KR20230151785A - Two-factor authentication access control method and system for each account and service using SDP - Google Patents

Abstract

A two-factor authentication access control method and system for each account and service using SDP is disclosed. An access control method performed in a server device according to one aspect of the present invention includes performing account authentication for a connected user terminal and a user; Confirming one or more available services according to the account authentication results; and providing connection information to the service server to the user terminal so that each service can be provided through user authentication from the service server providing the available services.

Description

Two-factor authentication access control method and system for each account and service using SDP}

The present invention is to provide a two-factor authentication access control method and system for each account and service using SDP.

Organizations, including companies, utilize work systems that multiple users access and use. Typically, in order to manage access to work systems for security reasons, accounts are issued to permitted users, and access is granted after a login procedure using ID/password, etc.

Because the user authentication process in these business systems determines whether or not to authenticate simply based on the account information (ID/password, etc.) associated with the user, problems may arise where abnormal users are allowed access due to hijacked accounts.

And, a typical conventional security method is a perimeter security method that responds to external attacks using a firewall. However, as malicious code that disables firewalls is often used, stability cannot be guaranteed with this security method.

In particular, recently, most people are using the cloud method. Cloud services allow user terminals located in remote locations to access and use cloud servers through a network. Therefore, the importance of security for connected users is increasing.

Republic of Korea Patent Publication No. 10-2015-0094548 Method and system for remote access and remote digital signature

Therefore, the present invention was devised to solve the above-mentioned problems, and is intended to provide a two-factor authentication access control method and system for each account and service using SDP that can enhance security for connected users.

In addition, the present invention is intended to provide a two-factor authentication access control method and system for each account and service using SDP to provide a minimum work environment while enhancing security by providing a processing method for each level according to the authentication result.

Other objects of the present invention will become clearer through the preferred embodiments described below.

According to one aspect of the present invention, an access control method performed in a server device includes the steps of performing account authentication for a connected user terminal and a user; Confirming one or more available services according to the account authentication result; And providing connection information to the service server to the user terminal so that each service can be provided by user authentication from the service server providing the available service. Dual processing for each account and service using SDP. An authentication access control method is provided.

Here, the account authentication results can be provided to the service server to be used for user authentication.

Additionally, the user terminal and network information can be provided to the service server, and the connection information that can be temporarily connected can be obtained from the service server.

In addition, the security level is determined using one or more of the location of the user terminal, whether it is moving, the number/type of nearby terminals searched using wireless signals, and whether a specific security program is installed, and the security is used to check the available services. Grades are available.

In addition, the result of the account authentication including the security level is provided to the service server, but the service server may apply a different method for user authentication according to the security level.

In addition, the result of the account authentication including the security level is provided to the service server, and the service server may apply a different user interface to the provided service depending on the security level.

Additionally, the account authentication may be re-performed at a periodicity according to the security level, and the result of the account authentication re-performance may be provided to the service server connected to the user terminal.

Additionally, the re-authentication method, de-identification level, and service screen size for each security level may be set differently.

According to another aspect of the present invention, there is a computer program stored in a computer-readable medium that performs a two-factor authentication access control method for each account and service using SDP, wherein the computer program causes the computer to perform the following steps, The steps include performing account authentication for the connected user terminal and the user; Confirming one or more available services according to the account authentication result; and providing connection information to the service server to the user terminal so that each service can be provided by user authentication from the service server providing the available services. A computer stored in a computer-readable medium. Program is provided.

According to another aspect of the present invention, account authentication is performed for the connected user terminal and the user, one or more available services are confirmed according to the account authentication results, and connection information to the service server providing each available service is provided. an access control server provided to the user terminal; A dual authentication access control system for each account and service using SDP is provided, including a plurality of service servers that perform user authentication and provide services.

Here, the access control server provides information about the user terminal and the network together with the result of the account authentication to the service server, and the service server provides temporary access based on the information about the user terminal and the network. The access information is generated and provided to the access control server, and the account authentication result can be used for user authentication.

In addition, the access control server determines the security level using one or more of the location of the user terminal, whether it moves, the number/type of nearby terminals searched using wireless signals, and whether a specific security program is installed, and the service server may apply a different method for user authentication according to the security level, or may apply a different user interface to the provided service according to the security level.

Additionally, the service server can set different re-authentication cycles, de-identification levels, and service screen sizes for each security level.

According to the present invention, security for connected users can be strengthened through two-factor authentication for each available service according to the result of account authentication for the user/terminal.

