KR20030043900A - A method detecting illegal accesses by access information - Google Patents

Abstract

PURPOSE: A method for detecting the connection of an illegal user by using connection environment information is provided to promptly interrupt the illegal use by informing a security manager and an original owner of the probability of the illegal use in real-time in case that a connection environment pattern of a user is suddenly changed. CONSTITUTION: When the user connects to an online site(1), a browser of the user transfers an IP(Internet Protocol), a browser kind, and a user device information to an online site server. The present connection environment information is found out by searching the location information of the IP from the IP location/organization information(7). The past connection environment information data is formed from a connection environment record database(9). The present connection environment information is compared with a plurality of past connection environment information(10). If the present connection environment information does not exist in the past connection environment information record, a warning message is sent to the security manager and the original owner(11).

Description

A method detecting illegal accesses by access information

According to the present invention, even when an illegal user accesses the online site by completely stealing the ID and password of the element owner, the long-term recorded connection environment pattern of the element owner (access area, access time, web browser to be used at the time of connection, connection device) It is a method to notify the security manager and the element user in real time of the accessibility warning of the fraudulent user by utilizing the fact that there is a general difference in the real-time connection environment pattern of the fraudulent user.

Currently, there are many methods for IT technical hacking for online site security, but it is formally legally used by fraudulent users to acquire the user's ID and password through internal consignment or existing hacking. If you are connected to the Internet, you cannot detect this. In reality, the leakage of the original user's (owner's) ID and password frequently occurs and often causes security incidents on financial sites and Internet commerce sites. In this way, if a user attempts to formally legally access an illegally acquired ID and password, it cannot prevent the final stage of the fundamental use of fraud unless the possibility of fraud is detected.

In order to solve the problems described above, the present invention can immediately stop the illegal use of a perfect ID and password by notifying the security manager and the owner of the element in real time that the user's connection environment pattern suddenly changes. Make sure

In order to achieve the above object, the present invention compares the current connection environment information with the connection environment information between them when the user accesses the online site, and extracts the difference. In addition, the connection environment information is additionally stored in the DB so that it can be used as a comparison data for the next connection.

When the user accesses the online site, the user's web browser (or user client program) sends various user environment information to the online server. Among these user access information, IP, time of connection, type of web browser and type of device (mobile) Mobile device type) and store this information in DB. In particular, IP information is used to find out the user's area. IP is allocated to the city / county / gu / dong unit by region / group by ISPs. Using the data, additionally extract and save the user's access area / group. In order to store the connection environment information for each user, information indicating the identity of the user (for example, an ID or a user identification key given to the user on the online site) is required. This information is obtained at the time of login, and additionally when a cookie is used. Even before login, find the user key using the user identification information stored in the cookie.

In this way, the user's connection environment information can be obtained and stored, and the connection environment pattern can be determined by comparing the current connection environment information with the accumulated information for a predetermined period.

1 is a schematic diagram of a method for detecting an illegal use possibility by checking the access environment information of a visitor and comparing it with past access information when a user accesses an online site.

<Description of the symbols for the main parts of the drawings>

①: User access to online site

②: The user logs into the online site using his / her ID and password.

③: process of checking if the cookie representing the user's identity is stored

④: The beginning of the process of detecting whether the accessor is fraudulent

⑤: Process of reading connection environment information of currently connected user

⑥: Process of finding user area / group by comparing user access IP with IP area / group mapping data to find user's current area / group

⑦: Current connection environment information of visitor

⑧: The process of importing the past connection environment information record of the connecting user from the saved DB.

⑨: past connection environment information of the connecting user

⑩: Process of comparing current real-time user's connection environment information and past pattern

⑪: The process of sending a warning to the security manager and the owner of the element when the access environment pattern such as the user's using area is different from the past pattern.

⑫: Process of additionally saving current connection environment information in DB

2 is a current (real time) connection environment information structure of a visitor;

3 is a structure of accessor's past connection environment information.

Hereinafter will be described in detail.

The user accesses the online site (Fig. 1 ①) and logs in (Fig. 1 ②) to perform a series of actions using the site contents. When such an action occurs, a fraudulent user detection process is performed from the first access or the login from ④ to 접속 of FIG. 1 (③ in FIG. 1 is an additional process). Fig. 2 is a real time user access environment information structure of a user who is currently connected, and Fig. 3 is a historical access environment information recording structure of a user who is connected.

Details of this method are as follows.

When a user connects to an online site, the user is distinguished from a user cookie that is sent to the online site server or an ID password that is entered at login. Once the user is identified, the process of checking whether the user is likely to be a fraudulent user is started (from ④ in FIG. 1).

The details of the process for checking whether there is a possibility of an illegal user are as follows.

When the user accesses the online site, the web browser (or client program) used by the user delivers the user's IP, browser type (client program type), and device information to the online site server. After reading the user connection environment information (⑤ in Fig. 1), the region / group information is found from the IP region / group information in the IP area / group information to obtain the region / group information (⑥ in Fig. 1). Find current connection environment information (7 in FIG. 1). On the other hand, when the user who is connected is connected in the past, the connection environment information is taken from the connection environment record DB (8 in Fig. 1) to form the past connection environment recording data (9 in Fig. 1). Then, the current access environment information of the visitor (FIG. 2: region, group name, web browser / client program type, device used) and a plurality of historical access environment information records (FIG. 3: region, group name, web browser / client program type, Contrast the information used. If the current connection environment information obtained in real time is not in the past connection environment information record, the user's connection environment is suddenly changed. Therefore, the illegal user is different from the principal use area of the element user (or the illegal user, not the element user's device). Device (i.e., illegally acquired ID / password) (i) of FIG. 1 and a warning message that there is a possibility of illegal use is sent to the security manager and the owner of the element (i) of FIG. Finally, the currently connected connection environment information is also stored in the connection environment record DB so that it can be used later (Fig. 1).

As described above, the present invention, even if there is an illegally obtained ID and password, the use of this, compared to the explicit user access environment pattern used by the element owners by revealing the possibility of illegal users further security I can strengthen it.

In general, even if the user illegally obtained the ID / password, the user may use it in a different region than the original user (owner) or use a different type of web browser and device. The fraudulent use can be detected even in the final illegal stage of the fraudulent user's attempt. In general, in the case of using a perfect ID and password obtained illegally, since there is no effective detection method at present, security incidents caused by the frequently used ID and password are prevented. The effect is very high.

In addition, this method uses illegal information based on specific data such as user connection environment information, IP region / group information, and device information, which are obtained in real time, explicitly and specifically according to the system communication protocol. The chance of being caught or blocked is very high.

Claims (1)

When a user accesses the online site, the user's real-time access environment information (area, user group, device, web browser or client program type) and past connection environment information (area, user group, device, web browser) Or the type of client program), if there is a discrepancy, how to detect / prevent fraud by warning the security manager and the owner of the element if there is a difference.