KR20010008298A - Automatic Login Processing Method and System For Internet Web Sites - Google Patents

Abstract

The present invention relates to a method of logging in to a plurality of service affiliate websites using a subscriber ID and an access password recorded in a smart card for each website to which an identifier is assigned.

According to the present invention, the identifier for the merchant web site and the subscriber ID access password as site-specific subscriber login information are recorded on the user's smart card, and when the user attempts to access the recorded website, the website is unknown to the user. Automatic login processing is performed by sending and receiving encrypted login information between the authentication processor and the smart card controller of the web site through the identifier.

As a result, users can use their smart cards designed to be portable and mobile, allowing them to log in automatically with secure access passwords and subscriber IDs from any computer, which may expose their access ID or password. Has been able to relieve anxiety.

Description

Automatic Login Processing Method and System For Internet Web Sites}

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a subscriber login processing technology that enables automated subscriber authentication processing for a plurality of Internet web sites by using personal access information stored in a subscriber information recording apparatus such as a smart card attached to a data communication terminal.

In the generalized Internet environment according to the development of information and communication technology, many Internet web sites differentiate their services from members and non-members, paid members and free members. Therefore, the web site visitor must go through the process of login and subscriber authentication in order to receive the service set by the contract with the web site. The login and subscriber authentication process usually consists of a visitor inputting an accessor's name (ID) and an access password directly. Since this process inconveniences the user, various attempts have been made to simplify the process.

The first attempt to simplify the process of signing in and signing up for multiple websites is to record the name and access password of each web page in a specific area, such as a visitor's communication terminal (personal computer). This is a method that automatically enters each time you visit a web page.

At this time, it is classified into a software type recording method and a hardware type recording method according to a medium for recording the accessor name and the connection password.

Software recording method is to record the data key for subscriber authentication on the hard disk of the user terminal, which is generally difficult to use on other computers besides one's own computer, and also provides special security for subscriber information recorded on the user's terminal. Because of this demand, there is a fatal problem that security is exposed when installed in a computer used in common such as a PC room.

The hardware recording method is to record subscriber authentication data keys in subscriber information recording devices such as portable smart cards. Since the security method is superior to the software method, it can be freely used on public PCs without fear of information exposure. Has the advantage that

Korean Patent Publication No. 2000-0006645 (published Feb. 7, 2000) allows an integrated circuit card to remember the owner's personal information and the accessor's name and access password for all the registered websites. It simplifies the sign-up process, and discloses a method to automate a part of the login process for the web site by using the recorded visitor name and access password and to make various transactions such as various searches and product purchases. However, this method does not fully automate the login process itself, and if a subscriber visits a particular website and chooses to log in using the subscriber ID and password recorded on the integrated circuit card, the subscriber ID and password fields appear. It is only to automatically fill in the contents recorded on the integrated circuit card, and the user is configured to perform login processing by transmitting subscriber information necessary for login to the server side only by pressing a separate login icon.

Therefore, the user's inconvenience at the time of login cannot be completely eliminated, and the cookie information generated by the web browser and stored in the public computer remains on the public computer when the mobile card is installed and moved. In particular, there is a problem in that the possibility of a password being exposed by observation of another person cannot be excluded.

The present invention is to compensate for the disadvantages of the above-described conventional log-in processing method using the recorded subscriber information, and to provide a more convenient interface to the user, when the user attempts to access a specific website, a separate key Automatic login processing to enhance the security and mobile installation of personal information including user IDs by enabling the login process to be performed automatically using the subscriber information recorded for each website in the smart key without the need for board or mouse operation. It is a technical problem to provide a method and a processing system.

1 is a diagram illustrating a system configuration in which an automatic login processing method according to the present invention is implemented;

FIG. 2 is a diagram schematically showing the configuration of an integrated circuit recording device 2 such as a smart card and the like, and a smart card controller 12 attached to the user terminal computer 1;

3 is a flowchart illustrating a process in which a user of a smart card provided according to the present invention accesses the authentication management system 3 at the initial stage of purchase to process user registration authentication;

4 is a user of a smart card provided according to the present invention accesses the authentication management system (3) and the merchant website (4) to receive a list of merchant websites provided from the authentication management system, and accesses individual websites to subscribers. A flow chart showing the process of performing the registration, and

FIG. 5 is a flowchart illustrating a process in which a login process is automatically performed when a user of a smart card provided according to the present invention attempts to access a merchant web site 4.

