KR102110815B1 - An access control system with onetime password function for access security - Google Patents

Abstract

The present invention relates to an access control system with a one-time password (OTP) function for access security which is installed between at least one user terminal and at least one server to relay between the user terminal and the server. The access control system comprises: an OTP generation unit to generate and store a one-time password (OTP) in accordance with a request of the user terminal; a client terminal to perform communication with the user terminal; a server handler to perform communication with the server; an authentication processing unit to relay a message between the client handler and the server handler, authenticate a password of an authentication message if the message is the authentication message, and use a stored account password to perform authentication with the server once the password is successfully authenticated; and a password management unit to manage an account password of the server. New password information is assigned by the system whenever a user accesses the server via access control to block illegal access and prevent a password from being exposed by hacking or user management negligence.

Description

Access control system with one-time password function for access security {An access control system with onetime password function for access security}

The present invention provides a one-time password function for access security to enhance security by enabling a one-time use of a password or password used to access a main server of an institution using a gateway-based access control technology. It relates to an access control system equipped.

Particularly, the present invention allows a user to discard a password or password once used as an authentication means when accessing an important server of an institution, and prevent a new password from being reused, thereby controlling access even when a password is exposed. The present invention relates to an access control system having a one-time password function for access security, which can provide security.

In general, for the security of server access, it is notified by assigning account information (ID / Password) to users who need access to the server, and after completing the work, change the account password of the server assigned at the end of access, or change the account itself. Delete it.

However, in case of changing the password, the password minimum usage period, maximum usage period, expiration period, etc. are set according to the account security policy for each server or OS (Patent Document 1). In particular, the minimum password usage period refers to a period in which the password must be maintained for at least n days after the password is changed. Therefore, the password change period does not arrive until the minimum password usage period has passed. That is, a problem occurs in that the password cannot be changed during this period. In particular, in the case of a privileged account such as "root", the account itself cannot be deleted.

Therefore, even if the password is exposed during this period, the password cannot be changed, and there is a problem in that a standardized password security policy cannot be established in case the password information is exposed.

Specifically, FIG. 1 illustrates a password security policy of a server or an operating system (OS). This security policy may be different depending on the type of server or operating system (OS).

As shown in FIG. 1, "PASS_MAX_DAYS" represents the maximum password use date, and "PASS_MIN_DAYS" represents the password minimum use date. In addition, "PASS_MIN_LEN" represents the minimum number of characters of the password, that is, the length of the password, and "PASS_WARN_AGE" represents the password expiration warning period.

There are many servers in one institution, and password security policies for each server are often set differently. In addition, the security policy can be established as a standardized policy. In this case, if you change the settings, depending on the type of server, you need to terminate the service and reboot the server. However, it is realistically very difficult to terminate the service in operation.

In addition, the minimum password use date should be set for the following reasons. That is, if the minimum password usage period is not set, the administrator or the user can easily change the password with a password familiar to him. That is, the regular change of the password may become meaningless by reusing the familiar password. Therefore, it is recommended that the minimum period of use be set from 1 day to 1 week.

However, when the password minimum use date is set as described above, there may be a case in which a one-time password change is impossible even though it has to be changed. That is, in the case of S financial company, the password information for the root is transmitted to an external partner engineer for regular PM (Prevention Maintenance) work of the server loaded with the customer information. At this time, the internal manager must finish the work and change the password exposed to employees of external partners for security. However, if the password change period of the root account of the target server is smaller than the password minimum use period (PASS_MIN_DAYS) policy, the corresponding password cannot be changed.

Korean Registered Patent No. 10-1475981 (announced on December 23, 2014)

The object of the present invention is to solve the problems as described above, using a gateway-based access control technology, access security using a password or password (Password) used to access the main server of the institution, one-time access security It is to provide an access control system with a one-time password function for.

That is, the object of the present invention is to apply the one-time password function, and change the password (Password) exposed to the user every time regardless of the account security policy set on the server, but when the user accesses the server via access control, It is to provide an access control system having a one-time password function for access security, which provides password information.

