WO2024063512A1

WO2024063512A1 - Infringement accident determination system using virtual identification information, method thereof, and computer program therefor

Info

Publication number: WO2024063512A1
Application number: PCT/KR2023/014185
Authority: WO
Inventors: 김휘영
Original assignee: 김휘영
Priority date: 2022-09-20
Filing date: 2023-09-19
Publication date: 2024-03-28
Also published as: KR102605029B1

Abstract

The present invention relates to an infringement accident determination system using virtual identification information, a method thereof, and a computer program therefor. The infringement accident determination system using virtual identification information according to the present invention comprises: a plurality of first server devices for operating at least one of a web site or an application, each of the first server devices having a database in which subscriber information including IDs and passwords is stored; and a second server device that generates and stores virtual IDs and passwords not included in the subscriber information in one of the first server devices, stores the generated IDs and passwords in the database of another one of first server devices, and determines that an infringement accident has occurred in the first server device if a log-in from the other first server device using the generated ID is determined to have occurred. Accordingly, it is possible to quickly handle an infringement accident in which personal information is leaked.

Description

Infringement incident determination system and method using virtual identification information, and computer program therefor

The present invention relates to a system and method for determining infringement incidents using virtual identification information, and a computer program therefor. More specifically, it relates to a system and method for determining infringement incidents using virtual identification information that can search for websites where personal information has been leaked using a virtual ID and password, and a computer program therefor.

With the development of hardware and network-related technologies, the type and amount of information transmitted between devices is rapidly increasing, and transaction types and transaction volumes for online e-commerce are also increasing significantly.

However, accidents in which personal information is leaked to the outside occur frequently during the process of sending and receiving information or making financial transactions online.

For this purpose, various information protection methods have been developed, but the types of cyber attacks to steal information are also becoming more diverse. Among these, one type of attack is to steal user accounts and transfer login information leaked from one place to another website. Credential stuffing, which leaks someone else's information by randomly entering an application, is an easy attack method, but it has the problem of causing fatal damage.

[Prior art literature]

[Patent Document]

(Patent Document 0001) Registered Patent Publication No. 10-0320119

Therefore, the purpose of the present invention is to provide a system and method for determining an infringement incident using virtual identification information that enables rapid response in the event of an infringement incident in which personal information is leaked, and a computer program for the same.

The above object is a server device for operating at least one of a website and an application, comprising: a plurality of first server devices having a database storing member information including an ID and a password; Creating and storing a virtual ID and password that are not included in the member information of one of the first server devices, and storing the generated ID and password as member information in a database of another first server device, Infringement accident using virtual identification information, including a second server device that determines that an infringement occurred in the first server device when it is determined that the user has logged in with the created ID in another first server device. This is achieved by a judgment system.

The second server device uses at least one of the individual first server devices and the first server devices grouped by preset categories as a node, and stores the nodes and links connecting the nodes in a graph-type database. It can be saved as .

When the infringement incident occurs, the second server device connects the first server device where the virtual ID was first created and stored with the first server device that attempted to log in with the created ID, and the infringement occurs at the same first server device. If it is determined that an accident has occurred again, a search may be performed for the first server device in the order of the connected nodes.

The second server device stores the Mac address, IP address, and connection time of the user terminal that attempted to log in with the generated ID, and provides blocking information for blocking network access of the stored Mac address to the plurality of first servers. It can be transmitted to the device.

The second server device may request additional authentication for login when it detects that there is another attempt to log in from the user terminal that attempted to log in with the created ID.

Meanwhile, the second server device is a server device for operating at least one of a website and an application, and has a database storing member information including ID and password. Creating a virtual ID and password that are not included; The second server device storing the generated ID and password as member information in a database of another first server device; And if it is determined that the other first server device has logged in with the generated ID, a step of determining, by the second server device, that an infringement incident has occurred in the first server device. The above purpose is also achieved by the infringement incident determination method of the infringement incident determination system using information.

The second server device uses at least one of the individual first server devices and first server devices grouped by preset categories as a node, and stores the nodes and the links connecting the nodes in a database in the form of a graph. Additional steps may be included.

