KR102035396B1 - An authenticating apparatus and an authenticating method applying open id idp for identifying user to fido uaf for enhancing security authentication of sdn - Google Patents

Abstract

According to an embodiment, the authentication system may authenticate and identify a user based on biometric information and a global identifier to enhance authentication security of the SDN structure. Therefore, the authentication system can identify a plurality of users registered in the terminal. Furthermore, when an unregistered user intends to register with the terminal, the terminal may enhance the security of the terminal by blocking registration of an unregistered user without permission of the main user of the terminal.

Description

Authentication method and authentication device applying Open ID IDP to identify users to FIDO UAF to strengthen security authentication of SDN SDN}

The present invention relates to an apparatus and method for authenticating a user.

Fast Identity Online (FIDO) is an alliance to establish international standards for providing online authentication services that take advantage of the uniqueness of biometric information. FIDO's biometric authentication protocol is called Universal Authentication Framework (UAF). Since the authentication process is performed by checking biometric information at the user terminal, the FIDO biometric authentication protocol can prevent leakage of personal information.

The present invention proposes an apparatus and method for authenticating a user using a global identifier and biometric information.

 According to an embodiment, in an authentication method performed in a terminal, requesting an authentication server connected to the terminal to provide a service to be used by a user of the terminal, and receiving challenge data corresponding to the request from the authentication server. When receiving, obtaining biometric information from the user, generating response data to be transmitted to the authentication server based on the obtained biometric information, and authenticating the user for the service generated by the authentication server. And transmitting the response data to the authentication server to obtain session information, wherein the response data includes a global identifier used to authenticate the user using redirection at the authentication server. Is provided.

According to one embodiment, the response data, the global identifier, the authentication method including a Uniform Resource Identifier (URI) containing the address of the identifier providing service to be redirected by the authentication server is provided.

According to an embodiment, the generating may include generating the response data based on the private key corresponding to the user and the challenge data when the obtained biometric information matches the pre-stored biometric information of the user. An authentication method is provided.

According to an embodiment, in an authentication method performed in an authentication server, receiving a request for a service provided by the authentication server from a terminal connected to the authentication server, in response to the received request, the terminal is challenged. Transmitting data, when receiving response data corresponding to the challenge data from the terminal, determining whether the response data is generated based on the biometric information of the user, and wherein the response data includes the biometric information of the user. And generating the user based on a global identifier included in the response data, and transmitting session information about the service to the terminal based on the identified user. This is provided.

According to one embodiment, the step of identifying, based on the global identifier included in the response data, authentication to identify the user by redirecting to an identifier providing service that generates a global identifier using the biometric information of the user A method is provided.

According to an embodiment of the present disclosure, the determining may include determining whether the response data is generated based on the biometric information of the user using a public key corresponding to the user of the terminal. An authentication method generated based on previously obtained biometric information is provided.

According to an embodiment, the user may be authenticated using the global identifier and the biometric information.

FIG. 1 is a diagram conceptually illustrating an authentication system in a software defined network (SDN) according to an embodiment.
2 is a flowchart illustrating an operation of authenticating a user in an authentication system, according to an exemplary embodiment.
3 is a flowchart illustrating an operation performed when registering a plurality of users in a terminal of an authentication system according to an embodiment.

Specific structural or functional descriptions of the embodiments according to the inventive concept disclosed herein are merely illustrated for the purpose of describing the embodiments according to the inventive concept, and the embodiments according to the inventive concept. These may be embodied in various forms and are not limited to the embodiments described herein.

Embodiments according to the inventive concept may be variously modified and have various forms, so embodiments are illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments in accordance with the concept of the present invention to specific embodiments, and includes modifications, equivalents, or substitutes included in the spirit and scope of the present invention.

Terms such as first or second may be used to describe various components, but the components should not be limited by the terms. The terms are only for the purpose of distinguishing one component from another component, for example, without departing from the scope of the rights according to the inventive concept, the first component may be called a second component, Similarly, the second component may also be referred to as the first component.

When a component is said to be “connected” or “connected” to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in the middle. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between. Expressions that describe the relationship between components, such as "between" and "immediately between," or "directly neighboring to," should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, the terms “comprise” or “have” are intended to designate that the stated feature, number, step, operation, component, part, or combination thereof exists, but includes one or more other features or numbers, It is to be understood that it does not exclude in advance the possibility of the presence or addition of steps, actions, components, parts or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined herein. Do not.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference numerals in the drawings denote like elements.

FIG. 1 is a diagram conceptually illustrating an authentication system in a software defined network (SDN) according to an embodiment.

The authentication system can identify the user using an extended FIDO UAF authentication scheme. Alternatively, the authentication system may identify the user by using the U2F for performing two-step authentication through additional elements. The biometric information of the user is unique information given to the user from the birth of the user. The authentication system may be connected with an application service utilizing SDN such as public service and financial service, and may provide a function of authenticating the user so that the application service provides a personalized service for the user.

