[0001]TECHNICAL FIELD
[0002]The present invention relates to a technique for enabling access from a plurality of devices without account registration or input of account-related information and, more particularly, to an access authentication method for multiple devices and platforms.
[0003]BACKGROUND ART
[0004]In general, when a user joins membership of a specific Internet site or purchases merchandise on an Internet shopping site, the user needs to let his or her real name authenticated and input much personal information. Along with the development of the Internet, numerous sites exist on the Internet. In Korea alone, hundreds of thousands of sites come and go. If an Internet user is prompted to input the user's real name and resident registration number each time the user signs up to a new site, the user's personal information is at the risk of leakage and malicious abuse in many ways by a number of hacking programs prevalent on the Internet.
[0005]To prevent information leakage, server systems typically adopt security policies that allow only authenticated users to access the systems. For example, a typical server system assigns an Identifier (ID) and a password to each user. Later, the server system requests input of the ID and password of the user to thereby authenticate the user. That is, the user transmits authentication information which is the ID and password to the server through his or her terminal and the server authenticates the user for access by comparing the received authentication information with pre-registered authentication information.
[0006]As more and more smart phones and tablet PCs have been used, individual users tend to possess a plurality of devices. An agreement on access to a specific account is rarely made between such devices. Even though a user uses the same account through different devices, the user should perform an authentication procedure by inputting an ID and a password each time the user switches from one device to another. Especially as devices and platforms get diverse, when a specific service is used through a plurality of devices and platforms, account registration and access authentication are required for each device or platform, which increases user inconvenience.
[0007]To mitigate user inconvenience, personal information such as an ID and a password can be stored in the form of cookie information in each device. However, the cookie information may be applied only within a specific application and is vulnerable to hacking. Therefore, the risk of leakage of the personal information is high.
[0008]DISCLOSURE
[0009]Technical Problem
[0010]An object of the present invention devised to solve the problem lies on an access authentication method for multiple devices and platforms, which when a user additionally registers to or logs in to a specific site through other devices or platforms after registering an account to the specific site through a specific device, enables the user to readily register to or access the specific site using an assigned temporary authentication key through other devices or platforms simply by manipulation of the specific device as a source device, in order to facilitate access from multiple devices and avoid the hacking risk of personal information.
[0011]Technical Solution
[0012]The object of the present invention can be achieved by providing an access authentication method for multiple devices and platforms, in which upon receipt of a multiple access request, a source device that has initially registered a user account to a subscribed site requests an authentication key for a target device to a server of the subscribed site, the target device receives an access authentication request together with an authentication key from the source device, when the source device receives the authentication key from an account authentication system, the authentication key being generated in response to an authentication key request from the subscribed site server by the account authentication system, the subscribed site server determines whether there is the registered user account and performs access authentication with the account authentication system, upon receipt of the authentication key from the target device, and the target device receives an access authentication completion notification from the subscribed site server, when the access authentication is completed.
[0013]In another aspect of the present invention, provided herein is an access authentication method for multiple devices and platforms, in which upon receipt of a multiple access request, a source device that has initially registered a user account to an account authentication system requests an authentication key for a target device to the account authentication system, an auxiliary device receives the authentication key from the authentication system and transmits an access authentication request together with the authentication key to one of target devices registered to the auxiliary device, and the target device transmits the authentication key to the account authentication system, so that the account authentication system determines whether there is the registered user account and performs access authentication.
[0014]In another aspect of the present invention, provided herein is an access authentication method for multiple devices and platforms, in which upon receipt of a multiple access request, a source device that has initially registered a user account to an account authentication system requests an authentication key for a target device to the account authentication system, the source device receives the authentication key from the authentication system and transmits an access authentication request together with the authentication key to a target device connected to the source device, and the target device transmits the authentication key to the account authentication system so that the account authentication system determines whether there is the registered user account and performs access authentication.
[0015]In a further aspect of the present invention, provided herein is an access authentication method for multiple devices and platforms, in which when a source device that has initially registered a user account to the account authentication system requests an authentication key for a target device to the account authentication system, the account authentication system generates an authentication key and transmits the authentication key to one of an auxiliary device and the source device, determines whether there is a registered user account corresponding to the authentication key, upon receipt of the authentication key from the target device that has received the authentication key from the source device or the auxiliary device, and transmits an access authentication completion notification to the target device, when the account authentication system detects the registered user account.
[0016]Advantageous Effects
[0017]According to embodiments of the present invention, a user having devices of a plurality of platforms can connect other devices simply by manipulating a source device that has initially registered an account, without inputting personal information such as an ID or a password through the other devices, while avoiding the hacking risk of the personal information.
