WO2005024646A1

WO2005024646A1 - Method of security service using notice of events

Info

Publication number: WO2005024646A1
Application number: PCT/KR2004/002262
Authority: WO
Inventors: Dujin Hwang
Original assignee: Dujin Hwang
Priority date: 2003-09-09
Filing date: 2004-09-07
Publication date: 2005-03-17

Abstract

The present invention provides a method of security service using notice of events comprising the steps of storing event information preset by a user in connection with user information thereof; notifying event occurring to the user if the occurring of the preset event is detected; and handling the incident for the connection generating the event if a notice of incident occurring for an event occurring is received from the user. According to the method, a service for a third party illegally using user information and accessing to a server is blocked, thereby preventing in advance damages by behavior of a malicious third party.

Description

Description METHOD OF SECURITY SERVICE USING NOTICE OF EVENTS Technical Field

[1] The present invention relates to a method of security service using notice of events, and more particularly, to a method of security service using notice of events wherein if an event preset by a user is detected, the event is notified to the user and authorized in real-time whether the event is generated by a legal use or not. Background Art

[2] In general, security service is a service in which safety for information contained in a computer is secured from behavior of an illegal third party; and which comprises functions of monitoring jobs available for illegally using or damaging information contained in a computer and blocking the access of an illegal user to the computer.

[3] Development of the Internet connecting computers, wired and wireless communication systems has brought convenience in utilizing various services in daily life such as information retrieval, information exchange, electronic commerce or the like.

[4] Popularization of such utilizing the Internet causes a lot of illegal behavior threatening safety of information contained in a computer and services provided on the Internet by hacking of a malicious third party and spreading of virus, thereby requiring various technologies for protection and prevention of security incidents.

[5] However, in case of leakage of user information such as ID, password, resident registration number or the like due to behavior of a malicious third party and user's carelessness, the fact was detected and met after a security incident occurred, thereby having difficulty in preventing substantial damage.

[6] Accordingly, a new systematic method of security service to solve said problems is required. Disclosure of Invention Technical Problem

[7] To solve the above and/or other problems, the present invention provides a method of security service using notice of events wherein if an event preset by a user is detected, the event can be notified to the user and authorized in real-time whether the event is generated by a legal use or not .

[8] Also, the present invention provides a method of security service using notice of events wherein log-in, entry of resident registration number, user information mod- ification or the like are not generated by a third party illegally using the user information.

[9] Also, the present invention provides a method of security service using notice of events wherein the access of a third party illegally using user information is notified to a user via short messaging service, E-mail, messenger or the like. Technical Solution

[10] According to an aspect of the present invention, the present invention provides a method of security service using notice of events wherein a service for a third party illegally using user information and accessing to a server is blocked, the method comprising the steps of event setup in which event information preset by a user is stored in connection with user information thereof; notification in which if the occurring of the preset event is detected, event occurring is notified to the user; and incident handling in which if a notice of incident occurring for the event occurring is received from the user, the incident for the connection generating the event is handled.

[11] In this regard, the user information comprises ID, password and resident registration number for identifying and authorizing a user. It is preferred that the event information in the step of event setup comprises an event data presetting an event a user wants to be notified; a notice setup data setting up whether to notice for a user if the preset event is detected; and a notice means data setting up notice means information for a user.

[12] It is preferred that the event data is set up as at least one of log-in, entry of resident registration number and user information modification.

[13] It is preferred that the notice means data is set up as at least one of wireless terminal, E-mail and messenger; and comprises information on the notice means which is set up.

[14] It is preferred that the event information further comprises lock setup data setting up whether access to the server is allowed or not.

[15] It is preferred that the step of event setup is performed using at least one of computer and wireless terminal connected to the Internet.

[16] It is preferred that the step of notification comprises the steps of deciding whether to notice event occurring by referring to the notice setup data; detecting the preset event occurring by comparing the occurred event with the event preset in the event data; deciding notice means of the event occurring by referring to the notice means data; generating a message notifying the event occurring preset in the event data; and notifying the generated message to the user via notice means decided in the step of deciding notice means of the event occurring.

[17] It is preferred that the step of incident handling comprises the steps of receiving the notice of the incident occurring from the user; releasing the connection in which the event received the notice of the incident occurring is generated by deciding that the event received the notice of the incident occurring is generated by a third party illegally using user information; and generating a new password, substituting the new password for the existing password of user information used illegally, and notifying the user of the new password set up via notice means. Advantageous Effects

[18] As described above, a method of security service using notice of events according to the present invention has the following effects.