In addition, according to the present invention, by providing a processing method for each level according to the authentication result, it is possible to provide a minimal work environment while enhancing security.

Figure 1 is a configuration diagram schematically showing the entire system for two-factor authentication access control for each account and service using SDP according to an embodiment of the present invention.
Figure 2 is a flowchart showing an access control process performed in an access control server according to an embodiment of the present invention.
Figure 3 is an example diagram illustrating two-factor authentication access control for each account and service using SDP according to an embodiment of the present invention.
Figure 4 is a flow chart showing a processing process in an access control system according to an embodiment of the present invention.
Figure 5 is a flowchart showing an access control process using a security level performed in an access control server according to an embodiment of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention.

When a component is said to be "connected" or "connected" to another component, it is understood that it may be directly connected to or connected to the other component, but that other components may exist in between. It should be. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between.

Terms such as first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, terms such as first threshold and second threshold, which will be described later, may be pre-designated as thresholds that are substantially different or partially the same, but may cause confusion when expressed with the same word, threshold. Since there is room, for convenience of classification, terms such as first and second will be used together.

The terms used herein are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as “comprise” or “have” are intended to indicate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

In addition, the components of the embodiments described with reference to each drawing are not limited to the corresponding embodiments, and may be implemented to be included in other embodiments within the scope of maintaining the technical spirit of the present invention, and may also be included in separate embodiments. Even if the description is omitted, it is natural that a plurality of embodiments may be re-implemented as a single integrated embodiment.

In addition, when describing with reference to the accompanying drawings, identical or related reference numbers will be assigned to identical or related elements regardless of the drawing symbols, and overlapping descriptions thereof will be omitted. In describing the present invention, if it is determined that a detailed description of related known technologies may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

Figure 1 is a schematic configuration diagram showing the entire system for two-factor authentication access control for each account and service using SDP according to an embodiment of the present invention, and Figure 2 is a configuration diagram schematically showing the system in the access control server according to an embodiment of the present invention. It is a flowchart showing the access control process performed, and Figure 3 is an example diagram illustrating two-factor authentication access control for each account and service using SDP according to an embodiment of the present invention.

Referring to FIG. 1, the entire system according to this embodiment includes a user terminal 10, an access control server 20, and a service server 30-1, ..., 30-n, hereinafter collectively referred to as 30. .

The user can use online services (business services, etc.) provided by the service server 30 using the user terminal 10, which is his/her terminal device. According to this embodiment, the service server only through the access control server 20. (30) can be used.

To this end, the user must perform account authentication with the access control server 20, and if account authentication is successful, a separate user authentication must be performed on the connected service server 30. In other words, the desired online service can be used only when double authentication is performed for account authentication with the access control server 20 and user authentication with the service server 30.

Referring to Figure 2, the access control server 20 performs account authentication for the connected user terminal 10 (S210), for example, by checking whether the user is a pre-registered authorized member using ID/password, etc. Member authentication and device authentication (using device identification information such as beer address) are performed to determine whether the device is a pre-registered terminal device.

And, when account authentication for the connected user terminal 10 is successful, the access control server 20 checks the services available for the account (hereinafter referred to as available services) (S220).

Here, the access control server 20 uses the location of the user terminal 10 (using GPS location information, AP (access point) information, IP address, etc.), whether it is moving (using changes in location information), and wireless signals. The number/type of nearby terminals discovered (the number or type of nearby terminal devices discovered through short-range wireless communication signals such as Wi-Fi, Bluetooth, etc. (mobile devices, APs, personal PCs, etc.)), and whether a specific security program is installed. It can be used to determine the security level and check available services.

Security levels can be set in various ways, and depending on the security level, available service types, authentication method when accessing the service server 30, whether to re-perform account authentication (or cycle), de-identification conversion level (non-identification processing of personal information) grade), interface method (for example, service screen size, etc.) may vary. This will be explained in more detail later.

In addition, the access control server 20 provides connection information to the service server 30 to the user terminal 10 so that each service can be provided by user authentication from the service server 30 providing available services. (S230).

Here, according to one example, the process of providing information about the user terminal 10 and network information to the service server 30 that provides available services and obtaining temporarily accessible connection information from the service server 30 is further performed. may be included. In other words, by providing temporary connection information to the corresponding user terminal 10, it is possible to prevent other terminals from connecting.

Additionally, according to one example, the access control server 20 may provide the result of account authentication to the service server 30 so that the service server 30 can use it for future user authentication. That is, the access control server 20 provides account authentication results (eg, user terminal 10 information, network environment information, security level information, etc.) to the service server 30 that provides available services.

