KR20030016073A - Method and system for user authertication using cookie in web - Google Patents

Abstract

PURPOSE: A method and system for authenticating a user through a cookie on a web is provided to prevent untrue cookie information from being transmitted using a secured cookie for an authenticating process of a user for a web service. CONSTITUTION: A web server(203) supplies a web service for a client(201) connected to the Internet(202). An authentication block(204) performs an authentication process of a client being transmitted from the web server(203) and creates a cookie including a predetermined random number. When an authenticated client requests new web document, an inquiry block(205) checks an authentication using a conventional cookie. A managing block(206) manages authentication information of the client(201) existing on the web server(203). A user information database(207) stores user information of the client(201) on the web server(203). A random number table DB(208) creates and stores random number values. An authentication information DB(208) stores authentication information of an authenticated user.

Description

Method and system for user authertication using cookie in web}

The present invention is to enhance the security function by using a cookie that is easy to implement when the user requires authentication through the web, in particular, to enhance the security while utilizing the convenience of the cookie to compensate for the security flaw of the existing cookie so that the user authentication is appropriate The present invention relates to a user authentication method and an authentication system through a cookie.

The World Wide Web (www) on the Internet is the most successful decentralized application in computing history. In a web environment, a client machine uses a standard page description language, known as hypertext markup language (HTML), to perform a transaction with a web server, such as a file (e.g., Hypertext Transfer Protocol (HTTP), a known application protocol that provides user access to text, graphics, images, sound, video, and the like. HTML provides basic document formatting and allows developers to specify links to other servers and files.

FIG. 1 is a block diagram illustrating an authentication system of a client through the web. The client 101 retrieves various resources of the Internet 102 using a web browser 111 and the Internet 102. And a web server 103 that performs authentication of the client 101 connected to and provides a web service to the authenticated client 101.

The authentication system of the client through the web configured as described above will be described with reference to FIG. 1 as follows.

First, a user of the client 101 accesses a web server 103 using a web service to search for various resources of the Internet 102 using a web browser 111, and then uses his or her information and ID ( You will be a member using your ID and password.

Subsequently, when the client 101 wants to use the web service, the web server 103 requests input of a user ID and password, and matches the user information stored in the user information database 104 of the input ID and password. If it does, it will authenticate, and if it does not match, it will refuse to connect or provide web services.

As described above, in order to provide a service through the web, it is necessary to check whether the accessor is an authenticated user at the initial stage and to verify whether the user is continuously authenticated.

This is because the characteristic of a web service is a connectionless service. That is, in the case of connection-oriented services, once authentication is performed, there is no need to check whether the session is authenticated later, but in the case of web services, authentication should be performed every time a document request is made. .

Currently, there are several methods of authenticating users through the web, depending on how they are implemented.

First, there is a method of registering a user on the web server itself to handle authentication through a function on the HTTP standard protocol. In this web server authentication, when a user wants to view a specific web page designated by the administrator, a login window is output, and the user inputs a user ID and password into the login window. When the user ID and password are input, this information is displayed. Is passed to the web server as data in the format described in HTTP.

Then, the web server reads the information and goes through a user authentication process, notifies the document access permission if authentication is completed, and notifies access if the authentication fails. After that, the authentication information of the user is continuously loaded on the header part of the HTTP and transmitted to the web server.

The second method uses cookies. When a user enters an ID and password at first, the authentication process is performed. Thereafter, a cookie is regarded as being made through a specific content cookie. In this method, the user's ID and password are input to the web server. If the authentication is successful, the web server writes the user's ID or password as a cookie and sends it to the client's web browser. The web browser will always send this cookie information from the next document request. The web server then assumes that the user has authenticated based on the cookie information and provides the service.

Here, a cookie is a part of information sent to a web browser by a web server, and the browser stores string information and sends it back to the web server whenever an additional request is made to the web server.

Third, there is a method of providing a service through the authentication process and creating a secure session based on a certificate through a third-party certification authority. In this method of using a certificate and secure session, the user enters an ID and password through a certificate provided by a third-party certification authority at login, and this information is passed to the web server via a secure session. If the authentication succeeds, the user will continue to receive services through the secure session.

However, in the first method of the related art, since authentication information is included in the header part, the ID and password of the user may leak when intercepting a packet in the middle.

In addition, since the second method also sends and receives cookie information, security problems occur such that intercepting cookie information in the middle can achieve the same effect as passing authentication without authentication.

And, like the third method, if a third certification authority is used, thorough security can be provided, but when requesting authentication service to a third certification authority, cooperation with a third certification authority and implementation of related systems There is a problem of complexity and high cost.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned conventional problem, and a cookie on a web which attempts to eliminate a problem in which false cookie information is transmitted by using a security-enhanced cookie to process authentication of a user for a web service. Its purpose is to provide a user authentication method and an authentication system.

