WO2014175642A1 - Identity authentication system capable of non-repudiation and method for providing same - Google Patents

Abstract

Disclosed are an identity authentication system and a method for providing the same, and the system is capable of: increasing security by separating a channel for requesting for identity authentication from a channel for inputting a password required for the identity authentication; and non-repudiation by preventing a man-in-the-middle-attack and a reply attack. A method for providing an identity authentication system, according to one aspect of the present invention, comprises the steps of: receiving, by the identity authentication system, an identity authentication request, which includes a mobile telephone number of a mobile terminal of a user and corresponds to a predetermined service, from a user terminal of the user through a wired/wireless data communication network; transmitting, by the identity authentication system, disposable authentication information corresponding to the identity authentication request to the user terminal; connecting, by the identity authentication system, a telephone call to the mobile terminal by using the mobile telephone number included in the received identity authentication request; receiving, by the identity authentication system, a first password and a second password from the mobile terminal through the telephone call; and providing the service through the user terminal when the first password received from the mobile terminal matches authentication information pre-stored in the identity authentication system and the second password received from the mobile terminal matches the disposable authentication information transmitted to the user terminal.

Description

Non-repudiable identity authentication system and its provision method

The present invention relates to an identity authentication system and a method of providing the same, which allow a user to verify that he or she is a legitimate user authorized to use a predetermined service (for example, online payment) using his mobile phone number. In detail, the security can be increased by separating the channel for requesting authentication from the channel for inputting the password required for authentication, and man-in-the-middle-attack and rely attack. The present invention relates to a self-authentication system capable of preventing repudiation and a method of providing the same.

Recently, with the development of wired and wireless communication networks and the spread of computers and the Internet in each home, various online services such as online commerce and internet banking have been provided. These services, by their very nature, are very important for identity verification to ensure that the user is a legitimate user.

Identity verification refers to the process of verifying that the person requesting a particular service (eg, online payment) is a legitimate user. In order to authenticate a user, a method of authenticating a legitimate user by using a pre-registered password or security key is commonly used. Such a method uses a user's personal information obtained through an illegal channel to register as a member or uses an ID. There is a problem that can be obtained illegally password.

Therefore, a user authentication method for confirming that the person requesting the service and the occupant of the mobile phone is the same person by transmitting an authentication number to the mobile phone and inputting it later appears, and these methods also include data transmitted in the middle. Man-in-the-middle attack by intercepting or illegally modifying or generating data, or by relying on security information such as passwords by illegal methods, and retransmitting it later to replicate It is very vulnerable to attack. If such a man-in-the-middle attack or a retransmission attack is possible, the person performing the authentication request can deny that the authentication request is not by itself, which seriously affects the reliability of the system.

On the other hand, in recent years, phishing schemes have also been increasingly sophisticated, and phishing schemes such as smishing using SMS have emerged. Smishing sends text messages that lead to illegal sites, allowing cell phone users to access a website to steal personal information or inject Trojans to control Internet-enabled mobile phones. Clicking on the masqueraded event as a received event automatically installs malware (malware) or steals your security information without your knowledge and causes damage such as approving a small payment. In order to obtain the authentication information of the user as a method, such a smishing technique is actively used. Even in such a case, there is a problem in that the man-in-the-middle attack is possible, thus preventing repudiation.

In the case of online payment or financial transactions, such an attack may cause irreversible damage. Therefore, such an Internet service effectively prevents the above-mentioned man-in-the-middle attack, retransmission attack, and attack by smishing and the like, and has high reproducibility. There is an urgent need for an authentication method with a high level of security.

Therefore, the present invention has been made to solve the above-mentioned problems, the technical problem to be achieved by the present invention is to secure a high security that can be prevented by the identity authentication system that is not vulnerable to man-in-the-middle attack or retransmission attack And it provides a method of providing the same.

According to an aspect of the present invention, as a method for providing an identity authentication system, (a) the identity authentication system sends an identity authentication request including a mobile telephone number of a user's mobile terminal from a user's user terminal through a wired or wireless data communication network; Receiving, (b) the identity authentication system, the one-time authentication information corresponding to the identity authentication request to be transmitted to the user terminal, (c) the identity verification system, included in the received identity authentication request Connecting a telephone call with the mobile terminal using the mobile telephone number, (d) the first authentication system receiving a first password and a second password through the telephone call from the mobile terminal; and e) the first password received from the mobile terminal and the authentication information previously stored in the identity authentication system; Value and if a second password received from the mobile terminal matches the authentication information, the one-time transmission to the user terminal, there is provided a method for providing identity authentication system comprising: I determined that authentication is successful.

In an embodiment, the step (d) may include: receiving, by the identity authentication system, a voice signal corresponding to the second password through the telephone call, and by the identity authentication system, the voice signal through voice recognition. Recognizing the second password from may include.

In one embodiment, the method of providing a personal authentication system further includes the step of the user authentication system analyzing the voice signal to determine whether the voice signal is uttered by the user, and (e) The first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system, and the second password received from the mobile terminal matches the one-time authentication information transmitted to the user terminal. If it is determined that the voice signal corresponding to the second password is uttered by the user, it may include determining that the identity authentication is successful.

In an embodiment, the step (d) may further include receiving, by the identity verification system, a DTMF signal corresponding to the first password through the telephone call.

In one embodiment, the step (c), the identity authentication system, when the identity authentication system attempts a call connection to the mobile telephone number is the source number of the identity authentication system to be output to the mobile terminal is Outputting to a user terminal and connecting the telephone call with the mobile terminal using the mobile telephone number included in the received personal authentication request.

In one embodiment, the step (c), the identity authentication system, attempting a call connection to the mobile phone number, if the call connection is not successful, the identity authentication system, callback to the mobile phone number The method may include transmitting a message and connecting a telephone call from the mobile terminal to the identity authentication system using the transmitted callback message.

In an embodiment, the step (b) may include the step of transmitting, by the identity authentication system, an issuance request of one-time authentication information corresponding to the identity authentication request to a predetermined issuing server, wherein the issuing server is configured as: In response to the issuance request, the one-time authentication information may be issued and transmitted to the user terminal.

In one embodiment, the identity authentication request further includes a predetermined check information, and the step (b), the identity verification system, the step of determining whether the check information corresponds to the mobile phone number and the determination result If it corresponds, the method may include transmitting one-time authentication information corresponding to the identity authentication request to the user terminal.

