KR20120054949A - Method for establishing a dynamic user-centric trust relationship - Google Patents

Abstract

PURPOSE: A method for forming a dynamic user centric trust relationship is provided to form trust relationships between services under the Internet and form a dynamic trust relationship that requests of a user are reflected. CONSTITUTION: An IDP server(200) receives trust information to be used for verifying dynamic trust relationship from a user who accesses the Internet. The IDP server receives a request for forming a dynamic trust relationship with a specific SP(Service Provider) server(120) from the user. The specific SP server receives the trust information from the user which accesses the Internet. The IDP server and the specific SP server mutually authenticate each other about whether the IDP server and the specific SP server have the trust information. The IDP server and the specific SP server form a dynamic trust relationship.

Description

Method for Establishing a Dynamic User-centric Trust Relationship

The present invention relates to a method of establishing trust between Internet services on the Internet, and more particularly, to a method of forming a user-centric dynamic trust relationship.

The meaning of trust between service objects in the Internet environment is as follows. The fact that service object A trusts service object B means that service object A trusts and accepts the contents of the message that service object B sends. In the Internet service environment, the method of forming trust between the existing Internet services was the method in which the Internet services based on the business agreement between the Internet services were centered. In this way, since the user's requirements are not reflected at all, even if any application service is provided to the user through a trust relationship, there is a limit to ultimately satisfying the user's requirements.

That is, in the conventional method, the trust relationship centered on the Internet service based on the business agreement is a fixed and closed static trust relationship that is formed through the business agreement and is maintained until the agreement is destroyed. This static trust relationship is implemented through cryptography, and typical protocols include PKI, Kerberos, and SAML.

On the other hand, a trust relationship in which service objects A and B form or release a trust relationship according to a user's request is called a dynamic trust relationship. Therefore, in order to become a user-centered Internet environment in which user requirements are reflected, it is required to dynamically form a trust relationship between Internet services according to a user's request. In other words, it is preferable that Internet services A and B dynamically form or release a trust relationship according to a user's request. Since dynamic trust is dynamically formed / released according to the user's needs, the efficiency of cryptography is of paramount importance.

An object of the present invention is to provide a method for providing a user-centered Internet service by forming a dynamic trust relationship in which a user's needs are reflected in forming a trust relationship between services in an Internet environment.

Other objects of the present invention will be readily understood through the following description.

According to an aspect of the present invention, in a method for forming a user-centric dynamic trust relationship between a personal information management service providing server (IDP server) and an Internet service providing server (SP server), the IDP server, the user connected to the Internet Receiving from said trust information to be used for verification of said dynamic trust relationship formation; Receiving, by the IDP server, a request for establishing a dynamic trust relationship with a specific SP server from the Internet-connected user; Receiving, by the specific SP server, the trust information from the user connected to the Internet; And establishing a dynamic trust relationship by performing mutual authentication on whether the IDP server and the specific SP server hold the trust information, thereby forming a dynamic trust relationship.

According to the present invention, it is possible to efficiently form a dynamic trust reflecting the user's needs in establishing a trust relationship between services in the Internet environment, and through such a dynamic trust relationship, the user can only dynamically trust the Internet service that he / she needs. Groups can be formed.

 In addition, according to the present invention, it is possible to automatically change the user's personal information stored in the Internet service providers.

In addition, according to the present invention, when the user subscribes to the Internet service directly selected, it is possible to automatically subscribe without repeatedly inputting personal information.

In addition, according to the present invention, the user can create a SSO group for services that the user actually wants SSO in the Internet environment, and can substantially increase the user's convenience by supporting SSO for the SSO group.

1 is a conceptual diagram related to the formation of a user-centric dynamic trust relationship according to an embodiment of the present invention.
2 is a general flow of a method for forming a dynamic trust relationship according to an embodiment of the present invention.
3 is a conceptual diagram related to automatic change of user-centered personal information in an Internet environment.
4 is a conceptual diagram related to user-centered automatic internet subscription in the Internet environment.
5 is a conceptual diagram related to user oriented single sign-on (SSO) in the Internet environment.

