KR20130035258A - Method and system for access control using call authentication - Google Patents

Abstract

PURPOSE: An access control method and a system capable of using a telephony approval are provided to prevent a falsification by controlling an abnormal access and performing an authentication through an additional terminal. CONSTITUTION: An access control system comprises an access person access terminal(110), an access person telephone terminal(120), a controllable target server(130), a telephony authentication server(140), and an administrator telephony terminal(150). The access person access terminal is connected with a controllable target server through local or remote and access to the data stored in the server. The access person access terminal transmits the authentication information according to the authentication request of the telephony authentication server. The controllable target server stores major core content when providing various services. The telephony authentication server is related with the controllable target server, confirms the authenticity of the server connection from the access person telephone terminal, and authenticates the access authentication for the access person telephone terminal. [Reference numerals] (110) Access person access terminal; (120) Access person telephone terminal; (130) Controllable target server; (140) Telephony authentication server; (150) Administrator telephony terminal;

Description

Method and system for access control using call authentication

The present invention relates to a method and system that can control abnormal access by enabling server access through telephone authentication to accessor and responsible person for a request for server access.

In general server access control, appropriate access control measures are applied based on criteria evaluated from various viewpoints such as business importance and information sensitivity, and work is performed to check the status of work performed after connecting to the server and to prevent accidents due to intentional or negligence. It also logs the history and in some cases operates an internal policy such as the inability to execute a command for a specific work order.

Basically, the ID / password check is the most common means of controlling server access, and when accessing important servers such as transaction ledgers and ATM machine operations of financial institutions, the user's work is controlled. Server security solutions and account security solutions This is also used.

The main function of the server security solution is to control the access rights of the system to unauthorized persons. The account security solution supports centralized management of heterogeneous systems, life cycle of accounts, and complex authentication based on PKI.

In some cases, this security solution and user authentication may be linked to SMS authentication, public certificate, and fingerprint recognition system.

However, these server security solutions and account security solutions are limited due to the high solution cost and the system to be introduced and applicable.

In particular, most of the individual security solutions such as web firewall, intrusion detection, and PC security that have a single function are actually controlled by ID / password authentication.

In addition, a large number of personal information leakage accidents occur frequently due to system management negligence, and authentication means such as personal authentication as well as personal authentication means used as a means of personal identification by means of evolving hacking methods such as memory hacking, malware, Zeus bot, etc. Theft of the situation is increasing day by day.

To date, the above authentication means have a limitation of being unidirectional in the same channel.

The one-way transaction does not verify the authenticity of the request by not checking whether the user has requested the use of the service for the service provided by the Internet service provider. Since the information is inputted, it can be arbitrarily manipulated by hacking in the inputting and checking step.

Using the interface provided by the operating system, even for simple system access control technology method and legitimate account information, it is possible to use the service in the situation of high probability of the illegal transaction using the personal information and illegally acquired information, and to confirm between the parties. Methods and means are needed.

Korean Unexamined Patent Publication No. 2001-0055118 (2001.07.04) discloses a technique for a method of authenticating using a certificate issued through a public institution.

Republic of Korea Patent Publication No. 2001-0055118 (2001.07.04)

The present invention is to provide a method and system for access control using a telephone authorization that can control the abnormal access by enabling the server access through the telephone authentication to the accessor and the responsible person for the request for access to the server.

In addition, the present invention does not perform authentication in the terminal accessing the server, access through the authentication of the phone that can not be forged by performing authentication through a separate terminal through the communication between the server providing the service and the server performing the phone authentication To provide a control method and system.

In addition, the present invention requires an input for approval and rejection for a request for access to the server by two-way authentication, and is processed by the input, thereby providing an access control method and system using telephone approval that can enhance identity verification and nonrepudiation. It is to provide.

In addition, the present invention detects abnormal symptoms of abnormal server access to determine the abnormal symptoms such as suspected hacking access control method using a phone authorization that can prevent the accident in advance by the user or the information subject to the user in the system It is to provide a system.

According to an aspect of the present invention, there is provided a method for controlling abnormal access by enabling server access through telephone authentication to accessor and responsible person for a request for server access.