When the infringement occurs, the second server device connects the first server device where the virtual ID was first created and stored with the first server device that attempted to log in with the created ID, and the second server device connects the first server device that attempted to log in with the created ID, and detects the infringement at the same first server device. If it is determined that has occurred again, the method may further include performing a search for the first server device in the order of the connected nodes.

storing, by the second server device, the Mac address, IP address, and access time of the user terminal that attempted to log in with the generated ID; and transmitting, by the second server device, blocking information for blocking network access of the stored MAC address to the plurality of first server devices.

The second server device may further include requesting additional authentication for login when it is detected that there is another attempt to log in from the user terminal that attempted to log in with the generated ID.

According to the infringement accident determination system and method using virtual identification information according to the present invention, and the computer program for the same, rapid response is possible in the event of an infringement accident in which personal information is leaked.

1 is a block diagram showing the configuration of an infringement incident determination system according to an embodiment of the present invention;

Figure 2 is a diagram for explaining the operation of the infringement incident determination system according to an embodiment of the present invention;

Figure 3 is a flowchart illustrating a method for determining an infringement incident in an infringement incident determination system according to an embodiment of the present invention.

Hereinafter, with reference to the attached drawings, a system and method for determining an infringement accident using virtual identification information according to embodiments of the present invention and a computer program therefor will be described in detail.

Figure 1 is a diagram showing the configuration of an infringement incident determination system according to an embodiment of the present invention. As shown in Figure 1, the infringement incident determination system according to an embodiment of the present invention includes a user terminal (C), a plurality of first server devices (1a, 1b, ..., 1n), and a second server device ( 2) Includes.

The first server device 1 is a server device for operating at least one of a website and an application, and has a database storing member information including ID and password. The infringement incident determination system according to the present invention can classify and group the first server device 1 into preset categories for quick determination of infringement incidents, and the classified categories can be changed.

The second server device 2 generates and stores a virtual ID and password that are not included in the membership information of any one first server device 1a, and sends the generated virtual ID and password to another first server device 1a. It is stored as membership information in the database of (1b, ..., 1n), and if it is determined that the user has logged in with a virtual ID created on the user terminal (C) connected to another first server device (1b, ..., 1n), It is determined that an infringement incident occurred in the first server device 1a.

That is, the second server device 2 according to the present invention generates a virtual ID and password that does not exist in any first server device 1a and connects it to at least one other first server other than the first server device 1a. When registering in the database of the device (1b, ..., 1n) and logging in with a virtual ID from the user terminal (C) connected to the first server device (1b, ..., 1n) due to an infringement of personal information, the first It can be determined that an infringement occurred in the first server device (1a) that created and registered the virtual ID.

Hereinafter, the server device storing the personal information subject to the infringement incident is referred to as the first server device 1a, and the server device connected to the user terminal C that attempted to log in using the leaked personal information is referred to as the first server device. Let us describe an embodiment of the present invention in (1b).

Here, the second server device 2 according to an embodiment of the present invention is preferably operated in the form of a CCS (Computing and Communication Services) server. The CCS method refers to an endpoint of the XMPP (Extensible Messaging And Presence Protocol) method that maintains a continuous connection with the server and performs asynchronous two-way communication. This allows you to easily monitor whether personal information infringement has occurred.

The communication method between the user terminal (C) and the first server device (1) and between the first server device (1) and the second server device (2) and the user terminal (C) according to the present invention is wired and/ Alternatively, it may include all communication methods that enable object-to-object networking through a wireless network, and is not limited to wired communication, wireless communication, 3G, 4G, 5G, or other methods.

For example, the wired and/or wireless network between the user terminal (C) and the first server device (1) and between the first server device (1) and the second server device (2) is a Local Area Network (LAN). ), MAN (Metropolitan Area Network), GSM (Global System for Mobile Network), EDGE (Enhanced Data GSM Environment), HSDPA (High Speed Downlink Packet Access), W-CDMA (Wideband Code Division Multiple Access), CDMA (Code Division) Multiple Access), TDMA (Time Division Multiple Access), Bluetooth, Zigbee, Wi-Fi, VoIP (Voice over Internet Protocol), LTE Advanced, IEEE802.16m, WirelessMAN-Advanced, HSPA+, 3GPP Long Term Evolution(LTE), Mobile WiMAX (IEEE 802.16e), UMB (formerly EV-DO Rev. C), Flash-OFDM, iBurst and MBWA (IEEE 802.20) systems, HIPERMAN, Beam-Division Multiple Access ( It may refer to a communication network using one or more communication methods selected from the group consisting of BDMA), Wi-MAX (World Interoperability for Microwave Access), and ultrasonic communication, but is not limited thereto.