<Explanation of symbols for main parts of drawing>

1: User terminal 2: Smart card (subscriber information recording device)

3: Authentication Management System 4: Merchant Web Site

In order to realize the above-described technical problem, the present invention, in the method for logging in to a plurality of service merchant websites using the subscriber ID and access password recorded in the smart card for each website to which the identifier is assigned as subscriber login information, A user installs a smart card and a smart card controller, runs a browser, and attempts to access one of a plurality of websites recorded on the smart card; and a subscriber terminal attempting to access from a subscriber authentication processor of the website. Transmitting the identifier of the web site to the smart card controller of the mobile station and requesting the transmission of the subscriber ID and the access password recorded on the smart card, and under the control of the smart card controller according to the request, the transmitted web site. Subscriber log for websites attempting to connect based on identifier Retrieving the subscriber ID and the access password as information, encrypting the retrieved subscriber ID and the access password, and transmitting them to the website which attempted the connection; and, under the control of the subscriber authentication processor of the website, transmitted from the smart card of the user terminal. Performing the login process by comparing the subscriber ID and the access password with the subscriber login information recorded on the website, and notifying the user of the login result and granting the predetermined right to read in case the login process on the website is successfully performed. It provides an automatic login method for a plurality of Web site, characterized in that it comprises a step.

By providing the present invention in such a configuration, the user ID and password for the merchant web site and the subscriber ID access password as site-specific subscriber login information are recorded on the user's smart card, and when the user attempts to access the recorded website, Unknowingly, the automatic login process can be performed by sending and receiving encrypted login information between the web site's authentication processor and the smart card controller through the web site identifier.

As a result, users can use their smart cards designed to be portable and mobile, allowing them to log in automatically with secure access passwords and subscriber IDs from any computer, which may expose their access ID or password. Has been able to relieve anxiety.

In addition, according to a preferred aspect of the present invention, the above-described automatic login method is a subscriber authentication processor of the website where the subscriber is currently logged in, requesting logout for the current subscriber and omitting the steps for the automatic login process. And presenting a subscriber login information input window for inputting a subscriber ID and an access password.

By providing such a configuration, the website can be removed without the smart card being disabled or disabled by the smart card controller if the user does not want to automatically log on to the website, thereby preventing the user from connecting to another user ID. You can selectively disable the login for only, and you can also connect with a different user ID.

Further, according to another aspect of the present invention, a subscriber information recording means for recording a web site identifier, a subscriber ID and a connection password of a subscriber as subscriber login information, and the web site identifier is transmitted to a user terminal when a user attempts to connect. And a subscriber information transmission requesting means for requesting, by the smart card controller installed in the terminal, to transmit, as subscriber login information, the subscriber ID and access password for the transmitted website identifier among the records of the smart card connected to the corresponding user terminal; When the subscriber ID and the access password requested by the subscriber information transmission requesting means are transmitted from the smart card controller of the terminal, the corresponding visitor login information is compared with the subscriber login information of the corresponding subscriber recorded in the subscriber information recording means. Determine whether you are logged in Provides an automatic log-in processing unit of a web site comprises a login processing means.

By providing the present invention having such a configuration, it is possible to improve the user's convenience and security at the same time for its own web site, thereby preventing the occurrence of problems due to illegal access.

Hereinafter, with reference to the accompanying drawings to describe the configuration of the present invention in more detail.

1 is a diagram illustrating a system configuration in which an automatic login processing method according to the present invention is implemented based on a connection relationship between a user terminal 1, an authentication management system 3, and an affiliated store web site 4. 2 schematically shows the configuration of the subscriber information recording apparatus 2 and the smart card controller 12 such as a smart card attached to the user terminal.

As shown in Fig. 1 and Fig. 2, a subscriber information recording device 2 such as a smart card that a subscriber can carry and move can be installed on the user terminal 1 side, and the subscriber authentication processor 44 of the merchant web site is provided. A control processor 12 is also provided which communicates with and controls to perform the subscriber automatic login process of the present invention.

The subscriber information recording device 2 is provided in the form of a card or key of a magnetic recording method or an integrated circuit recording method. Preferably, the subscriber information recording device 2 is portable and easy to move and install. It is a good idea to insert it directly into the Universal Serial Bus (USB) port provided with the peripheral device. One example is the ikey series from Rainbow Technology. This is simply called a "smart card."

The smart card 2 records an identification number (production serial number), a master key value, and a PIN (Personal Identified Number) as smart card unique information 21 attached to a key. As user information 22 generated when accessing and registering (3), a name, resident registration number, address, date of birth, telephone number, etc. are recorded, and a user password for identity verification is also recorded.

The smart card includes an authentication key 23, which is generated and built when a user registers after accessing the authentication management system 3 after purchase, and is required for user verification and authentication management system 3 And a user private key necessary for encrypting / decrypting data when exchanging data with the merchant web site 4.