In order to achieve the above object, the present invention relates to an access control system having a one-time password function for access security, installed between at least one user terminal and at least one server, relaying between the user terminal and the server. As an OTP generating unit for generating and storing a one-time password (OTP) at the request of the user terminal; A client handler that communicates with the user terminal; A server handler that communicates with the server; An authentication processing unit that relays a message between the client handler and the server handler, and if the message is an authentication message, authenticates the password of the authentication message and, upon successful authentication, authenticates the server using the stored account password; And, characterized in that it comprises a password management unit for managing the account password of the server.

In addition, in the present invention, in the access control system having a one-time password function for access security, the OTP generation unit discards the one-time password when the validity period of the one-time password has elapsed and sets it to expire by the number of uses. It is characterized in that the corresponding one-time password is discarded even if the expiration date does not arrive.

In addition, the present invention, in the access control system with a one-time password function for access security, the authentication processing unit detects whether or not the authentication message by filtering the message received from the client handler, the service account and the detected authentication message It is characterized by extracting a password (hereinafter referred to as an input password), retrieving stored one-time password information with the extracted service account, and performing authentication by determining whether the retrieved one-time password matches the input password.

In addition, the present invention, in the access control system having a one-time password function for access security, the authentication processing unit performs an authentication process with the server through the server handler, according to an authentication protocol, a service account for authentication And a password, respectively, using the extracted service account and account password, and entering the retrieved account password in a message for passing the password, and transmitting the corresponding message to the server handler.

In addition, the present invention in the access control system with a one-time password function for access security, the password management unit stores and stores the service account and account password in advance, periodically or specific events according to the preset security policy It is characterized by changing the account password according to.

In addition, the present invention in the access control system having a one-time password function for access security, the password management unit accesses the server through the server handler, and accesses the server using the stored service account and account password , Requesting to change the account password to the server with a new account password by creating a new account password, and updating the account password of the corresponding service account with the new account password.

As described above, according to the access control system having a one-time password function for access security according to the present invention, illegal access is prevented by granting new password information every time the user accesses the server via the access control. The effect of blocking and preventing passwords from being exposed due to hacking or neglecting user management is obtained.

1 is a diagram illustrating a password security policy of an operating system (OS) according to the prior art.
2 is a block diagram of an entire system for carrying out the present invention.
Figure 3 is a block diagram of the configuration of an access control system with a one-time password function for access security according to an embodiment of the present invention.
4 is an exemplary table showing one-time password information according to the present invention.
5 is a flowchart illustrating a server access method by an access control system having a one-time password function for access security according to an embodiment of the present invention.

Hereinafter, specific contents for carrying out the present invention will be described in accordance with the drawings.

In the description of the present invention, the same parts are denoted by the same reference numerals, and repeated explanation is omitted.

First, the configuration of the entire system for carrying out the present invention will be described with reference to FIG. 2.

2, the entire system for implementing the present invention is composed of a user terminal 10, at least one server 40, and an access control gateway 30 that controls access to the server 40. . In addition, the user terminal 10 and the access control gateway 30 are connected through a network (not shown). In addition, the administrator terminal 20 used by the administrator, or the access control gateway 30 may further include a database 80 for storing data.

The user terminal 10 is a computing terminal used by a user, and is a PC, laptop, tablet PC, smartphone, phablet, and the like. In addition, the user terminal 10 has a network function that can connect to the server 40 or the access control gateway 30 through a network (not shown). In addition, the user terminal 10 may be executed by installing a program system such as an application.

In addition, a communication application (not shown) is installed in the user terminal 10, and a communication operation may be performed by accessing the server 40 through the communication application. A communication application (not shown) is a variety of terminal tools for a user to remotely access the server 40, and accesses the server 40 through a communication protocol and performs communication. For example, a communication application performs a task through a shell using a remote access protocol, such as Telnet (TELNET) or File Transfer Protocol (FTP) for file transfer, and a secure shell (SSH) protocol. Meanwhile, the communication application actually accesses the server 40 through the access control gateway 30.

The fact that the user terminal 10 approaches the server 40 is actually accessing the server 40 through a communication application installed in the user terminal 10. However, for convenience of description, it will be described below that the user terminal 10 accesses the server.

Meanwhile, the user terminal 10 accesses the server 40 after performing user authentication using a one-time password. Specifically, the user terminal 10 requests and issues a one-time password (OTP) to the access control gateway 30 and performs user authentication of the server 40 with the issued one-time password. At this time, the user authentication is performed by a user ID (or access ID, service ID) and a one-time password.

