KR20190069171A - An authenticating apparatus and an authenticating method applying open id idp for identifying user to fido uaf for enhancing security authentication of sdn - Google Patents

Abstract

According to an embodiment of the present invention, an authentication system may authenticate and identify a user based on biometric information and a global identifier to enhance authentication security of a software defined network (SDN) structure. Therefore, the authentication system may identify a plurality of users registered in a terminal. Furthermore, when an unregistered user intends to register with the terminal, the terminal may enhance the security of the terminal by blocking registration of the unregistered user without permission of a main user of the terminal.

Description

TECHNICAL FIELD [0001] The present invention relates to an authentication method and an authentication apparatus for applying an Open IDP for identifying a user to a FIDO UAF in order to enhance security authentication of an SDN. SDN}

The present invention relates to an apparatus and method for authenticating a user.

Fast Identity Online (FIDO) is a federation for establishing international standards for providing online authentication services that take advantage of the uniqueness of biometric information. FIDO's biometric authentication protocol is called Universal Authentication Framework (UAF). Since the authentication process is performed by checking the biometric information at the user terminal, the FIDO biometric authentication protocol can prevent the leakage of the personal information.

The present invention proposes an apparatus and method for authenticating a user using global identifier and biometric information.

 According to another embodiment of the present invention, there is provided an authentication method performed by a terminal, the method comprising: requesting an authentication server connected to the terminal to provide a service to be used by a user of the terminal; receiving challenge data corresponding to the request from the authentication server; Generating biometric information from the user when receiving the biometric information, generating response data to be transmitted to the authentication server based on the obtained biometric information, and authenticating the user, And transmitting the response data to the authentication server to obtain session information, wherein the response data includes an authentication method including a global identifier used to authenticate the user using redirection at the authentication server / RTI >

According to one embodiment, the response data includes an Uniform Resource Identifier (URI) including an address of an identifier providing service to be redirected by the authentication server as the global identifier.

According to one embodiment, the generating step generates the response data based on the private key corresponding to the user and the challenge data when the obtained biometric information matches the biometric information of the user stored in advance An authentication method is provided.

According to an embodiment, there is provided an authentication method performed by an authentication server, the authentication method comprising: receiving a request for a service provided from the authentication server from a terminal connected to the authentication server; Determining whether the response data is generated based on the biometric information of the user when the response data corresponding to the challenge data is received from the terminal; Identifying the user based on the global identifier included in the response data, and transmitting the session information for the service to the terminal based on the identified user / RTI >

According to one embodiment, the identifying step redirects the identifier to an identifier providing service that generates a global identifier using the biometric information of the user based on the global identifier included in the response data, thereby authenticating the user Method is provided.

According to an embodiment, the determining step may determine whether the response data is generated based on the biometric information of the user by using a public key corresponding to the user of the terminal, An authentication method generated based on previously obtained biometric information is provided.

According to an embodiment, the user can be authenticated using the global identifier and the biometric information.

FIG. 1 conceptually illustrates an authentication system in a Software Defined Network (SDN) according to one embodiment.
2 is a flowchart illustrating an operation of authenticating a user in an authentication system according to an embodiment.
3 is a flowchart illustrating an operation performed when a plurality of users are registered in a terminal of an authentication system according to an exemplary embodiment.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are presented for the purpose of describing embodiments only in accordance with the concepts of the present invention, May be embodied in various forms and are not limited to the embodiments described herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms " comprises ", or " having ", and the like, are used to specify one or more of the features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

FIG. 1 conceptually illustrates an authentication system in a Software Defined Network (SDN) according to one embodiment.

The authentication system can identify the user using the extended FIDO UAF authentication scheme. Alternatively, the authentication system may identify the user using the U2F, which performs two-step authentication through the additional element. The biometric information of the user is unique information given to the user from the time the user is born. The authentication system may be connected to an application service using SDN such as public service and financial service, and may provide a function of authenticating a user so that the application service provides a personalized service to the user.

Referring to FIG. 1, the authentication system can utilize the biometric information (for example, fingerprint, iris, vein, face, etc.) obtained from the user to authenticate the user. More specifically, the terminal 110 of the authentication system may include a sensor capable of acquiring biometric information, and may identify the user based on the biometric information obtained from the sensor. That is, an operation to identify a user using biometric information may be performed locally (e.g., at the terminal 110). The authentication system according to one embodiment includes a global identifier (" global identifier) to prevent a malicious user from registering with the stolen terminal 110, thereby preventing the stolen terminal 110 from being abused.

