KR100383442B1 - security method of server system - Google Patents

Abstract

The present invention relates to a security method of a server system, comprising a server, a plurality of clients to access the server, a plurality of ports connecting the server and a plurality of clients, and the server and the plurality of clients A security method of a server system for generating a one-time password independently for each server and client pair, wherein an algorithm for generating a password is installed periodically or at a time required by the server side; A server connection step of connecting a server and a client by opening a server side port to a client to access the server, a password generation step of generating the same seed code and password between the connected server and the client, and at the client side A password judging step for determining whether the generated password matches the password generated at the server side, and if the passwords do not match at the password judging step, closing the server-side port to block access to the client connected to the server. It is configured to include an access blocking step, and by generating the same password between the server and the user with the same seed code (sed code) and the same algorithm periodically or at the point of time requested by the server side to determine whether they are illegal Monitor and manage the connection.

Description

Security method of server system {security method of server system}

The present invention relates to a security method of a server system that fundamentally blocks illegal user access in addition to a legitimate user.

Recently, thanks to the rapid development of the computer industry, personal computers have been widely used in almost all fields, and administrative documents such as public institutions are also stored in computer files.

In addition, the Internet is becoming common and is spreading to every family. Nowadays, archiving of personal computers is not only safe because of illegal user hacking, but also major government agencies including financial institutions and public institutions can not be assured. to be.

In addition, as e-commerce, which conducts various off-line transactions in cyberspace through the Internet, is activated, the contents of information (messages) transmitted between buyers and suppliers (BtoB or BtoC) are protected. There is a growing interest in document security methods.

Equally important, however, is the secure management of various server systems, including certificate servers and electronic payment servers, which manage and authenticate each user (including buyers and suppliers) so that e-commerce can be secured between buyers and suppliers. .

Illegal user access to the server is very important because it can cause not only the performance of the server but also the destruction of the server system and the leakage of information in the server.

Thus, in order to block illegal access of the user to the server system, the user's validity is authenticated with a user ID and a password.

In other words, the password is encrypted and stored in the server.If the user enters ID and password, the user ID and password are compared with the password stored in the server. It was made.

However, in such a security method of the conventional server system, when an illegal user finds and inputs a legitimate user's ID and password, there is a problem that the server does not have a method of distinguishing illegal users, thereby enabling hacking.

In addition, even if an illegal user accesses the server, once the connection is established between the server and the user, access is allowed regardless of whether the user is justified.

The administrator was forced to view logs or other running processes, investigate suspicious connections, and block them. This method depends on the sincerity and related knowledge of the administrators. There is a problem that it is impossible for the administrators to perform such tasks perfectly in the situation of rapidly increasing computer systems connected to the network as in today.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, by generating mutual passwords at the time required by the server or the user periodically by the same seed code and the same algorithm between the server and the user. The purpose of the present invention is to provide a security method of a server system that monitors and manages illegal access of a user by determining whether they are identical.

Another object of the present invention, even if a connection between the server and the user is made, the server side checks the password transmitted from the user side periodically or aperiodically to distinguish the illegal user who knows the password, and without the password backdoor ( It is to provide a security method of server system to find all users who access by using backdoor) or vulnerabilities to secure the server.

1 is an overall configuration diagram of a server system with a security function according to the present invention,

2 is a flowchart showing an operation procedure for protecting a server using the server system according to the present invention.

<Explanation of symbols for the main parts of the drawings>

10: server 20 (20-1 to 20-n): client

30 (30-1 to 30-n): port

In order to achieve the above object, a security method of a server system according to the present invention includes a server, a plurality of clients to be connected to the server, a plurality of ports connecting the server and the plurality of clients, and the server And a plurality of clients are provided with an algorithm for generating a password periodically or at a time required by the server side to generate an independent one-time password for each server and client pair. A server connection step of connecting a server and a client by opening a server side port to a client to access the server, a password generation step of generating the same seed code and password between the connected server and the client, and at the client side A password judging step for determining whether the generated password matches the password generated at the server side, and if the passwords do not match at the password judging step, closing the server-side port to block access to the client connected to the server. Characterized in that configured to include a connection blocking step.

The server and the plurality of clients are provided with a program (software) for generating the same password periodically or at the time required by the server side by the same seedcode and the same password generation algorithm. It is characterized by generating independent one-time passwords for each pair.

The same seedcode between the server and the client is not fixed, and each connection generates a seedcode at the server side or the client side, and generates a mutual password by the same algorithm based on the seedcode.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is an overall configuration diagram of a server system having a security function according to the present invention.

As shown in FIG. 1, a server system having a security function includes a server 10 and a plurality of clients 20-1 to 20-n (users) who want to connect to the server 10 and the server 10. And a plurality of ports 30-1 to 30-n for connecting the plurality of clients 20-1 to 20-n through an internet network, and the like; The server 10 and the plurality of clients 20-1 through 20-n have the same seed code and the same password periodically or aperiodically (the time required by the server side) by the same password generation algorithm. A program (software) is generated that generates.

Programs installed on the server 10 and the plurality of clients 20-1 to 20-n are independent one time passwords for each server 10 and client 20-1 to 20-n pairs. Are generated symmetrically from each other, and pass the password generated at the client 20-1 to 20-n to the server 10, and at the server 10 at the client 20-1 to 20-n. By checking whether the transmitted password is the same as the password generated on the server 10 side, it manages and monitors the validity of the user.