Referring to Figure 3, which shows one scenario, when a human resources manager and a developer as users access the access control server 20 and perform account authentication, the access information for using each business service is sent to the access control server 20. ) is provided from. Accordingly, personnel managers can use common work services and personnel management services from the corresponding service server 30, and developers can use common work services and developer services. Of course, when connecting to each service server 30, each user authentication (ID/password authentication, etc.) must be performed to use the service.

According to one example, the SDP API can be used as shown in the drawing, and Software Defined Perimeter (SDP for short) is also called 'Black Cloud' and was used in the Black Core Network of GIG (Global Information Grid) around 2007. By priority, it is an approach to computer security that evolved from work done by the Defense Information Systems Agency (DISA). SDP is a framework that controls access to resources based on identity. It checks the status of network devices, terminals, and user IDs and grants access only to authorized users and terminals. No services are provided to unauthorized terminals. You will not be able to get any connection information. The infrastructure operates as a 'black cloud' network where DNS information or IP addresses are not known until authentication and authorization are performed, so hackers cannot easily breach the security.

In addition, according to one example, as shown in FIG. 3, the access control server 20 may relay the service from the service server 30 between the user terminal 10 and, of course, this is only one embodiment and the service The server 30 may communicate directly with the connected user terminal 10 after user authentication.

Figure 4 is a flowchart showing a processing process in an access control system according to an embodiment of the present invention.

Referring to FIG. 4, the access control server 20 performs account authentication for the user/device (user terminal 10) (S410). As described above, member authentication using ID/password, etc., and authentication of the user terminal 10 as to whether it is a pre-registered terminal device are performed.

In addition, the access control server 20 sends the authentication result, including information about the user terminal 10 and information about the network used by the user terminal 10, to each service server 30 that provides the confirmed available service. Provided as (S420).

The service server 30 that receives this stores information about the user terminal 10, creates temporary access information (S430), and provides it to the access control server 20 (S440).

The access control server 20 provides related information, such as temporary access information to the service server 30, to the user terminal 10 (S450).

When the user terminal 10 is connected using temporary access information, user authentication is performed based on the registered member information, but user authentication is further performed using information about the user terminal 10 previously stored in S430 (e.g. For example, check whether the connection is from the same user terminal 10).

According to this embodiment, the access control server 20 first performs account authentication to check available services, and each service server 30 provides services after user authentication, thereby strengthening security through double authentication. Additionally, by performing additional authentication on the user terminal 10 using temporary access information, security performance can be improved by blocking access from other terminal devices that are not account authenticated.

Figure 5 is a flowchart illustrating an access control process using a security level performed by the access control server 20 according to an embodiment of the present invention.

Referring to FIG. 5, the access control server 20 determines the security level according to the terminal status during account authentication (S510).

As described above, the security level may vary depending on the location of the user terminal 10. For example, when providing corporate business services, the security level may vary depending on whether the user terminal 10 exists within the company office or outside, and furthermore, if it is outside, whether it moves (movement speed can also be used) You can use more. For convenience of understanding, for example, if it is determined that the movement is using public transportation, etc., the service screen size may be reduced to reduce the amount of information displayed when providing the service.

Additionally, the number and type of nearby terminals discovered by the user terminal 10 using wireless signals can be used. For example, the number of nearby terminals means that there are many people around, so the amount of information exposed can be minimized, and the type of nearby terminals is a personal PC, an AP such as a router, or a mobile device such as a smartphone. It may also vary depending on the device. The user terminal 10 operates a short-distance wireless communication function such as Wi-Fi or Bluetooth to receive signals from surrounding terminals and provides information about this to the access control server 20, and the access control server 20 The information is used to determine the security level.

Additionally, whether a specific security program is installed on the user terminal 10 can be further used to determine the security level. For example, it is checked whether a specific anti-virus program or a security program provided by the access control server 20 is installed (and update information).

The access control server 20 provides information about the determined security level to the service server 30 (S520).

The service server 30 may apply different user authentication methods, service provision methods, user interfaces, etc. to the connected user terminals 10 according to the security level. For example, if the security level is the lowest, mobile phone authentication is added, the display screen is provided at the minimum size when providing the service, and all personal information (e.g. name, address, resident registration number, etc.) is stored. It is provided after de-identifying the information (replacing it with other information).

The access control server 20 re-performs account authentication at intervals according to the security level and informs the service server 30 of the re-performance result (S530). For example, account authentication is performed every 1 hour at security level 1, every 30 minutes at security level 2, and every 5 minutes at the lowest security level, and the re-performance result is notified to the service server 30. It goes without saying that if re-performance fails, the provided service may be discontinued.

