KR100276690B1 - Authentication Method for Secure Object-Based Distributed Processing Systems - Google Patents

Abstract

The present invention relates to an authentication method of a secure object-based distributed processing system.

In most existing distributed processing environments, a user simply receives a password and checks whether the user is an available user to determine whether to allow it. In this case, if a password is leaked, sensitive information may be exposed to illegal users, which may cause a great loss.

In order to prevent this, the present invention encrypts and transmits a password or a public key even at the time of an authentication request and gives a public key certificate or a service ticket as a result of the authentication so that the server application process can use the service request. When an application process driven by an authenticated user requests a service from a server application process, this key is used to encrypt and send a message so that the message can be safely transmitted and received in a distributed processing environment.

Description

Authentication Method for Secure Object-Based Distributed Processing Systems

The present invention relates to an authentication method of a secure object-based distributed processing system, and more particularly, to an authentication method of a secure object-based distributed processing system that can cope with security breaches that may occur in a distributed processing environment.

Despite the advantages of an object-based distributed processing system, hesitation in use in security-sensitive areas such as banking is due to security breaches that can occur in distributed processing environments, i.e. unauthorized access to information, authorized users The illegal use of information as if it were a user, or the interception or alteration of information on a communication line.

The authentication method in the existing distributed processing environment simply receives a password and checks whether the user is an available user, thereby determining whether or not to allow the user. Thus, when a password is leaked, important information may be exposed to an illegal user, thereby causing a great loss.

Accordingly, an object of the present invention is to provide a method for authenticating a secure object-based distributed processing system that can cope with security breaches that may occur in a distributed processing environment.

The present invention for achieving the above object is the step of interpreting the user's password name and authentication method, the encrypted authentication data and the requested authorization information, etc. in the authentication security object, and the authentication method requested by the user in the authentication security object If the public key authentication method is used, the public key authentication method is used to decrypt the encrypted public key with the user's public key, interpret the signature with the private key of the user (authentication object), and then use the user's public key in the user information database. Recovering the certificate, comparing the decrypted user's public key with the key recovered from the user information database, and returning the certificate and the public key certificate to the user if they are identical; The authentication method requested by the user in the authentication secure object is a public key authentication room. In the case of secret key authentication, decrypting an encrypted password with a key made of the user's password, and recovering the user's password from a user information database; and recovering from the decrypted user's password and a user information database. Comparing one password and returning a certificate, a service ticket, and a session key to the user if the password is the same, and transiting to the first step if the password is not the same.

1 is a block diagram for explaining an interaction process between a customer computer system and a server computer system.

2 is a block diagram illustrating an operation of an authentication object when a user requests an authentication.

3 is a flow chart illustrating an authentication method of a secure object-based distributed processing system according to the present invention.

<Description of the symbols for the main parts of the drawings>

1: customer computer system 2: server computer system

3a and 3b: secure object-based distributed processing system

4: user 5: login process

6a: Customer Application Process 6b: Server Application Process

7a and 7b: authentication security object 8a and 8b: security context object

9a and 9b: Object Request Broker 10a: Interface Repository

10b: Server Information Store

The present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram illustrating an interaction process between a customer application process on a customer computer system and a server application process on a server computer system. The secure object-based distributed processing systems 3a and 3b are variously required to prevent security breaches. Of secure objects 7a and 7b. Secure objects 7a and 7b to prevent unauthorized illegal users, multiple security context objects 8a and 8b to encrypt messages to prevent interception or alteration of messages on communication lines; It consists of access decision objects 7a and 7b which prevent a user without access to certain information. The details of these objects are needed to accomplish the above.

When the general user 4 requests authentication using the login process 5 of the customer computer system 1, the login process 5 is the user name and password or key inputted by the user 4 (long term). A request is made to the security authentication object 7a, which is one of the security objects, as an input value. After the authentication is completed, the user 4 runs the distributed customer application process 6a (103), and the distributed customer application process 6a receives the object request broker 9a through a customer stub provided by the distributed object system 3a. Ask the server to find the server application process, perform some operation on the objects inside it, and return the result (104). The object request broker 9a calls a vault object, one of the security objects, to establish a security association with the customer application process 6a and the server application process 6b in the server computer system 2 ( 105). The object request broker 9a accesses 106 the security context objects 8a created in step 105 to encrypt the data sent to the server computer system 2. When the server application process 6b of the server computer system 2 has requested its connection information and interface information to the object request broker 9a, the object request broker 9a stores in the interface store 10a (107). . The object request broker 9a of the customer computer system 1 transmits 108 a security token or operation request data, which is an encrypted message, to the object request broker 9b in the server computer system 2.