In addition, as another embodiment, the user terminal 10 may be issued indirectly through the administrator terminal 20 without receiving the one-time password directly from the access control gateway 30. That is, the user terminal 10 may request the issuance of the administrator terminal 20 and receive the one-time password issued by the administrator terminal 20. At this time, the user terminal 10 and the administrator terminal 20 may communicate directly or through the access control gateway 30.

In addition, when the user terminal 10 requests a service account from the administrator or the administrator terminal 20, the administrator terminal 20 selects a service account, and provides a one-time password for the selected service account to the access control gateway 30. Can be issued. At this time, when a one-time password is issued, the selected service account and the issued one-time password are transmitted to the user terminal 10.

Next, the administrator terminal 20 is a computing terminal used by the administrator, and is a PC, a laptop, a tablet PC, a smartphone, and the like. In addition, the manager terminal 20 connects to the access control gateway 30 through a network (not shown). In addition, preferably, the administrator terminal 20 may perform direct communication with the user terminal 10 or may perform communication through the access control gateway 30.

In one embodiment, the administrator terminal 20 responds to the request for the one-time password approval of the access control gate 30 by determining approval or disapproval.

In another embodiment, the administrator terminal 20 requests the issuance of the one-time password to the access control gateway 30 according to the user or the user terminal 10's request for the one-time password issuance. The issued one-time password is transmitted through the administrator terminal 20 or directly from the access control gateway 30 to the user terminal 10.

In addition, when the user terminal 10 requests access to the server 40, the administrator terminal 20 may select an allowable service account, and request the access control gateway 30 for a one-time password for the selected service account. .

Next, at least one server 40 is installed. That is, a plurality of servers 40 may be installed.

Each server 40 receives a connection request from the user terminal 10 through a network (not shown), and permits connection according to the request to perform communication. At this time, preferably, the server 40 communicates with the user terminal 10 through a communication protocol.

Further, the server 40 receives a message such as a command from the user terminal 10 using a communication protocol, performs a command or request of the corresponding message, and transmits the result (or result message) to the user terminal 10 do. At this time, a session is formed between the user terminal 10 and the server 40, and a connection request or message, result content, etc. are transmitted and received in a data packet through a communication protocol.

Meanwhile, the communication between the server 40 and the user terminal 10 described above is not directly connected and processed, but is connected through the access control gateway 30. That is, the request message of the user terminal 10 is transmitted to the server 40 through the access control gateway 30, and the response message of the server 40 is also transmitted through the access control gateway 30 to the user terminal 10 Is passed on.

Meanwhile, preferably, the server 40 may set a control policy such that a firewall is installed and only data (or data packets) received from the access control gate 30 pass through. Therefore, the user terminal 10 cannot directly access the server 50 and can only access the server 40 through the access control gateway 30. If the packet path is transmitted to the server 40 without changing the packet path to the gateway 30, the server access paths other than the gateway, which is the condition for establishing access control, are blocked by the firewall policy blocking all access.

On the other hand, the server 40 performs authentication (or user authentication, service authentication) using the service account and password for the user's server access, and permits server access only when the user authentication has passed, and the service of the server Provides The service account is identified by ID (or user ID, access ID, service ID). Hereinafter, for convenience of description, it will be referred to as a service account (or service ID). In addition, the corresponding service account is authenticated by a password. Hereinafter, the password for the service account of the server 40 will be referred to as an account password.

Next, the access control gateway 30 is a gateway installed on a network (not shown) between the user terminal 10 and the server 40, and monitors and relays between the user terminal 10 and the server 40 or Cut off.

That is, the access control gateway 30 receives the message (or data packet) received from the user terminal 10 and delivers it to the server 40, and receives the result (or data packet) from the server 40 to the user terminal. (10).

At this time, the access control gateway 30 analyzes the received message, determines whether to block commands, etc. contained in the message, or monitors and stores the communication content. That is, according to a predetermined security policy or access control policy, the corresponding message is monitored, such as being transmitted or blocked, to the server 40, and communication information is recorded and stored in a log.