According to another aspect of the present invention, there is provided a method for providing an identity authentication system, wherein (a) the identity authentication system requests a user authentication request including a mobile phone number of a mobile terminal of a user from a user terminal of a wired / wireless data communication network. Receiving through, (b) the identity authentication system, the one-time authentication information corresponding to the identity authentication request is transmitted to the user terminal, (c) the identity authentication system, the call back message to the mobile phone number Transmitting a telephone call from the mobile terminal to the identity authentication system according to the transmitted callback message, and (d) the identity authentication system using a first password and a second call from the mobile terminal through the telephone call. Receiving a password and (e) the first password received from the mobile terminal Determining that the user authentication is successful when the second password received from the mobile terminal matches the one-time authentication information transmitted from the mobile terminal and matches the authentication information previously stored in the user authentication system. A method for providing an authentication system is provided.

According to another aspect of the present invention, there is provided a method for providing an identity authentication system, wherein (a) the identity authentication system requests a user authentication request including a mobile phone number of a mobile terminal of a user from a user terminal of a wired / wireless data communication network. (B) allowing the identity verification system to transmit one-time authentication information corresponding to the identity verification request to the user terminal, and (c) the identity verification system to the received identity verification request. Connecting a telephone call to the mobile terminal using the included mobile telephone number; and (d) receiving, by the identity verification system, a voice signal from the mobile terminal through the telephone call; An authentication system performing voice recognition on the voice signal; and (f) voice recognition result on the voice signal. When matched with the one-time authentication information, there is provided a method for providing identity authentication system comprising: I determined that authentication is successful.

In one embodiment, the method for providing the identity authentication system further includes a step of analyzing the voice signal to determine whether the voice signal is uttered by the user, and the step (f) includes: If it is determined that the voice recognition result with respect to the one-time authentication information and the voice signal is uttered by the user, it may include the step of determining that the identity authentication is successful.

According to another aspect of the present invention, there is provided a computer-readable recording medium having recorded thereon a program for performing the above method.

According to another aspect of the present invention, an identity authentication system includes a processor and a memory storing a program, wherein the program, when executed by the processor, causes the identity authentication system to perform the above-described method. An identity authentication system is provided.

According to another aspect of the present invention, a request receiving module including a mobile phone number of the user's mobile terminal and receives a user authentication request corresponding to a predetermined service from the user's user terminal through a wired or wireless data communication network, the user authentication A one-time authentication information module for transmitting one-time authentication information corresponding to the request to the user terminal, a phone call module for connecting a phone call with the mobile terminal by using the mobile phone number included in the received identity authentication request; A password receiving module for receiving a first password and a second password through the telephone call from a mobile terminal and the first password received from the mobile terminal correspond to authentication information previously stored in the identity authentication system and received from the mobile terminal. The second password is the user end When a match the one time authentication information transmission group, is provided with a person authentication system including a control module that determines that identity authentication is successful.

In one embodiment, the password receiving module receives a voice signal corresponding to the second password through the telephone call, and the identity authentication system recognizes the second password from the voice signal through voice recognition. It may further include a voice recognition module.

In one embodiment, the identity authentication system further comprises a voiceprint analysis module for determining whether the voice signal is uttered by the user by voice analysis of the voice signal, the control module is received from the mobile terminal The first password matches an authentication password previously stored in the identity authentication system, and the second password received from the mobile terminal matches at least a portion of the one-time password sent to the user terminal and corresponds to the second password. If it is determined that the voice signal is uttered by the user, it can be determined that the authentication of the person is successful.

According to another aspect of the present invention, a request receiving module including a mobile phone number of the user's mobile terminal and receives a user authentication request corresponding to a predetermined service from the user's user terminal through a wired or wireless data communication network, the user authentication A one-time authentication information module for transmitting one-time authentication information corresponding to the request to the user terminal, transmitting a callback message to the mobile phone number, and connecting a telephone call from the mobile terminal to the identity authentication system by the transmitted callback message. A telephone call module configured to receive a first password and a second password through the telephone call from the mobile terminal, the first password received from the mobile terminal, and the authentication information previously stored in the identity authentication system. Match and said mobile stage When the second password received from the terminal is matched with the one-time authentication information transmitted to the user terminal, a personal authentication system is provided that includes a control module that determines that the user authentication is successful.

According to another aspect of the present invention, a request receiving module including a mobile phone number of the user's mobile terminal and receives a user authentication request corresponding to a predetermined service from the user's user terminal through a wired or wireless data communication network, the user authentication A one-time authentication information module for transmitting one-time authentication information corresponding to the request to the user terminal, a telephone call module for connecting a telephone call to the mobile terminal by using the mobile phone number included in the received authentication request; A password receiving module for receiving a voice signal corresponding to a password from the mobile terminal through the telephone call, a voice recognition module for recognizing the password by performing voice recognition on the voice signal, and the recognized password and the one-time authentication information. If there is a match, the identity verification was successful An identity authentication system including a control module for determining is provided.

In addition, according to an embodiment of the present invention, since a channel (i.e. data communication network such as wired or wireless internet) for which authentication is requested and a channel (i.e., telephone network) for confirming a password are distinguished from each other, information leakage from any one channel Even if this happens, security can be maintained.

In addition, in one embodiment of the present invention, since the one-time authentication information that is discarded after being used once is used for authentication, a vulnerability to retransmission attack can be prevented.

In addition, by receiving a password through an ARS call, there is a high possibility that information is not leaked through an attack in a data communication network, for example, a virus, a worm, or a malicious code.

In addition, it is possible to effectively prevent the vulnerability to the man-in-the-middle attack because it receives a variety of information necessary for identity authentication through a telephone call that has the characteristic that eavesdropping or eavesdropping is very difficult.

In addition, by inputting the pre-stored authentication information and one-time authentication information at once, it is possible to ensure a higher security.

In addition, the one-time authentication information is discarded immediately after the end of the authentication process so that it cannot be used for the next authentication, so that another person may overhear it. Therefore, by inputting password information corresponding to the one-time authentication information by voice, it is possible to provide input convenience to the user while maintaining security.

In addition, by using the one-time authentication information and the method of analyzing the voiceprint at the same time there is an effect that can significantly increase the security level. That is, when the one-time authentication information is input as the voice signal, it may be guaranteed that the voice information to be uttered is not previously recorded. Therefore, by confirming that the voice signal is uttered by a legitimate user through voiceprint analysis, it is possible to clearly ensure that the person who has confirmed the one-time authentication information (that is, the person who has made the authentication request) is the legitimate user.

