KR100412356B1 - Discovery protocol for user authentication, execution apparatus, data structure thereof and method for authentication of administration in the jini network - Google Patents

Abstract

The present invention discloses a discovery protocol capable of authenticating a user in a Genie network, an execution apparatus thereof, a data structure, and an administrator authentication method.

According to the present invention, when a service and a client create and use a TCP socket to communicate with a lookup service using the Genie Discovery protocol, the TCP socket is used to transmit encrypted authentication information of the service or client to the lookup service. In addition, the lookup service decrypts the received encrypted authentication information and decides whether to send a response message to the service or the client to authenticate the user, thereby maintaining compatibility with the lookup service while maintaining compatibility with all services and clients using the discovery protocol in the Genie network. It can provide security for communicating discovery protocols. Therefore, the service or network resources can be used only by authorized users in transactions such as commerce through Genie network, thereby increasing the reliability of commerce using the network.

Description

Discovery protocol for user authentication, execution apparatus, data structure etc and method for authentication of administration in the jini network}

The present invention relates to a computer network, and more particularly, to a discovery protocol capable of authenticating a user when building a system using Genie technology in a computer network.

Genie technology, introduced by Sun Microsystems in January 1999, is proposing ways to find and interact with devices and services connected to the network. A network to which Genie technology is applied is called a Jini Network.

Literature on Genie technology is published at the following URL.

http://www.sun.com/jini/whitepapers/

http://www.sun.com/jini/specs/jini1.1html/coreTOC.html

http://www.artima.com/jini/index.html

http://pandonia.canberra.edu.au/java/jini/tutorial/Jini.xml

The Genie network is proposing a discovery protocol for finding available devices or service resources. Other technologies that use the discovery protocol include Genie, Home Audio Video Interoperability (HAVi), Universal Plug and Play (UPnP), and Salutation.

The discovery protocol is for the Genie network to start itself up. Lookup service that provides a community between clients or services connected to the Genie network using the discovery protocol (the term service is used to indicate the device or host providing the service and will continue to use the same meaning unless otherwise confused). Allows you to get an initial remote object that references the lookup service. Users connected to the Genie network through the client can use these initial remote objects and lookups to get all the additional object references.

The lookup service is a computer or a network device having information about network resources including a service that can be provided in a genie network, and a plurality of lookup services may exist in one network.

When a service capable of providing a predetermined service is connected to the Genie network, the service is connected to the network by transmitting information including its location and the service it can provide to a lookup service connected to the Genie network. Make it available to existing or connected clients. Or, a client wishing to use a service connected to a Genie network accesses a lookup service to obtain information about available services. In such cases, the discovery protocol is used to find available lookup services.

New lookup services connected to the Genie network reveal their presence to clients or services. In this case, use the discovery protocol.

However, the proposed Gini network has a problem that security is weak because there is no way to verify whether the user is an authenticated user when accessing the lookup service using the discovery protocol to retrieve information. In particular, when the various forms of commerce through the network increases, such a security vulnerability may cause a larger problem.

In addition, there is a problem that an unauthenticated user can manage the administrator because security is not applied to the administration management function that can manage users and resources in the existing Gini technology network. If an unauthorized administrator can manage the administration, there may be a big side effect of using the network.

SUMMARY OF THE INVENTION The present invention has been made in an effort to provide a discovery protocol, an execution device, and a data structure capable of authenticating a user in a Genie network, in order to solve the problems of the discovery protocol.

Another technical problem to be solved by the present invention is to provide an administrator authentication method in a Genie network in order to solve the absence of the above administrator authentication.

1 illustrates a packet format of a unicast discovery protocol and a process of executing a protocol.

2 illustrates a packet format of a multicast request and a process of executing a protocol.

3 illustrates a packet format of a multicast open protocol and a process of executing a protocol.

4 illustrates a flow of a discovery protocol capable of user authentication in a Genie network according to the present invention.

5 is a block diagram illustrating the configuration and data direction of discovery protocol execution apparatuses capable of user authentication in a Genie network according to the present invention.

6 illustrates a packet format of the unicast discovery protocol according to the present invention.

7 is a simplified view of a block and an execution process of an apparatus for executing a unicast discovery protocol according to the present invention.

8 illustrates in detail a block and an execution process of an apparatus for executing a unicast discovery protocol according to the present invention.

9 illustrates a packet format of a multicast request protocol according to the present invention.

10 is a simplified view of a block and an execution process of an apparatus for executing a multicast discovery protocol according to the present invention.