Meanwhile, in the infringement incident determination system according to an embodiment of the present invention, the second server device (2) uses each of the plurality of first server devices (1) as nodes to easily determine the infringement incident, and establishes a connection between the nodes. You can connect it with a link and save it as a database in the form of a graph.

When an infringement incident occurs, the second server device 2 connects the first server device 1a, where the virtual ID was first created and stored, with the first server device 1b, which attempted to log in with the created ID, thereby If it is determined that an infringement incident has occurred again on the site of the server device (1a), it is possible to quickly check which first server device (1b) attempted to log in using the above graph database. Of course, there may be only one first server device 1 stored as a node, or it is also possible for a plurality of grouped first server devices 1 to be stored as one node.

And the second server device (2) according to an embodiment of the present invention stores the Mac address, IP address, and connection time of the user terminal (C) connected to the first server device (1b) that attempted to log in with the created ID. And, blocking information for blocking network access of the stored MAC address can be transmitted to a plurality of first server devices 1. As a result, it is possible to prevent the same infringement incident from occurring again by a user attempting to infringe on personal information.

In addition, the second server device 2 according to an embodiment of the present invention may request additional authentication for login when it detects that there is another attempt to log in from the user terminal C that attempted to log in with the created ID. there is.

And the second server device (2) according to the present invention compares the login time in the first server device (1a) using the generated ID and password with the login time in the other first server device (1b), and determines the time point. As the difference increases, the number of searchable first server devices 1 and/or the number of categories to which the first server device 1 belongs can be expanded.

Hereinafter, the operation of the infringement incident determination system according to an embodiment of the present invention will be described with reference to FIGS. 2 and 3. As shown in Figure 2, the infringement incident determination system according to an embodiment of the present invention first includes a plurality of first server devices in which the second server device 2 has a database storing member information including IDs and passwords. Create a virtual ID and password that are not included in the member information of any one of (1a, ..., 1n) (1a) (S10).

Next, the second server device 2 stores the generated ID and password as member information in the database of the other first server device 1 (S20).

If it is determined that another first server device (1b) has logged in with the ID created in step S10, the second server device (2) determines that an infringement incident has occurred in the first server device (1a) (S30).

As a result, the second server device (2) can easily determine which site of the server device (1) the infringement occurred by checking which ID was logged in, making it possible to respond quickly in the event of an infringement that results in personal information being leaked. .

Meanwhile, the infringement incident determination method of the infringement incident determination system using virtual identification information according to an embodiment of the present invention is that the second server device 2 is divided into individual first server devices 1 and preset categories. The method may further include setting at least one of the grouped first server devices 1 as a node and storing the node and the links connecting the nodes as a database in the form of a graph.

And, when an infringement occurs, the second server device (2) uses the first server device (1a), where the virtual ID was first created and stored, and the first server device (1b), which attempted to log in with the created ID, as each node. A step of connecting in a graph form and performing a search for the first server device 1 in the order of connected nodes may be further included if it is determined that an infringement incident has occurred again in the same first server device. As a result, in the event of an infringement incident, it is possible to quickly confirm the first server device (1b) that attempted to log in. At this time, the second server device 2 matches and stores the number of login attempts with the first server device 1b that attempted to log in, and it is also possible to connect the first server device in the order of the number of attempts.

In addition, the infringement incident determination method of the infringement incident determination system using virtual identification information according to an embodiment of the present invention is that the second server device (2) uses the user terminal (C) that attempted to log in with the ID created in step S10. A step of storing the Mac address, IP address, and connection time, and transmitting blocking information for blocking network access of the Mac address stored by the second server device 2 to a plurality of first server devices 1a, ..., 1n. Additional steps may be included. As a result, it is possible to prevent the same infringement incident from occurring again by a user attempting to infringe on personal information.