The present invention may be variously modified and have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail with reference to the accompanying drawings. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

In describing the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals (eg, first, second, etc.) used in the description process of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, in the present specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that, unless there is an opposite substrate, it may be connected or connected via another component in the middle.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention.

1 is a conceptual diagram related to the formation of a user-centered dynamic trust relationship according to the present invention, and FIG. 2 is a general flow of a method for forming a dynamic trust relationship according to an embodiment of the present invention.

The present invention relates to a personal information management service provider (ID service provider, hereinafter referred to as IDP) and an Internet service provider based on trust information provided by a user (refer to s of FIG. 1, hereinafter referred to as s). (Hereinafter abbreviated as SP) provides a method (or protocol) for forming a simple dynamic trust relationship. In other words, if the user provides the trust information through the secure channel in advance to the ID service and the general Internet service requiring dynamic trust, the ID service and the general Internet service confirm the existence of the trust information provided by the user. To form. In the present invention, in order to implement a dynamic trust relationship with an efficient encryption technique, the public key is excluded and only the hash is used to increase the efficiency.

Accordingly, in the present invention, as illustrated in FIG. 1, an IDP (IDP server 200 of FIG. 1) in which a user connected to the Internet (refer to the user terminal 110 of FIG. 1) needs to form a dynamic trust relationship. If the agreement information a is provided to the ISP and the ISP (see the ISP server 120 of FIG. 1) through a preset secure channel, the IDP and the ISP mutually retain the agreement information a provided by the user. By verifying / verifying, we establish a dynamic trust relationship.

Here, since the trust information s is information provided by the user as information used for verifying the dynamic trust relationship formation between the IDP and the SP, the dynamic trust relationship between the IDP and the SP will be referred to as a user-centered dynamic trust relationship.

Accordingly, in the present invention, the IDP provides the personal information management service to the SP based on the formed dynamic trust relationship.

The method of forming a user-centric dynamic trust relationship according to the present invention described above may be performed according to the flow of the embodiment shown in FIG. 2. Hereinafter, a method of forming a user-centric dynamic trust relationship according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

The method for forming a user-centric dynamic trust relationship according to an embodiment of the present invention may be largely composed of four steps, as shown in FIG. 2.

Referring to FIG. 2, in the method of forming a dynamic trust relationship according to the present invention, the user selects and joins an IDP to manage his / her ID information [S100], and the user needs to form a dynamic trust relationship with the IDP. Selecting an SP [S200], forming a dynamic trust relationship between the IDP and the SP selected by the user [S300], and based on the dynamic trust tube between the IDP and the SP, the IDP determines the user's ID information. It consists of a step [S400] to properly manage.

Hereinafter, each configuration step will be described.

[Step S100]

A user accesses the Internet through a web browser or the like of his own terminal, and then selects and subscribes to an IDP that is most likely to be used and trusted among several IDPs. When signing up, the user goes through the identity verification process and provides his / her ID information to be managed on the Internet.

Here, ID information refers to all information related to an identity of a user, and general information may correspond to personal information. For example, the ID information includes a social security number, a user's real name, age, gender, a service ID and password (id / password), a phone number, a mobile phone number, an address, an email address, a work address, a work address, a work phone number, and the like. Various personal information may be included. Here, the service ID refers to an ID used for using the corresponding service and is distinguished from the ID information. In addition, the ID information may include additional information (for example, a field of interest, a hobby, etc.) in addition to the information related to the identity of the user.

In addition to the above general ID information, the user provides trust information s (hereinafter, referred to as s) for forming user-centric dynamic trust. The trust information s is determined by the length of a normal password that a person can remember. Since the trust information s corresponds to the authentication information of the dynamic trust, the user's web browser transmits using the secure channel HTTPS when transmitting between the IDP web servers. Currently, HTTPS is a mandatory technology that all Internet service providers, such as IDP and SP, must use when transmitting user's important ID information.

[Step S200]

The user selects SPs that need to establish a dynamic trust relationship with the IDP they use. These SPs are effectively the SPs that the user actually uses.