The smart card 2 also includes site access information 24 for a number of merchant web sites 4 subscribing to the services provided by the authentication management system, including unique identification numbers for merchant web sites, The subscriber ID and access password are recorded for each merchant web site. The contents of the records are inputted by the user selecting from a list of affiliated stores provided by the authentication management system or newly inputting the information, or by directly inputting already registered contents.

The smart card 2 also records payment account information 25 necessary for payment by purchases on the website. The payment account information 25 may include credit card numbers, access passwords, expiration date information, etc., entered by the user, and when combined with cyber money, account number, payment password, balance information, payment Records and the like may be recorded.

The smart card controller 12 installed in the user's PC is usually provided in the form of a control program, and reads the contents of the smart card 2 and communicates with the merchant web sites 4 to record the contents of the smart card. Or to communicate with the authentication management system to receive a list of merchant websites. The smart card controller includes a control processor 14 for driving a smart card, performing data processing for transmitting and receiving specified information according to communication with a counterpart, and configuring a screen to be displayed to a user. An encryption processor 15 for encrypting / decrypting data is included.

The smart card (1) of such a configuration has recorded all the necessary information when a user registers or logs in to a specific website, and the recorded information is stored even when the owner carries it and installs it on a public computer. Since it is kept as it is, it can be freely used for login / payment processing on other computers as if it were its own computer.

As shown in FIG. 1, the communication between the smart card controller 12 installed in the user terminal 1 and the authentication management system 3 is performed when the user who purchased the smart card executes smart card registration and user information registration. This can happen when the controller is automatically upgraded, when you want to see a list of merchant websites. In addition, when the balance for the cyber money and the payment list are designed to be recorded on the smart card, communication may be made to record the result after the purchase at the merchant web site 4 is made.

The communication between the smart card controller 12 of the user terminal 1 and the merchant website 4 takes place to automate the login process when the user initiates a connection to the merchant website. In addition, communication with the authentication management system 3 and the merchant web sites 4 is performed to process subscriber payment authentication and billing, etc. when the subscriber purchases a product after logging in.

3 is a flowchart illustrating a process in which a user of a smart card provided according to the present invention connects to the authentication management system 3 and processes user registration authentication at the initial purchase.

As shown in detail in this figure, the purchaser of the smart card attaches the smart card to his terminal or the like, installs the smart card controller 12 in the form of a control program, and then fills in user information on the user and the authentication management system ( Request registration for 3) (steps S1 to S2). Then, the smart card controller 12 transmits the product serial number and the entered user information and requests user registration and approval (step S3). Then, the authentication processor 34 of the authentication management system 3 registers the user information (step S4) and confirms the registration (step S5). Then, the user information registration is successful, and the smart card controller 12 generates an authentication key necessary for communication and payment security (step S7), records it in the smart card 2 (step S8), and writes the public authentication key. The data is transmitted to the authentication management system 3 (step S9) to be recorded in the authentication management system (step S10).

In FIG. 3, the personal authentication key and the public authentication key are generated at the user terminal side and the public authentication key is transmitted to the authentication management system 3, but the generation is performed at the authentication management system and the personal authentication key is transmitted to the user terminal side. Can be configured to write to a smart card.

After completing the process of exchanging the authentication key by communicating with the smart card controller 12 of the user terminal in this way, the authentication management system (3) transmits a copy of the public authentication key transmitted from the user terminal to each merchant web site to all merchants And the user terminal can be configured to perform user identification and data encryption using an authentication key.

4 is a user of a smart card provided in accordance with the present invention accesses the authentication management system 3 and the merchant web site 4 to receive a list of merchant web sites provided from the authentication management system, and accesses individual web sites to subscribers. A flow chart showing the process of performing registration.

As shown in FIG. 4, the user browses a list of merchant web sites in a manner such as viewing a web page of the authentication management system 3 (steps S11 to S13), and selects a desired web site to provide from the web page. The subscriber registration is completed by filling out the subscriber information including the subscriber ID and the access password on the form (steps S14 to S17). At this time, in the web page 4, if the subscriber registration is successfully performed, the subscriber completion message is transmitted and the identifier for the web site is transmitted to the smart card controller 12 of the user terminal (step S18). Then, the controller 12 of the user terminal records this web site identifier, subscriber ID and access password in the site connection information recording area of the smart card (step S19).

5 is a smart card controller 12 and a merchant web site 4 installed in the user terminal 1 when a user of the smart card 2 provided according to the present invention attempts to access the merchant web site 4. Is a flowchart illustrating a process in which a login process is automatically performed through communication between subscriber authentication processors 44 of a.

As shown in the figure, a user first installs a portable and mobile installable smart card 2 and a smart card controller 12 in a user terminal, and then inputs a password (or user ID and password) for user verification ( Step S21).