11 illustrates in detail a block and an execution process of an apparatus for executing a multicast discovery protocol according to the present invention.

12 illustrates a block and an execution operation of an administration device in a Genie network to which a security process is added according to the present invention.

According to the present invention for solving the technical problem, access to a look-up service host including information on the resources and services available in the network through a client connected to the Jini network to obtain information about the resources and services A discovery protocol capable of importing and authenticating a user, comprising: (a) generating a version of a discovery protocol at the client and encrypting a user's identification code and password by a predetermined method to generate packet data; (b) transmitting information including the packet generated in step (a) to the lookup service host; (c) comparing the version of the discovery protocol included in the packet with its protocol version at the lookup service host receiving the information transmitted in step (b); (d) extracting the encrypted user identification code and password from the received information if the protocol versions are the same; (e) decrypting the encrypted information using the reverse procedure of any method used for encryption in step (a); (f) confirming the authorized user using the decrypted user's identification code and password; And (g) transmitting, by the lookup service host, information to the client that has been identified as an authorized user, including a registration proxy and a list of groups of services to which the lookup service host is subscribed. do.

According to an embodiment of the present invention for solving the above technical problem, a user accesses a lookup service host having information on resources and services available in the network, and obtains information on the resources and services, and performs user authentication. A discovery protocol execution apparatus, comprising: a version generator configured to generate a header including version information of a discovery protocol; An encryption unit for encrypting a user's identification code and password by a predetermined method; A transmission unit which transmits the header generated by the version generation unit and the information encrypted by the encryption unit; And information about a resource and a service available by receiving information including a registration proxy of the lookup service and a group list of services to which the lookup service host is subscribed after being authenticated by the lookup service host. Characterized in that it comprises a confirmation receiving unit for receiving information and confirming that the user authentication.

According to the present invention for solving the another technical problem, to the look-up service host system for requesting information about the resources and services available in the network from the client connected to the Genie network and executing the discovery protocol for user authentication A reception unit comprising: a receiver configured to receive data including a version of a protocol transmitted from the client and user authentication information encrypted by a predetermined method, and to separate a header and encrypted information; A decoding unit for decrypting the encrypted user identification code and password using a reverse process of a predetermined method used for the encryption if the version information of the header is equal to a predetermined value; A confirmation unit for confirming whether the user is an authorized user by comparing the decrypted user identification code and password with information of a pre-registered user; And a registration proxy response unit which transmits information including a registration proxy and a list of groups of services to which the lookup service host is subscribed, to the client confirmed to be an authorized user.

According to the present invention for solving the another technical problem, access to a lookup service host including information on resources and services available in the network through a client connected to the Genie network for the resources and services CLAIMS 1. A data structure transmitted via a discovery protocol capable of fetching information and authenticating a user, comprising: a header indicating the protocol version; Secure data in which a user's identification code and password are encrypted by a predetermined method; A service proxy that is an object for communicating with the lookup service after the client performs a discovery protocol; And group list data of a service to which the lookup service host is subscribed.

According to an embodiment of the present invention for solving the above technical problem, the network resources and services are accessed by accessing a lookup service host including information on resources and services available in the network through a client connected to a Jini network. A method of securely managing a user to be used and a resource connected to a network, the method comprising: (a) registering a registrar adminproxy including administration information for user management from the lookup service; Receiving; (b) generating packet data by encrypting a manager's identification code and password in a predetermined method in the client; (c) transmitting data including the packet generated in step (b) to the lookup service host; (d) extracting the encrypted administrator identification code and password from a received data at a lookup service host; (e) decrypting the encrypted information using the reverse procedure of any method used for encryption in step (b); (f) confirming whether the administrator is an authorized administrator using the decrypted user's identification code and password; And (g) if it is confirmed that the administrator is authorized, transmitting data including a message for allowing the user to manage the user to the client, and continuing the communication in the state where the administrator authority is granted.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Unlike typical client / server systems, in Genie systems, clients and services are loosely connected through lookup services. Both clients and services need to locate the lookup service to run on the network. Services expose themselves by registering their proxies in one or several lookup services. In other words, it allows the community to know the services. This indicates that a service can usually use other services in the federation. This is also true for clients.

The client calls the lookup service to find the location of the required service, downloads the proxy object of the service, and starts interacting with the service itself. This is called discovering. Discovering is a function of Genie that dynamically constructs distributed networks. In a well-designed Genie network, each client, service, and lookup service can start, stop, fail, and restart independently. During these operations, the network continues to operate with network-specific functions.