Referring to FIG. 1, the authentication system may utilize biometric information (eg, fingerprint, iris, vein, face, etc.) obtained from the user to authenticate the user. More specifically, the terminal 110 of the authentication system may include a sensor for obtaining biometric information, and may identify a user based on biometric information obtained from the sensor. That is, an operation of identifying a user using biometric information may be performed locally (for example, at the terminal 110. The authentication system according to an embodiment may include a global identifier that may individually identify a user in the UAF). By combining a global identifier, it is possible to prevent a malicious user from registering the stolen terminal 110, abuse of the stolen terminal 110.

More specifically, the authentication system according to an embodiment may generate and manage a global identifier for identifying a user by using an Open ID. Open ID is an authentication service standard that allows multiple network services to be used without a subscription by integrating account information managed by different network services into one. Referring to FIG. 1, there is shown an Identity Provider (IDP) 130 that generates a global identifier for a user. The IDP 130 may provide a global identifier in a Uniform Resource Locator (URL) or Uniform Resource Identifier (URI) format. Since the global identifier of the URI format can be used like an Internet address, a user can access each of the plurality of network services 120 without subscribing to each of the plurality of network services 120 associated with the IDP 130.

The process of authenticating and identifying a user by the authentication system can be largely divided into (1) registration of a user and (2) authentication of a user. When registering a user, the terminal 110 may obtain biometric information of the user. The obtained biometric information of the user may be used to generate a private key and a public key by an authenticator running in the terminal 110. A client application (FIDO client) requesting authentication of an authenticator and a user in the terminal 110 may be connected through an interface such as an authenticator specific module (ASM). The private key may be stored in the terminal 110, and the public key may be stored in the IDP 130, the Relying Party (RP), or the authentication server. The RP may provide network services to the user.

The IDP 130, the Relying Party (RP), or the authentication server storing the public key may store the public key and then generate a global identifier corresponding to the user. The generated global identifier can be utilized to identify the user. The global identifier may be provided to the terminal 110 or to a user of the terminal 110. The global identifier may be generated based on the URI format.

When authenticating a user, the terminal 110 and the IDP 130 may identify the user by using the biometric information of the user. When the user is identified by the communication between the terminal 110 and the IDP 130, a global identifier corresponding to the identified user may be generated. The global identifier may be generated based on the public key stored in IDP 130. Since the global identifier is generated based on the public key unique to the user, it can be utilized to identify the user. The generated global identifier may be utilized as a single sign on (SSO) that may be utilized in the IDP 130 as well as other network services 120. The global identifier may be used to identify a user by using an Open ID, Security Assertion Markup Language (SAML), or the like.

2 is a flowchart illustrating an operation of authenticating a user in an authentication system, according to an exemplary embodiment.

Referring to FIG. 2, when a user intends to use a network service, the terminal 210 may request an authentication server to provide a network service that the user of the terminal 210 intends to use. When the terminal 210 and the authentication server communicate, security can be maintained using TLS (Transport Layer Security). The biometric information authentication service 220 of the authentication server may request the terminal 210 to perform authentication based on the biometric information of the user in response to the user's request. The biometric information authentication service 220 may transmit the challenge data used to generate the authentication result based on the biometric information, the policy data related to the policy for authenticating the biometric information, and the authenticator information to the terminal 210.

Upon receiving the challenge data, the policy data, and the authenticator information, the terminal 210 may obtain biometric information of the user. Using the policy data or the authenticator information, the terminal 210 may identify the type of biometric information to be obtained from the user. The user may input biometric information (fingerprint, iris, vein, vocal tract, face, etc.) through the sensor of the terminal 210.

The terminal 210 may access an area (eg, a secure area of the memory or an encrypted storage) in which the private key is stored in the terminal 210 using the acquired biometric information of the user. The terminal 210 may acquire a private key corresponding to the biometric information in the area. Based on the obtained private key, the terminal 210 may perform an electronic signature on the challenge data. The terminal 210 may generate response data including the result data of the electronic signature and the global identifier received from the authentication server in the process of registering the user. The generated response data may be transmitted to the biometric information authentication service 220 of the authentication server.

Upon receiving the response data, the biometric information authentication service 220 may determine whether the result data included in the response data is generated using the private key. In detail, the biometric information authentication service 220 may verify the response data using the public key of the user stored in the authentication server in the process of registering the user. In addition, the biometric information authentication service 220 may redirect to the IDP service 230 of the authentication server by using the global identifier included in the received response data.