[19] Rrst, if an event preset by a user is detected, the event can be notified to the user and authorized in real-time whether the event is generated by a legal use or not , thereby preventing in advance damages by the behavior of a third party illegally using user information.

[20] Second, log -in, entry of resident registration number, user information modification or the like are not generated by a third party illegally using the user information , thereby thoroughly blocking the access of a malicious third party and preventing the illegal use of user information.

[21] Third, the access of a third party illegally using user information is notified to a user via short messaging service, E-mail, messenger or the like, whereby the user directly blocks the behavior of the malicious third party. Description of Drawings

[22] FIG. 1 is a configuration diagram of systems and networks for carrying out the method of security service using notice of events according to an embodiment of the present invention;

[23] FIG. 2 is a flow chart of the process of the method of security service using notice of events according to an embodiment of the present invention;

[24] FIG. 3 is a view of a user interface provided to preset an event in the method of security service using notice of events in FIG. 2;

[25] FIG. 4 is a view of user interfaces showing a process for presetting an event in the method of security service using notice of events in FIG. 2;

[26] FIG. 5 is a detailed flow chart of the step of notification in the method of security service using notice of events in FIG. 2;

[27] FIG. 6 is a view of a user interface provided to notify an incident occurring in the method of security service using notice of events in FIG. 2; and

[28] FIG. 7 is a view of user interfaces showing a process for handling the incident occurring in the method of security service using notice of events in FIG 2. Best Mode

[29] FIG. 1 is a configuration diagram of systems and networks for carrying out the method of security service using notice of events according to an embodiment of the present invention. Referring to FIG. 1, the configuration of systems and networks for carrying out the method of security service using notice of events according to an embodiment of the present invention comprises user terminals 10, 20 and 30, a third party terminal 60, a security server 70, the Internet 40 including mail servers 42 and 44, and a mobile communication network 50 including short messaging service servers 52 and 54.

[30] The user terminals 10, 20, and 30 may be a computer 10, a personal digital assistant (PDA) 20 and a cellular phone 30 as a component accessing to the security server 70 via Internet 40, registering user information and presetting event information. Also, if an event preset by a user occurs, the notice of the event occurring is received from the security server 70 and the notice of the incident occurring for the event occurring is transmitted to the security server 70.

[31] The third party terminal 60 may be the terminal illegally using user information and accessing to the security server 70. Also, the third party terminal 60 may be a component to generate the same event as event preset by a user, after the third party terminal 60 connects to the security server 70 via the Internet 40. Also, the third party terminal 60 may be a computer and a wireless terminals (not shown) such as a cellular phone, PDA or the like available for accessing to the security server 70 via the Internet 40.

[32] The security server 70 comprises a database 72 including user information and event information in connection with the user information. If an event preset by a user is detected, this is notified to the user via Internet 40 including mail servers 42 and 44, and a mobile communication network 50 including short messaging service servers 52 and 54. If a notice of an incident occurring is received from a user, a process of handling the incident such as releasing an access for an event receiving notice of the incident occurring is performed.

[33] The security server 70 may be a separate server provided with a function of security service according to an embodiment of the present invention and a server adding a function of security service according to an embodiment of the present invention to commercial servers such as Daum, Naver, Koomin Bank, Game Company servers or the like, which is providing services on the Internet 40.

[34] The mail servers 42 and 44 may be a sending mail server 42 and a receiving mail server 44. The sending mail server 42 is a mail server working with the security server 70 and the Internet 40 and sends a message of event occurring generated by the security server 70 to a user mail account. The receiving mail server 44 is a mail server managing user mail accounts and a mail server receiving a message of event occurring from the sending mail server 42 and then sending the message to a user via mail.

[35] The short messaging service servers 52 and 54 may be a sending short messaging service server 52 and a receiving short messaging service server 54. The sending short messaging service server 52 is a short messaging server working with the security server 70 and a mobile communication network 50 and sends a message of event occurring generated by the security server 70 to a users' phone. The receiving short messaging service server 54 is a short messaging service server managing user wireless terminals 20 and 30 at the point where the user wireless terminals 20 and 30 is located and a short messaging service server receiving a message of event occurring from the sending short messaging service server 52 and then sending the message to a user via a short messaging service.

[36] The user information comprises ID, password and resident registration number for identifying and authorizing a user. Also, the event information comprises an event data presetting an event a user wants to be notified; a notice setup data setting up whether to notice for a user if the preset event is detected; and a notice means data setting up notice means information for a user.

[37] In addition, the event data may be set up as at least one of log-in, entry of resident registration number and user information modification. It is preferred that the notice means data is set up as at least one of wireless terminal, E-mail and messenger and comprises information on a notice means which is set up.