On the other hand, the same seed code between the server 10 and the clients 20-1 to 20-n is not fixed, and the server 10 side or the clients 20-1 to 20-n are connected at every connection. On the other hand, the seed code is generated and the mutual password is generated by the same password generation algorithm.

This is due to the fact that due to the development of communication, the effect of periodic one-time password transmission amount on the overall traffic is weak.

Hereinafter, the operational effects of the security method of the server system configured as described above will be described.

FIG. 2 is a flowchart showing an operation procedure for protecting a server by using the server system according to the present invention. In FIG. 2, S denotes a step.

First, a program (software) for generating a password by the same seed code and the same password generation algorithm is installed in the server 10 and the computers of the plurality of clients 20-1 to 20-n.

Programs installed on the server 10 and the plurality of clients 20-1 to 20-n are independent one time passwords for each server 10 and client 20-1 to 20-n pairs. Generate symmetrically with each other.

Next, when any (many) clients (or processes) 20-1 to 20-n request a connection to the server 10 (S1), a daemon that is a background process on the server 10 side becomes a kernel. The function calls are assigned to ports (30-1 to 30-n), and the new daemon is forked to the ports (30-1 to 30-n) to communicate. All clients 20-1 to 20-n wishing to access (10) are connected to ports 30-1 to 30-n of the server 10 side (S2).

From this point on, the daemon and the client 20-1 to 20-n side applications, i.e., the server 10 and the client 20-1 to 20-n side computers across the ports 30-1 to 30-n. By using the same seedcode and the same password generation algorithm in the programs installed in the program, the same password is generated periodically or aperiodically (as required by the server side) as follows.

That is, the server 10 determines whether the seed code is required to generate the same password on the server 10 and the clients 20-1 to 20-n, and if the seed code is required (if YES), the client Seed code is requested from (20-1 ~ 20-n) side (S3, S4).

The client 20-1 to 20-n transmits the seed code of the server 10 to the server 10 by inputting the seed code according to the request (S5).

Subsequently, the server 10 requests a password from the client 20-1 to 20-n to confirm whether the clients 20-1 to 20-n connected to the server 10 are valid, and the seed code and the seed code. The server 10 side password is generated by the password generation algorithm. (S6, S7)

When the password is generated on the server 10 side, the clients 20-1 to 20-n also by the seed code and the password generation algorithm according to the password request on the server 10 side also on the clients 20-1 to 20-n side. In step S8, the password is generated and transmitted to the server 10.

Therefore, the server 10 compares the password transmitted from the client 20-1 to 20-n with the password generated by the server 10, and if the password matches (if YES), the server 10 The ports 30-1 to 30-n are kept open to keep the clients 20-1 to 20-n connected (S9 to S11).

As a result of the determination in step S10, if the passwords do not match (NO), the ports 20-1 to 30-n of the server 10 side are immediately closed to close the clients 20-1 to 20-n. (S10, S12)

Even if the clients 20-1 to 20-n maintain the connection to the server 10, the server 10 determines whether it is the next password request time, and if it is not the password request time (NO), the next password request. Wait until the point in time (S13, S14)

The password request point is used to identify illegal users who know the password on the server 10, and periodically or aperiodically to find all users who access using the server's backdoor or vulnerability without a password. It is time to check the password generation algorithm.

If the determination result in step S13 is a password request point (YES), the flow returns to step S6 to repeat the operation of step S6 or less.

Accordingly, the server 10 requests the client 20-1 to 20-n again for a password and checks whether the same is the same as the server 10 side password. It continuously manages and monitors the validity of the clients 20-1 to 20-n already connected.

This is done while the clients 20-1 to 20-n requesting a connection are connected to the port 30 on the server 10 side to pass the mutually generated password values. 1 to 20-n) checks the password generation algorithm periodically or non-periodically and re-requests the password value, making it impossible for hackers who cannot send the password value to the constantly changing algorithm.

As a result, even if the malicious user knows the password of the legitimate user, there is no way to generate the one-time password of the next step, so that the port 30-1 to 30-n can be immediately closed to block the connection.

The server system periodically scans the open ports 30-1 to 30-n to check whether the open ports 30-1 to 30-n are exchanging the one-time passwords generated at both ends. If not, the ports 30-1 to 30-n may be closed to fundamentally block illegal user access.

According to the security method of the server system according to the present invention as described above, by generating the same password between the server and the user by the same seed code (sed code) and the same algorithm periodically or at the point of time requested by the server side By judging whether it is the same, there is an effect of continuously monitoring and managing illegal user access.

In addition, according to the present invention, even if a connection is established between the server and the user, the server side checks the password transmitted from the user side periodically or aperiodically to distinguish illegal users who know the password, and back-door ( The server can be secured by finding all users who access by using backdoors or vulnerabilities, which effectively prevents e-commerce paralysis and information leakage of major government agencies.

Claims (3)

Server, a plurality of clients wishing to access the server, and a plurality of ports connecting the server and the plurality of clients, and the server and the plurality of clients periodically or at the time required by the server side. A security method of a server system, wherein a generating algorithm is installed to generate an independent one-time password for each server and client pair; A server connection step of connecting a server and a client by opening a server-side port to a client to access the server; A password generation step of generating the same seedcode and password between the connected server and the client; A password discrimination step of determining whether the password generated at the client side is matched with a password generated at the server side by transferring the password generated at the client side; And a connection blocking step of blocking a connection of a client connected to the server by closing the server port if the password does not match in the password judging step. delete The method of claim 1, The same seedcode between the server and the client is not fixed to each other, and generates a mutual password based on the seedcode generated at the server side or the client side at every connection.