[Step S300]

According to an embodiment of the present invention, the step of forming a dynamic trust relationship between the IDP and the SP selected by the user may be performed through the following process.

[A] The user logs in through the authentication process to the IDP designated to act on his or her personal information management in step S200.

[B] After the login, the user tells the IDP the URL of the SP and requests to establish dynamic trust.

In this case, the IDP uses a predetermined hash function of intermediary information f for ID association, IDP_URL (hereinafter abbreviated as IU), t _i , TQ and stored trust information s. To generate the hashed first hash value information h1 (= H (f || IU || t _i || TQ || s)). Subsequently, a trust relationship is requested while transmitting the f, t _i , TQ and h1 to the SP. In this case, the transmission method may be HTTP POST Redirection (IDP->User-> SP).

Here, f, t _i , TQ, s are all symbols defined in the UTIDM protocol, f is ID federating information, and t _i is a time stamp generated by IDP. IDP), TQ means trust request information, and s means trust secret information.

The SP receives the trust request message from the IDP and verifies the user with f and IU. If the user has already established a trust relationship with the IDP, it is considered a reuse attack and ignored, otherwise the user is asked to provide trust information s'. In this case, the transmission method may be HTTP Response (SP-> User).

[D] The user receives a request from the SP, enters trust information s '(where s' is the same as the trust information s described above, but otherwise indicated for description on the specification) and sends it to the SP. . In this case, the transmission method may be HTTPS (user-> SP).

[E] When the SP receives the trust information s 'from the user, the SP hashes the f, IU, t _i , and TQ received from the s' and the IDP, so that the second hash value information h2 (= H (f || IU || t _i | Calculate | TQ || s')). At this time, if h1 and h2 are the same, and hashes f, SP_URL (hereinafter, abbreviated as SU), t _s , TS, and s', and the third hash value information h3 (= H (f || SU || t _s | TS | s'))) and send f, t _s , TS and h3 to the IDP. In this case, the transmission method may be HTTP POST Redirection (SP->User-> IDP). In this case, the SP registers the IDP as the IDP of the user. However, if h1 and h2 are different, the error is sent to IDP without accepting the dynamic trust request from IDP.

Here, the t _s and TS are all symbols defined in the UTIDM protocol, t _s denotes a time stamp generated by SP, and TS denotes trust response information. .

[F] The IDP receives the dynamic trust response message from the SP and verifies the user with f and SU. If a trust relationship with the SP is already established for the user, the IDP considers it to be a reuse attack and ignores it. Otherwise, the IDP hashes the received f, SU, t _s , TS, and the stored user trust information s. Generates value information h4 (= H (f || SU || t _s TS || s)).

In this case, when comparing h3 and h4, if the same, the dynamic trust relationship is formed with the SP, and the SP is included in the managed trust group MSG of the user, and f is stored as intermediary information for ID association. If not, send an error message to the SP and inform the user of the error condition.

According to the method of forming a dynamic trust relationship according to the above process, at the request of the user, the IDP forms a dynamic trust relationship with the SP selected by the user, and the SP is included in the user's management SP group (ie, MSG). In this process, the IDP and the SP share the trust information s provided by the user, and the id association is performed through the intermediary information f. Therefore, according to the present invention, the user can form a dynamic trust group using only the Internet service required by the user based on the dynamic trust relationship, which can be a basis for user information management and the like. In forming the dynamic trust, IDP uses t _i and SP uses t _s as the time stamp.

The foregoing describes the dynamic trust formation process. In this case, the dynamic trust release may be requested when the user determines that the ID information management of the specific SP through the IDP is not necessary. Accordingly, when dynamic trust is released between the IDP and a specific SP, the IDP removes the SP from the dynamic trust group, and the SP must delete the user's trust information s and IDP information. The dynamic trust protocol is basically the same as the SSO protocol, only the contents of the information passed from the IDP to the SP change from authentication to dynamic trust.