[38] The event information further comprises a lock setup data setting up whether access to the security server 70 is allowed or not.

[39] TAB. 1 illustrates user information and event information.

[40] TAB. 1

[41]

[42] Referring to TAB. 1, user information comprises ID cookya, Password pass 1234 and Resident Registration Number 701010-1000000.

[43] Also, at least one of log-in, entry of resident registration number and user information modification is set up in the event data of the event information; in the lock setup data, if an access to security server using user information is allowed, 'yes' is set up and if not allowed, 'no' is set up; and in the notice setup data, if a notice is needed when an preset event occurs, 'yes' is set up and if not needed, 'no' is set up.

[44] Such as wireless terminal like cellular phone 30 and PDA 20, E-mail, messenger, or the like, notice means notifying event occurring is set up in the notice means data. It is preferred that information on each notice means, for example, a cellular phone number 016-400-4000 for wireless terminals 20 and 30, an E-mail address cookya@chpat.co.kr for E-mail and information about whether to connect with security server 70 provided with a function of messenger for messenger, is further comprised. Mode for Invention

[45] FIG. 2 is a flow chart of the process of the method of security service using notice of events according to an embodiment of the present invention. Referring to FIG. 2, the method of security service using notice of events according to an embodiment of the present invention may comprise the steps of event preset (S100), event occurring (S200), notification (S300), incident decision (S400) and incident handling (S500).

[46] The step of event preset (S100) is a step in which event information preset by a user is stored in a database 72 of security server 70 in connection with the user information. The user accesses to the security server 70 via computer 10 and wireless terminals 20 and 30 connecting to the Internet 40, that is, user terminals 10, 20 and 30; registers the user information including ID, password, resident registration number or the like; and presets information such as a lock setup data, an event data, a notice setup data, a notice means data or the like related to providing the security service using notice of events according to an embodiment of the present invention.

[47] In the method of security service using notice of events, user interfaces provided to preset an event and a process for the event preset will be described in detail with reference to user interfaces, hereinbelow.

[48] FIG. 3 is a view a user interface provided to preset an event in the method of security service using notice of events according to an embodiment of the present invention, and FIG. 4 is a view of user interfaces showing a process for presetting an event.

[49] Referring to FIGS. 3 and 4, a user interface 110 provided to preset an event is illustrated in case that a user terminal 100 is a cellular phone 30. The user interface 110 provided via the cellular phone 30 may be provided from the security server 70 and by an application program built in the cellular phone 30.

[50] Keypads 102, 104 and 106 of the cellular phone 30 can be used in a process of presetting an event according to an embodiment of the present invention. For instance, pressing MENU key 102 provides an initial screen to preset the event; pressing SHIFT key 104 can be used for lock setup and notice setup; and pressing OK key 106 can be assigned to finally confirm a selected state and to progress a next process.

[51] First, an initial screen of user interface 110 is an initial screen for presetting an event and may illustrate the security server 70 such as Daum, Naver, Kookmin Bank, Game Company, or the like provided with a security function according to an embodiment of the present invention.

[52] If a user selects Daum server for presetting the event, a user interface 112 for configuration can be provided. The user may locate Select bar at Lock Setup and select Setup or Release using Shift keys 104.

[53] It is preferred that if '4. Help' is selected in the user interface 112 for configuration, description for security service provided according to an embodiment of the present invention is presented. For example, '1. Lock Setup: to set up whether access to the corresponding server is allowed or not', '2. Notice Setup: to set up whether to notice if an event preset by a user occurs', 3. Reservation Setup: to set up LockRelease function at specified time' or the like can be provided.

[54] In Daum server, if Release in Lock Setup is selected and the OK key 106 is pressed, a user interface 114 informing that the data is being transmitted to Daum server can be provided. It is preferred that if the transmission is finished, a user interface 116 informing a user that event presetting is normally finished can be provided.

[55] In the above description, a case of a cellular phone 30 as a user terminal is illustrated, and a case of other user terminal available for accessing to the security server 70 via Internet 40, that is, computer 10 or PDA 20 may be similarly illustrated.

[56] Further, the user interface 110 for presetting an event may be provided in the form of an interface in which an event data, a notice means data or the like is further set up as well as lock setup, notice setup and reservation setup as described above.

[57] Hereinafter, a lock setup data is set up as 'no', an event data is set up as 'log-in', a notice setup data is set up as 'yes' and a notice means data is set up as a cellular phone having a cellular phone number 016-400-4000. Also, a case that an event generated by a third party is log-in will be illustrated.