According to an embodiment of the present invention, a method for authenticating that a connection of a visitor access terminal to a control target server is true, the method comprising: receiving a server connection request from the visitor access terminal; Requesting, by the control target server, a phone authentication server to include a at least one of the server connection request information and the visitor telephone terminal information; The telephone authentication server transmits an authentication information request guide including the server access request information to the visitor phone terminal by using the accessor phone terminal information, obtains authentication information, performs accessor authentication, and sends an authentication result to the control target server. Transmitting; And when the control target server confirms that the authentication result is an authentication success or an approval confirmation, the access control method using the telephone approval may include providing a connection of the accessor access terminal to the server.

The telephone authentication server transmits the authentication information request guide including the server connection request information to the visitor telephone terminal by using the telephone terminal information of the person responsible for access to the server of the visitor to obtain the authentication information, and authenticate the visitor. The method may further include transmitting an authentication result to the control target server.

The control server requesting the phone authentication to the phone authentication server may be implemented in the Authentication Package (Authentication Package) on the LS (Local Security Authority Service) -based interface provided by the operating system.

The control server requesting the phone authentication to the phone authentication server may receive a phone number from an external server security system or an account security system, including a separate phone authentication gateway server, and transmit the phone number to the phone authentication server.

According to another aspect of the present invention, there is provided a system capable of controlling abnormal access by enabling server access through telephone authentication to accessor and responsible person for a request for server access.

According to an embodiment of the present invention, a phone authentication server for transmitting the server connection request information and the visitor phone terminal information requested by the accessor access terminal to the visitor phone terminal to obtain authentication information to perform a phone authentication to generate an authentication result; And a control target server which does not approve or disapprove access to the server requested by the visitor access terminal according to the authentication result, and an access control system using a telephone approval to control access to the server through telephone authentication. have.

An authentication package may be implemented and executed in an LSAS based interface provided by an operating system of the controlled server.

The control target server may include a phone authentication gateway server that receives a phone number from an external server security system or an account security system and delivers the phone number to the phone authentication server.

By providing a method and a system for controlling access using telephone days according to an embodiment of the present invention, an abnormal access can be controlled by enabling a server access through a telephone authentication to an accessor and a person in charge for a request for accessing a server. .

In addition, the present invention has the advantage that forgery is not possible by performing authentication through a separate terminal through communication between a server providing a service and a server performing telephone authentication without performing authentication in a terminal accessing the server.

In addition, the present invention requires an input for approval and rejection for a request for server connection by two-way authentication, and is processed by the input, thereby enhancing the identity verification and nonrepudiation function.

In addition, the present invention has the advantage of preventing the accident in advance by detecting the abnormal symptoms of abnormal server connection by automatically blocking the server connection when determining abnormal symptoms such as hacking suspects.

Furthermore, since the present invention uses an interface provided by the operating system, there is an advantage that it can be inexpensively implemented without the need of a separate gateway or application type system.

Therefore, there is an advantage that can be widely used in a variety of value-added services, such as remote access control, security server access, use of abnormal symptoms analysis results.

1 is a block diagram schematically showing the configuration of an access control system based on telephone authentication according to an embodiment of the present invention.
2 is a flow diagram illustrating an access control procedure based on telephone authentication according to an embodiment of the present invention.
3 is a flow chart illustrating a visitor authentication procedure in the access control procedure of FIG.
4 is a flow chart showing a responsible person authentication procedure in the access control procedure of FIG.
5 is a schematic diagram illustrating a process of requesting telephone authentication by identifying a server access by a server access control agent installed in a server when using an interface provided by an operating system;
6 is an overall service configuration diagram illustrating a case of linking to a separate server security system or an account security system;
7 is a screen diagram of a server management policy used when linked to a separate server security system or an account security system.
8 is a flowchart illustrating an abnormal symptom access control procedure according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[Description of Fig. 1]

1 is a block diagram schematically showing the configuration of an access control system using a telephone authorization according to an embodiment of the present invention.

Referring to FIG. 1, the access control system includes a visitor access terminal 110, a visitor telephone terminal 120, a control target server 130, a phone authentication server 140, and a responsible telephone terminal 150.

The visitor access terminal 110 is a device that is connected to the control target server 130 locally or remotely to access the stored data of the server 130.