Preferably, the access control gateway 30 determines whether to authorize according to the security policy for each user authority based on the message, and if it is an authorized use request, newly connects communication (or session) to the real server 40 and , Relays communication with the user terminal 10. Therefore, the access control gateway 30 relays communication by accessing the real server 40.

In particular, at this time, the access control gateway 30 connects to the server 40 and forms a session (hereinafter, a server session) with the server 40. In addition, the access control gateway 30 forms a session (hereinafter, a client session) with the user terminal 10. And it relays between the client session and the server session.

In addition, the access control gateway 30 records the relay history between the user terminal 10 and the server 40. The relay history includes access information (IP address and port number) of the user terminal accessing the gateway 30, access information (IP address and port number) of the server accessing the server 40 for relaying, and the server 40. It consists of the process ID (PID) of the service provided.

In addition, the access control gateway 30 is issued by generating a one-time password (Onetime Password) according to the request issued by the user terminal 10 or the administrator terminal 20, the issued one-time password to the user terminal 10 or the administrator terminal (20). At this time, the access control gateway 30 receives the service account along with the request.

In addition, preferably, the access control gateway 30 receives an access request to the server 40 (when only the server is designated and the service account is not determined), selects an allowable service account, and selects the service account for the selected service account. One-time passwords can be issued.

In addition, the access control gateway 30 requests an authorization to the administrator terminal 20 with respect to the request for issuing a one-time password, and upon receiving the approval, issues the one-time password. The issued one-time password is stored. At this time, the one-time password is stored and mapped to the service account so that it can be identified by the service account.

In addition, the access control gateway 30 registers and manages authentication information (ID and password) of a user or service account for accessing the server 40. The service account of the server is identified by an ID, and the corresponding account is authenticated by a password (or account password).

Also, the access control gateway 30 changes the account password periodically or according to a specific event. That is, the access control gateway 30 accesses the server 40 using a user account and account password stored as service authentication information (or user authentication information), and generates a new account password to generate a new account password for the server 40 Request to renew your account password. Then, update the account password of the account in the user account or service account with the new account password. Since the account password is automatically changed periodically, the security of the account password can be further enhanced.

In addition, the access control gateway 30 relays a message between the user terminal 10 and the server 40, but if the authentication message for the server 40, the password (or input password) input from the user terminal 10 After authentication, user authentication of the server 40 is performed after authentication.

The authentication message is a message for authenticating the service account of the server 40. When the message to be relayed is the authentication message received from the user terminal 10, the access control gateway 30 extracts the service account and input password of the authentication message, and compares the extracted service account and input password with the stored one-time password. To authenticate. When searching for a stored one-time password, search by service account.

Then, when authenticated by a one-time password, the access control gateway 30 performs user authentication of the server 40 using the stored account password. That is, the service account and the account password for the service account are transmitted to the server 40. At this time, the access control gateway 30 performs a user authentication (or service account authentication) process with the server 40, but performs an authentication process using an account password instead of an input password (or a one-time password).

Next, the database 80 includes the OTP authentication DB 81 that stores the generated one-time password, the account authentication DB 82 that stores the service account and account password of the server, and the log DB 83 that records and stores the log. Etc. However, the configuration of the database 80 is only a preferred embodiment, and in developing a specific device, it may be configured in a different structure according to a database construction theory in consideration of the ease and efficiency of access and search.

Next, a detailed configuration of the access control system 30 with a one-time password function for access security according to an embodiment of the present invention will be described with reference to FIG. 3.

The access control system 30 according to the present invention may be implemented as the access control gateway described above. Hereinafter, reference numerals of the access control system are used as the same reference numerals as the access control gateway.

As shown in FIG. 3, the access control system 30 according to an embodiment of the present invention includes an OTP generation unit 31 for generating a one-time password (OTP), and a client handler for communicating with the user terminal 10 ( 32), a server handler 33 that communicates with the server 40, an authentication processing unit 34 that performs user authentication (or service authentication), and a password management unit 35 that manages the account password of the server. do.

First, the OTP generating unit 31 is requested to issue a one-time password, and issues and transmits a one-time password. That is, the OTP generation unit 31 is requested to issue a one-time password from the user terminal 10 or the administrator terminal 20. At this time, the service account or service account information is received.

