SECURE USER TWO FACTOR AUTHENTICATION METHOD AND SYSTEM FROM PERSONAL INFOMATION LEAKING AND SMISHING

摘要

The present invention relates to a method and a system for a user two-factor authentication capable of preventing damage due to hacking, SMS phishing, and farming by two-factor authenticating a user by using a passcode set by the user or OTP and IMSI, ICCID which are unique identification numbers saved in a USIM. The method of the present invention may include the steps of: when an authentication server receives a user′s cell phone number in a registration step of the authentication service, checking whether the user is a proper user and storing unique information for the user authentication in a database; storing the user′s passcode in the USIM of a cell phone corresponding to the cell phone number by the authentication server in the registration step of the authentication service; when the authentication server receives the user′s cell phone number in a step of using the authentication service, requesting an input of a passcode from the pertinent user after checking whether the user is registered in the authentication service; when a passcode is inputted in the user′s cell phone, performing a first authentication by comparing the inputted passcode to the passcode stored in the USIM by an authentication application; extracting the unique information stored in the USIM with a result of the passcode authentication and transmitting the outcome to the authentication server by the authentication application; performing a second authentication by comparing the transmitted unique information to the stored unique information or unique information of a mobile communication company by the authentication server; transmitting a result of the authentication to the service server by the authentication application; and providing the pertinent user with the service depending on the result of the authentication by the service server.