There are two different methods of discovery.

The first is Multicast Discovery. This method is used to open and access any and all nearby services.

The second is Unicast Discovery. It is used for static mapping based on URL to specific service already known and accessed.

These discovery methods are divided into three discovery protocols. Unicast Discovery Protocol, Multicast Request Protocol, and Multicast Announcement Protocol. Each protocol contains a sending part, a part dealing with the entry of an entity, and a handler for the receiving entity.

Each protocol will be described below.

1 illustrates a process of executing a unicast discovery protocol of a genie network.

Services and clients use the unicast discovery protocol when they already know the location of the lookup service they want to access.

The discoverer host 130 on which the unicast discovery protocol is executed transmits a request message for the lookup service to the lookup service host 140. The lookup service host 140 receiving the request sends data necessary to receive the service to corresponding services and clients (host 1 in FIG. 1) as a response message. The lookup service host 140 does not respond when a message corresponding to the lookup service host is delivered.

2 illustrates a process of executing a multicast request protocol protocol of a Genie network.

When a service or client starts for the first time, the service or clients use this protocol to access adjacent lookup services using the IP multicast protocol. Used in TCP / IP protocol-based environment, it is a structure that puts multicast UDP datagram and TCP protocol underneath.

Discoverer 230 using a multicast request protocol of a service or a client connected to a new Genie network to start a host operation is a UDP multicast to send a request message to lookup services. Broadcast the message to the outside through. The lookup service host 240 receiving the message transmits the response message to the discovery host 230 identified from the received request message.

3 illustrates a process of executing a Multicast Announcement Protocol of a Genie network.

Lookup services use a multicast publishing protocol to disclose their presence to clients or services. All lookup services must send their information on request using the multicast public protocol. It serves as a backup protocol that allows lookup services to find clients and services for lookup services if the multicast request protocol fails.

The lookup service 340 creates a multicast UDP socket to send a message and a unicast TCP socket to receive a message from a relational service and the service and other clients 330 that are notified of the existence of a new lookup service create a multicast UDP socket. . When a client or service 330 receives an announcement of a lookup service and the announcement is not in their response list, it creates a TCP socket and sends it to the lookup service 340 to request information and a response TCP message from the lookup service 340. Receive.

4 illustrates a flow of a discovery protocol capable of user authentication in a Genie network according to the present invention.

Discovery that can access a lookup service host including information on resources and services available on the network through a client connected to the Genie network, obtain information about the resources and services, and perform user authentication. The protocol generates a packet data by generating a version of the discovery protocol in the client and encrypting the user's identification code and password in a predetermined method (step 400), and the information including the packet generated in step 400 is The user is transmitted to the lookup service host (step 410), and the transmitted information is received and compared with the protocol version of the discovery protocol included in the packet (step 420). If the protocol versions are the same, the encrypted user is received from the received information. Extract the recognition code and password (step 430), the password Decrypted information is decrypted using the reverse process of the predetermined method used for the encryption of step 400 (step 440), and the user is verified using the decrypted user's identification code and password (step 450). The client transmits information including a registration proxy and a group list of services to which the lookup service host is subscribed.

5 is a block diagram illustrating the configuration and data direction of discovery protocol execution apparatuses capable of user authentication in a Genie network according to the present invention.

In the Genie network, the discovery protocol execution apparatus 500 which accesses a lookup service host 505 having information on resources and services available in the network, obtains information on the resources and services, and performs user authentication. Version generation unit 508 for generating a header containing the version information of the discovery protocol, the encryption unit 510 for encrypting the user's identification code and password by a predetermined method, the header and encryption unit created in the version generation unit 508 A group of services to which a registration proxy and a lookup service host 505 of a lookup service transmitted after being authenticated by the transmitting unit 520 and the lookup service host 505 that transmit the encrypted information are subscribed to Receive information including a list to receive information about available resources and services, and user authentication And a confirmation receiving unit 570 confirms that the call has.

In the lookup service host system 505 executing a discovery protocol for requesting information on resources and services available on the network from a client 500 connected to the Genie network and for authenticating a user, Receiving unit 530 for receiving the data including the version of the protocol and the user authentication information encrypted by a predetermined method to separate the header and the encrypted information, if the version information of the header is equal to a predetermined value and the encrypted user identification code and Decryption unit 540 for decrypting a password using the reverse process of the predetermined method used for encryption, and a confirmation unit for confirming whether the user is an authorized user by comparing the decrypted user identification code and the password with information of a pre-registered user. 550 and a registrar proxy to the client that has been verified as an authorized user. And a look-up service host 505, the proxy response registration unit 560 for transmitting the information including the group list of service that is joined.