After all, according to the technical idea of the present invention can be equipped with both characteristics that are robust against man-in-the-middle attack (due to authentication through telephone call) and characteristics that are robust to retransmission attack using one-time authentication information. There is an effect that can be.

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a view for conceptually explaining a user authentication system according to an embodiment of the present invention.

2 is a block diagram illustrating a schematic configuration of a user authentication system according to an embodiment of the present invention.

3 is a view showing an example of information that can be maintained in the identity authentication system according to an embodiment of the present invention.

4 is a view for explaining the flow of a method for providing a user authentication system according to an embodiment of the present invention.

5 is a diagram illustrating an example of a user authentication request UI provided to a user terminal to implement a method for providing a user authentication system according to an embodiment of the present invention.

6 is a diagram illustrating an example of a guide UI provided to a user terminal to implement a method for providing a user authentication system according to an embodiment of the present invention.

7 is a diagram illustrating an example of a screen output to a mobile terminal of a user in a method for providing a user authentication system according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described in the specification, one or more other It is to be understood that the present invention does not exclude the possibility of the presence or the addition of features, numbers, steps, operations, components, parts, or a combination thereof.

In addition, in the present specification, when one component 'transmits' data to another component, the component may directly transmit the data to the other component, or through at least one other component. Means that the data may be transmitted to the other component. On the contrary, when one component 'directly transmits' data to another component, it means that the data is transmitted from the component to the other component without passing through the other component.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a view for conceptually explaining a user authentication system according to an embodiment of the present invention.

Referring to FIG. 1, in order to implement a method for providing a user authentication system according to an embodiment of the present invention, a predetermined user authentication system 100 may be provided.

The identity authentication system 100 may receive an identity authentication request corresponding to a predetermined service from the user terminal 210. For example, the service may be an online payment request. In this case, the user terminal 210 may transmit an authentication request for the user who uses the user terminal 210 to the personal authentication system 100 together with the online payment request or on the premise of the online payment request. .

The user terminal 210 may be used to include all types of data processing devices (eg, laptops, desktops, mobile terminals, set-top boxes, etc.) capable of requesting identity authentication to the identity authentication system 100. have.

The identity authentication system 100 is accessible to the user terminal 210, all types of data processing system that can receive the identity authentication request (for example, a predetermined website, page, interactive broadcast server, etc.) Can be provided.

In one embodiment, a predetermined merchant system (not shown) may exist between the user terminal 210 and the identity authentication system 100, and the identity authentication system 100 receives an identity authentication request from the merchant system. Can be received. That is, the affiliated store system may receive an identity authentication request together with a payment request through the user's terminal 210 and transmit the identity authentication request to the identity authentication system 100.

The identity authentication request may be performed through a predetermined wired or wireless data communication network, that is, a first communication channel (for example, the Internet, as shown in FIG. 1). In addition, the user may input his mobile phone number (eg, a mobile phone number, USIM number, etc.) through his user terminal 210. The mobile phone number may be a phone number of the mobile terminal 220 possessed by the user requesting identity verification.

The identity authentication request may include the mobile phone number of the mobile terminal 220 of the user input by the user terminal 210. That is, the user can enter his mobile phone number (cell phone number, USIM number, etc.) while making a request for identity verification through his terminal 210. The mobile phone number may be a phone number of the mobile terminal 220 used by the user for requesting identity verification.

In some embodiments, the user may further input user identification information (for example, an ID or name, a date of birth, a login password, etc.) registered through the terminal 210.

The user identification information may be used as predetermined check information. Since the mobile phone number may be information that has already been disclosed to many people, there may be a case where additional information (for example, a login password) required for identity verification is requested after the identity verification request using the corresponding mobile phone number. Therefore, if the requester is to be identified by the mobile phone number, which is the publicly disclosed information, the predetermined check information may be further used to increase stability. Therefore, the identity verification request may include a mobile phone number and check information. When the identity authentication request is received, the identity verification system 100 may determine whether the mobile phone number corresponds to the check information. Only when it is determined that they correspond to each other, the remaining identity authentication procedure can be performed as described below. To this end, the identity authentication system 100 may store the mobile phone number and corresponding check information in advance. As a result, according to the present embodiment, such check information can be received together with the mobile telephone number and used as information for the first authentication. After the first authentication using the check information and the second authentication by performing the authentication as described below, there is an effect that the stability of the service can be significantly increased. In addition, the identity authentication system 100, if the identity verification request received while changing the check information for the same mobile phone number within a predetermined time or more than a predetermined number of times to reject the request or perform a separate additional authentication process stability Can increase.

On the other hand, the identity authentication system 100 may allow the user terminal 210 that sent the identity authentication request to receive one-time authentication information (eg, one time password (OTP)) corresponding to the identity authentication request. . Then, the user terminal 210 may display the received one-time authentication information so that the user can recognize it.

In one embodiment, one-time authentication information may be issued by the identity authentication system 100. In this case, when the identity authentication system 100 receives the identity authentication request from the user terminal 210, the identity authentication system 100 may issue one-time authentication information and transmit the one-time authentication information to the user terminal 210.

On the other hand, in another embodiment, the one-time authentication information may be issued by another server (for example, the card company system 300) by the request of the identity authentication system 100, in this case, the one-time authentication information Issuing the server (for example, card company system 300) may transmit the one-time authentication information issued to the user terminal 210. Then, the user terminal 210 may display the received one-time authentication information so that the user can recognize it.

In another embodiment, the one-time authentication information is issued by another server (for example, the card company system 300) at the request of the personal authentication system 100, but the server (for example, the one-time authentication information is issued). For example, the card company system 300 may transmit the issued one-time authentication information to the identity verification system 100. In this case, the subject that transmits the issued one-time authentication information to the user terminal 210 may be the identity verification system 100.

The one-time authentication information may be a value written once and discarded. That is, the one-time authentication information, as will be described later can be used for identity authentication for the user corresponding to the user terminal 210, once the one-time authentication information is used for identity authentication, the one-time authentication information is It may be discarded and cannot be used again.