An object of the present invention is to reject and manipulate cookie information that has not been properly authenticated by storing a random number assigned by a web server instead of storing it in a cookie as much as an ID value of an authenticated user. The object of the present invention is to provide a user authentication method and an authentication system through cookies on the web, which can deny access to web documents by determining cookie information.

1 is a diagram illustrating a client and a web server for a web service.

2 is a block diagram showing a user authentication system through a cookie on the web according to an embodiment of the present invention.

3 is a flow chart showing a user authentication method via a cookie on the web according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

101,201 ... Client 102,202 ... Internet

103,203 ... Web server 104,207 ... User information DB

111,211 Web browser 204 Authentication block

205 ... Query block 206 ... Administrative block

208 ... Random check storage 209 ... Authentication information storage

In order to achieve the above object, a user authentication method via a cookie on the web according to the present invention,

Comparing the authentication block received from the web server with the user information database when the client logs in, and confirming whether the authentication block is valid user information;

If the verification result is valid user information, a random random value is taken to generate a cookie value including the user information and the random number and transmitted to the client's web browser, and the user information, random number value, and login time are stored in the authentication information storage unit. Storing;

Reading user information and a random number from a cookie value delivered when a new web document is requested from the client, and checking whether authentication information exists in an authentication information storage unit;

And transmitting the requested web document content to the web browser if the user information and the random number exist in the authentication information storage unit, and denying access to the web document if the authentication information storage unit does not exist in the authentication information.

Preferably, when the client requests a logout, the management block may include deleting user information recorded in the authentication information storage unit and authentication information corresponding to a random number.

Preferably, when the new web document request, the latest connection time is updated and the authentication information of the user is deleted when there is no web document request for a predetermined time.

In detail, the authentication block records the IP address of the client in the authentication information database, and compares the user IP address of the recorded authentication information database with the IP address at the request of the client to determine whether to access a web document. It is characterized by.

A system for authenticating a user through cookies on the web according to an embodiment of the present invention includes a web server for providing a web service to a client connected to the Internet; An authentication block for generating a cookie including an authentication process of the client and an arbitrary random value transmitted from the web server; An inquiry block which authenticates using an existing cookie when requesting a new web document of an authenticated client; A management block for managing authentication information of a client existing on the web server; And a random number table storage unit for generating and storing random number values in advance, and an authentication information storage unit for storing user authentication information for which authentication has been completed.

The authentication block may generate a cookie with valid user information and a random random value stored in the random number storage.

The authentication information storage unit may include user information, a random number value, a login time, a final access time, and an IP address of the client, which have completed the authentication procedure from the authentication block.

Hereinafter, with reference to the accompanying drawings as follows.

2 is a block diagram illustrating a user authentication system through cookies on the web according to an embodiment of the present invention, and FIG. 3 is a flowchart illustrating a user authentication method through cookies on the web according to an embodiment of the present invention.

First, a client 201 receiving a web service using a web browser 211; A web server 203 for requesting authentication information from a client 201 connected to the Internet 202 and delivering a web page according to the input authentication information; An authentication block 204 which receives the user authentication information from the web server 203 and generates a user authentication process and a cookie; An inquiry block 205 for verifying an authentication using an existing cookie value when a user who has completed an authentication process requests another web document; A management block 206 for managing authentication information existing on a web server, a user information database (DB) 207 for storing user information, and a random number value to be assigned by the web server 203 for enhanced security function in advance The random number storage unit 208 generates and stores the authentication information storage unit 209 storing user authentication information according to the authentication result.

Referring to the accompanying drawings, a system and method for authenticating a user through cookies on the web according to an exemplary embodiment of the present invention as described above will be described.

2 and 3, the client 201 connects to the web server 203 on the Internet 202 using its web browser 211, and a user ID when a user authentication request of the web server 203 is requested. And password.

The web server 203 receives the user ID and password and passes it to the authentication block 204 (S301), the authentication block 204 queries the user ID and password to the user information database 207, and whether it is valid. It is confirmed (S302).

If the verification result of the authentication block 204 is invalid user information, access to the web document is rejected, and if valid user information is obtained, a random random value is taken from the random number storage unit 208 (S303).

In this case, the authentication block 204 stores a valid user ID, a random value, and a login time in the authentication information storage unit 209 (S304), and generates a cookie including the user ID and the random number to generate a web server ( 203 and the web server 203 transmits the cookie received from the authentication block 204 to the web browser 211 of the client 201 through the Internet.