Hereinafter, embodiments of the present invention will be described in each case of the discovery protocol with reference to the drawings of FIGS. 4 and 5.

6 illustrates a packet format of the unicast discovery protocol according to the present invention, and FIG. 7 briefly illustrates a block and an execution process of an apparatus for executing the unicast discovery protocol according to the present invention.

As in the conventional case, the unicast discovery protocol according to the present invention is used when services and clients already know the location of a lookup service to be accessed. The location is determined by the name and port number of the host 700 on which the lookup service is running.

Each part of the packet form of FIG. 6 is comprised as follows.

Header (600): Integer value indicating the version of the discovery protocol used. By giving a version, you can see when future discovery protocols communicate with groups implemented with earlier versions of the protocol. The current version of Genie is '1', so this value is set to '1'. As the Genie version gets higher, this value will change accordingly.

Security (610): An ID and password, which are a user identification code of a user who wants to use a service, are encrypted through a predetermined method.

Registrar Proxy (620): A java.rmi.MarshalledObject with the Java object serialization that the discoverer receives from the lookup service for communication with the lookup service.

Groups (630):

group: The names of groups of which the lookup service is a member

(Groups may contain a group length field, which is not shown in the drawing but is an integer indicating the number of groups.)

The version generator 508 generates a version of the discovery protocol. The discovery protocol encrypts the identification code (ID) and password of the user who wants to use the service in the encryption unit 510 of the client or the discoverer 700 or 500 that is a lookup service (step 400). .

It is preferable to use the AES (Advanced Encryption Standard) algorithm, and this encryption method can be implemented by using other encryption algorithms, for example, other encryption algorithms such as the Data Encryption Standard (DES) algorithm.

The transmitter 520 transmits the Gini protocol version and the data (ID, Password) encrypted by the AES algorithm to the lookup service hosts 710 and 505 through the TCP unicast socket (step 410).

The receiving unit 530 of the lookup service hosts 710 and 505 extracts a version of the discovery protocol included in the received packet and checks whether the version is the same as its protocol version (step 420).

If the protocol versions are the same, the encrypted user identification code and password are extracted from the received information and transmitted to the decryption unit 540 (step 430).

The transmitted encrypted data is decrypted through the reverse process of the method used for encryption in the decryptor 540 (step 440). The method used for encryption may be known in advance, or the header portion of the encrypted data may be read by reading the header of the encrypted data according to the encryption method.

After checking whether the lookup service is a user who can use the lookup service (step 450), the registrar proxy of the lookup service and the lookup service (710, 505) of the group to which the lookup service is subscribed as a member only are available. The list is transmitted as a response message to the discoverers 700 and 500 through the confirmation transmission unit 560 (step 460). In this case, it is preferable to use a TCP unicast socket.

The registration proxy transmitted to the confirmation receiver 570 of the discoverers 700 and 500 is an object for communicating with the lookup services 710 and 505 after the discoverers 700 and 500 perform the discovery protocol.

If a unicast request message that does not contain a security message is sent from another discoverer 720, it is not an authorized user and thus does not give a response. Since there is no response, the other discoverer 720 may use a lookup service ( The discovery protocol does not successfully communicate with the 710 and cannot establish a connection with the lookup service 710.

FIG. 8 illustrates in detail a block and an execution process of an apparatus for executing the unicast discovery protocol according to the present invention of FIG. 7. Comparing the block of FIG. 8 with the block of FIG. 5, the name is slightly different. This is to change the name of some blocks to add a functional aspect for the actual implementation, the configuration of Figure 8 includes all of the configuration of FIG. The function of the receiving unit 530 of FIG. 5 is included in the unicast discovery processing unit 830 of FIG. 8, and the function of the checking unit 550 of FIG. 5 is included in the user matching unit 850 of FIG. 8. . In addition, the function of the confirmation receiving unit 570 of FIG. 5 is included in the registration proxy unit 880 of FIG. 8. The following description proceeds using only the reference numerals of FIG. 8 except for the reference numerals of FIGS. 4 and 5.

In the discoverer 800, the encryption unit 810 encrypts a user ID and a password using an encryption algorithm such as an AES algorithm, and transmits the Genie protocol version (generated by the version generator 808 through the transmission unit 820). defaut: 1) together with the lookup service 802.