On the other hand, the identity authentication system 100 may perform a predetermined process for identity verification using the mobile phone number of the mobile terminal 220 received according to the technical idea of the present invention. To this end, the identity authentication system 100 uses the mobile telephone number to provide predetermined identity information (eg, personal information and / or password) to be used for identity authentication to the user's mobile terminal 220. You can request In addition, the identification information may be received from the mobile terminal 220. In this case, the identity authentication system 100 may request the identity information required for authentication through a second communication channel (for example, a mobile communication network as shown in FIG. 1) different from the first communication channel. have.

In one embodiment, the identity authentication system 100 may include a predetermined Auto Response System (ARS) for connecting a telephone call with the mobile terminal 220, and the telephone call with the mobile terminal 220 Connect and receive the identity information via ARS. According to an embodiment, the identity authentication system 100 may be connected to a predetermined ARS to control the ARS to implement the technical idea of the present invention.

That is, in one embodiment, the identity authentication system 100 may perform an ARS call to the mobile terminal 220 corresponding to the mobile phone number, information for identity authentication when an ARS call, that is, a telephone call is connected. You can ask for input. For example, the identity authentication system 100 may extract the mobile phone number included in the received identity authentication request, and output the extracted mobile phone number to a predetermined ARS. Then, the ARS may connect a wireless call to the mobile terminal 220. That is, you can make a call. Then, the ARS may request identity verification information necessary for identity authentication from the mobile terminal 220. When the user inputs the identification information in response to the request, the identity authentication system 100 may receive the information input from the ARS system and perform identity verification.

In one embodiment, the identity verification information may include only one password to be compared with the one-time authentication information transmitted to the user terminal 210 later. However, for higher security, another embodiment may include two passwords (a first password and a second password). In this case, whether or not the first password is set by the user later and matches the authentication information previously stored in the identity authentication system 100 will be compared, and the second password will be transmitted later to the user terminal 210. Matching with the one-time authentication information may be compared.

In an embodiment in which the identity information includes two passwords, the user may enter the first password and the second password through the telephone authentication (ie, ARS call) formed with the identity authentication system 100 and the identity authentication system 100. ) Can be sent. That is, the two passwords may be transmitted to the identity verification system 100 through one telephone call instead of the other telephone call. As the length of the password increases, it becomes harder to find out the password, so the security can be enhanced. Therefore, for example, a higher security can be achieved by transmitting an eight-digit password combining the first password and the second password at a time than when transmitting the first four-digit password and the second four-digit password, respectively. It can be secured.

On the other hand, when the first password or the second password is composed of numbers may be input as a DTMF tone on a telephone call (for example, ARS call).

On the other hand, in one embodiment, in the case of the second password corresponding to the one-time security information that is used only once and discarded after use, unlike the first password corresponding to the previously stored authentication information for the user, it is transmitted as a voice signal. Can be. This is because there is no problem even if another person overhears the voice signal corresponding to the second password. In this case, the identity authentication system 100 may include a voice recognition module for voice recognition of the voice signal.

In addition, when the second password is transmitted as a voice signal, the personal authentication system 100 may verify whether the speech is uttered by the user by analyzing the received voice signal. To this end, the identity authentication system 100 may store voiceprint information of the user in advance, and may include a voiceprint analysis module.

Voice analysis may be a method for identifying the personality of a person's voice. Individual vocal tracts are based on the anatomical shape of the voice organs, ie the size, shape, and physical characteristics of the vocal tract, vocal cords, nasal cavity, teeth, etc. It may be determined by pronunciation, vocabulary, intonation, and the like. The voice analysis module may compare the features and identify the sameness between the user's voice stored in advance and the user's voice received through a telephone call.

As in the above-described embodiment of the present invention, when information necessary for identity authentication is received through a telephone call, the mobile terminal 220 does not need to install a predetermined IC chip or separate software for identity verification. It works. Therefore, the service according to the embodiment of the present invention may be utilized even in a conventional 2G phone.

Meanwhile, the mobile terminal 220 may be a computing device including a mobile phone, a smart phone, a tablet PC, a personal digital assistant (PDA), and a wireless computing device or another including a handheld device having other wireless access functions. It may be a processing device connected to a wireless modem.

According to an embodiment of the present invention, the identity authentication system 100 may provide a technical idea that allows a user to identify himself or herself before receiving identity verification information required for authentication through the mobile terminal 220. That is, according to an embodiment of the present invention, the user authentication system 100 can confirm to the user that he is a legitimate identity authority.

To this end, in one embodiment, the identity authentication system 100 first outputs predetermined system identification information to the user terminal 210, and then inputs identification information necessary for authentication through the mobile terminal 220. When receiving the same system confirmation information may be output to the mobile terminal 220. For example, the identity authentication system 100 may output the calling number of the ARS call to the user terminal 210. Thereafter, when the identity authentication system 100 connects an ARS call to the mobile terminal 220 of the user, an origination number of the ARS call may be output to the mobile terminal 220 of the user. Therefore, the user may confirm that the subject to which the ARS call is connected to his mobile terminal 220 is the identity authentication system 100.

The system identification information is not necessarily the calling number. When the identity authentication system 100 connects the ARS call through the mobile terminal 220, the predetermined notice text (for example, a guide letter of a lettering service of a mobile service provider) to be output to the mobile terminal 220 is recalled in advance. It may be displayed on the user terminal 210. In this case, the guide phrase may change every time.

Therefore, the user authentication system 100 allows the user to confirm that the system that is being asked for identity authentication through the user terminal 210 and the system that is requesting identity verification information through the mobile terminal 220 are the same. can do.

The identity verification information and / or the identity verification request may further include additional personal information to be used for identity verification. For example, the personal information may include, but is not limited to, a user's social security number, owned card number, password, date of birth, and the like.

Meanwhile, if necessary, the identity authentication system 100 may transmit and receive data necessary for a predetermined identity authentication process with a predetermined authentication server 300. The authentication server 300 may be, for example, a server of a mobile communication company or a server of a credit card company.

In one embodiment, when the authentication server 300 issues the one-time authentication information described above, the identity authentication system 100 transmits the password information received from the mobile terminal 220 to the authentication server 300. It is possible to compare whether or not the received password is the same as the one-time authentication information.