Then, when the user accesses the merchant web site by executing a general purpose or dedicated web browser (step S22), the subscriber authentication processor 44 of the merchant web site controls the identifier assigned to the own web site. 12) and request to transmit subscriber login information (subscriber ID, access password) (step S23).

The smart card controller 12 of the user terminal receives the web site identifier and reads the subscriber login information for the web site with the identifier from the site access information recording area of the smart card, that is, the subscriber ID and the access password (step S24). The content is transmitted to the merchant web site (step S25).

The subscriber authentication processor 44 of the merchant website 4 receives the subscriber login information transmitted from the smart card controller 12 of the user terminal (step S26) and performs login processing (step S27), whereby the subscriber Receive the service provided by (steps S28 to S29). This connection status is until the current user logs out by requesting logout, no input until the automatic logout timeout is exceeded, or the smart card being disconnected or disabled (steps S30 to S33). ) Continue.

If the visitor attempted to connect without using the smart card, the visitor would not be able to respond to the subscriber login information transmission request in step S23 (recognized as "NO" in step S26), in which case the subscriber login. The screen is displayed (step S32) and waits for the visitor to directly enter login information.

There is a case where a user wants to log out of a current subscriber ID for some reason, or try to connect to another subscriber ID. In this case, the current subscriber ID is simply logged out by removing the smart card, and if necessary, the subscriber ID and access password can be entered as other subscriber login information in the newly opened subscriber login screen, but simultaneously If the user wants to log out only for one web site or access another subscriber ID, the user requests to log out from the web page (step S30). Then, the user can log out the current user and display the subscriber login screen. At this time, the automatic login process of steps S22 to S27 should be omitted. This allows you to log out only on selected web pages without removing the smart card or shutting down the smart card controller.

Or, considering that the user who is currently logged in attempts to connect with a different subscriber ID, if the web page provides one more option to log in with a different subscriber ID than the logout option, and the user chooses to connect with a different subscriber ID, It is possible to configure the login page to be opened so that the subscriber ID and access password can be entered by excluding the login process.

As described above, the configuration of the automatic login method and system configured to automate the login process for a plurality of web sites based on the subscriber information recorded in the smart card has been described. However, the present invention is not limited to these embodiments and can be modified in various forms by those skilled in the art.

By providing the present invention of the above-described configuration, by recording the identifier for the merchant website and the subscriber ID access password as site-specific subscriber login information on the user's smart card, when the user attempts to access the recorded website It is possible to perform automatic login processing by sending and receiving encrypted login information between the authentication processor and the smart card controller of the website through the website identifier without knowing it. As a result, users can log in automatically with secure access passwords and subscriber IDs from any computer using a smart card designed to be portable and installed. Can be solved.

Claims (3)

In the method of logging in to a plurality of service merchant websites using the subscriber ID and access password recorded in the smart card for each website to which the identifier is assigned as subscriber login information. Installing a smart card and a smart card controller and starting a browser to attempt to access one of a plurality of websites recorded on the smart card; Transmitting the identifier of the web site to the smart card controller of the subscriber terminal which attempted to access from the subscriber authentication processor of the web site and requesting the transmission of the subscriber ID and the access password recorded on the smart card; In response to the request, under the control of the smart card controller, the subscriber ID and the access password are retrieved as the subscriber login information for the website attempted to access the web site based on the transmitted website identifier, and the encrypted subscriber ID and the access password are encrypted. Sending it to the website that attempted to access it, Performing a login process by comparing the subscriber ID and access password transmitted from the smart card of the user terminal with the subscriber login information recorded in the website under the control of the subscriber authentication processor of the web site; If the login process on the web site is successfully performed, notifying the user of the log-in result and granting a predetermined view right. The method of claim 1, Requesting the logout of the current subscriber to the subscriber authentication processor of the currently logged in website; Omitting the steps for the automatic login process, and presenting a subscriber login information input window for inputting a subscriber ID and an access password. Subscriber information recording means for recording a web site identifier, subscriber ID and access password as subscriber login information; When the user attempts to connect, the web site identifier is transmitted to the user terminal, and the smart card controller installed in the terminal receives the subscriber ID and access password for the transmitted web site identifier from the record of the smart card connected to the user terminal. Subscriber information transmission request means for requesting transmission as login information; When the subscriber ID and access password requested by the subscriber information transmission requesting means are transmitted from the smart card controller of the user terminal, the corresponding subscriber login information is compared with the subscriber login information of the corresponding subscriber recorded in the subscriber information recording means. Automatic login processing apparatus for a web site comprising a subscriber authentication processing means for determining whether a visitor is logged in.