In addition, the OTP generating unit 31 generates and issues the requested one-time password. At this time, it is issued as a one-time password for the service account. The issued one-time password is recorded and stored in the database 80 or OTP authentication DB 81.

An example of a form in which a one-time password is stored is illustrated in FIG. 4. As illustrated in FIG. 4, the stored one-time password information may be configured with a service account, an encrypted (hashed) password, an expiration date (or expiration period, a maintenance period, etc.), login information indicating whether or not to log in. Preferably, as shown in Figure 4, the one-time password information is stored in the form of a list.

 That is, the one-time password is stored as a password for the service account. That is, the one-time password is identified by the service account. In addition, the one-time password can be stored or compared as a value by a one-way function such as a hash function in a conventional manner.

In addition, the validity period indicates a time for which a one-time password is maintained or an expiration time. For example, if the validity period elapses after the one-time password is issued, the corresponding one-time password is discarded.

In addition, information about whether to log in or use a one-time password can also be recorded. For example, the one-time password can be set to expire by the number of uses. That is, if used as a login once or a specific number of times, the corresponding one-time password may be discarded even if the validity period has not been reached.

In addition, the OTP generation unit 31 transmits the issued one-time password to the user terminal 10 or the administrator terminal 20.

In addition, preferably, the OTP generation unit 31 may request an authorization from the administrator terminal 20 for a request for issuing a one-time password by the user terminal 10, and may issue a one-time password upon receiving the approval. .

Next, the client handler 32 receives the message from the user terminal 10 and delivers it to the server handler 33, and receives the result message of the server 40 from the server handler 33, and then the client handler 32 To pass. That is, the client handler 32 relays data such as a message between the user terminal 10 and the server handler 33.

At this time, it is transferred (relayed) between the client handler 32 and the server handler 33 through the authentication processing unit 34. The authentication processing unit 34 performs authentication by filtering the authentication message from the relayed message. Hereinafter, for convenience of description, the relaying process of the authentication processing unit 34 may be omitted.

Preferably, the client handler 32 establishes a session (hereinafter referred to as a client session) with the user terminal 10, and transmits and receives data (such as a message) through the established client session. Particularly, when the communication protocol is the SSH protocol, the client handler 32 establishes an encrypted session (or SSH session, a client session) by the SSH protocol.

Further, the client handler 32 delivers the message received from the user terminal 10 to the authentication processing unit 34. Whether or not the transmitted message is an authentication message is filtered by the authentication processing unit 34.

In particular, when the message received from the user terminal 10 is an authentication message, the client handler 32 does not receive a message transmitted from the server 40 for a message regarding the authentication result, and is generated by the authentication processing unit 34. It receives the message and transmits it to the user terminal 10. That is, the authentication operation with the user terminal 10 is not performed by the server 40, but is performed by the authentication processing unit 34.

Next, the server handler 33 forms a session (hereinafter, a server session) corresponding to the session (or client session) formed with the client handler 32 with the server 40. That is, the client session and the server session are sessions for relaying between the user terminal 10 and the server 40. In particular, when the communication protocol is the SSH protocol, the server handler 33 establishes an encryption session (or SSH session, a server session) by the SSH protocol. In addition, the server handler 33 may store the SSH authentication key in advance and use the stored SSH authentication key to form an SSH session with the server 40 as a server session. That is, it is possible to enhance security by using a different SSH authentication key from the client session.

In addition, the server handler 33 receives a message from the client handler 32 and transmits the message to the server 40 through a server session. Also, on the contrary, the server handler 33 delivers the message received from the server 40 to the client handler 32. At this time, a message is transmitted (relayed) between the server handler 33 and the client handler 32 through the authentication processing unit 34. Therefore, the message is relayed between the user terminal 10 and the server 40 by the client handler 32 and the server handler 33.

In addition, the server handler 33 relays the authentication process (or authentication operation, authentication protocol) with the server 40 with the authentication processing unit 34. That is, the server handler 33 receives the messages necessary for the authentication protocol of the server 40 from the authentication processing unit 34 and transmits them to the server 40, and receives the authentication result message received from the server 40 to authenticate the authentication processing unit. (34).

In addition, the server handler 33 may relay a message between the password management unit 35 and the server 40 at the request of the password management unit 35. That is, the password management unit 35 performs a task of changing the account password for the service account of the server 40. Therefore, the server handler 33 relays the operation message for changing the account password.