More specifically, the authentication system according to an embodiment can generate and manage a global identifier capable of identifying a user using an Open ID. Open ID is an authentication service standard that integrates account information managed by different network services into a single ID, and makes it possible to use multiple network services without using a single ID. Referring to FIG. 1, there is shown an Identity Provider (IDP) 130 for generating a global identifier for a user. The IDP 130 may provide a global identifier in a Uniform Resource Locator (URL) or Uniform Resource Identifier (URI) format. The global identifier of the URI format can be used as an Internet address so that the user can access each of the plurality of network services 120 without joining each of the plurality of network services 120 connected to the IDP 130. [

The process by which the authentication system authenticates and identifies a user can be largely divided into (1) an operation of registering a user, and (2) an operation of authenticating a user. When the user is registered, the terminal 110 can acquire biometric information of the user. The obtained biometric information of the user can be used to generate a private key and a public key by an authenticator executed in the terminal 110. The authenticator in the terminal 110 and the client application (FIDO client) requesting authentication of the user can be connected through an interface such as an ASM (Authenticator Specific Module). The private key may be stored in the terminal 110 and the public key may be stored in the IDP 130, the RP (Relying Party), or the authentication server. The RP can provide the network service to the user.

The IDP 130, the Relying Party (RP), or the authentication server storing the public key may store the public key, and then generate a global identifier corresponding to the user. The generated global identifier can be used to identify the user. The global identifier may be provided to the terminal 110 or the user of the terminal 110. Global identifiers may be generated based on the URI format.

When the user is authenticated, the terminal 110 and the IDP 130 can identify the user using the biometric information of the user. When a user is identified by communication between the terminal 110 and the IDP 130, a global identifier corresponding to the identified user can be generated. The global identifier may be generated based on the public key stored in the IDP 130. Since the global identifier is generated based on the public key unique to the user, it can be utilized to identify the user. The generated global identifier can be utilized as SSO (Single Sign On) which can be utilized in IDP 130 as well as other network services 120. The global identifier may be used to identify a user using Open ID, Security Assertion Markup Language (SAML), or the like.

2 is a flowchart illustrating an operation of authenticating a user in an authentication system according to an embodiment.

2, when a user wants to use a network service, the terminal 210 may request an authentication server to provide a network service that a user of the terminal 210 wants to use. When the terminal 210 and the authentication server communicate, TLS (Transport Layer Security) can be used to maintain security. The biometric information authentication service 220 of the authentication server may request the terminal 210 to perform authentication based on the user's biometric information in response to the user's request. The biometric information authentication service 220 can transmit to the terminal 210 the challenge data used for generating the authentication result based on the biometric information, the policy data related to the policy for authenticating the biometric information, and the authenticator information.

The terminal 210 receiving the challenge data, the policy data, and the authenticator information can acquire the biometric information of the user. Using the policy data or the authenticator information, the terminal 210 can identify the type of biometric information to be acquired from the user. The user can input biometric information (fingerprint, iris, vein, gate, face, etc.) through the sensor of the terminal 210.

The terminal 210 can access an area (for example, a security area of the memory or encrypted storage) in which the private key is stored in the terminal 210 using the acquired biometric information of the user. The terminal 210 can acquire the private key corresponding to the biometric information in the area. Based on the obtained private key, the terminal 210 may perform an electronic signature on the challenge data. The terminal 210 may generate response data including the resultant digital signature and the global identifier received from the authentication server in the process of registering the user. The generated response data can be transmitted to the biometric information authentication service 220 of the authentication server.

The biometric information authentication service 220 that has received the response data can determine whether the result data included in the response data is generated using the private key. Specifically, the biometric information authentication service 220 can verify the response data using the public key of the user stored in the authentication server in the process of registering the user. In addition, the biometric information authentication service 220 can redirect to the IDP service 230 of the authentication server using the global identifier included in the received response data.

The IDP service 230 may generate the global identifier of the user in the URL or URI format in the process of registering the user. The IDP service 230 can identify the user of the terminal 210 using the global identifier. The IDP service 230 can transmit the result of identifying the user to the biometric information authentication service 220. [ The IDP service 230 determines the validity of the received global identifier based on whether (1) the parameter of the global identifier matches the URI of the instance, and (2) whether the parameter of the global identifier is reached within a preset allowable time Can be inspected.