If the dynamic trust is normally released, the SP deletes the user's trust information s. However, a malicious SP may not delete the trust information s. In preparation for this possibility, the user should be able to change the trust s for the new dynamic trust group. In this case, the change of the trust information s may be changed from C (Common ID) to a new s'. Since the ID information change protocol guarantees the confidentiality and integrity of the changed information, it can be applied to the change of trust information s.

[Step S400]

After the dynamic trust relationship is formed between the IDP and the SP according to the user's request, the step of properly managing the personal information of the user by the IDP may include three management functions as described below. Hereinafter, the specific content of each management function is demonstrated.

[Auto change function of personal information-see Fig. 3]

When a dynamic trust is established according to the above process, the IDP automatically provides the personal information of the user to the SP. Thereafter, the function of automatically changing the personal information of the user may be performed according to the following process.

[A] As some of the user's personal information in the IDP changes, the user asks the IDP to reflect the UC to all SPs in the MSG. Here, UC is a symbol defined in the UTIDM protocol, which means an updated common ID.

In this case, IDP hashes the f, IU, t _i , UQ, and s to generate fifth hash value information h5 (= H (f || IU || t _i || UQ || s)). Then, f, t _i , UQ and h5 are transmitted to SP1 included in the MSG. In this case, the transmission method may be HTTP POST (IDP-> SP). Here, UQ is a symbol defined in the UTIDM protocol and means change request information for updating common ID.

In this case, the SP identifies the user with f and IU received from the IDP, compares the stored time stamp t _i 'with the currently received time stamp t _i , and reuses if t _i <= t _i '. It is regarded as an attack and ignored, and if t _i > t _i ', the stored s and the received f, IU, t _i and UQ are hashed so that the sixth hash value information h6 (= H (f || IU || t _i || UQ || s))

At this time, if h5 and h6 are the same, the SP accepts the user's personal information change request from the IDP, hashes f, SU, t _s , US, s, and the seventh hash value information h7 (= H (f || SU | After generating | t _s || US || s)), send f, t _s , US, and h7 to IDP. In this case, the transmission method may be HTTP POST Redirection (SP-> IDP). Here, US is a symbol defined in the UTIDM protocol and means a response information for updating common ID.

However, if h5 and h6 are different, it rejects the request for change of personal information and sends an error message to IDP. In this case, the transmission method may be HTTP POST Redirection (SP1-> IDP).

[D] In this case, IDP identifies the user with f and SU received from SP1, compares the previously saved t _s 'with the currently received t _s , if t _s <= t _s ', If it is ignored and t _s > t _s ', hashing the stored s and the received f, SU, t _s , US, and the eighth hash value information h8 (= H (f || SU || t _s || US || s)).

At this time, if h7 and h8 are the same, the session key k = h ((t _i || t _s ) ^ (f || s)) is generated. Then, f and UC are hashed to generate ninth hash value information h9 (= H (f || UC)), and UC is encrypted using session key k to generate E (= E _k (UC)). Send f, E and h9 to the IDP. In this case, the transmission method may be HTTP POST Redirection (IDP-> SP). If h7 and h8 are different, report an error to the user.

Where k and E are symbols defined in the UTIDM protocol, k is a session key generated between the IDP and the SP by the UTIDM key-forming protocol, and E is information encrypted by session key k. Means.

In this case, the SP identifies the user with f and IU received from the IDP, and generates the session key k = h ((t _i || t _s ) ^ (f || s)) as in the case of IDP. Decode At this time, to verify the integrity of f and UC = D _k (E), the tenth hash value information h10 (= H (f || UC)) is calculated and if the value is equal to h9, the user's personal information is changed to UC and t _i Is stored as the most successful time stamp value for the user and a completion message is sent to the IDP. If h9 and h10 are different, the integrity is broken and an error message is sent to the IDP. In this case, the transmission method may be HTTP POST (SP-> IDP).

When the IDP receives the completion message from SP1, it stores t _s as the most successful time stamp for the user and completes the change of the user's personal information stored in SP1. If you receive an error message from SP1, report it to the user. The above procedure applies to all SPs in the management SP group.