Next, the authentication processing unit 34, if the relayed message is an authentication message for a server or a service account, extracts the input password of the authentication message to authenticate whether it matches (with the stored password), and checks whether the input password is correct. ) If authentication is passed, an authentication operation (or authentication protocol) with the server 40 is performed using the password (account password) of the actual server account instead of the password (input password) entered by the user.

That is, the authentication processing unit 34 filters the message received from the client handler 32 to detect whether or not the authentication message. The authentication message is a message for authenticating the service account of the server 40 and includes a password or a service account and password.

Next, the authentication processing unit 34 extracts the service account and password from the authentication message. Next, with the extracted service account, stored one-time password information is retrieved, and it is checked whether the retrieved one-time password and the extracted password (or input password) match. Matching is judged to be the same, and in particular, when encrypted by a hash function, it is prepared by encrypting with the same hash function. If it matches, it is determined that the one-time password is authenticated.

Next, when the one-time password is authenticated, the authentication processing unit 34 retrieves the account password with the extracted service account. Then, the input password of the corresponding authentication message is replaced with the account password, and authentication is performed. The account password is a password stored in the database 80 or the account authentication DB 82, and is an account password corresponding to the service account.

That is, the authentication processing unit 34 performs an authentication process with the server 40 through the server handler 33 according to the authentication protocol, but uses the extracted service account and account password as service accounts and passwords, respectively. In particular, in the message for passing the password, the retrieved account password is input, and the corresponding message is transmitted to the server handler 33.

In addition, the authentication processing unit 34, if the password authentication failure is repeated more than a certain number of times for a specific service account, determines as a threat user and blocks the server access request function itself.

Next, the password management unit 35 stores and manages the service account and account password of the server 40 in the database 80 or the account authentication DB 82.

That is, the account password information is composed of a service account, an account password of the corresponding service account, and the like. Account password information may be stored in the form of a list (list).

Preferably, the service account and account password are set and stored in advance by an administrator or the like.

In addition, preferably, the password management unit 35 changes the account password periodically or according to a specific event according to a preset security policy. In particular, the password management unit 35 performs a password change operation with the server 40 through the server handler 33.

At this time, the specific event is a preset event, and may be set as a system rebooting or updating of client programs of a user terminal, command of an administrator, or a user. In particular, the password management unit 35 accesses the server 40 before exceeding the maximum password usage period, and changes the account password to a random password according to the password security policy.

In addition, the password management unit 35 changes the account password according to the password security policy. As an example, the password of the administrator account is set to at least 8 digits, and consists of a combination of special characters, numbers, mixed case. Also, the account password must be changed at least once every three months.

Specifically, the password management unit 35 accesses the server 40 using the service account and account password stored in the account authentication DB 82, generates a new account password, and creates a new account password to account 40 to the server 40 Request change. Then, in the account authentication DB 82, the account password of the corresponding service account is updated with the new account password. That is, the password management unit 35 accesses the server 40 through the server handler 33, performs account authentication with the account password before updating, and updates the account password.

Next, the effect of the present invention will be described in more detail.

As described above, by checking the integrity of the password through the one-time password in the access control gateway 30, an actual malicious password attack (eg, brute force attack, etc.) can be prevented. That is, even if a malicious password attack occurs, it is possible to provide a basic defense against all attacks because a one-time password is not issued. In addition, due to the attack, even if the authentication failure count exceeds, the service account of the server is not disabled. In addition, it is possible to recognize the threat by loading the history of failed authentication and notifying the administrator.

Next, a method of accessing a server by an access control system having a one-time password function for access security according to an embodiment of the present invention will be described with reference to FIG. 5.

As shown in FIG. 5, the authentication is performed by replacing the password in the access control gateway 30, and the user recognizes the one-time password issued by the remote terminal application as the password of the normal server.

First, the user or the user terminal 10 requests password information (or one-time password) from the access control gateway 30 or the OTP generation unit 31 to access the server (S10).

Next, the user or the user terminal 10 requests the access (or SSH connection) of the server 40 through the access control client (S21). At this time, through the client handler 32 and the server handler 33 receiving the user's SSH connection request from the access control gateway 30, a session key exchange process (or SSH key handshake process) is performed to establish a session connection ( S22).