In order to find the server response process that supports the operation, the object request broker 9b of the server computer system 2 analyzes the operation request message received from the object request broker 9a of the customer computer system 1 to store the server information store. (10b) is searched (109). A vault object, which is one of the secure objects 7b, is invoked 110 to create a server-side secure context using the security token, the security association establishment request message received from the customer computer system 1. In order to decrypt the received encrypted message (111), the security context object (8b) is called (111), and the access decision object, which is one of the security objects, is called again to confirm whether to accept the security association establishment request, and if so, Using the server skeleton of the server application process 6b to request that the customer application process 6a perform some operation in the requested server application process 6b (112).

FIG. 2 is a block diagram illustrating an operation of an authentication object when a user requests an authentication, and details the authentication process of the user of FIG. 1.

The authentication secure object 22 receives information input by the user, that is, an authentication scheme, a user identifier, a password, or a public key, transmitted by the user's login process 21 (201). The authentication secure object 22 searches the user information DB 23 to confirm whether the user requesting authentication has an account that can use the system (202) and if the user has relevant information, gives the user a reference to the certificate. The certificate is returned to the certificate DB 24 (203).

The certificate DB 24 executes a customer application process so that the information necessary when the process requests a service from the server application process, that is, authorization information, key information required for a conversation, encryption algorithm identifier (ID), and the like. It contains. The user information DB 23 stores a user ID, a password, a public key, a secret key, and the like of the user.

FIG. 3 is a flowchart illustrating an authentication method of a secure object-based distributed processing system according to the present invention, and describes the process 201 described in FIG. 2 in detail. When a user requests authentication, a certificate containing information such as whether the user is a registered user and, if a registered user, the authority information for the user, whether it is an administrator or a general user, and what information can be accessed. Returns a service ticket or public key certificate required to use the server application process.

The user's password name, authentication method, encrypted authentication data, requested authorization information, and the like are interpreted by the authentication secure object (301). It is checked whether the authentication method requested by the user is a public key authentication method (302). If the public key authentication method is used, the user's private key is signed, which is encrypted using an encryption algorithm with the public key of the authentication object. Decrypt the authentication information (user's public key) with the user's public key using a decryption algorithm, and again interpret the signature with the private key of its own (authentication object) and then the user's public key in the user information DB. It recovers (303). If the decrypted user's public key is compared with the key retrieved from the DB (304), the certificate and the public key certificate containing the user's usage right information are returned to the user (305). If the public key of the decrypted user and the key retrieved from the DB are not the same as the comparison result of step 304, the process proceeds to step 301. This public key certificate is a key used when a user requests a server application process to service a customer application process.

If the verification method in step 302 is a secret key authentication method, the encrypted authentication information (password) is decrypted with a key shared with the user and the user's password is recovered from the user information DB (306). If the password of the decrypted user is compared with the password retrieved from the DB (307), it returns the certificate containing the user's permission information and the session key to use when talking with the service ticket required when using the server application process. (308). If it is not the same, step 301 is reached.

As described above, according to the present invention, even when the authentication request is made, the password or the public key is encrypted and transmitted and used as the service request to the server application process by providing the public key certificate or the service ticket as a result of the authentication. In addition, when an application process driven by an authenticated user requests a service from a server application process, the message is encrypted and sent using this key, so that the message can be safely transmitted and received in a distributed processing environment. Therefore, the electronic commerce, electronic money, and financial transaction application processes (systems) operating in the distributed object processing system environment supporting the above authentication function can be safely performed.

Claims (1)

Interpreting the user's password name and authentication method, encrypted authentication data, and requested authorization information in the authentication secure object; The authentication security object checks whether the authentication method requested by the user is a public key authentication method, and in the case of the public key authentication method, decrypts the encrypted public key with the user's public key, and interprets the signature as a private key of the user (authentication object). Recovering the user's public key from the user information database; Comparing the decrypted user's public key with the key retrieved from the user information database and returning the certificate and the public key certificate to the user if they are the same; otherwise, transitioning to the first step; Checking whether the authentication method requested by the user in the authentication secure object is a public key authentication method, in the case of a secret key authentication method, decrypting an encrypted password with a key shared with the user and recovering the user's password from a user information database; , Comparing the decrypted user's password with the password retrieved from the user information database, and returning the certificate, the service ticket, and the session key to the user if they are the same; and if not, transitioning to the first step. Authentication method of a secure object-based distributed processing system.

Images