KR101059058B1 - Apparatus, method and system for service access control based on user location - Google Patents

Abstract

PURPOSE: A service access control device based on the location, a method thereof, and system thereof are provided to control usage authority and access authority about a service which is provided by a SaaS(Software as a Service) technology. CONSTITUTION: A communication unit(210) receives a service request message transmitted to a service server, which provides a multi-tenant service, from user. A confirmation device(220) confirms a tenant in which a user belongs from the service request message received by the communications unit. A determining unit(230) determines whether the user is able to access to the service or not based on the location of the user and the checked tenant. If it is determined as the user is accessible to the service, the service request message is forwarded to the service server by the communication unit.

Description

Apparatus, Method and System for Service Access Control based on User Location}

The present invention relates to a location-based service access control device, method and system, and more particularly, to a location-based service access control device, method and system that can control the authority to access the service according to the user's location. It is about.

It is a type of service that accesses and uses a provider's system that exists outside of SaaS (Software as a Service), so it can be accessed anytime, anywhere from various areas within a company as well as outside the company. Therefore, the necessity of security because it is vulnerable to the leakage of information is continuously discussed.

Therefore, an object of the present invention for solving the above problems, by controlling the access rights and usage rights for the services provided by SaaS technology, it is possible to fundamentally block the leakage of information in the organization, and to ensure the reliability of the service There is provided a location-based service access control apparatus, method and system.

Location-based service access control apparatus according to an embodiment of the present invention includes a communication unit for receiving a service request message transmitted from the user to the service server for providing a multi-tenant service; A confirmation unit for confirming a tenant to which the user belongs from a service request message received by the communication unit; And a determining unit determining whether the user can access the service based on the location of the user and the identified tenant. It may include.

If it is determined that the user is accessible to the service, the service request message may be forwarded by the communication unit to the service server.

The location of the user is mapped to the identification of the user and the tenant to which the user belongs and is stored in a database in real time, and the determination unit may use the location of the user stored in the database.

The confirmation unit may further confirm the ID of the user from the service request message, and the determination unit may determine a location mapped to the ID of the user in the database as the location of the user.

The determination unit may determine whether the user is accessible to the service with reference to a security policy set on a tenant and location basis.

The determining unit compares the location of the user with a security policy set based on the tenant and location, and, if the user location belongs to a location where the service set in the security policy is provided, the user It may be determined that the service is accessible.

The security policy includes a policy of whether a user existing at a specific location allows or blocks access to the service server, and a policy of restricting the user's access to a specific resource of a service provided by the service server. It may include at least one of the policies.

The security policy may be set based on the logical location of the user.

The apparatus for controlling location-based service access according to an embodiment of the present invention disallows forwarding of the service request message when the user determines that the service is inaccessible to the service by the determining unit. The control unit for controlling the communication unit to transmit a message indicating that the access of the user can be further included.

According to an embodiment of the present invention, a method of controlling service access based on a location may include receiving a service request message transmitted from a user to a service server providing a multi-tenant service; Confirming a tenant to which the user belongs from the received service request message; Determining whether the user is accessible to the service based on the location of the user and the identified tenant; It may include.

The method for controlling service access based on a location according to an embodiment of the present invention may further include forwarding the service request message to the service server when the user is determined to be accessible to the service. .

The location of the user is mapped to the identification (identification) of the user and the tenant to which the user belongs; and storing in real time in a database; wherein the determining step may use the location of the user stored in the database have.

The checking may further include checking the ID of the user from the service request message, and determining the location of the user as a location mapped to the ID of the user in the database. Can be.

The determining may determine whether the user has access to the service with reference to a security policy set on a tenant and location basis.

The determining may include comparing a location of the user with a security policy set based on the tenant and location; And as a result of the comparison, determining that the use is accessible to the service if the user location belongs to a location where the service is set in the security policy.

The security policy may include at least one of a policy regarding whether to allow or block a user's access to a service existing at a specific location, and a policy regarding whether to restrict the user's access to a specific resource of a service provided by the service server. It may include a policy.