The biometric information authentication service 220 transmits the session information 210 corresponding to the network service request of the terminal 210 based on the result of verifying the response data using the public key and the result of identifying the user received from the IDP service 230 Or whether to generate cookie information. When generating the session information or the cookie information, the biometric information authentication service 220 may transmit the generated session information or cookie information to the terminal 210. [ The terminal 210 can access the network service using the received session information or cookie information.

In summary, an authentication system according to one embodiment can authenticate and identify a user based on biometric information and a global identifier, for authentication security enhancement of the SDN architecture. Accordingly, the authentication system can identify a plurality of users registered in the terminal 210. [ Furthermore, when an unregistered user wants to register with the terminal 210, the terminal 210 blocks the registration of the unregistered user without permission of the main user of the terminal 210, thereby enhancing the security of the terminal 210 .

3 is a flowchart illustrating an operation performed when a plurality of users are registered in a terminal of an authentication system according to an exemplary embodiment. Assume that a first user registers with a terminal in which no user is registered.

Referring to FIG. 3, in step 310, the terminal can acquire biometric information of the first user. In step 320, the terminal may generate a private key and a public key corresponding to the first user from the acquired biometric information. The private key may be stored in the terminal. The public key may be transmitted to an authentication server connected to the terminal. The authentication server can generate a global identifier for the first user and transmit the global identifier to the terminal. The global identifier may also be stored in the terminal. The process performed by the terminal until the global identifier is received after acquiring the user's biometric information is referred to as a registration process for the user.

Referring to FIG. 3, after a first user is registered, a second user may attempt to register with the terminal. The terminal can determine whether the second user attempts to register based on whether the inputted biometric information is biometric information corresponding to the first user. When the input biometric information is biometric information corresponding to the first user, the terminal can perform the authentication of the first user based on FIG. If the inputted biometric information is not biometric information corresponding to the first user, the terminal can determine whether to perform the registration process of registering the second user based on the inputted biometric information.

More specifically, at step 330, if the second user attempts to register with the terminal, at step 340, the terminal may determine whether the first user has approved the registration. That is, the terminal may ask the first user whether to approve the registration of the second user, unlike when registering the first user. In other words, the terminal can determine the first user as the primary user controlling the registration process of the terminal.

When the first user inputs the biometric information of the first user to the terminal in response to the request of the terminal, the terminal can perform the registration process for the second user in step 350. Therefore, if the first user does not input his / her biometric information to the terminal, the second user can not register with the terminal. As a result, since the registration process is not performed without the approval of the first user, a situation in which a plurality of users are indiscriminately registered in the terminal can be prevented.

 Table 1 shows pseudo code operations performed by the terminal when registering a plurality of users.

 Referring to Table 1, if one user account exists in the terminal, an existing user account can be selected as the main user account. If you register additional user accounts, you can not add user accounts without the approval of the selected primary user account.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

110: terminal
120: Network Services
130: IDP

Claims (6)

In an authentication method performed in a terminal,
Requesting an authentication server connected to the terminal to provide a service to be used by a user of the terminal;
Acquiring biometric information from the user when receiving challenge data corresponding to the request from the authentication server;
Generating response data to be transmitted to the authentication server based on the obtained biometric information; And
Transmitting the response data to the authentication server to obtain session information for the service generated by the authentication server by authenticating the user;
Lt; / RTI >
The response data includes:
And a global identifier used to authenticate the user using redirection at the authentication server. The method according to claim 1,
The response data includes:
And a URI (Uniform Resource Identifier) including an address of an identifier providing service to be redirected by the authentication server as the global identifier. The method according to claim 1,
Wherein the generating comprises:
And generates the response data based on the private key corresponding to the user and the challenge data when the acquired biometric information matches the biometric information of the user stored in advance. In an authentication method performed by an authentication server,
Receiving a request for a service provided by the authentication server from a terminal connected to the authentication server;
Transmitting challenge data to the terminal in response to the received request;
Determining whether the response data is generated based on the user's biometric information when receiving response data corresponding to the challenge data from the terminal;
Identifying the user based on the global identifier included in the response data when the response data is generated using the biometric information of the user; And
Transmitting session information for the service to the terminal based on the identified user;
. 5. The method of claim 4,
Wherein the identifying comprises:
And redirecting the identifier to an identifier providing service for generating a global identifier based on the user's biometric information based on the global identifier included in the response data. 5. The method of claim 4,
Wherein the determining step comprises:
Determining whether the response data is generated based on the biometric information of the user by using a public key corresponding to the user of the terminal,
The public key includes:
Based on biometric information previously obtained from the user.

Images