Therefore, according to the present invention, when a user needs to change personal information on the Internet, the user can automatically change the ID through the IDP for the management SP group without having to remember and access the SP in which the personal information is stored. Increased privacy and convenience in

[Internet automatic subscription function-see Figure 4]

After the user-centered dynamic trust relationship is formed, the automatic subscription to the Internet may be performed according to the following process.

IDP generates the session key k = h ((t _i || t _s ) ^ (f || s)). H and the personal information C (common ID) are hashed to generate eleventh hash value information h11 (= H (f || C)), and C is encrypted with the session key k to obtain E (= E _k (C)). And send f, E, and h11 to the SP. In this case, the transmission method may be an HTTP POST redirection method (IDP->user-> SP).

[B] The SP checks the user with f and IU (IDP_URL) among the information received from the IDP, and checks the f and s values already stored by the user. Like IDP, E is generated by generating the session key k = h ((t _i || t _s ) ^ (f || s)). In order to confirm the integrity of C, the twelfth hash value information h12 (= H (f || D _k (E))) is calculated and compared with h11, and C is stored as the user's personal information. Then ask the user for the local id / passwd setting for the SP. In addition, to provide the service, it requests additional personal information of the user that is specialized for SP. The id / passwd from the user is received via HTTPS. In this case, the transmission method may be HTTP Response (SP-> user) or HTTPS Request (user-> SP).

Once all the necessary information has been collected, a normal completion message is sent to the IDP. In this case, the transmission method may be HTTP POST Redirection (SP-> user-> IDP).

If h11 and h12 are different, the integrity is broken and an error message is sent to the IDP. In this case, the transmission method may be HTTP POST Redirection (SP->user-> IDP).

[C] The IDP will complete the automatic internet sign-up process upon receipt of a normal completion notice from the SP. At this time, when the error situation notification from the SP informs the user of the situation.

As the number of Internet service providers increases, the number of Internet services that users subscribe to is increasing. In order to subscribe to an Internet service, most service providers require the user's personal information, which is mostly similar. Therefore, users must bear the inconvenience of having to enter similar personal information every time they subscribe to the Internet service. Therefore, by using the above-mentioned Internet auto-subscription function, the user automatically provides personal information stored in IDP in advance without having to repeatedly enter similar types of personal information each time he / she subscribes to the desired SP. It becomes convenient.

[Single Sign-On (SSO) Function-See FIG. 5]

After the user-oriented dynamic trust relationship is formed, the SSO function may be performed according to the following process.

First, SSGs are formed by selecting SPs among MSGs that a user wants to apply SSO to. The IDP then provides SSO to the user for the SSG. In this case, the SSO may be provided by the following process.

[A] The user authenticates with the IDP to obtain an IDP authentication cookie.

[B] In this case, the IDP hashes f, IU (IDP_URL), time stamp t _i, authentication confirmation information A (authentication confirm information), and s to generate the thirteenth hash value information h13 (= H (f || IU ||). t _i || A || s)) and send f, t _I , A, and h13 to SP1 in the SSG. In this case, the transmission method may be HTTP POST Redirection (IDP->User-> SP). Where A is a symbol defined in the UTIDM protocol.

[Is] SP will validate the user with f and IU received from IDP and is 'as compared to the currently received t _i, t _i <= t _i' already t _i stored, ignoring regarded as a replay attack, and If t _i > t _i ', the previously stored s, the received f, t _i and A are hashed and the 14th hash value information h14 (= H (f || IU || t _i || A || s)) If h13 and h14 are the same, IDP authentication based on dynamic trust and information integrity transmitted are verified, the authentication cookie for SP1 is issued, and t _i is the most successful time stamp value for the user. Save and send the normal completion message to IDP. In this case, the transmission method may be HTTP GET Redirection (SP->User-> IDP).

If h13 and h14 are different, the IDP authentication and information integrity are considered to be broken and an error message is sent to the IDP. In this case, the transmission method may be HTTP GET Redirection (SP->User-> IDP).

[D] If IDP receives normal notification, SSO repeats the above process for all SPs that need SSO. If an error notification is received, IDP notifies the user of the situation.

SSO is enabled for the services selected by the user, which greatly increases the user's convenience.