For example, the accessor access terminal 110 may be a computer, a notebook computer, a mobile communication terminal, a smartphone, a tablet PC, a PDA, or the like. Of course, in addition to the accessor access terminal 110 may be applied to all the same if the communication function device.

The visitor phone terminal 120 is a device for transmitting authentication information according to an authentication request of the phone authentication server 140. The visitor phone terminal 120 is a device registered or designated by the visitor access terminal 110 in order to be granted access authority to the control target server 130, and is connected with the phone authentication server 140 to provide authentication information for access approval. It may be provided to the phone authentication server 140.

Alternatively, the accessor phone terminal 120 may be a phone terminal 120 held by the owner of the data stored in the control target server 130. For example, the certificate is stored in the roaming server and the owner of the certificate is connected to the roaming server. If you want to use the public certificate, the control target server 130 is to allow the owner of the certificate to authenticate for access authorization to the phone terminal is confirmed to be the owner, such as real name.

The visitor phone terminal 120 may be equally applicable to a device capable of performing a telephone function, for example, a mobile communication terminal or a landline telephone.

The server to be controlled 130 is a device that stores the main core contents in providing various services.

For example, the controlled server 130 may be a server of an intermediary service that brokers goods for sale of goods online, or may be a server of a game service that provides games online. That is, the control target server 130 may be equally applied to all devices that provide a specific service online.

In addition, the controlled server may be a server that manages various systems. For example, an authentication management system server, an abnormal symptom system server, a customer management system server, an ATM server, a DB security system server, a NAC management system server, a PC security system server, It can be an SSO server, a VPN server, and so on. Similarly, when accessing a cloud server or using data in a roaming management server or accessing a roaming management server or using data in a roaming management server.

The control target server 130 requests a user authentication for the accessor access terminal 110 to the telephone authentication server 140 according to the server access request of the accessor access terminal 110 to obtain an authentication result, and according to the authentication result. The service requested by the accessor access terminal 110 may be provided.

The phone authentication server 140 is interlocked with the control target server 130, and checks the authenticity of the server connection from the visitor telephone terminal 120 when the visitor access terminal 110 wants to access the control target server 130. Means for authenticating the access right to the accessor access terminal 110.

For example, the telephone authentication server 140, at the request of the control target server 130, for the access authority authentication of the visitor access terminal 110, to the visitor access terminal 110 to the visitor phone terminal 120. By requesting the user authentication for the user to obtain the authentication information, after performing the user authentication using this can provide the authentication result to the control target server (130).

In addition, the phone authentication server 140 is a voice prompt, voice recognition, voice recording, DTMF (Dual Tone Multi Frequency) collection, TTS (Text-To-Speech) It may be a special resource for performing such a function. For example, the authentication server 140 may be an IP (Intellectual peripheral) of an intelligent network system.

[Description of FIGS. 2 and 4]

2 is a flowchart illustrating an access control procedure based on telephone authentication according to an embodiment of the present invention, FIG. 3 is a flowchart illustrating an accessor authentication procedure in the access control procedure of FIG. 2, and FIG. 4 is an access control procedure of FIG. 2. Is a flow chart showing the person's certification process.

In step 210, the control target server 130 receives a server access request from the accessor access terminal 110.

Accordingly, in step 215, the control target server 130 determines whether the server connection request of the visitor access terminal 110 requires control.

For example, the server manager is responsible for detecting abnormal symptoms even after the initial connection, and especially for private tasks such as system format and file deletion. In the case where the access control of the server accessor is set as a necessary condition by the access control will be made according to the present invention.

If the user needs to check the reliability of the server, in step 220, the server to be controlled 130 may request information on the server connection requested by the accessor access terminal 110 (called 'server connection purpose' for convenience of understanding and explanation). And a phone authentication request including at least one of authentication terminal information registered corresponding to the accessor access terminal 110 to the phone authentication server 140.

In step 225, a phone authentication is performed from the server accessor through a request to the phone authentication server 140 to obtain an authentication result. If necessary, in step 230, a separate phone authentication is performed from the server administrator to obtain an authentication result.

For convenience of understanding and explanation, the telephone authentication procedure for the visitor will be described with reference to FIG. 3.