[0018]DESCRIPTION OF DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention, illustrate embodiments of the invention and together with the description serve to explain the principle of the invention. In the drawings: FIG. 1A is a block diagram of an access authentication system for multiple devices and platforms according to an embodiment of the present invention; FIG. 1B is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 1A ; FIG. 1C is a detailed flowchart of the access authentication method illustrated in FIG. 1B ; FIG. 2A is a block diagram of an access authentication system for multiple devices and platforms according to another embodiment of the present invention; FIG. 2B is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 2A ; FIG. 3 is a block diagram of an access authentication system for multiple devices and platforms according to a further embodiment of the present invention; FIG. 4 is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 3 ; and FIG. 5 is a flowchart illustrating an operation of an account authentication system.
[0019]Throughout the drawings, the same drawing reference numerals will be understood to refer to the same elements, features and structures.
[0020]BEST MODE
[0021]Reference will be made to preferred embodiments of the present invention with reference to the attached drawings. Those skilled in the art will appreciate that the present invention may be carried out in other specific ways than those set forth herein. The scope of the present invention is therefore not limited by the embodiments of the present invention.
[0022]FIG. 1A is a block diagram of an access authentication system for multiple devices and platforms according to an embodiment of the present invention.
[0023]The term used herein “platform” may refer to a type of Operating System (OS) such as Windows or Linux, or a development environment of a device or software, particularly a resource-limited mobile device environment. On different types of OSs or in different environments, a specific service may be connected through different applications and information may be input in different manners. In this case, it is necessary to facilitate access irrespective of what device or platform a user uses and a requirement for repeated procedures may lead to bad user experience.
[0024]A source device 110 is a device which initially registered a specific account to an account authentication system 190 . The source device 110 and a target device 130 include a smart TV, a mobile phone, a smart phone, a tablet PC, a Personal Digital Assistant (PDA), a Personal Multimedia Player (PMP), an MP3 player, a laptop computer, a smart card, etc. The source device 110 and the target device 130 have built-in communication modules capable of connecting to Wireless Fidelity (WiFi), Bluetooth, ZigBee, or a 3 rd Generation (3G) network. In addition, an application for performing an algorithm described with reference to FIG. 1B is installed or built-in in the form of firmware in the target device 110 and the target device 130 . When needed, the source device 110 may be connected to the target device 130 in a broadband communication scheme.
[0025]Upon receipt of a request for issuing an authentication key from the source device 110 , a subscribed site server 140 requests issuance of an authentication key to the account authentication system 190 so that the account authentication system 190 may generate a new authentication key. Upon receipt of an authentication key from the target device 130 , the subscribed site server 140 transmits the received authentication key to the account authentication system 190 so that the account authentication system 190 may determine whether there is a registered user account for the target device 130 and performs access authentication, using the authentication key.
[0026]The account authentication system 190 includes a random coefficient authentication key generator 191 for generating an authentication key for the target device 130 , a database 192 for storing IDs, passwords, and other personal information about users, and an account authenticator 193 for searching for personal information about a user in the database 192 and performing access authentication for the user with the target device 130 . The account authentication system 190 is a kind of server that may operate in the same communication scheme as between the source device 110 and the target device 130 or may operate over a dedicated network.
[0027]FIG. 1B is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 1A .
[0028]Referring to FIG. 1B , upon receipt of a multiple access request, the source device 110 that initially registered a user account to a subscribed site requests an authentication key for the target device 130 to the subscribed site server 140 (S 100 ).
[0029]Then the subscribed site server 140 requests issuance of an authentication key to the account authentication system 190 (S 110 ).
[0030]The account authentication system 190 generates a new authentication key in response to the request for issuing an authentication key received from the subscribed site server 140 (S 111 ). Attributes may be assigned to the generated authentication key, such as an authentication valid duration, a valid number of times of use, an encrypted mobile phone number, an encrypted email, etc. For example, if the authentication valid duration is 1 hour and the valid number of times of use is 5, the target device 130 can be authenticated using the above same authentication key only up to 5 times. Upon expiration of 1 hour after the authentication key is issued, the target device 130 cannot be user-authenticated even though user authentication has been performed less than 5 times. Information about the authentication valid duration, the valid number of times of use, the encrypted mobile phone number, the encrypted email, a last authentication date and time, and the number of authentications (verifications) that have been performed so far may be stored in the database 192 .
[0031]Subsequently, the source device 110 receives the authentication key from the account authentication system 190 (S 120 ).