The unicast discovery processor 830 of the lookup service host 802 receives the transmitted packets, checks whether the protocols match, and transmits the user ID and password to the decoder 840 of the security manager 806. The decryption unit 840 decrypts the user ID and password by using a reverse process of the encryption algorithm used in the encryption unit 810. For example, when AES is used as the encryption algorithm, the decoder 840 also uses the AES algorithm. If the encryption unit 810 uses a different encryption algorithm, the decryption unit 840 will also decrypt using another algorithm corresponding to the algorithm.

The user coincidence checker 850 compares the decrypted user ID and password with the data of the database 860 of the user / password list to check whether the user ID and password are usable. If the user is allowed to confirm the result, the registration proxy response unit 870 transmits the list of groups (620 and 630 of FIG. 6) to which the registration proxy and the lookup service 802 subscribe, to the discoverer 800. do. The transmitted data at this time consists of a socket of a TCP unicast message.

The database 860 may be implemented by a commercial database management program or a general database implementation program using a storage medium such as a hard disk.

Through the above process, the discovery protocol is executed in a state where security for an authenticated user is maintained.

The discovery proxy unit 880 of the discoverer communicates with the registration management unit 890 of the lookup service 802 using a remote method invocation (RMI) through a registration proxy that has been transmitted. At this time, the registration proxy unit 880 maintains communication with the registration management unit 890 based on the received information of the registration proxy 885.

The unicast discovery processing unit 830 and the registration proxy response unit 870 may be divided into the discovery management module 804 because they play a role in managing the discovery protocol.

The decryption unit 840 and the user coincidence unit 850 are only functionally separated and may be set as one functional block called the security management module 806 depending on the implementation.

In the related art, unencrypted user-related data transmitted to the unicast discovery processing unit 830 is directly transmitted to the registration proxy response unit 870 without undergoing a security process, and a response message is transmitted to the discoverer 800. Communication was established. As a result, it can be seen that there is no defense for security at all, and in the case of the embodiment of FIG. 8 according to the present invention, it can be seen that security is performed.

9 illustrates a packet format of a multicast request protocol according to the present invention, and FIG. 10 briefly illustrates a block and an execution process of an apparatus for executing the multicast discovery protocol according to the present invention.

As with the conventional multicast request protocol, the service or clients use this protocol to access adjacent lookup services using the IP multicast protocol when the first service or client starts. It is used in the TCP / IP protocol-based environment, and has the same structure as the conventional case in which the multicast UDP datagram and the TCP protocol are underneath.

Each part of the packet format is composed as follows.

Datagram packet:

port: Integer value indicating the TCP port number that the listener listens for for a response from the lookup service.

group n: Group name of the lookup services the discoverer wants to find (900).

service ID n: Service ID (910) of the lookup service already registered by the discoverer.

Registrar Proxy (620): A java.rmi.MarshalledObject with the Java object serialization that the discoverer receives from the lookup service for communication with the lookup service.

Header (930):

protocol version: An integer value indicating the version of the discovery protocol used, and is currently set to '1', and the value of the version is changeable as in the case of FIG.

Security (940): An ID and a password, which is a user identification code of a user who wants to use a service, are encrypted through a predetermined method.

Groups (950):

Group Length: An integer representing the number of groups.

-Group: Names of groups the lookup service is a member of. A string in UTF-8 format that represents the names of the groups to search for.

Although not included in FIG. 9, the following may be added to the packet format of FIG. 9.

Heard From:

The packet contains a list of lookup services that the discoverer has already responded to, and a lookup service that has received a multicast request does not need to respond if it is included in the Heard From.

Heard Length: An integer value indicating the number of heards.

-Heard: Genie service ID. Each ID is a 128-bit value that uniquely identifies a lookup service.)

The discoverer 1000 transmits a datagram packet as a request message through UDP multicast. The datagram packet includes the port number of the discoverer required for the lookup service to start unicast discovery, the group of lookup services that the discoverer wants to find (900), and the service ID (910) of the lookup service that the discoverer has already registered. It is composed of

The multicast request processing unit of the lookup service 1010 waits for a multicast request from the multicast group 224.0.1.85, port number 4160. When the multicast packet arrives, the discoverer checks whether the lookup service 1010 itself is included in the desired group and whether the service ID of the lookup service 1010 already exists in the service ID registered by the discoverer 1000. . If so, the lookup service will connect to the discoverer's unicast TCP socket. When the connection is made to the TCP socket of the discoverer, the discoverer 1000 establishes a TCP unicast connection with the lookup service 1010 in the order of performing the unicast discovery in FIG. 4, 7, or 8. .