The security policy may be set based on the logical location of the user.

Method for controlling service access based on location according to an embodiment of the present invention, if the user is determined to be inaccessible to the service, disabling forwarding of the service request message; And transmitting a message informing that the user cannot access the service.

A system for controlling service access based on a location according to an embodiment of the present invention includes a service server for providing a multi-tenant service; A location tracking module for tracking a location of a user and updating the database; And a service access control device for determining whether to forward the service request message of the user to the service server based on a tenant to which the user belongs and the location of the user.

The service access control device may forward the service request message to the service server when it is determined that the user can access the service requested by the service request message.

The service access control device compares the security policy set on the tenant basis with the location of the user, and if the user location belongs to a location where the service set in the security policy is provided, the user It may be determined that the service is accessible.

If the user determines that the user is inaccessible to the service, the service access control device disallows forwarding of the service request message and provides the user with a message informing that the user cannot access the service. Can be.

According to an embodiment of the present invention, since location information and security policy are managed differently for each tenant, internal security may be further strengthened. This provides an environment in which multitenants can apply services based on SaaS.

In addition, according to an embodiment of the present invention, a location-based security policy can be applied to each tenant without modifying existing application logic for each tenant, and a single-instance service is possible.

In addition, according to an embodiment of the present invention, a function related to security can be realized without installing a program for location tracking in a device in order to provide a service based on location tracking.

In addition, according to an embodiment of the present invention, since a service request is transmitted to a service server such as a web server only after a location-based security audit is performed in the service access control device, services made of a web or C / S (client / server) model. You can control by URL.

In addition, according to an embodiment of the present invention, since the Saas service provided in the cloud environment as a base model, the model can be applied without requiring modification of existing application code. That is, by adding only the service access control device, it is possible to service multiple tenants with one application code without modifying other components or applications.

1 is a diagram illustrating a web service system for controlling service access based on a location according to an embodiment of the present invention.
2 is a block diagram illustrating a service access control apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a method of controlling service access based on a location according to an embodiment of the present invention.

Objects, other objects, features and advantages of the present invention will be readily understood through the following preferred embodiments associated with the accompanying drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this specification, when an element is referred to as being on another element, it may be directly formed on another element, or a third element may be interposed therebetween.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the words 'comprises' and / or 'comprising' do not exclude the presence or addition of one or more other components.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In describing the specific embodiments below, various specific details are set forth in order to explain the invention more specifically and to help understand. However, one of ordinary skill in the art can understand that the present invention can be used without these various specific details. In some cases, it is mentioned in advance that parts of the invention which are commonly known in the description of the invention and which are not highly related to the invention are not described in order to prevent confusion in explaining the invention without cause.

1 is a diagram illustrating a web service system for controlling service access based on a location according to an embodiment of the present invention.

Referring to FIG. 1, the web service system includes a first tenant T1, a second tenant T2, a network 30, a location tracking device 100, a location database (DB) 110, The security policy DB 120 may include a service access control device 200 and a service server 300.

The web service system of FIG. 1 may provide a service as a SaaS (Software as a Service) method to a multi-tenant, and has, for example, a web server-WAS-DB structure. In particular, the web service system according to the embodiment of the present invention adds a DB 110 that manages the location information of each tenant T1 and T2 and a DB 120 that is responsible for the security policy of each tenant, and each DB ( Based on the information recorded in the 110 and 120 and the location of the user of each of the tenants T1 and T2, the access authority to the service requested by the user may be controlled.

That is, the service requested by the user may be controlled according to a predetermined tenant security policy and the current location of the user. The user terminal (eg, 11) may access the service requested by the user to use the service, block access to the service, or restrict the partial use of the service according to the user's location and security policy. .

In the present specification, "user" means i) "user" or ii) "user terminal" and "user", and the term "user" means i) and ii). Except where there is no need to distinguish in particular, it can be interpreted to fit the corresponding embodiment.

The SaaS method has a service concept of making only the services required by the user available among the services provided by various software. In the SaaS scheme, a service provider, that is, the service server 300 may provide a software service to a plurality of tenants using one or more platforms, and each tenant may pay a fee corresponding to the service used.