In addition, in one embodiment, the identity authentication system 100 transmits the personal information and the mobile phone number input from the user to the authentication server of the mobile communication company, by confirming whether the user is the name of the mobile phone number identity authentication ( In other words, by performing the owner authentication of the mobile phone, or by transmitting the card information received from the user to the credit card company's authentication server, and confirming that the user is the name of the credit card (identification of the owner of the credit card) You can also do

2 is a block diagram illustrating a schematic configuration of a user authentication system according to an embodiment of the present invention. As shown in FIG. 2, the identity authentication system 100 includes a request reception module 110, a one-time authentication information module 120, a telephone call module 130, a password reception module 140, and a control module 150. , Voice recognition module 160, voiceprint analysis module 170 and DB (Database; 180) may be included. According to an embodiment of the present invention, some of the above-described elements may not necessarily correspond to the elements necessary for the implementation of the present invention, and according to the embodiment, the identity authentication system 100 may Of course, it may include more components than this.

The identity authentication system 100 may include hardware resources and / or software necessary to implement the technical idea of the present invention, and means one physical component or one device. no. That is, the identity authentication system 100 may refer to a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, the identity authentication system 100 may be installed in devices spaced apart from each other. It may be implemented as a set of logical configurations for implementing the technical idea of the present invention by performing. In addition, the identity authentication system 100 may refer to a set of components that are separately implemented for each function or role for implementing the technical idea of the present invention. For example, the request receiving module 110, one-time authentication information module 120, telephone call module 130, password receiving module 140, control module 150, voice recognition module 160 and / or voiceprint The analysis module 170 may be located in different physical devices or may be located in the same physical device. In addition, according to the embodiment, the request receiving module 110, one-time authentication information module 120, telephone call module 130, password receiving module 140, control module 150, voice recognition module 160 and The combination of software and / or hardware constituting each of the voice analysis module 170 may also be located on different physical devices, and components located on different physical devices may be organically combined with each other to implement the respective modules.

In addition, the term "module" in the present specification may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for performing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware. It can be easily inferred by the average expert in the technical field of the present invention.

The control module 150 includes other components included in the identity authentication system 100 (for example, request reception module 110, one-time authentication information module 120, telephone call module 130, password receiving module). 140, the voice recognition module 160, and / or the voiceprint analysis module 170, and the like, and / or the resource.

The DB 180 may store various information that may be stored or maintained in advance in the identity authentication system 100. 3 is a diagram illustrating an example of information stored in the DB 180. Referring to FIG. 6, the DB 180 may store authentication information (password) corresponding to each mobile phone number. In addition, according to the implementation example, identification information, check information, etc. of a user corresponding to each mobile phone number may be further stored.

As described above, the authentication information may be used to verify whether the user occupying the mobile terminal corresponding to the mobile telephone number is a legitimate user together with the one-time authentication information. In addition, the check information may be used for primary authentication as to whether a user who has requested a user authentication through the user terminal 210 is a legitimate user. In addition, the DB 180 may store voiceprint information for each user.

The request receiving module 110 may receive a personal authentication request corresponding to a predetermined service (eg, online commerce, internet banking) through a wired or wireless data communication network (eg, internet, mobile internet). The request receiving module 110 may directly receive the identity authentication request from the user terminal 210, or may be received through a predetermined affiliate server.

As described above, the identity authentication request may include a mobile phone number of the user's mobile terminal 220, according to an embodiment check information and / or the user terminal 210 corresponding to the mobile phone number Personal information of the user corresponding to may be further included.

The one-time authentication information module 120 may allow one-time authentication information corresponding to the identity authentication request to be transmitted to the user terminal.

In one embodiment, the one-time authentication information module 120 may request issuance of the one-time authentication information to a predetermined authentication server (300). The authentication server 300 may be, for example, a card company system or a mobile communication system. The authentication server 300 may issue one-time authentication information in response to the issuing request. The authentication server 300 may directly transmit the issued authentication information to the user terminal 210. According to an implementation example, the authentication server 300 may transmit the issued authentication information to the user authentication system 100 so that the one-time authentication information module 120 transmits it to the user terminal 210. In the latter case, the identity authentication system 100 may temporarily store the one-time authentication information, and verify the password to be received from the mobile terminal 220 by using this.

The telephone call module 130 may connect a telephone call with the mobile terminal using the mobile telephone number included in the identity authentication request. In one embodiment, the phone call module 130 may attempt to connect to the mobile phone number, and the mobile terminal 220 may connect the phone call by accepting the call connection.

On the other hand, there may be a case where the telephone call is not connected according to the user's situation. For example, if the mobile terminal 220 does not answer the call or rejects the call during the preset timeout period, it may be inappropriate to connect the call repeatedly. Therefore, according to another embodiment of the present invention, even if the user does not answer the phone, another technical idea that can perform identity verification may be provided. To this end, when the mobile terminal 220 does not answer the call during the preset timeout period or rejects the call connection, the call connection module 130 may transmit a callback message to the mobile phone number. have. Then, when the user is in a situation of performing authentication, the user may select a callback message transmitted to the user terminal 210. The callback message may include a telephone number (ie, calling number) of the ARS included in or connected to the identity authentication system 100. Therefore, when the user selects the callback message, a telephone call may be connected to the ARS.

On the other hand, the phone call module 130 may attempt to connect a phone call to the mobile phone number, and if the phone call is not connected, the call back message may be transmitted to the mobile phone number. Authentication can also be performed using the back message.

On the other hand, the telephone call module 130 may transmit the calling number of the identity authentication system 100 to the user terminal 210 before connecting the telephone call with the mobile terminal 220. In this case, the user terminal 210 may display the received caller ID so as to recognize that the subject to which the ARS call is to be connected later is the identity authentication system 100.

The password receiving module 140 may request input of a password through a connected telephone call and may receive a password from the mobile terminal 220.

According to an embodiment, the password may be preset and correspond to authentication information stored in the DB 180 or may correspond to the one-time authentication information described above.

In one embodiment, the password can be divided into two parts (a first password and a second password). In this case, the first password may be a portion corresponding to the authentication information stored in the DB 180 in advance, and the second password may be a portion corresponding to the one-time authentication information described above.

Some of the password information received by the password receiving module 140 from the mobile terminal 220 may be voice signals. In some embodiments, in particular, a second password corresponding to one-time authentication information among the password information may be a voice signal.

In this case, the voice recognition module 160 may recognize the second password from the voice signal through voice recognition, and the voiceprint analysis module 170 may analyze the voice signal and perform the voice signal analysis. It is possible to determine whether or not the user is uttered.

The identity authentication system 100 may store in advance the lexical model information or the acoustic model information necessary for the voice recognition module 160 to perform voice recognition in the DB 180. According to the exemplary embodiment, the voice recognition rate can be increased by separately managing the acoustic model information for each user. There is no limitation on the speech recognition technology required to implement the present invention, and a detailed description of the known technology regarding speech recognition will be omitted.