If a cookie value is transmitted from the web browser 211 to the web server 203 when a new web document is requested from the client 201 that has received the authentication procedure, the web server 203 returns the cookie value to the inquiry block 205. In step S306, the inquiry block 205 reads the user ID and the random number from the cookie value and inquires whether the stored user ID and the random number exist in the authentication information storage unit 209 (S307).

If the user ID and the cookie value exist in the authentication information storage unit 209, the inquiry block 205 modifies the latest connection time of the authentication information storage unit 209 to the current time, and the web server 203 is the client 201. ) Transmits the requested web document content to the web browser 211. However, if the user ID and the random number do not exist, the client 201 denies access to the web document.

Thereafter, when the client 201 requests the logout, the web server 203 receives the request and transmits the cookie value (ID, random number value) to the management block 206 (S308), and the management block 206 receives the request. The authentication information corresponding to the user ID and the random number recorded in the cookie value is deleted from the authentication information storage unit 209 (S309).

On the other hand, the management block 206 periodically checks the authentication information of the authentication information storage unit 209 and deletes the authentication information that has elapsed a predetermined time since the latest connection time. In this case, the user must perform the authentication procedure again.

In order to further enhance the security, the user's IP address is recorded in the authentication information to check whether the IP address of the client 201 making a request at every connection matches the IP address in the authentication information. That is, the authentication information storage unit 209 stores a user ID, a random number value, a login time, a recent access time, a user IP address, and transmits the ID and the random number value to the inquiry block 205 when the authentication request is made.

By simply storing a random number with a user ID that has been authenticated in the cookie during the authentication process of the user, cookie information that is not properly authenticated can be rejected. That is, the cookie information that is manipulated as if the user cookie is generated by generating a random cookie value is judged to be false and denies access to the web document. It is also possible to selectively reject multiple connections from unspecified areas.

In addition, to further enhance security, the IP address of the client 201 is recorded in the authentication information storage unit 209, and the IP address of the client 201 that makes a request at every connection matches the IP address in the authentication information. It can be secured by accessing or denying web documents.

As described above, according to the user authentication method through a cookie on the web according to the present invention, after authentication verification of the user information from the user information database when the authentication request from the client, random random values for valid user information By generating a cookie value to be included and sending it to a web browser, and performing a web service by comparing the cookie value when requesting a new web document, it is possible to prevent the intention of manipulating the cookie value to access the server in an impure manner. In addition, there is an advantage that can manage the information of the currently connected user on the web service providing a non-continuous service.

In addition, by authenticating the user through a cookie with enhanced security, the convenience of using the cookie is maintained as it is, and the vulnerability to the security of the existing method is maximized.

Claims (7)

Comparing the authentication block received from the web server with the user information database when the client logs in, and confirming whether the authentication block is valid user information; If the verification result is valid user information, a random random value is taken to generate a cookie value including the user information and the random number value and transmitted to the client's web browser, and the user information, random number value, and login time are stored in the authentication information storage unit. Storing the; Reading user information and a random number from a cookie value delivered when a new web document is requested from the client, and checking whether authentication information exists in an authentication information storage unit; And transmitting the requested web document content to the web browser if the user information and the random number exist in the authentication information storage unit, and denying access to the web document if the authentication information storage unit does not exist in the authentication information. User Authentication Method. The method of claim 1, And a management block deleting the user information recorded in the authentication information storage unit and the authentication information corresponding to the random number when the client requests a logout request. The method of claim 1, The user authentication method through a cookie on the web, characterized in that for updating the latest access time when the new web document request and deletes the user's authentication information when there is no web document request for a certain time. The method of claim 1, The authentication block records the IP address of the client in the authentication information database, and compares the user IP address of the recorded authentication information database with the IP address at the request of the client, and determines whether to access the web document. User authentication via cookies on the web. A web server for providing a web service to a client connected to the Internet; An authentication block for generating a cookie including an authentication process of the client and an arbitrary random value transmitted from the web server; An inquiry block which authenticates using an existing cookie when requesting a new web document of an authenticated client; A management block for managing authentication information of a client existing on the web server; On the web, characterized in that it comprises a user information database for storing the user information of the client on the web server, a random number storage unit for generating and storing a random number value, and an authentication information storage unit for storing the user authentication information has been authenticated User Authentication System via Cookies. The method of claim 5, The authentication block is a user authentication system via a cookie on the web, characterized in that for generating a cookie with a valid user information and a random number stored in the random number storage unit. The method of claim 5, The authentication information storage unit comprises a user information that completes the authentication procedure from the authentication block, a random number value, login time, the last access time, the user authentication system via a cookie on the web, characterized in that each of the IP address.