Multi-Tenancy refers to the sharing of services among multiple tenants based on virtualization technology and the same infrastructure in a computing environment. Multi-Tenant refers to a plurality of tenants, and one tenant is a group using a service, for example, one enterprise. Therefore, one tenant includes a plurality of users. For convenience of description, the first tenant T1 and the second tenant T2 are illustrated in FIG. 1, but are not limited thereto. The first tenant T1 includes users who use a personal computer (11) and portable terminals 12 and 13, and the second tenant T2 connects the laptop computer 21 and the portable terminal 22 to each other. Includes users you use.

The network 30 supports wired or wireless communication between devices located in a network system.

The location tracking apparatus 100 may track the locations of the user terminals 11 to 13, 21, and 22 used by the users of the first tenant T1 and the second tenant T2. The location tracking device 100 may be implemented as a module and provided in the service access control device 200. The location tracking device 100 may track and collect a location through various methods such as radio frequency identification (RFID), wireless fidelity (Wi-Fi), and global positioning system (GPS).

The location tracking apparatus 100 may store information about the location of each tracked user terminal 11 to 13, 21, and 22 in the location DB 110. The location tracking apparatus 100 may map information about the tracked location to an ID of an user and an ID of a tenant to which the user belongs and store the location information in the location DB 110.

The location tracking device 100 tracks the positions of each of the user terminals 11 to 13, 21, and 22 periodically or aperiodically. If the positions of the user terminals 11 to 13, 21, and 22 are changed, the changed position is determined. Information about can be updated in the location DB (110). As a result, the positions of the user terminals 11 to 13, 21, and 22, that is, the positions of the first tenant T1 and the second tenant T2 may be managed in real time. Such location tracking and management may be irrelevant to services provided by the service server 300 and may be performed by separate operations.

In addition, the location tracking apparatus 100 may change the tracked location to a logical location set by the tenant administrator. The physical location is coordinate information measuring the location of the user terminal (eg, 11), and the logical location may be a logical space divided according to the purpose or purpose of the place. To this end, the location tracking device 100 may have information in which physical locations and logical locations are mapped to each other. Examples of logical locations include offices, meeting rooms, lounges, lobbies, homes, and so on. The tenant manager may be a manager of each of the first tenant T1 and the second tenant T2.

The location DB 110 may map and store information about the location tracked by the location tracking apparatus 100 to an ID of a user and an ID of a tenant to which the user belongs. The ID of the user may be an ID of users using the user terminals 11 to 13, 21, and 22, and the ID of the tenant may be an ID of the first tenant T1 and the second tenant T2. Table 1 shows an example of information on the location stored in the location DB (110).

Tenant ID User ID (user terminal) Logical location TNT1 aa (11) Company office bb (12) Company lobby cc (13) Company break room TNT2 dd (21) Not traceable ee (22) Company conference room

 Referring to [Table 1], since the location DB 110 is used on a system supporting multi-tenant, the location DB 110 stores and manages location information of users of the first tenant T1 and the second tenant T2. In Table 1, the user whose user ID is aa is using the user terminal 11, and the most recently tracked location is the company office. TNT1 is the ID of the first tenant T1, and TNT2 is the ID of the second tenant T2.

As described above, the actual physical location of the user is changed and stored in a logical location set by the tenant manager or the manager of the service server 300, and the stored logical location is controlled by the service access control apparatus 200 to control the authority of the service. Used.

The security policy DB 120 may map and store service access rights allocated to each of the first tenant T1 and the second tenant T2 by location. The tenant administrator may set the service access authority of each tenant based on the location in the security policy DB 120. Service access authority means security policy. The security policy may include, for example, a policy regarding whether to allow or block service access of a user existing at a specific location. Table 2 shows an example of the security policy stored in the security policy DB (120).