In the process of registering a user, the IDP service 230 may generate a global identifier of the user in the format of a URL or a URI. The IDP service 230 may identify the user of the terminal 210 using the global identifier. The IDP service 230 may transmit a result of identifying the user to the biometric information authentication service 220. The IDP service 230 determines the validity of the received global identifier based on (1) whether the parameter of the global identifier matches the URI of the instance and (2) whether the parameter of the global identifier has reached within a preset allowable time. You can check

The biometric information authentication service 220 responds to the network service request of the terminal 210 based on a result of verifying the response data using the public key and a result of identifying the user received from the IDP service 230. Alternatively, it may be determined whether to generate cookie information. When generating session information or cookie information, the biometric information authentication service 220 may transmit the generated session information or cookie information to the terminal 210. The terminal 210 may access the network service using the received session information or cookie information.

In summary, the authentication system according to an embodiment may authenticate and identify a user based on biometric information and a global identifier, in order to enhance authentication security of the SDN structure. Therefore, the authentication system may identify a plurality of users registered in the terminal 210. Furthermore, when an unregistered user tries to register with the terminal 210, the terminal 210 blocks the registration of the unregistered user without permission of the main user of the terminal 210, thereby enhancing the security of the terminal 210. Can be.

3 is a flowchart illustrating an operation performed when registering a plurality of users in a terminal of an authentication system according to an embodiment. Assume that the first user registers with a terminal in which no user is registered.

Referring to FIG. 3, in step 310, the terminal may acquire biometric information of the first user. In operation 320, the terminal may generate a private key and a public key corresponding to the first user from the obtained biometric information. The private key may be stored in the terminal. The public key may be transmitted to the authentication server connected to the terminal. The authentication server may generate and transmit a global identifier for the first user to the terminal. The global identifier may also be stored in the terminal. After the terminal acquires the user's biometric information, the process of receiving the global identifier until the global identifier is called a registration process for the user.

Referring to FIG. 3, after registering a first user, a second user may attempt to register with the terminal. The terminal may determine whether the second user attempts to register based on whether the input biometric information corresponds to the biometric information corresponding to the first user. When the input biometric information is the biometric information corresponding to the first user, the terminal may perform an operation of authenticating the first user based on FIG. 2. If the input biometric information is not the biometric information corresponding to the first user, the terminal may determine whether to perform a registration process of registering the second user based on the input biometric information.

More specifically, in step 330, when the second user tries to register with the terminal, in step 340, the terminal may determine whether the first user has approved the registration. That is, unlike when registering the first user, the terminal may ask the first user whether to approve the registration of the second user. In other words, the terminal may determine the first user as the main user who controls the registration process of the terminal.

If the first user inputs the biometric information of the first user to the terminal in response to a request of the terminal, in step 350, the terminal may perform a registration process for the second user. Therefore, if the first user does not input his / her biometric information to the terminal, the second user cannot register to the terminal. As a result, since the registration process is not performed without the approval of the first user, a situation in which a plurality of users are registered indiscriminately can be prevented.

 Table 1 shows an operation performed by the terminal when registering a plurality of users with a pseudo code.

 Referring to Table 1, when one user account exists in the terminal, the existing user account may be selected as the main user account. If you register additional user accounts, you cannot add user accounts without the approval of the selected primary user account.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different manner than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

110: terminal
120: network service
130: IDP

Claims (6)

In the authentication method performed in the terminal,
Requesting an authentication server connected to the terminal to provide a service to be used by a user of the terminal;
Acquiring biometric information from the user when receiving challenge data corresponding to the request from the authentication server;
Generating response data to be transmitted to the authentication server based on the obtained biometric information; And
Transmitting the response data to the authentication server to obtain session information for the service generated at the authentication server by authenticating the user.
Including,
The response data,
A global identifier used to authenticate the user using a redirect at the authentication server,
The global identifier is used to identify the user registered in the terminal to be distinguished from other users not registered in the terminal,
Authentication method. The method of claim 1,
The response data,
And a Uniform Resource Identifier (URI) including an address of an identifier providing service to which the authentication server redirects as the global identifier. The method of claim 1,
The generating step,
And generating the response data based on the private key corresponding to the user and the challenge data, when the obtained biometric information matches the pre-stored biometric information of the user. In the authentication method performed in the authentication server,
Receiving a request for a service provided by the authentication server from a terminal connected to the authentication server;
In response to the received request, transmitting challenge data to the terminal;
When receiving response data corresponding to the challenge data from the terminal, determining whether the response data is generated based on the biometric information of the user;
When the response data is generated using the biometric information of the user, identifying the user based on a global identifier included in the response data; And
Transmitting session information about the service to the terminal based on the identified user;
Including,
The global identifier is used to identify the user registered in the terminal to be distinguished from other users not registered in the terminal,
Authentication method. The method of claim 4, wherein
The identifying step,
And recognizing the user by redirecting to an identifier providing service that generates a global identifier using biometric information of the user based on the global identifier included in the response data. The method of claim 4, wherein
The determining step,
It is determined whether the response data is generated based on the biometric information of the user by using the public key corresponding to the user of the terminal,
The public key is
An authentication method generated based on biometric information previously obtained from the user.

Images