Authentication system in client/server system and authentication method thereof
View Patent ↗The security of an authentication system using a one-time password is increased, a shift from an authentication system using a fixed password is simplified, and a range of use is increased. An authentication system wherein a one-time password is synchronized with time, or an authentication system wherein a one-time password is synchronized with the number of online service authentication requests, is provided. When a one-time password client 9 downloads a one-time password for online service authentication from a one-time password server 2 , current time information or a current value of the number of online service authentication requests is made to coincide between the client and server, and an online service authentication request is authenticated as long as the downloaded one-time password for online service authentication is valid. The one-time password may also be synchronized with service usage details contained in the online service authentication request.
1. An authentication system in a client/server system wherein an online service server, a one-time password server, and an online service client are connected via a network, comprising:
the online service server; the one-time password server; the online service client; and a one-time password client, wherein
the one-time password server stores service usage details with respect to an online service authentication preparation request containing the service usage details received from the online service client;
the one-time password server, after authenticating a download request for a one-time password for online service authentication, shares common keys for encrypting sets of service usage details and a one-time password for online service authentication with the one-time password client;
the one-time password client decrypts, with the common key, and displays sets of the service usage details and one-time password for online service authentication; and
the online service server authenticates the online service authentication request received from the online service client by a one-time password for online service authentication,
the online service server, after receiving a set of the encrypted service usage details and the one-time password for online service authentication from the one-time password server, encodes it to a QR Code and transmits it to the online service client;
the online service client displays the QR Code; and
the one-time password client inputs and decodes the QR Code, then decrypts the QR code with the common key.
2. An authentication method in a client/server system wherein an online service server, a one-time password server, and an online service client are connected via a network, comprising: the online service server; the one-time password server; the online service server; and a one-time password client, the method comprising the steps of:
storing, in the one-time password server, service usage details with respect to an online service authentication preparation request containing the service usage details received from the online service client;
sharing, in the one-time password server, a common key for encrypting sets of service usage details and one-time passwords for online service authentication, with the one-time password client, after authenticating a one-time password download request for online service authentication;
decoding, with the common key, and displaying the sets of service usage details and one-time password for online service authentication by the one-time password client; and
authenticating, in the online service server, the online service authentication request received from the online service client by a one-time password for online service authentication, wherein
after receiving a set of the encrypted service usage details and the one-time password for online service authentication from the one-time password server, encoding, in the online service server, the set to a QR Code and transmits the set to the online service client; and
displaying the QR Code by the online service client; and
inputting and decoding the QR Code by the one-time password client, then decrypting the QR code with the common key.