[0032]Upon receipt of an access authentication request along with the authentication key from the source device 110 (S 130 ), the target device 130 transmits the authentication key to the subscribed site server 140 (S 131 ) so that the subscribed site server 140 may determine whether there is a registered user account for the target device 130 and perform access authentication through the account authentication system 190 .
[0033]The subscribed site server 140 transmits an authentication key verification request along with the authentication key to the account authentication system 190 (S 140 ).
[0034]The account authentication system 190 checks whether there is the registered user account and performs access authentication (S 141 ). Preferably, upon receipt of the request for issuing an authentication key from the subscribed site server 140 , the account authentication system 190 may verify a Uniform Resource Locator (URL) included in the request for issuing an authentication key by searching for the access URL of the user stored in the database 192 . The URL from which the user accesses the subscribed site may be stored in the database 192 . Even when the subscribed site server 140 requests issuance of an authentication key to the account authentication system 190 , the account authentication system 190 determines whether the same URL has been used. Therefore, malicious use of the access authentication system according to the embodiment of the present invention can be prevented.
[0035]Upon completion of the access authentication, the account authentication system 190 notifies the subscribed site server 140 of user authentication completion (S 142 ).
[0036]Finally, the target device 130 receives a notification indicating access authentication completion from the subscribed site server 140 (S 150 ).
[0037]FIG. 1C is a detailed flowchart of the access authentication method illustrated in FIG. 1B .
[0038]In the embodiment of the present invention, the source device 110 and the target device 130 are not related directly to the account authentication system 190 except for issuance of an authentication key. The subscribed site server 190 takes charge of issuing an authentication key and user authentication. A request for issuing an authentication key may include information about an ID of the subscribed site, an email address, a phone number, the number of verifications, and an authentication duration. When a new authentication key is generated, information about an authentication valid duration, the valid number of times of use, an encrypted mobile phone number, an encrypted email, a last authentication date and time, and the number of authentications (verifications) that have been performed so far may be stored in the database 192 . In the process of processing a response to the request from the subscribed site, the subscribed site may be notified that a new authentication key will be transmitted to the source device 110 , in response to the request for user authentication and issuance of an authentication key.
[0039]In the process of processing an authentication key verification request, the account authentication system 190 performs user authentication by checking the presence or absence of the authentication key and expiration or non-expiration of an authentication duration and comparing the site ID and the number of times of use with the database 192 .
[0040]FIG. 2A is a block diagram of an access authentication system for multiple devices and platforms according to another embodiment of the present invention.
[0041]The source device 110 is a device that has initially registered a specific account to the account authentication system 190 . The source device 110 , an auxiliary device 120 , and target devices 131 and 132 include a mobile phone, a smart phone, a tablet PC, a PDA, a PMP, an MP3 player, a laptop computer, a smart card, etc. Or the source device 110 may be a communication device with a built-in encryption module, which is not equipped with any particular function.
[0042]The auxiliary device 120 assists access authentication of the target devices 131 and 132 . The auxiliary device 120 may establish a one-to-one connection with the source device 110 or the target devices 131 and 132 . The auxiliary device 120 may store a list of target devices to receive an authentication key and the ID of a target device to receive the authentication key with priority in its inner memory, for example, a flash memory or a memory card.
[0043]The source device 110 , the auxiliary device 120 , and the target devices 131 and 132 have built-in communication modules that can connect to WiFi, Bluetooth, ZigBee, a 3F network, etc. In addition, an application capable of performing the algorithm described with reference to FIG. 2 is installed or built-in in the form of firmware in the source device 110 , the auxiliary device 120 , and the target devices 131 and 132 . When needed, the source device 110 may be connected to the target devices 131 and 132 in a broadband communication scheme.
[0044]The account authentication system 190 includes the random coefficient authentication key generator 191 for generating an authentication key for the target devices 131 and 132 , the database 192 for storing IDs, passwords, and other personal information about users, and the account authenticator 193 for searching for personal information about a user in the database 192 and performing access authentication for the user with the target device 131 . The account authentication system 190 is a kind of server that may operate in the same communication scheme as between the source device 110 and the target devices 131 and 132 or may operate over a dedicated network.
[0045]FIG. 2B is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 2A .
[0046]Referring to FIG. 2B , upon receipt of a multiple access request, the source device 110 that has initially registered a user account to the account authentication system 190 requests an authentication key for the target device 131 to the account authentication system 190 (S 210 ). The account authentication system 190 generates an authentication key (S 211 ). The authentication key may be a random-number authentication key. To reinforce security, the authentication key preferably has an increased number of digits.
[0047]Subsequently, the auxiliary device 120 receives the authentication key from the account authentication system 190 (S 220 ).