Although the above has been described with reference to embodiments of the present invention, those skilled in the art may variously modify the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. And can be changed easily.

110: user terminal
120: SP server
200: IDP server

Claims (13)

In the method of forming a user-centric dynamic trust relationship between an IDP server and an Internet service provision server (SP server),
Receiving, by the IDP server, trust information to be used for verifying the dynamic trust relationship establishment from an internet connected user;
Receiving, by the IDP server, a request for establishing a dynamic trust relationship with a specific SP server from the Internet-connected user;
Receiving, by the specific SP server, the trust information from the user connected to the Internet; And
Forming a dynamic trust relationship by performing mutual authentication on whether the IDP server and the specific SP server hold the trust information;
Method for forming a user-centric dynamic trust relationship comprising a.
The method of claim 1,
Forming the dynamic trust relationship,
The IDP server may be configured to pre-specify a hash function of mediating information for linking personal information of the user, URL information of the IDP, time stamp information of the IDP generated by the IDP, trust request information, and trust information received from the user. generating first hash value information hashed using a hash function;
Transmitting, by the IDP server, the first hash value information, the mediation information, the IDP time stamp information, and the trust request information to the specific SP server;
The specific SP server hashes the mediation information received from the IDP server, the URL information of the IDP, the IDP time stamp information, the trust request information, and the trust information received from the user using the predetermined hash function. Generating a second hash value information; And
When the second hash value information matches the transmitted first hash value information, accepting, by the specific SP server, a dynamic trust relationship formation request from the IDP server
Method for forming a user-centric dynamic trust relationship comprising a.
The method of claim 2,
Forming the dynamic trust relationship,
The specific SP server hashes the mediation information, URL information of the specific SP, time stamp information of the SP generated by the specific SP, response information for a trust request, and trust information received by the specific SP from the user. Generating one third hash value information;
Sending, by the specific SP server, the third hash value information, the mediation information, the SP time stamp information, and the trust response information to the IDP server;
Generating, by the IDP server, fourth hash value information that hashes the received mediation information, the URL information of the SP, the SP time stamp information, the trust response information, and the trust information received from the user by the IDP server. step; And
If the fourth hash value information matches the transmitted third hash value information, the IDP server completing a dynamic trust relationship with the specific ISP server;
Method for forming a user-centric dynamic trust relationship further comprising.
The method of claim 2,
The specific SP server, receiving the trust information from the user connected to the Internet,
And requesting provision of trust information from the user connected to the Internet, upon receiving the request for establishing the dynamic trust relationship from the IDP server.
The method of claim 2,
The specific ISP server accepting the dynamic trust relationship establishment request from the IDP server,
And registering, by the specific SP server, the IDP server, which has requested the dynamic trust relationship, as the IDP server of the user.
The method of claim 2,
Comprising the IDP server to complete the dynamic trust relationship with the particular ISP server,
Registering, by the IDP server, the specific SP having the dynamic trust relationship with a managed SP group of the user, and storing the intermediate information as information for ID association between the IDP server and the specific SP;
User-centric dynamic trust relationship forming method comprising a.
The method of claim 1,
After forming the dynamic trust relationship,
Changing the personal information of the user at the request of the user;
Changing the personal information of the user,
Generating, by the IDP server, fifth hash value information hashing the mediation information, URL information of the IDP, current time stamp information of the IDP server, change request information according to the changed personal information of the user, and the trust information. step;
Transmitting, by the IDP server, the fifth hash value information, the mediation information, the current time stamp information of the IDP server, and the change request information to the specific SP;
The SP server compares previous time stamp information of the IDP previously stored by the current time stamp information of the IDP received from the IDP server, and the received IDP time stamp is the previous time stamp of the IDP. Generating greater than sixth hash value information hashing the media information received from the IDP, URL information of the IDP, current time stamp information of the IDP, the change request information, and trust information; And
When the sixth hash value information matches the fifth hash value information, accepting, by the specific SP server, a personal information change request from the IDP server
Method for forming a user-centric dynamic trust relationship comprising a.
The method of claim 7, wherein
Changing the personal information of the user,