The operation of the infringement incident determination method according to the embodiments described above may be at least partially implemented as a computer program and recorded on a computer-readable recording medium. A computer-readable recording medium on which a program for implementing the operation of the infringement incident determination method of the infringement incident determination system using virtual identification information according to the embodiments is recorded is any computer-readable recording medium in which data that can be read by a computer is stored. Includes various types of recording devices. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices. Additionally, computer-readable recording media may be distributed across computer systems connected to a network, and computer-readable codes may be stored and executed in a distributed manner. Additionally, functional programs, codes, and code segments for implementing this embodiment can be easily understood by those skilled in the art to which this embodiment belongs.

What has been described above is only an embodiment for implementing the infringement accident determination system and method using virtual identification information and a computer program therefor according to the present invention, and the present invention is not limited to the above-described embodiment, and the claims below It will be said that the technical spirit of the present invention exists to the extent that anyone with ordinary knowledge in the technical field to which the present invention pertains can implement it with various modifications without departing from the gist of the present invention as claimed in the scope.

Claims

A server device for operating at least one of a website and an application, comprising: a plurality of first server devices (1) having a database storing member information including ID and password;

Create and store a virtual ID and password that are not included in the membership information of one of the first server devices (1a), and enter the generated ID and password into the database of the other first server device (1b) as a member. A second server device (2) that stores information as information and, when it is determined that a user has logged in with the ID created in the other first server device (1b), determines that an infringement incident has occurred in the first server device (1a). A system for determining infringement incidents using virtual identification information, comprising:
According to paragraph 1,

The second server device 2,

At least one of the individual first server devices 1 and the first server devices 1 grouped by preset categories is used as a node, and the nodes and the links connecting the nodes are converted into a database in the form of a graph. A system for determining infringement incidents using virtual identification information, which is characterized by storing.
According to paragraph 2,

The second server device 2,

When the above infringement incident occurs, the first server device (1a), where the virtual ID was first created and stored, is connected to the first server device (1b) that attempted to log in with the created ID,

If it is determined that the infringement incident has occurred again in the same first server device (1a), a search is performed on the first server device (1) in the order of the connected nodes. Infringement using virtual identification information Accident judgment system.
According to paragraph 1,

The second server device 2,

The MAC address, IP address, and connection time of the user terminal (C) that attempted to log in with the created ID are stored, and blocking information for blocking network access of the stored Mac address is stored in the plurality of first server devices (1). A system for determining infringement incidents using virtual identification information, which is transmitted to .
According to paragraph 4,

The second server device 2,

A system for determining an infringement incident using virtual identification information, characterized in that it requests additional authentication for login when the user terminal (C) attempting to log in with the created ID detects that there is another attempt to log in.
The second server device 2 is a server device for operating at least one of a website and an application, and is one of a plurality of first server devices 1 having a database storing member information including ID and password. generating a virtual ID and password that are not included in the member information of the first server device (1a);

The second server device (2) storing the generated ID and password as member information in the database of another first server device (1b); and

When it is determined that the other first server device (1b) has logged in with the created ID, the second server device (2) determines that an infringement incident has occurred in the first server device (1a). A method of determining an infringement incident of an infringement incident determination system using virtual identification information.
According to clause 6,

The second server device 2 uses at least one of the individual first server devices 1 and the first server devices 1 grouped by preset categories as a node, and connects the nodes. A method of determining an infringement incident in an infringement incident determination system using virtual identification information, further comprising the step of storing the link in a database in the form of a graph.
In clause 7,

When the infringement incident occurs, the second server device 2 connects the first server device 1a, where the virtual ID was first created and stored, and the first server device 1b, which attempted to log in with the created ID, and connects the same Virtual identification, further comprising the step of performing a search for the first server device (1) in the order of the connected nodes when it is determined that the infringement incident has occurred again in the first server device (1a). Method for determining infringement incidents in an infringement incident determination system using information.
According to clause 6,

The second server device (2) storing the Mac address, IP address, and connection time of the user terminal (C) that attempted to log in with the created ID; and

Virtual identification information further comprising the step of the second server device (2) transmitting blocking information for blocking network access of the stored MAC address to the plurality of first server devices (1). Infringement incident determination method of the infringement incident determination system used.
According to clause 9,

The second server device 2,

Infringement using virtual identification information, further comprising requesting additional authentication for login when the user terminal (C) attempting to log in with the created ID detects that there is another attempt to log in. Infringement incident determination method of the incident judgment system.
A computer program combined with hardware and stored in a computer-readable recording medium to execute the method for determining an infringement incident according to any one of claims 6 to 10.