Here, according to one example, when re-performing account authentication begins, the service server 30 stops the service being provided, and when re-performing account authentication succeeds, it cancels the suspension of the service and provides the service again.

According to another example, when the service server 30 requests access from the user terminal 10 to specific information (referred to as security information) preset for each security level, account authentication is performed in conjunction with the access control server 20. It can be done again.

In addition, the service server 30 can also perform re-authentication of user authentication at a cycle and method according to security level. For example, if the security level is the highest, mobile phone authentication can be performed every hour by entering a password, and if the security level is the lowest, mobile phone authentication can be performed every 10 minutes.

A computer program stored in a computer-readable medium may be provided that performs the two-factor authentication access control method for each account and service using the above-described SDP.

Additionally, the two-factor authentication access control method for each account and service using SDP described above can be implemented as computer-readable code on a computer-readable recording medium. Computer-readable recording media include all types of recording media storing data that can be deciphered by a computer system. For example, there may be Read Only Memory (ROM), Random Access Memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, etc. Additionally, the computer-readable recording medium can be distributed to computer systems connected through a computer communication network, and stored and executed as code that can be read in a distributed manner.

In addition, although the present invention has been described above with reference to preferred embodiments, those skilled in the art will understand the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. You will understand that it can be modified and changed in various ways.

10: user terminal
20: Access control server
30: Service server

Claims (13)

In the access control method performed on the server device,
Performing account authentication for the connected user terminal and the user;
Confirming one or more available services according to the account authentication result; and
Double authentication for each account and service using SDP, including providing access information to the service server to the user terminal so that each service can be provided by user authentication from the service server providing the available services. Access control methods.
In claim 1,
A two-factor authentication access control method for each account and service using SDP, wherein the result of the account authentication is provided to the service server and used for user authentication.
In claim 1,
A two-factor authentication access control method for each account and service using SDP, which provides the user terminal and network information to the service server and acquires the temporarily accessible connection information from the service server.
In claim 1,
The security level is determined using one or more of the location of the user terminal, whether it is moving, the number/type of nearby terminals searched using wireless signals, and whether a specific security program is installed, and the security level is used to check the available services. Two-factor authentication access control method for each account and service using SDP.
In claim 4,
The result of the account authentication, including the security level, is provided to the service server,
A two-factor authentication access control method for each account and service using SDP, wherein the service server applies different methods for user authentication according to the security level.
In claim 4,
The result of the account authentication, including the security level, is provided to the service server,
A two-factor authentication access control method for each account and service using SDP, wherein the service server applies different user interfaces to the provided services according to the security level.
In claim 4,
A two-factor authentication access control method for each account and service using SDP, wherein the account authentication is re-performed at a periodicity according to the security level, and the account authentication re-performance result is provided to a service server connected to the user terminal.
In claim 4,
A two-factor authentication access control method for each account and service using SDP, with different re-authentication methods, de-identification levels, and service screen sizes for each security level.
A computer program stored in a computer-readable medium that performs a two-factor authentication access control method for each account and service using SDP, wherein the computer program causes the computer to perform the following steps, which steps include:
Performing account authentication for the connected user terminal and the user;
Confirming one or more available services according to the account authentication result; and
A computer program stored in a computer-readable medium, comprising the step of providing connection information to the service server to the user terminal so that each service can be provided by user authentication from the service server providing the available service. .
An access control server that performs account authentication for the connected user terminal and user, confirms one or more available services according to the account authentication results, and provides access information to the service server providing each available service to the user terminal. ; and
A two-factor authentication access control system for each account and service using SDP, including a plurality of service servers that perform user authentication and provide services.
In claim 10,
The access control server provides information about the user terminal and network to the service server along with the results of the account authentication,
The service server generates the access information that can be temporarily accessed based on information about the user terminal and the network and provides it to the access control server, and uses the account authentication result to authenticate the user, for each account and service using SDP. Two-factor authentication access control system.
In claim 10,
The access control server determines the security level using one or more of the location of the user terminal, whether it moves, the number/type of nearby terminals searched using wireless signals, and whether a specific security program is installed,
The service server applies a different method for user authentication according to the security level, or applies a different user interface to the provided service according to the security level. A dual authentication access control system for each account and service using SDP.
In claim 12,
The service server is a dual authentication access control system for each account and service using SDP, where the re-authentication cycle, de-identification level, and service screen size are set differently for each security level.