In operation 310, the telephone authentication server 140 transmits an authentication information request including a service type included in the telephone authentication request to the visitor telephone terminal 120 using the authentication terminal information.

In step 315, the phone authentication server 140 obtains authentication information from the visitor phone terminal 120.

For example, the phone authentication server 140 may obtain authentication information from the visitor phone terminal 120 using DTMF.

In step 320, the phone authentication server 140 authenticates the user of the accessor access terminal 110 using the authentication information, and then transmits the authentication result to the control target server 130 in step 330.

On the other hand, the phone authentication server 140 may record and store the phone authentication process when the phone authentication for the visitor proceeds by voice, and thus may be used as evidence or other evidence for the user's disclaimer.

That is, in step 325, the phone authentication server 140 stores the recorded information through the phone authentication process, and optionally transmits the authentication result to the control target server 130 in step 330.

As such, when the visitor access terminal 110 requests access to the control target server 130, the control target server 130 is interworked with the telephone authentication server 140 to verify authenticity of the access to the server. Phone authentication can be performed to obtain an authentication result.

Referring back to FIG. 2, in step 235, the control target server 130 determines whether the authentication result obtained from the telephone authentication server 140 is authentication success or authentication failure.

If the authentication result is successful, in step 240, the control target server 130 approves the server access of the visitor access terminal 110.

However, if the authentication result is an authentication failure, the control target server 130 repeats the telephone authentication procedure of step 225 a specified number of times.

In step 245, the control target server 130 accumulates and stores the authentication result for the visitor access terminal 110, and statistically processes and stores a log of the access history of the accessor access terminal 110.

On the other hand, in step 230, in addition to the telephone approval for the visitor may be a telephone approval for the server owner.

For this purpose, the telephone authentication procedure for the responsible person will be described with reference to FIG. 4.

In step 410, the phone authentication server 140 transmits the authentication information request including the service type included in the phone authentication request to the responsible telephone terminal 120 using the authentication terminal information.

In step 415, the phone authentication server 140 obtains authentication information from the responsible phone terminal 120, and in step 420, the phone authentication server 140 authenticates the user of the visitor access terminal 110 using the authentication information. After the execution, the authentication result is transmitted to the control target server 130 in step 425.

In addition, the phone authentication server 140 may record and store the phone authentication process when the phone authentication for the responsible person is performed by voice. In step 425, the phone authentication server 140 stores the recorded information through the phone authentication process. And, when transmitting the authentication result to the control target server 130 in step 430 it is optionally transmitted together.

In this way, the control target server 130 checks whether the server connection of the accessor is true and valid through the telephone of the person responsible for accessing the server, apart from confirming the authenticity of the accessor through the telephone approval of the visitor. More granular server access control can be implemented.

Hereinafter will be described in detail the access control method for each base to which the present invention is applied.

[Description of Fig. 5]

5 is a schematic diagram illustrating a process of requesting phone authentication by identifying a server access by a server access control agent installed in a server when using an interface provided by an operating system.

Operating System (OS) provides a Local Security Authority Service (LSAS), so the present invention can be implemented based on such a security architecture.

In other words, in the case of Microsoft, the system can be accessed only when the phone authentication is completed after checking the user account on the Winlogon-based or LSASS-based interface provided. In the LSASS-based Server Authientication Fileter, It can be implemented by interlocking Gina, CP based on WinLogon.

At this time, LSASS-based Server Authientication Fileter is implemented Winlogon and LSASS in turn, and then performs Authentication Package.In this case, implement Server Authentication fileter of MSV1_0 (LM / NTLM) module. Specify.

Then, the user can log in only after filter authentication processing is completed after ID / password authentication. Therefore, the present invention can be applied to filter authentication.

Unlike Winlogon, Gina and CP are interworked and implemented. Similarly, Winlogin and Gina (Vista and below) or CP (Vista and above) are linked before Server Authenticaton is executed. Then, it is possible to confirm whether the phone authentication of the present invention after the ID / password authentication is completed.

[Description of FIGS. 6 and 7]

6 is a diagram illustrating a whole service configuration showing a case of linking to a separate server security system or an account security system, and FIG. 7 is a screen diagram of a server management policy used when linking to a separate server security system or an account security system. .