[0048]The auxiliary device 120 transmits the authentication key and an access authentication request to one of the target devices 131 and 132 registered to the auxiliary device 120 (S 230 ). Herein, the auxiliary device 120 is connected to the target device 131 through an ad-hoc network, a WiFi network, a 3G network, ZigBee, or Bluetooth.
[0049]Upon receipt of the access authentication request, the target device 131 transmits the authentication key to the account authentication system 190 (S 240 ). The account authentication system 190 searches the database 192 using the received authentication key (S 241 ). When the account authentication system 190 detects the registered user account in the database 192 , the account authentication system 190 transmits an access authentication completion notification to the target device 131 (S 250 ).
[0050]FIG. 3 is a block diagram of an access authentication system for multiple devices and platforms according to a further embodiment of the present invention.
[0051]The access authentication system illustrated in FIG. 3 is not provided with the auxiliary device 120 and the source device 110 takes charge of a part of the functions of the auxiliary device 120 . In this case, although much resources of the source device 110 are used to support access authentication of the target devices 131 and 132 , portability is increased.
[0052]FIG. 4 is a diagram illustrating a signal flow for an access authentication method for multiple devices and platforms in the access authentication system illustrated in FIG. 3 .
[0053]Referring to FIG. 4 , upon receipt of a multiple access request, the source device 110 that has initially registered a user account to the account authentication system 190 requests an authentication key for the target device 131 to the account authentication system 190 (S 410 ). The account authentication system 190 generates an authentication key (S 411 ). The authentication key may be a random-number authentication key.
[0054]Subsequently, the source device 110 receives the authentication key from the account authentication system 190 (S 420 ). Before or after this step, the source device 110 establishes a connection to the target device 131 . Herein, the source device 110 is connected to the target device 131 through an ad-hoc network, a WiFi network, a 3G network, ZigBee, or Bluetooth.
[0055]The source device 110 transmits the authentication key and an access authentication request to the connected target device 131 (S 430 ).
[0056]Upon receipt of the access authentication request, the target device 131 transmits the authentication key to the account authentication system 190 (S 440 ). The account authentication system 190 searches the database 192 using the received authentication key (S 441 ). When the account authentication system 190 detects the registered user account in the database 192 , the account authentication system 190 transmits an access authentication completion notification to the target device 131 (S 450 ).
[0057]FIG. 5 is a flowchart illustrating an operation of the account authentication system.
[0058]Referring to FIG. 5 , the account authentication system 190 receives an authentication key request for the target devices 131 and 132 from the source device 110 that has initially registered a user account to the account authentication system 190 (S 510 ).
[0059]The account authentication system 190 generates an authentication key through the random coefficient authentication key generator 191 (S 520 ).
[0060]Then, the account authentication system 190 transmits the authentication key to one of the source device 110 and the auxiliary device 120 (S 530 ). Upon receipt of the authentication key, the source device 110 or the auxiliary device 120 transmits an access authentication request together with the authentication key to the target device 131 .
[0061]Then, the account authentication system 190 receives a request for checking the presence or absence of the registered user account along with the authentication key from the target device 131 (S 540 ).
[0062]The account authentication system 190 determines whether there is a user account corresponding to the authentication key by searching the database 192 (S 550 ).
[0063]When detecting the registered user account, the account authentication system 190 transmits an access authentication completion notification to the target device 131 (S 560 ).
[0064]To reinforce security, the number of times of using an authentication key or the valid duration of the authentication key may be restricted. That is, although access authentication can be performed simultaneously for two or more target devices using one authentication key, if a predetermined number of target devices succeed in access authentication, the authentication key may be discarded.
[0065]It may further be contemplated as another embodiment of the present invention that after the account authentication system 190 transmits the access authentication completion notification, the account authentication system 190 processes the valid duration (available time period) of the authentication key as expired.
[0066]The present invention may be implemented in software. Preferably, the access authentication methods for multiple devices and platforms according to the embodiments of the present invention can be implemented as a program that can be written on a computer-readable recording medium and can thus be read by a processor. When implemented in software, the configuring means of the present invention is code segments that execute necessary tasks. The program or code segments can be written to a processor-readable recording medium, a transmission medium, or a computer data signal combined with carrier waves over a communication network.
[0067]The computer-readable recording medium may be any type of recording device in which data is stored in a computer-readable manner. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a DVD±ROM, a DVD-RAM, a magnetic tape, a floppy disc, a hard disk, an optical data storage, a flash memory, and a memory card. The computer-readable recording medium can be distributed over a plurality of computer systems connected to a network so that computer-readable code is written thereto and executed therefrom in a decentralized manner.
[0068]While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.