In addition, the identity authentication system 100 may previously store information necessary for the voiceprint analysis module 170 to perform voiceprint analysis, that is, user's voiceprint information in the DB 180. Since the human voice is a complex wave in which various frequency components are mixed, the user's voice information can be grasped by frequency analyzing the user's voice. Voice information may include various acoustic parameters such as resonance frequency, frequency intensity, vocal cord vibration type and sound height due to vocal cord vibration. In one embodiment, the voiceprint analysis module 170 may analyze voice signals received from the mobile terminal 220 to extract voiceprint information, and compare the voiceprint information with pre-stored voiceprint information to perform voiceprint analysis.

The control module 150 may perform identity verification using the information received from the mobile terminal 220.

According to an embodiment, the control module 150 may determine whether the portion (ie, the second password described above) corresponding to the one-time authentication information and the one-time authentication information of the information received from the mobile terminal 220 do not coincide with each other. You can check. According to an embodiment, the control module 150 transmits the second password to the authentication server 300 that issued the one-time authentication information, so that the authentication server 300 has the second password and the one-time authentication information. It can be determined whether it matches. If the identity authentication system 100 stores the one-time authentication information, the control module 150 may directly determine whether the second password matches the one-time authentication information.

According to an embodiment, the control module 150 may include a portion (ie, the first password described above) corresponding to the authentication information previously stored in the DB 180 among the information received from the mobile terminal 220 and the previously stored information. It may be determined whether the authentication information matches.

The control module 150 may authenticate the user based on a comparison result between the second password and the one-time authentication information. In addition, according to an embodiment, the control module 150 may improve the security level by further considering the comparison result between the first password and the pre-stored authentication information and / or the comparison result of the voiceprint analysis module 170. .

On the other hand, the control module 150 may perform additional identity authentication for the user using predetermined personal information. The personal information about the user may include a mobile phone number, a resident number, a date of birth, a credit card number, an address, etc. for the user, and the personal information is the personal authentication request transmitted by the user terminal 210. And / or identity verification information transmitted by the mobile terminal 220. The control module 150 transmits the received personal information to a predetermined authentication server (for example, 300) to request an authentication of the user, thereby performing additional identification.

When the identity is authenticated by the above-described method, the control module 150 may enable the service requested by the user to be provided through the user terminal 210. For example, when the user requests identity authentication to use internet banking, the control module 150 may allow the user terminal 210 to provide an initial procedure for starting internet banking. Of course, the control module 150 may transmit a predetermined guide message when the user authentication fails, and may not allow the service to be provided to the user terminal 210.

Hereinafter, a method of providing a user authentication system according to an embodiment of the present invention will be described with reference to FIGS. 5 to 7 with reference to FIG. 4.

4 is a view for explaining the flow of a method for providing a user authentication system according to an embodiment of the present invention.

Referring to FIG. 4, a user may transmit a user authentication request to the user authentication system 100 using his user terminal 210 (S100). The identity authentication request may include a mobile phone number, and in some embodiments, may include at least some of the user's personal information.

Meanwhile, in order to receive the identity authentication request from the user terminal 210, the user terminal 210 may display a UI as illustrated in FIG. 5. FIG. 5 is a diagram illustrating an example of a user authentication request UI provided to a user terminal in order to implement a method for providing a user authentication system according to an embodiment of the present invention. Referring to FIG. For example, when making a request for using an online payment, the UI 10 as shown in FIG. 5 may be provided to the user terminal 210. When a user authentication request is made, the user may input a mobile phone number (eg, a mobile phone number) through a predetermined input UI 11 included in the UI 10. According to the implementation example, the payment information (for example, credit card information, payment amount, etc.) may be input using the payment information input UI 13 for inputting the payment information, and the input information may be input to the personal authentication request. It may be included and transmitted to the identity verification system 100.

Referring back to Figure 4, the identity authentication system 100 is a one-time authentication information to a predetermined authentication server (card company system 300 in the example of FIG. 4) so that one-time authentication information corresponding to the identity authentication request can be issued. May issue a request (S110). Then, the card company system 300 may issue one-time authentication information (OTP) (S120). One-time authentication information (OTP), together with the authentication information previously stored in the identity authentication system 100, may be used to perform identity authentication for the user later.

In one embodiment, the card company system 300 transmits the issued one-time authentication information (OTP) to the user terminal 210 (S130), the one-time authentication information (OTP) received by the user terminal 210 It can be output (S140). In addition, the card company system 300 may notify the identity authentication system 100 that one-time authentication information has been issued. According to an embodiment, unlike steps S130 and S150 of FIG. 4, the card company system 300 transmits the issued one-time authentication information (OTP) to the identity verification system 100, and the identity verification system 100. ) May transmit one-time authentication information (OTP) to the user terminal 210.

On the other hand, the identity authentication system 100 transmits the calling number (for example, the ARS call originating number) of the identity authentication system 100 to the user terminal 210 (S160), the user terminal 210 The caller ID of the identity authentication system 100 may be output to the caller (S170).

On the other hand, according to an embodiment, unlike the step (S140, S170) of Figure 4, the user terminal 210 is the one-time authentication information and the calling number of the identity authentication system 100 as shown in FIG. It can be output on one guide UI. 6 is a diagram illustrating an example of a guide UI provided to a user terminal to implement a method for providing a user authentication system according to an embodiment of the present invention. As shown in FIG. 6, the guide UI 20 includes a UI 21 for guiding the calling number of the identity authentication system 100 and a UI 22 for guiding one-time authentication information (OTP). can do.

The UI 21 may include a message informing that an ARS identity verification call is coming from an ABC authentication center (call number: 070-1010-1234). The name (ABC authentication center) and the calling number 21 of the identity authentication system 100 included in the UI 21 are later output to the user's mobile terminal 220 again, so that the user is authenticated by the identity authentication system 100. ) Can be verified.

On the other hand, in some of the embodiments using both the authentication information and the one-time authentication information stored in advance in the identity authentication system 100, the user can be mixed with the arrangement of the characters constituting each authentication information. To this end, the identity authentication system 100 may share the arrangement information regarding the position where the characters constituting the pre-stored authentication information and the position where the characters constituting the one-time authentication information are arranged with the user terminal 210. have. For example, the identity verification system 100 may transmit the batch information to the user terminal 210.