In this case, the controlled server identifies a user accessing the controlled server by including a separate telephone authentication gateway server, and interlocks with a linked server security system server or an account management system and delivers the phone number stored therein to the telephone authentication server. Perform phone authentication.

At this time, the phone authentication gateway server is responsible for interfacing the phone authentication account, managing the phone authentication policy, and querying the authentication history log in relation to the server security system server or the account management system.

In this case, the phone authentication gateway server may individually set whether to use the phone authentication for the accessor and the person in charge, and the conditions necessary for phone authentication in managing the plurality of phone authentication servers that they have as shown in FIG.

[Description of Fig. 8]

8 is a flowchart illustrating an abnormal symptom access control procedure according to an embodiment of the present invention.

According to the present invention, the control target server accumulates and stores the authentication result for the visitor access terminal 110, and statistically processes and stores the log of the access history of the accessor access terminal 110.

The information related to the stored access and authentication is analyzed and classified into a normal pattern and an abnormal pattern, and the abnormal pattern is databased with an abnormal symptom.

When the server access request newly received from the accessor access terminal corresponds to the abnormal symptom database, telephone authentication is automatically started to control abnormal access.

That is, when the server connection request requested to the control target server is detected as abnormal in step 810, the phone authentication server is requested to the phone authentication server in step 815.

In steps 820 and 825, the telephone connection is authenticated individually or together to determine whether the requesting server connection is true for the visitor and the person in charge, so that in case of abnormality, the server connection can be blocked to prevent further accidents.

In step 830, if the authentication result is normal, the server notifies the accessor access terminal to approve the server access through step 835. In step 840, the authentication result and the access history are additionally logged and stored.

On the other hand, the method for performing user authentication based on telephone authentication according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various electronic means for processing information may be recorded in the storage medium. The storage medium may include program instructions, data files, data structures, etc. alone or in combination.

Program instructions to be recorded on the storage medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software. Examples of storage media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic-optical media such as floppy disks. hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

110: accessor connection terminal
120: visitor telephone terminal
130: server under control
140: phone authentication server

Claims (8)

In the method of authenticating that the connection to the control target server of the visitor connection terminal is true,
Receiving, by the control target server, a server access request from the accessor access terminal;
Requesting, by the control target server, a telephone authentication server to include a server authentication request information and a visitor telephone terminal information;
The telephone authentication server transmits an authentication information request guide including the server access request information to the visitor phone terminal by using the accessor phone terminal information, obtains authentication information, performs accessor authentication, and sends an authentication result to the control target server. Transmitting; And
And authorizing, by the control target server, the access result to the server of the accessor access terminal when the authentication result is authentication success or approval confirmation.
The method according to claim 1,
The telephone authentication server transmits the authentication information request guide including the server connection request information to the visitor telephone terminal by using the telephone terminal information of the person in charge of whether the accessor is connected to the server to obtain the authentication information. And performing authentication to transmit the authentication result to the controlled server.
The method according to claim 1,
The control server requests the phone authentication to the phone authentication server by implementing an authentication package on an Local Security Authority Service (LSAS) based interface provided by an operating system (OS). Access control method using telephone authorization.
The method according to claim 1,
The control server requests the phone authentication to the phone authentication server, the phone authentication gateway server, including receiving a telephone number from an external server security system or account security system, characterized in that the transfer to the phone authentication server Access control method using telephone authorization.
3. The method according to claim 1 or 2,
And the telephone authentication server further comprises recording and storing a telephone authentication process.
A telephone authentication server for transmitting the server connection request information and the visitor telephone terminal information requested by the visitor access terminal to the visitor telephone terminal to obtain authentication information to perform phone authentication to generate an authentication result; And
And an access control system for controlling access to the server through phone authentication, including a control target server which does not approve or approve access to the server requested by the visitor access terminal according to the authentication result.
The method of claim 6,
Access control using telephone authorization, characterized in that an authentication package is implemented and executed in a local security authority service (LSAS) based interface provided by an operating system (OS) of the controlled server. system.
The method of claim 6,
The controlled server includes a telephone authentication gateway server which receives a telephone number from an external server security system or an account security system and transmits the telephone number to a telephone authentication server.

Images