Next, the user or the user terminal 10 enters and transmits a service account and password (one-time password) (or ID / Password) for authorization to access the server 30 (S31). The service account and the one-time password transmitted to the client handler 32 are transmitted to the authentication processing unit 34 (S32), and the authentication processing unit 34 confirms the integrity of the corresponding password (input password) (S33).

Next, the authentication processing unit 34 inquires the account password of the actual server in the account authentication DB 82 (S40), and performs authentication negotiation with the server 40 (S50).

Next, the authentication processing unit 34 does not deliver the password (or input password, one-time password) entered by the user when authenticating with the real server 40 through the server handler 33, and is executed in the account authentication DB 82. The authentication is completed by passing the retrieved account password (S50).

That is, the authentication processing unit 34 performs authentication for the service account of the server 40 through the server handler 33. The detailed process of the agency is as follows.

Step S51: Client UserAuth Request (none): ID

-> Request a means to authenticate with the server ID

Step S52: Server UserAuth Failure (method list)

 -> Pass the list of authentic means of the requested ID (ex: password, ssh key, key stroke,…)

Step S53: Client UserAuth Request (Password)

  -> Notify the server that authentication will be performed using the "Password" method.

Step S54: Server UserAuth PK OK

  -> OK sign for authentication method

Step S55: Client UserAuth Request (validation)

  -> Request for verification of conformity by passing actual password information

Step S56: Server UserAuth Success

  -> Message when password authentication passes

Next, when the authentication with the server 40 is successful, the authentication processing unit 34 transmits an authentication success (complete) message to the user terminal 10 through the client handler 32 (S60). The user terminal 10 may check the command line for which authentication has been completed.

Through the above authentication process, in the case of the user, the one-time password assigned by the user is recognized as the password of the actual server.

Above, although the invention made by the present inventors has been specifically described according to the above-described embodiments, the present invention is not limited to the above-described embodiments, and it is needless to say that various modifications can be made without departing from the gist thereof.

10: user terminal 20: administrator terminal
30: access control gateway 31: OTP generation unit
32: client handler 33: server handler
34: authentication processing unit 35: password management unit
40: server 80: database
81: OTP authentication DB 82: account authentication DB
83: log DB

Claims (6)

In the access control system having a one-time password function for access security, which is installed between at least one user terminal and at least one server, relays between the user terminal and the server,
An OTP generating unit for generating and issuing a one-time password (OTP) for a service account of a server at the request of the user terminal, and storing the issued one-time password;
A client handler that communicates with the user terminal;
A server handler that communicates with the server;
Relay a message between the client handler and the server handler, if the message is an authentication message, authenticate the password of the authentication message with the stored one-time password, and if authentication is successful, perform authentication with the server using the stored account password Authentication processing unit; and,
It includes a password management unit for storing and managing the account password of the service account of the server,
The authentication processing unit detects the authentication message by filtering the message received from the client handler, extracts the service account and password (hereinafter, the input password) from the detected authentication message, and retrieves the stored one-time password information with the extracted service account. Then, it determines whether the searched one-time password matches the input password and performs authentication,
When the authentication of the input password is successful, the authentication processing unit performs an authentication process with the server through the server handler according to an authentication protocol, and as the service account and password for authentication, respectively, the extracted service account and account password Access control system with a one-time password function for access security, characterized in that using, and entering the account password of the stored service account in the message to pass the password, and transmits the message to the server handler.
According to claim 1,
The one-time for access security, characterized in that the OTP generation unit discards the one-time password when the validity period has elapsed for the one-time password, and discards the one-time password even if the validity period does not arrive when it is set to expire by the number of uses. Access control system with password function.
delete delete According to claim 1,
The password management unit is provided with a one-time password function for access security, characterized in that the service account and account password is set and stored in advance, and periodically or in accordance with a predetermined security policy to change the account password according to a specific event. Access control system.
The method of claim 5,
The password management unit accesses the server through the server handler, accesses the server using a stored service account and account password, generates a new account password, requests the server to change the account password with the new account password, Access control system with a one-time password function for access security, characterized in that the account password of the service account is updated with a new account password.

Images