 For example, if the one-time authentication information is 452178 and the pre-stored authentication information is a four-digit number ****, as shown in FIG. 6, the user terminal 210 has the one-time authentication information and the pre-stored authentication information. UI 22 may be displayed to guide the order in which should be entered. Subsequently, when a user inputs a password through the mobile terminal 220, the identity authentication system 100 may divide the input password into two parts (first password and second password) based on the batch information. have. By inputting a different arrangement of the pre-stored authentication number and one-time authentication number for each authentication request, it is possible to effectively block the attack intercepting the input.

Referring back to FIG. 4, the identity authentication system 100 may connect a telephone call with the user's mobile terminal 220 using a mobile telephone number included in the identity authentication system 100. At this time, the caller's number and / or caller information may be output to the user's mobile terminal 220, as shown in FIG. 7 is a diagram illustrating an example of a screen output to the user's mobile terminal 220 in the method for providing a user authentication system according to an embodiment of the present invention. As shown in FIG. 7, the same information as the caller information and the call number information (see FIG. 6) guided through the user terminal 210 may be output to the mobile terminal 220. In this way, the user can check the identity between the subject that he or she made the authentication request and the subject that wants to connect the ARS call.

As such, the identity authentication system 100 distinguishes a channel (i.e., a data communication network such as a wired or wireless internet) for which identity authentication is requested from a channel (i.e., a telephone network) for confirming a password, thereby preventing information leakage from any one channel. Even if it happens, it can provide a system structure that can maintain security. In addition, when receiving a password through the ARS, there is a high effect that the information is not likely to leak through attacks, such as viruses, worms, or malware in the data communication network. In addition, in the case of a telephone call, unlike a packet communication network, eavesdropping / tapping is very difficult. The identity authentication system 100 can effectively prevent vulnerabilities for man-in-the-middle attacks because it receives various information necessary for identity authentication via a telephone call having such a feature.

Referring back to FIG. 4, the identity authentication system 100, via a connected telephone call, has a first password pw1 corresponding to authentication information previously stored in the DB 180 and a second corresponding to the one-time authentication information. Password information including the password pw2 may be input (S190). For example, when the user is guided as shown in FIG. 6, the user places four characters corresponding to the first password after the second, third, and fourth digits of the one-time authentication information 452178. Password information can be entered after the sixth digit.

As described above, in one embodiment of the present invention, by inputting previously stored authentication information and one-time authentication information at once, it is possible to ensure higher security. This is because it is much harder to find a long-digit password that is made up of two pieces rather than inputting pre-stored authentication information and one-time authentication information having relatively short digits individually.

On the other hand, the identity verification system 100 may perform identity verification with the input password information.

The user authentication system 100 may determine whether the first password is the same as previously stored authentication information (S200).

In addition, when the second password of the password information is input as a voice signal, the identity authentication system 100 may determine whether the voice signal is uttered by the user through voice text analysis (S210). The second password may be recognized by performing voice recognition on the signal (S220).

The one-time authentication information is discarded immediately after the authentication process so that it cannot be used for the next authentication, so that other people may overhear it. Therefore, as described above, in the case of the embodiment in which the password information corresponding to the one-time authentication information is input by voice, input convenience can be provided to the user while maintaining security.

In addition, by using the one-time authentication information and the method of analyzing the voiceprint at the same time there is an effect that can significantly increase the security level. That is, when the one-time authentication information is input as the voice signal, it may be guaranteed that the voice information to be uttered is not previously recorded. Therefore, by confirming that the voice signal is uttered by a legitimate user through voiceprint analysis, it is possible to clearly ensure that the person who has confirmed the one-time authentication information (that is, the person who has made the authentication request) is the legitimate user.

Referring back to FIG. 4, the identity authentication system 100 transmits the second password to the card company system 300 that issued the one-time authentication information (S230), and the card company system 300 is connected to the second password. It may be determined whether the one-time authentication information is the same, and the determination result may be transmitted to the personal authentication system 100 (S240).

The identity authentication system 100 may determine whether the user who requested the authentication is a legitimate user, based on a result of the voiceprint analysis, a comparison with the previously stored authentication information, and a comparison with the one-time authentication information. If it is determined that the service can be provided to the user (S260).

As such, in one embodiment of the present invention, the one-time authentication information discarded after being used once can be used for authentication, thereby preventing a vulnerability to a retransmission attack. In addition, since authentication is performed through a telephone call as described above, there is an effect that can prevent the vulnerability to the man-in-the-middle attack. After all, according to the technical idea of the present invention there is an effect that can be prevented. In addition, the first password and the second password are transmitted to the identity authentication system 100 through one procedure (telephone call connected between the person authentication system 100 and the mobile terminal 220), so that the two passwords are separated from each other in one procedure. There is an effect that different authentication procedures are performed at the same time. Therefore, it is possible to obtain higher security than two different methods of authentication, which are weak in man-in-the-middle attack or retransmission attack, respectively.

On the other hand, according to the embodiment, the identity authentication system 100 may include a processor and a memory for storing a program executed by the processor. The processor may include a single core CPU or a multi core CPU. The memory may include fast random access memory and may include nonvolatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other nonvolatile solid state memory devices. Access to memory by the processor and other components may be controlled by the memory controller. Here, when the program is executed by the processor, the user authentication system 100 according to the present embodiment may allow the above-described method of providing the user authentication system.

Meanwhile, the method for providing a user authentication system according to an embodiment of the present invention may be implemented in a computer-readable program command form and stored in a computer-readable recording medium. The program may also be stored in a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

The program instructions recorded on the recording medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the software art.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, floppy disks, and the like. Included are hardware devices specifically configured to store and execute the same magneto-optical media and program instructions such as ROM, RAM, flash memory, and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Examples of program instructions include not only machine code generated by a compiler, but also devices that process information electronically using an interpreter, for example, high-level language code that can be executed by a computer.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. .

The present invention can be applied to a system for authenticating a user.