Similarly, no response is made to the request of another discoverer 1020 that has sent a request message that has not been secured, so communication is impossible.

FIG. 11 illustrates in detail a block and an execution process of an apparatus for executing the multicast discovery protocol according to the present invention of FIG. 10. Since reference numerals 1108 to 1190 of FIG. 11 are functionally identical to those of reference numerals 808 to 890 of FIG. 8, respectively, a description overlapping with the contents of FIG. 8 will be omitted unless necessary.

The multicast request unit 1102 of the discoverer 1110 transmits the request message to the lookup service 1101 as a multicast UDP packet. The multicast request processing unit 1103 of the lookup service 1101 determines whether or not a TCP connection is established, and if a connection is possible, the connection is made through the connection generation unit 1104 and the connection maintaining unit 1105 of the discoverer. . The above procedures are identical to the existing multicast request protocol. When the TCP connection is established, the discoverer 1100 and the lookup service 1101 perform the discovery protocol through a method such as the unicast discovery protocol of FIG. 8.

Comparing FIG. 11 with FIG. 2, which is a process of a conventional protocol, in the related art, unencrypted user-related data transmitted to the unicast discovery processing unit 1130 is transferred directly to the registration proxy response unit 1170 without undergoing a security process. A response message was sent to the discoverer 1100 to communicate. As a result, it can be seen that there is no defense for security at all, and in the case of the protocol of the embodiment of FIG. 11 according to the present invention, security can be seen.

In addition, when a conventional discoverer without a security function applies for a service to a lookup service that uses the discovery protocol with a security function to which the present invention is applied, no response is given, in which case the discoverer is not authenticated. In this case, it is normal to not authenticate the lookup service. In addition, when the discoverer having the security function to which the present invention is applied is connected to a conventional Genie network without the security function, the lookup service of the Genie network will process the security packet as general data, so that the discovery is applied. The writer can receive the desired response from the lookup service. That is, the discovery or lookup service using the discovery protocol to which the present invention is applied maintains compatibility that can be used simultaneously with the discovery or lookup service using the conventional discovery protocol.

Java 2 security mechanisms can be used to limit the areas to which a group of services or applications can connect. For example, if a new Genie service is downloaded over the Internet, you can restrict access to certain groups if you can't trust the source of the service. When a service or other application attempts to create a LookupDiscovery object or change the set of groups to find a LookupDiscovery object, the code checks to see if the creator has permission to try each of the desired set of groups. LookupDiscovery throws a java.lang.SecurityException if you do not have the proper permissions.

However, those privileges should be set to be available to trusted programs. This is because applications allow you to find no groups. Therefore, the user must pass some form of the policy file so that the lookup service hosts themselves can perform discovery.

This mechanism can optionally be used to restrict the groups that an application wants to connect to. In order for a service to be able to access specific groups, the user must be able to create a policy file and pass it to the Java Virtual Machine through the java.security.policy property. . This policy file allows the user to allow or restrict access to applications that perform discovery, whether the service, client, or lookup service itself.

12 is a view illustrating security in a manager mode in a genie network according to the present invention, and illustrates a block and an execution operation of an administrator management device to which a security process is added according to the present invention.

In the conventional Genie network, new users can be added, modified, deleted, and retrieved by the Registrar Admin Proxy and the Admin Manager. In the configuration of FIG. 12 according to the present invention, only the administrator who is authorized by adding the Admin Admin (1265) to the function extension of the existing Registrar Admin Proxy and the Admin Manager (Administrative Manager) is new. You can add, edit, delete, and search users.

This method of accessing a lookup service host including information on resources and services available on the network through a client connected to the Genie network and performing management of the users who will use the network resources and services is as follows. Is executed.

The registration proxy unit 1220 of the client system 1200 receives a Registration Admin Admin Proxy from the registration proxy management unit 1210 of the lookup service host 1205. This means that you can start working on administration. The received registration admin proxy is sent to the registration admin proxy 1230.

The registration admin proxy unit 1230, which has received the registration admin proxy, connects to the lookup service 1205 according to the access of the administrator to execute a function such as adding, modifying, deleting, and inquiring information necessary for user or other management (client The administrator connects through the system 1200, and this connection function is performed through the registration admin proxy unit 1230). At this time, the administrator ID and password of the administrator encrypted through the encryption unit 1240 and the password transmission unit 1250 having the same functions as the encryption unit and the password transmission unit illustrated in FIG. 8 or 11 may be registered. It is transmitted to the administration manager 1260 of the lookup service 1205 through. At this time, the registration admin proxy unit 1230 packetizes and transmits the transmitted data.