The specific SP server generates seventh hash value information hashing the mediation information, URL information of the specific SP, current time stamp information of the specific SP, change response information for the personal information change request, and the trust information. Making;
Sending, by the specific SP server, the seventh hash value information, the mediation information, the current time stamp information of the SP, and the change response information to the IDP server;
The IDP server compares the current time stamp information of the SP received from the specific SP with previous time stamp information of the SP, and if the current time stamp of the SP is greater than the previous time stamp of the SP, Generating eighth hash value information hashing information, URL information of the SP, current time stamp information of the SP, the change response information, and the trust information;
When the eighth hash value information matches the seventh hash value information, the IDP server generates a session key, generates encrypted information encrypting the user's changed personal information using the generated session key, and Generating ninth hash value information hashing the media information and the changed personal information;
Transmitting, by the IDP server, the ninth hash value information, the mediation information, and the encryption information to the specific SP;
Generating, by the specific SP server, the encrypted personal information to obtain the changed personal information, and generating tenth hash value information that hashes the obtained changed personal information and the intermediate information; And
If the tenth hash value information matches the ninth hash value information, changing the personal information of the user according to the obtained changed personal information by the specific SP server;
Method for forming a user-centric dynamic trust relationship further comprising.
The method of claim 8,
Changing the personal information of the user,
Updating, by the specific SP server, time stamp information of the IDP server using the current time stamp information received from the IDP server; And
Updating, by the IDP server, time stamp information of the SP server using the current time step information received from the specific SP server;
Method for forming a user-centric dynamic trust relationship further comprising.
The method of claim 1,
After forming the dynamic trust relationship,
Automatically subscribing a user to an Internet service for a specific SP based on the formed dynamic trust relationship,
The step of automatically subscribing to the Internet service,
The IDP server generates a session key, generates encrypted information that encrypts the personal information of the user using the session key, and generates eleventh hash value information that hashes the intermediate information and the personal information of the user. Making;
Transmitting, by the IDP server, the eleventh hash value information, the encryption information, and the intermediate information to an SP server to which the user intends to subscribe to an Internet service;
Acquiring, by the SP server, the received encrypted information to obtain personal information of the user, and generating twelfth hash value information that hashes the obtained personal information and the mediated information; And
If the twelfth hash value information matches the eleventh hash value information, storing, by the SP server, the obtained personal information as personal information of a user
Method for forming a user-centric dynamic trust relationship comprising a.
The method of claim 1,
After forming the dynamic trust relationship,
SSO authentication access step further comprises, the SSO authentication access step,
Generating, by the IDP server, thirteenth hash value information hashing the mediation information, URL information of the IDP, current time stamp information of the IDP server, authentication confirmation information required for SSO authentication access, and the trust information;
Transmitting, by the IDP server, the thirteenth hash value information, the mediation information, the current time stamp information of the IDP server, and the authentication confirmation information to a specific SP server;
The specific SP server compares the current time stamp information of the received IDP server with previous time stamp information of the IDP server, and if the current time stamp is greater than the previous time stamp, the received intermediate information and the current time. Generating a fourteenth hash value information hashing the stamp information, the authentication confirmation information, and the trust information;
When the 14th hash value information matches the 13th hash value information, generating a authentication cookie for the SSO authentication access by the specific SP server
Method for forming a user-centric dynamic trust relationship comprising a.
The method of claim 1,
After forming the dynamic trust relationship,
Receiving, by the IDP server, a request to release a dynamic trust relationship with a particular ISP server from the user connected to the Internet; And
In response to the dynamic trust relationship release request, deleting, by the IDP server, the requested ISP server from the dynamic trust group.
Method for forming a user-centric dynamic trust relationship further comprising a.
The method of claim 1,
After forming the dynamic trust relationship,
Receiving, by the IDP server, a change request of the trust information from the user connected to the Internet; And
Changing, by the IDP server and the specific ISP server, the consent information according to the ID information change protocol in response to the trust information change request;
User-centric dynamic trust formation method further comprising.

Images