Claims (18)

As a method of providing an identity authentication system, (a) receiving, by the identity authentication system, an identity authentication request including a mobile telephone number of a user's mobile terminal from a user terminal of the user through a wired / wireless data communication network; (b) allowing the user authentication system to transmit one-time authentication information corresponding to the user authentication request to the user terminal; (c) connecting, by the identity verification system, a telephone call with the mobile terminal corresponding to the mobile telephone number included in the identity verification request received; (d) receiving, by the identity verification system, a first password and a second password from the mobile terminal via the telephone call; And (e) the first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system, and the second password received from the mobile terminal matches the one-time authentication information sent to the user terminal. If, the identity authentication system providing method comprising the step of determining that the authentication is successful. The method of claim 1, In step (d), Receiving, by the identity authentication system, a voice signal corresponding to the second password through the telephone call; And And, by the identity authentication system, recognizing the second password from the voice signal through voice recognition. The method of claim 2, wherein the identity authentication system providing method is The identity authentication system further analyzing the voice signal to determine whether the voice signal is uttered by the user; In step (e), The first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system, and the second password corresponding to the voice signal determined to be uttered by the user is transmitted to the user terminal. If it is matched with the one-time authentication information, the method of providing a personal authentication system comprising the step of determining that the authentication is successful. The method of claim 2, In step (d), And receiving, by the identity authentication system, a DTMF signal corresponding to the first password through the telephone call. The method of claim 1, In step (c), Causing the identity verification system to output the calling number of the identity authentication system to be output to the mobile terminal when the identity authentication system attempts to make a call connection to the mobile telephone number; And And providing, by the identity authentication system, a telephone call with the mobile terminal using the mobile telephone number included in the received identity authentication request. The method of claim 1, In step (c), The identity authentication system attempting to make a call to the mobile telephone number; If the call is unsuccessful, transmitting, by the identity verification system, a callback message to the mobile telephone number; And And a telephone call is connected from the mobile terminal to the identity authentication system using the transmitted callback message. The method of claim 1, In step (b), Wherein the identity authentication system, comprising the step of transmitting a request for issuing one-time authentication information corresponding to the identity authentication request to a predetermined issuing server, The issuing server, In response to the issuing request, issuing the one-time authentication information and transmitting it to the user terminal. The method of claim 1, The identity verification request, Further includes predetermined check information, In step (b), Determining, by the identity verification system, whether the check information corresponds to the mobile telephone number; And And if it is determined that the corresponding one-time authentication information corresponding to the identity authentication request is transmitted to the user terminal. As a method of providing an identity authentication system, (a) receiving, by the identity authentication system, an identity authentication request including a mobile telephone number of a user's mobile terminal from a user terminal of the user through a wired / wireless data communication network; (b) allowing the user authentication system to transmit one-time authentication information corresponding to the user authentication request to the user terminal; (c) the identity authentication system transmitting a callback message to the mobile telephone number and connecting a telephone call from the mobile terminal to the identity authentication system by the transmitted callback message; (d) receiving, by the identity verification system, a first password and a second password from the mobile terminal via the telephone call; And (e) the first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system, and the second password received from the mobile terminal matches the one-time authentication information sent to the user terminal. If, the identity authentication system providing method comprising the step of determining that the authentication is successful. As a method of providing an identity authentication system, (a) receiving, by the identity authentication system, an identity authentication request including a mobile telephone number of a user's mobile terminal from a user terminal of the user through a wired / wireless data communication network; (b) allowing the user authentication system to transmit one-time authentication information corresponding to the user authentication request to the user terminal; (c) connecting, by the identity verification system, a telephone call to the mobile terminal using the mobile telephone number included in the received identity authentication request; And (d) receiving, by the identity verification system, a voice signal from the mobile terminal through the telephone call; (e) performing, by the identity verification system, voice recognition on the voice signal; And (f) if the voice recognition result for the voice signal matches the one-time authentication information, determining that the user authentication is successful. The method of claim 10, wherein the identity authentication system providing method Further analyzing the voice signal to determine whether the voice signal is uttered by the user, Step (f), And if the voice recognition result of the voice signal matches the one-time authentication information and determines that the voice signal is uttered by the user, determining that the user authentication is successful. A computer-readable recording medium having recorded thereon a program for performing the method according to any one of claims 1 to 11. As an identity authentication system, A processor; Contains memory that stores programs, When the program is executed by the processor, the identity authentication system causes the identity authentication system to perform the method according to any one of claims 1 to 11. A request receiving module for receiving an identity authentication request including a mobile phone number of a user's mobile terminal from the user's user terminal through a wired or wireless data communication network; A one-time authentication information module for transmitting one-time authentication information corresponding to the identity authentication request to the user terminal; A telephone call module for connecting a telephone call with the mobile terminal using the mobile telephone number included in the received authentication request; A password receiving module for receiving a first password and a second password from the mobile terminal through the telephone call; And If the first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system and the second password received from the mobile terminal matches the one-time authentication information sent to the user terminal, Identity authentication system including a control module for determining that authentication is successful. The method of claim 14, The password receiving module, Receiving a voice signal corresponding to the second password through the telephone call, The identity authentication system, And a voice recognition module for recognizing the second password from the voice signal through voice recognition. The system of claim 15, wherein the identity authentication system, Further comprising a voice analysis module which analyzes the voice signal to determine whether the voice signal is uttered by the user, The control module, The first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system, and the second password corresponding to the voice signal determined to be uttered by the user is transmitted to the user terminal. Identity verification system that determines that the identity authentication was successful, if it matches the one-time authentication information. A request receiving module for receiving an identity authentication request including a mobile phone number of a user's mobile terminal from the user's user terminal through a wired or wireless data communication network; A one-time authentication information module for transmitting one-time authentication information corresponding to the identity authentication request to the user terminal; A telephone call module which transmits a callback message to the mobile telephone number and connects a telephone call from the mobile terminal to the identity authentication system by the transmitted callback message; A password receiving module for receiving a first password and a second password from the mobile terminal through the telephone call; And Identity authentication when the first password received from the mobile terminal matches the authentication information previously stored in the identity authentication system and the second password received from the mobile terminal matches the one-time authentication information sent to the user terminal. Identity authentication system comprising a control module that determines that this was successful. A request receiving module including a mobile phone number of the user's mobile terminal and receiving a user authentication request corresponding to a predetermined service from the user terminal of the user through a wired or wireless data communication network; A one-time authentication information module for transmitting one-time authentication information corresponding to the identity authentication request to the user terminal; A telephone call module for connecting a telephone call to the mobile terminal using the mobile telephone number included in the received authentication request; And A password receiving module for receiving a voice signal corresponding to a password from the mobile terminal through the telephone call; A voice recognition module for recognizing the password by performing voice recognition on the voice signal; And And a control module for determining that the authentication is successful when the recognized password matches the one-time authentication information.

Images