[58] The step of event occurring (S200) is a step in which an event preset by a user is generated by a third party illegally using user information and accessing to the security server 70. For instance, a process in which the third party obtaining the user information such as ID, password, or the like by the illegal method tries to log in the security server 70 using user information generates an event preset by the user. The event generated by the third party may be an event preset by the user such as entry of user's resident registration number, user information modification or the like.

[59] Hereinafter, a case that an event generated by a third party is when the third party illegally obtaining user's ID and password log in the security server 70 will be illustrated.

[60] The step of notification (S300) is a step in which if event occurring preset by a user is detected, the event occurring is notified to the user. FIG. 5 is a detailed flow chart of the step of notification in the method of security service using notice of events according to an embodiment of the present invention. Referring to FIG. 5, The step of notification comprises the steps of decision on whether to lock (S310), decision on whether to notice (S320), event occurring detection (S330), notice means decision (S340), message generation (S350, S360, S370) and message sending (S355, S365, S375).

[61] In the step of decision on whether to lock (S310), allowance to access to the security server 70 is decided with reference to a lock setup data. In the present embodiment, since the lock setup data is set up as 'no', an access to the security server 70 is allowed, thereby proceeding to next step. If the lock setup data is set up as 'yes', the access to the security server 70 using user information is thoroughly blocked.

[62] In the step of decision on whether to notice (S320), the notice of event occurring is decided with reference to a notice setup data. In the present embodiment, since the notice setup data is set up as 'yes', if an event preset by a user is detected, this is notified to the user. If the notice setup data is set up as 'no', the user has no intention to receive a security service according to an embodiment of the present invention thereby being followed by a normal procedure according to request of a connector.

[63] In the step of event occurring detection (S330), preset event occurring is detected by comparing the occurred event with the preset event in an event data. In other words, if a third party illegally obtaining user's ID and password log in, the security server 70 accesses to event information in connection with user information using user's ID as a key. If the event preset by the user and the event generated by the third party are compared and then both is the same, what the event preset by the user is generated is detected. Accordingly, since the event generated by the third party in the present embodiment is 'log-in' and the event preset by the user is 'log-in', the security server 70 may detect the event preset by the user, that is, log-in occurring.

[64] In the step of notice means decision (S340), a notice means of event occurring is decided with reference to an notice means data. In the present embodiment, the notice means data is set up as a cellular phone 30 having a phone number, 016-400-4000.

[65] In the step of message generation (S350, S360, S370), a message informing that an preset event occurs is generated. Since a notice means is a cellular phone 30 in the present embodiment, it is preferred that the message informing that a third party log in is generated in the form of a short messaging service. If the notice means is E-mail, the message may be generated in the form of E-mail and if the notice means is messenger, the message may be generated in the form of a message of messenger.

[66] In the step of message sending (S355, S365, S375), a generated message is notified to a user via a notice means decided in the step of the notice means decision. In the present embodiment, since the notice means is a cellular phone 30 having a phone number, 016-400-4000, a short message is sent to the cellular phone 30 of 016-400-4000 as a destination. The short messaging can be sent to the user via a sending short messaging server 52 and receiving short messaging server 54 within mobile communication networks 50 working with the security server 70.

[67] In other words, if the security server 70 detects a trial of log-in using user information in the present embodiment, event information stored in connection with the user information is accessed. Since a lock setup data is set up as 'no', an event data is set up as 'log-in', a notice setup data is set up as 'yes' and a notice means data is set up as a cellular phone 30 having a phone number, 016-400-4000, the security server 70 generates a message informing of log-in and sends a short messaging to the user cellular phone 30 of 016-400-4000.

[68] The short messaging includes a notice message, 'You logged in O service at O hr. O min. O sec'

[69] In the incident decision (S400), a user receiving a message transmitted from the security server 70 decides whether an event occurring is the event generated by the user itself or not. Since the user does not log in the security server 70 in the present embodiment, the user may regard the log-in as illegal log-in using its user information to try to log in and notify an incident occurring to security server 70.

[70] In the method of security server using notice of events according to an embodiment of the present invention, user interfaces provided for notifying an incident occurring and a process of handling the incident through the user interfaces will be described in detail according to FIGS. 6 and 7.

[71] The step of incident handling (S500) is a step in which the security server 70 receiving a notice of an incident occurring from a user handles an incident for a connection generating an event and comprises the steps of receiving the notice of the incident occurring from a user; releasing the connection in which the event received the notice of the incident occurring is generated by deciding that the event received the notice of the incident occurring is generated by a third party illegally using user information; and generation a new password, substituting the new password for the existing password of user information used illegally and notifying the user of the new password set up via notice means.