Tenant ID Accessible logical location Security Policy (Service Access Rights) TNT1 Company office read Company lobby writing Company break room None TNT2 Company conference room copy Company office read

Referring to [Table 2], the security policy DB 120 stores a security policy set for each location and tenant. A user belonging to the first tenant T1 can only read a service in the company office, and access to the service is blocked in the company break room. When the user requests the use of the service, the service access control apparatus 200 determines whether the service is available according to the tenant-specific security policy recorded in the security policy DB 120.

The service access control apparatus 200 may determine whether to forward the service request message transmitted from the user terminal 11 to the service server 300 based on the tenant to which the user of the user terminal 11 belongs and the location of the user. That is, the service access control apparatus 200 may filter the service request message based on the tenant to which the user belongs and the location of the user, and forward or not forward the service request message to the service server 300.

The service server 300 is a server capable of providing a SaaS service and also providing a multi-tenancy service. The service server 300 may include a web server, a web application server (WAS), and a database. When the service request message is forwarded from the service access control device 200, the service server 300 provides a corresponding service to the user terminal 11 that has transmitted the service request message.

2 is a block diagram illustrating a service access control apparatus 200 according to an embodiment of the present invention.

Referring to FIG. 2, the service access control apparatus 200 may include a communication unit 210, a confirmation unit 220, a determination unit 230, and a control unit 240.

The communication unit 210 may communicate with a plurality of user terminals 11 to 13, 21, and 22, the location tracking device 100, and the service server 300 through the network 30. The communication unit 210 may receive a service request message for requesting the provision of a service from one of the plurality of user terminals 11 to 13, 21, and 22, for example, the user terminal 11. In addition, the communication unit 210 may forward the service request message to the service server 300 under the control of the control unit 240 or block reception of the service request message.

In the present embodiment, it has been described that the communication unit 210 may perform both an operation of receiving a service request message and an operation of forwarding a service request message to the service server 300, but this is exemplary. For example, it may be possible to separately configure a communication unit performing an operation of receiving a service request message and a communication unit performing an operation of forwarding a service request message.

The identification unit 220 may monitor the service request message of the user terminal 11 to be forwarded to the service server 300, and may confirm the tenant to which the user of the user terminal 11 belongs and the ID of the user. This is because the service request message includes service contract information, an ID of a user, and an ID of a tenant. Hereinafter, the first tenant T1 will be described as an example of the tenant to which the user of the user terminal 11 belongs. The first tenant T1 to which the user of the user terminal 11 belongs may be known by the ID of the tenant included in the service request message.

The determination unit 230 may determine whether the user terminal 11 is accessible to the service based on the location of the user and the tenant confirmed by the identification unit 220. Specifically, the determination unit 230 may determine the updated location mapped to the user's ID from the location DB 110 and determine the location of the user. For example, if the ID of the user included in the service request message is 'aa', the determination unit 230 may determine a location mapped to 'aa' in the location DB 110 as the location of the user.

When the location of the user is confirmed, the determination unit 230 may determine whether the user terminal 11 can access the service by referring to the security policy set for each location in the first tenant T1 of the security policy DB 120. . In detail, the determination unit 230 compares the identified user's location with the security policy set for each location in the first tenant T1. As a result of the comparison, if the location of the user belongs to a location that can receive the service set in the security policy, the determination unit 230 may determine that the user terminal 11 is accessible to the service. For example, if the location of the user identified in the location DB 110 is the company office and the company office is located at the location set in the first tenant T1, the determination unit 230 accesses the service by the user terminal 11. It can be determined as possible.

The controller 240 may control the communicator 210 to forward the service request message to the service server 300 when the determination unit 230 determines that the user terminal 11 is accessible to the service.

In addition, if it is determined by the decision unit 230 that the user terminal 11 is inaccessible to the service, the controller 240 may disable forwarding of the service request message. In addition, the controller 240 may compose a message indicating that access to the service is not possible, and then control the communicator 210 to transmit the created message to the user terminal 11.