The administrator security unit 1265 included in the administration manager 1260 separates the encrypted portion and transmits the encrypted portion to the decryption unit 1270 of the security management unit 1295.

The decryption unit 1270 decrypts the information on the manager using the method used for encryption in the encryption unit 1240. The decrypted administrator information is compared with the data of the database 1290 of the administrator's ID and password registered in advance in the user matching confirmation unit 1280 to receive administrator authentication. The decoding unit 1270, the user matching confirmation unit 1280, and the database unit 1290 have the same functions as the decoding unit, the user matching confirmation unit, and the database unit of FIG. 8 or 11, respectively.

If it is confirmed that the administrator is authorized, the administration manager 1260 transmits data including a message for allowing user management to the client 1200 to which the administrator is connected to continue communication to which the administrator is granted.

Authorized administrators can perform tasks such as adding, modifying, deleting, and retrieving users and managing the available resources connected to the Genie network.

At this time, it is possible to limit the scope of work that can be managed according to the administrator's recognition code. For example, an administrator recognition code for a new user registration and an administrator recognition code for updating or deleting information about a user are separately set in advance, and the user match confirmation unit 1280 checks the administrator recognition code for each user, and the administration manager In operation 1260, the registration admin proxy unit 1230 may include data representing the authority of the management task which can be performed by the administrator who is currently connected when the message granting the user management task is transmitted.

Through the above method, even in a Gini network without an administrator security function, security for the administrator can be executed while maintaining compatibility with the conventional technology.

Each of the functional blocks of FIGS. 5, 8, 11, and 12 may be implemented through a software method or a device such as a PLD or FPGA, or a device such as a ROM containing executable code of a program. A person having ordinary skill in the art to which the present invention pertains may easily know with reference to the specification of the Genie document.

And it can be easily understood by those skilled in the art that each of the above steps according to the present invention can be variously implemented in software or hardware using a general programming technique.

Some steps of the present invention may be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, CD-RW, magnetic tape, floppy disks, HDDs, optical disks, magneto-optical storage devices, and carrier wave (eg, Internet It also includes the implementation in the form of). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to the present invention, when a service and a client create and use a TCP socket to communicate with a lookup service using the Genie Discovery protocol, the TCP socket is used to transmit encrypted authentication information of the service or client to the lookup service. In addition, the lookup service decrypts the received encrypted authentication information and decides whether to send a response message to the service or the client to authenticate the user, thereby maintaining compatibility with the lookup service while maintaining compatibility with all services and clients using the discovery protocol in the Genie network. It can provide security for communicating discovery protocols. Therefore, the service or network resources can be used only by authorized users in transactions such as commerce through Genie network, thereby increasing the reliability of commerce using the network.

Claims (12)