[72] The step of handling the incident (S500) further comprises the steps of collecting and tracing information on an illegal user, and reporting and requesting an investigation to the machinery of government such the Cyber Invasion Response Center or the like.

[73] FIG. 6 is a view of a user interface provided to notify an incident occurring in the method of security service using notice of events according to an embodiment of the invention; and FIG. 7 is a view of user interfaces showing a process for handling the notice of the incident occurring in the method of security service using notice of events.

[74] Referring to FIGS 6 and 7, a user interface 210 provided for the process of handling an incident is illustrated in case that a user terminal 200 is a cellular phone 30. It is preferred that the user interface provided via the cellular phone 30 is provided by an application program built in the cellular phone 30.

[75] Meanwhile, in case that a user terminal 200 is a computer 10 or PDA 20, a user interface provided for the process of handling an incident may be included in a notice message of event occurring sent by the security server 70. Keypads of the cellular phone 30 may function the same as the case for event presetting described above.

[76] First, the user interface 210 informing of event occurring informs that a log-in occurs by providing a user with a short messaging received from the security server 70. If the user itself does not log in the security server 70, the user recognizing that a log-in occurs via a message sent from the security server 70 regards the log-in as illegal log-in using its user information to try to log in and progresses the process of notifying an incident occurring using the keypads of the cellular phone 30.

[77] In this regard, a user interface 212 for confirming user's intention of notifying an incident occurring may be further provided.

[78] If the user selects OK key in order to show again the user's intention of notifying the incident occurring, an interface 214 informing the user that notifying the incident occurring is in process can be provided. If a transmission for notifying the incident occurring is finished, it is preferred that a user interface 216 informing the user that the process of notifying the incident occurring is normally finished is provided.

[79] The security server 70 accepting the notification of the incident occurring may release the connection generating the event reported, generate a new password, and notify the user of the new password. A user interface 218 informing of the new password contains information newly generated and set up as a user password by the security server 70. Hereby, the user may normally access to the security server 70 with the new password notified, while an illegal trial of reconnection by a third party is prevented.

[80] In the above description, the case that a user terminal is set up as a cellular phone 30 in the steps of deciding an incident occurring and handling the incident is illustrated, while the case of other user terminal accessible to the security server 70 via Internet 40, that is, a computer 10 or PDA 20 may be progressed similarly to the case of the cellular phone.

[81] While this invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications in form and details can be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Any element in a claim that does not explicitly state 'step for' performing a specific function, is not to be interpreted as a 'step' clause. Industrial Applicability [82] As described above, the method of security service using notice of events can be used in the field of security or the like for servers providing information and services on the Internet.

Claims

[1] A method of security service using notice of events wherein a service for a third party illegally using user information and accessing to a server is blocked, the method comprising the steps of: event setup in which event information preset by a user is stored in connection with user information thereof; notification in which if the occurring of the preset event is detected, event occurring is notified to the user; and incident handling in which if a notice of incident occurring for the event occurring is received from the user, the incident for the connection generating the event is handled. [2] The method of claim 1, wherein the user information comprises ID, password and resident registration number for identifying and authorizing a user. [3] The method of claim 1, wherein the event information in the step of event setup comprises: an event data presetting an event a user wants to be notified; a notice setup data setting up whether to notice for a user if the preset event is detected; and a notice means data setting up notice means information for a user. [4] The method of claim 3, wherein the event data is set up as at least one of log-in, entry of resident registration number and user information modification. [5] The method of claim 3, wherein the notice means data is set up as at least one of wireless terminal, E-mail and messenger; and comprises information on the notice means which is set up. [6] The method of claim 3, wherein the event information further comprises lock setup data setting up whether access to the server is allowed or not. [7] The method of claim 1, wherein the step of event setup is performed using at least one of computer and wireless terminal connected to the Internet. [8] The method of claim 3, wherein the step of notification comprises the steps of: deciding whether to notice event occurring by referring to the notice setup data; detecting the preset event occurring by comparing the occurred event with the event preset in the event data; deciding notice means of the event occurring by referring to the notice means data; generating a message notifying the event occurring preset in the event data; and notifying the generated message to the user via notice means decided in the step of deciding notice means of the event occurring. [9] The method of claim 2, wherein the step of incident handling comprises the steps of: receiving the notice of the incident occurring from the user; releasing the connection in which the event received the notice of the incident occurring is generated by deciding that the event received the notice of the incident occurring is generated by a third party illegally using user information; and generating a new password, substituting the new password for the existing password of user information used illegally, and notifying the user of the new password set up via notice means.