In the above-described embodiment, the communication unit 210, the confirmation unit 220, the determination unit 230, and the control unit 240 have been described as performing one or more functions, respectively. However, as described above, other components may be configured in the same manner as it is possible to configure the communication unit 210 separately from the communication unit performing the operation of receiving the service request message and the communication unit performing the operation of forwarding the service request message. You should know that it can be configured as.

3 is a flowchart illustrating a method of controlling service access based on a location according to an embodiment of the present invention.

Each step of FIG. 3 may be implemented by the web service system described with reference to FIGS. 1 and 2.

The location tracking apparatus 100 may track and collect the locations of the user terminals 11 to 13, 21, and 22 used by the users of the first tenant T1 and the second tenant T2 (S310).

The location tracking device 100 maps the information about the location of each tracked user terminal 11 to 13, 21, 22 to the ID of the user and the ID of the first tenant T1 to which the user belongs to the location DB 110. Can be stored in (S320). In operation S320, the location tracking apparatus 100 may change the tracked location into a logical location set by the tenant administrator and store the location in the location DB 110.

The user terminal 11 may transmit a service request message for requesting the provision of a service to the service server 300 by a user's command (S330).

The service access control apparatus 200 may delay the forwarding of the service request message transmitted from the user terminal 11, and determine whether the service access is possible before forwarding the service request message to the service server 300.

To this end, the service access control apparatus 200 may monitor the service request message of the user terminal 11 and check the ID of the first tenant T1 to which the user of the user terminal 11 belongs and the ID of the user ( S340).

In addition, the service access control apparatus 200 may check the stored location mapped to the ID of the user from the location DB 110 and determine the checked location as the current location of the user (S350).

When the location of the user is confirmed, the service access control apparatus 200 may check the security policy for each location of the first tenant T1 stored in the security policy DB 120 (S360).

The service access control apparatus 200 may compare the location of the user identified in operation S350 with the security policy identified in operation S360, and determine whether the user terminal 11 is accessible to the service based on the comparison result in operation S370. .

If the location of the user does not belong to a location capable of receiving the service set in the security policy, the service access control apparatus 200 may determine that the user terminal 11 is inaccessible to the service.

Therefore, the service access control apparatus 200 may disable the forwarding of the service request message, create a message notifying that the service cannot be used, and then transmit the created message to the user terminal 11 (S380). .

In contrast, in operation S370, when the location of the user belongs to a location where the service set in the security policy is provided, the service access control apparatus 200 may determine that the user terminal 11 is accessible to the service.

Accordingly, the service access control apparatus 200 may forward the service request message to the service server 300 (S390).

The service server 300 may provide a service available to the user terminal 11 (S395).

According to the above-described embodiment of the present invention, the administrator of each tenant may establish a security policy based on the location of each tenant using the service, and control the service access authority according to the security policy and the location of the user belonging to the tenant. . In this way, by controlling the use of the service according to the location it is possible to minimize the occurrence of problems such as information leakage. In particular, by restricting specific services that are sensitive to security, the security of the service itself can be enhanced, and the security of data used for the service can be enhanced. In addition, for enhanced security, it can be easily applied to general web service or SaaS service without directly modifying the logic or code of the application.

In addition, according to the above-described embodiment of the present invention, the service request of the user is monitored in the location-based service access control device before being forwarded to the service server. The service access control device may determine whether to permit the service request based on the user information and tenant information included in the service request message and the current location of the user. At this time, the service request message does not include the location information of the user, the location information of the user is collected independently of the service request. When the service request message is received, the collected location information of the user may be loaded into the service access control device and used to determine whether the user can access the service.

Meanwhile, according to another embodiment of the present invention, the security policy DB may store a 'policy on whether to restrict access of a user terminal to a specific resource of a service'. In addition, the service access control apparatus knows information about services requested by the user terminal and resources required to use the service. If the stored policy determines that the user terminal is accessible to a specific resource based on the location of the user's location (i.e., user terminal), the service access control device requests the service server to access the user terminal to the required specific resource. Can be. The particular resource may be a virtual resource, for example.