Discovery that can access a lookup service host including information on resources and services available on the network through a client connected to the Genie network, obtain information about the resources and services, and perform user authentication. In the protocol, (a) generating a packet data by generating a version of a discovery protocol in the client and encrypting a user's identification code and password by a predetermined method; (b) transmitting information including the packet generated in step (a) to the lookup service host; (c) comparing the version of the discovery protocol included in the packet with its protocol version at the lookup service host receiving the information transmitted in step (b); (d) extracting the encrypted user identification code and password from the received information if the protocol versions are the same; (e) decrypting the encrypted information using the reverse procedure of any method used for encryption in step (a); (f) confirming the authorized user using the decrypted user's identification code and password; And (g) transmitting, by the lookup service host, information including a registration proxy and a list of groups of services to which the lookup service host is subscribed to a client that is confirmed to be an authorized user. Discovery protocol that enables user authentication on Genie networks. The method of claim 1, The discovery protocol of step (b) is user authentication in the Genie network, characterized in that using the TCP Unicast (TCP Unicast) socket. The method according to claim 1 or 2, In the step (b), the lookup service host is a discovery protocol capable of authenticating a user in a Genie network, characterized in that specified by the name and port number of the lookup service host. The method of claim 1, The discovery protocol of step (g) is user authentication in the Genie network, characterized in that using the TCP Unicast (TCP Unicast) socket. The method of claim 1, The method of claim 1, wherein the predetermined method of encryption of step (a) and decryption of step (e) includes an Advanced Encryption Standard (AES) algorithm. A discovery protocol execution apparatus capable of accessing a lookup service host having information on resources and services available in the network in a Genie network, and obtaining information on the resources and services and authenticating a user, A version generation unit generating a header including version information of the discovery protocol; An encryption unit for encrypting a user's identification code and password by a predetermined method; A transmission unit which transmits the header generated by the version generation unit and the information encrypted by the encryption unit; And Information on resources and services available by receiving information including a registration proxy of the lookup service transmitted after user authentication at the lookup service host and a group list of services to which the lookup service host is subscribed. The discovery protocol execution apparatus capable of user authentication in a Genie network, characterized in that it comprises a confirmation receiving unit for receiving and confirming that the user authentication. A lookup service host system that executes a discovery protocol for requesting information about resources and services available in the network from a client connected to a Genie network and for authenticating a user. A receiving unit for receiving data including the version of the protocol transmitted from the client and user authentication information encrypted by a predetermined method, and separating the header and the encrypted information; A decoding unit for decrypting the encrypted user identification code and password using a reverse process of a predetermined method used for the encryption if the version information of the header is equal to a predetermined value; A confirmation unit for confirming whether the user is an authorized user by comparing the decrypted user identification code and password with information of a pre-registered user; And User authentication in the Genie network, characterized in that it comprises a registration proxy response unit for transmitting to the client is confirmed to be an authorized user (registrar proxy) and information including a list of groups of services to which the lookup service host is subscribed. Lookup service host system running a discovery protocol. Discovery that can access a lookup service host containing information on resources and services available on the network through a client connected to the Genie network to obtain information about the resources and services and authenticate users In the data structure transmitted through the protocol, A header indicating the protocol version; Secure data in which a user's identification code and password are encrypted by a predetermined method; A registration proxy that is an object for communicating with the lookup service after the client performs a discovery protocol; And a group list data of a service to which the lookup service host is subscribed. The data structure transmitted through a discovery protocol capable of user authentication in a Genie network. Discovery that can access a lookup service host containing information on resources and services available on the network through a client connected to the Genie network to obtain information about the resources and services and authenticate users In a computer-readable recording medium recording a protocol, (a) generating a packet data by generating a version of a discovery protocol in the client and encrypting a user's identification code and password by a predetermined method; (b) transmitting information including the packet generated in step (a) to the lookup service host; (c) receiving the information transmitted in step (b) and comparing the version of the discovery protocol included in the packet with its protocol version; (d) extracting the encrypted user identification code and password from the received information if the protocol versions are the same; (e) decrypting the encrypted information using the reverse procedure of any method used for encryption in step (a); (f) confirming the authorized user using the decrypted user's identification code and password; And (g) transmitting user information including a registration proxy and a list of groups of services to which the lookup service host is subscribed to, the client identified as an authorized user. A computer-readable recording medium having recorded thereon a program for executing this possible discovery protocol on a computer. A user authentication method in a discovery protocol for accessing a lookup service host including information on resources and services available in the network through a client connected to a Genie network, for obtaining information about the resources and services. (a) encrypting a user's identification code and password in a predetermined method at the client; (b) transmitting information including the encrypted user identification code and a password to the lookup service host; (c) decrypting the encrypted information at the lookup service host that has received the information transmitted in step (b) using a reverse procedure of the predetermined method of step (a); (d) confirming whether the user is authorized to use the service using the decrypted user's identification code and password; And (e) transmitting information including data indicating that the client is authorized to be authorized to be an authorized user, the information including discovery data. Secure the management of the users connected to the network resources and services and the resources connected to the network by accessing the lookup service host including information on the resources and services available on the network through a client connected to the Genie network. In how to run (a) receiving, by the client, a registrar admin proxy including administration information for user management from the lookup service; (b) generating packet data by encrypting a manager's identification code and password in a predetermined method in the client; (c) transmitting data including the packet generated in step (b) to the lookup service host; (d) extracting the encrypted administrator identification code and password from a received data at a lookup service host; (e) decrypting the encrypted information using the reverse procedure of any method used for encryption in step (b); (f) confirming whether the administrator is an authorized administrator using the decrypted user's identification code and password; And (g) if it is confirmed that the administrator is authorized, transmitting data including a message allowing the administrator to manage the user to the client, and continuing the communication in the state where the administrator authority is granted. Administrator authentication method. The method of claim 11, Recognition code of step (b) may vary depending on the scope of the administrator's work rights, The data transmitted in the step (g) includes the scope of the administrator's work rights, administrator authentication method in the genie network.