to limit the scope of the present disclosure as defined in the claims. Therefore, those skilled in the art will understand that various modifications and equivalent embodiments are possible. Therefore, the true technical protection scope of the present disclosure should be defined by the technical concept of the appended claims.

[0133] The security system according to the embodiment of the present disclosure allows for additional security control based on the location of the terminal, as the user inputs user information from the terminal currently connected. Furthermore, since the key security device is linked to a smartphone or installed as an application through a simple user information input interface such as a fingerprint sensor, camera, or keypad, the FIDO standard security system can be applied even in legacy IT environments.

Claims

1. In the operation method of a security system that authenticates users based on FIDO, A step of receiving first user information by a user information receiving device to which a key security device is connected; A step of storing feature information generated based on the first user information in the key security device; A step of receiving second user information requested for authentication through the user information receiving device; and A step of receiving a token that allows user access from a FIDO server in response to a case where it is determined that the authentication characteristic information generated based on the second user information and the characteristic information are matched by the key security device. A method of operating a security system including:

2. In paragraph 1, The first step of receiving user information is: A step of receiving first user information through a first authentication device connected to the user information receiving device; and A step of receiving second user information through a second authentication device of a type different from the first authentication device. Including, The step of storing the above characteristic information in the key security device is: A step of generating a 1-1 security key by corresponding the first user information to the first authentication device; A step of generating a first-second security key by corresponding the second user information to the second authentication device; and A step of storing the above 1-1 security key and the above 1-2 security key in different storage areas. A method of operating a security system, characterized in that it includes:

3. In paragraph 1, The step of storing the above characteristic information in the key security device is: A step of generating encrypted characteristic information based on device information of the key security device and the first user information; and A step of decrypting the encrypted characteristic information by the above key security device. A method of operating a security system, characterized in that it includes:

4. In paragraph 3, The above encrypted feature information is, A method of operating a security system, characterized in that the characteristic information generated by the user information receiving device or the RP (Relying Party) server connected to the user information receiving device and communicated with the user information receiving device and stored at least temporarily in the user information receiving device and the RP server after the characteristic information is transmitted to the key security device is discarded.

5. In paragraph 4, A step of blocking access from the user information receiving device and the RP server to the storage area of ​​the key security device where the characteristic information is stored. A method of operating a security system, characterized in that it further includes:

6. In paragraph 1, A step of transmitting a first ACK signal to the RP server in response to the characteristic information being stored in the key security device; and A step of providing user authentication information from the RP server to the FIDO server in response to the first ACK signal. A method of operating a security system, characterized in that it further includes:

7. In paragraph 6, The step of transmitting the first ACK signal is: A step of providing a public key generated based on the above characteristic information to the RP server. A method of operating a security system, characterized in that it includes:

8. In paragraph 1, The step of receiving the second user information is: A step of identifying the type of authentication requested by the user to the user information receiving device; and A step of receiving the second user information from an authentication device corresponding to the above authentication type. A method of operating a security system, characterized in that it includes:

9. In paragraph 1, The step of receiving the above token is: A step of obtaining device information of the key security device connected to the user information receiving device; and A step of generating the authentication characteristic information based on the type of the authentication device, device information of the key security device, and the second user information. A method of operating a security system, characterized in that it includes:

10. In paragraph 9, The step of receiving the above token is: A step of comparing the authentication characteristic information with the characteristic information by the key security device; and A step of transmitting a second ACK signal to the RP server when it is determined that the characteristic information corresponds to the authentication characteristic information as a result of the above comparison. A method of operating a security system, characterized in that it includes:

11. RP (Relying Party) service module that generates characteristic information from the first user information received through the authentication device. A key security device that is connected to the RP service module and stores the characteristic information, and determines whether the authentication characteristic information generated based on the second user information requested for authentication through the authentication device matches the characteristic information. Including, The above key security device, A security system characterized in that access to a storage area where the above characteristic information is stored is blocked from an external device.

12. In paragraph 11, The above RP service module, A security system characterized in that, in response to determining that the above authentication characteristic information matches the above characteristic information, a token allowing user access is received from the FIDO server.

13. In paragraph 11, The above RP service module, By receiving first user information through a first authentication device, a 1-1 security key is generated by corresponding the first user information to the first authentication device, and by receiving second user information through a second authentication device of a type different from the first authentication device, a 1-2 security key is generated by corresponding the second user information to the second authentication device. The above key security device, A security system characterized in that the first-first security key and the first-second security key are stored in different storage areas.

14. In paragraph 11, The above RP service module, Generate encrypted characteristic information based on device information of the key security device and the first user information and transmit it to the key security device, The above key security device, A security system characterized by decrypting the above encrypted feature information.

15. In paragraph 14, The above RP service module, A security system characterized in that after transmitting the characteristic information to the key security device, the first security key stored at least temporarily is discarded.

16. In paragraph 11, The above key security device, In response to storing the above characteristic information, a first ACK signal is transmitted to the RP service module, The above RP service module, A security system characterized in that it provides user authentication information to a FIDO server in response to the first ACK signal.

17. In paragraph 16, The above key security device, A security system characterized in that it provides a public key generated based on the above characteristic information to the RP service module.

18. In paragraph 11, The above RP service module, A security system characterized in that it identifies the type of authentication requested by the user to the user information receiving device and receives the second user information from the authentication device corresponding to the type of authentication.

19. In paragraph 11, The above RP service module, A security system characterized in that it obtains device information of the key security device and generates the authentication characteristic information based on the type of the authentication device, the device information of the key security device, and the second user information.

20. In paragraph 11, The above key security device, A security system characterized in that it compares the above authentication feature information with the above feature information, and if it is determined as a result of the comparison that the feature information corresponds to the above authentication feature information, it transmits a second ACK signal to the RP service module.

Images