Methods according to an embodiment of the present invention can be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

T1: first tenant T2: second tenant
30: network 100: location tracking device
110: Location Database 120: Security Policy Database
200: service access control device 300: service server

Claims (22)

A communication unit receiving a service request message transmitted from a user to a service server providing a multi-tenant service;
A confirmation unit for confirming a tenant to which the user belongs from a service request message received by the communication unit; And
A determining unit determining whether the user can access the service based on the location of the user and the identified tenant; Location-based service access control device comprising a. The method of claim 1,
And if the user is determined to be accessible to the service, the service request message is forwarded to the service server by the communication unit. The method of claim 2,
The location of the user is mapped to the identification of the user and the tenant to which the user belongs and is stored in real time in a database.
And the determining unit uses the location of the user stored in the database. The method of claim 3,
The confirmation unit further confirms the ID of the user from the service request message,
The determining unit, the location-based service access control device, characterized in that for determining the location stored in the database mapped to the user ID of the user. The method according to claim 1 or 2,
And the determining unit determines whether the user can access the service by referring to a security policy set based on tenants and locations. The method of claim 5,
The determination unit,
Compare the location of the user with the security policy set based on the tenant and location, and, as a result of the comparison, if the user location belongs to a location where the service set in the security policy is provided, the user accesses the service. Location-based service access control device, characterized in that determined to be possible. The method of claim 5,
The security policy is,
At least one policy of whether a user existing at a specific location allows or blocks access to the service server, and a policy of restricting access of the user to a specific resource of a service provided by the service server; Location-based service access control device comprising a. The method of claim 5,
And the security policy is set based on the logical location of the user. The method of claim 1,
If it is determined by the determining unit that the user is inaccessible to the service,
And a controller for disabling forwarding of the service request message and controlling the communication unit to transmit a message indicating that access to the service server is not possible to the user. Access control device. Receiving a service request message transmitted from a user to a service server providing a multi-tenant service;
Confirming a tenant to which the user belongs from the received service request message; And
Determining whether the user is accessible to the service based on the location of the user and the identified tenant; Including, the method of controlling service access based on the location. The method of claim 10,
If it is determined that the user is accessible to the service, the service request message is forwarded to the service server. The method of claim 10,
The location of the user is mapped to the identification (identification) of the user and the tenant to which the user belongs; and storing in real time in a database;
The determining step uses a location of a user stored in the database. The method of claim 12,
The checking may further confirm an ID of the user from the service request message.
The determining step,
Determining a location stored in the database mapped to the user's ID as the user's location. The method according to claim 10 or 11, wherein
The determining may include determining whether the user is accessible to the service by referring to a security policy set on a tenant and location basis. The method of claim 14,
The determining step,
Comparing the location of the user with a security policy set based on the tenant and location; And
And determining that the use is accessible to the service if the user location belongs to a location where the service set in the security policy can be provided. How to control access. The method of claim 14,
The security policy is,
A policy of whether to allow or block a user's access to a service existing at a specific location; and a policy of whether to restrict access of the user to a specific resource of a service provided by the service server. Characterized in that a method of controlling service access based on location. The method of claim 14,
Wherein the security policy is set based on a logical location of the user. The method of claim 10,
Disabling forwarding of the service request message if the user is determined to be inaccessible to the service; And
And transmitting a message indicating that access to the service is not available to the user. A service server for providing a multi-tenant service;
A location tracking module for tracking a location of a user and updating the database; And
And a service access control device for determining whether to forward the service request message of the user to the service server based on the tenant to which the user belongs and the location of the user. System. The method of claim 19,
The service access control device, if it is determined that the service requested by the user in the service request message is accessible, characterized in that for forwarding the service request message to the service server, to control the service access based on the location System. The method of claim 20,
The service access control device,
The security policy set on the tenant basis is compared with the location of the user, and as a result of the comparison, the user is determined to be accessible to the service if the user location belongs to a location where the service is set in the security policy. System for controlling service access based on location. The method of claim 19,
The service access control device, if it is determined that the user is inaccessible to the service, disallows forwarding of the service request message, and provides a message for notifying the user that access to the service is impossible. System for controlling service access based on location.

Images