KR100501125B1 - Policy verificating system of internet contents and method therefore - Google Patents

Abstract

The present invention relates to a system and method for verifying authority of internet content. In particular, the present invention relates to a technology for verifying the authority of internet contents to selectively provide the service by determining whether to allow or disallow access according to a user's authority when accessing wired or wireless Internet contents for applications and various additional services. .

According to the present invention, in the authority verification method of the Internet content, XSO authorization verification to control the URL that the user accesses through the creation of a policy rule, authorization check and authorization rule update-update process when authenticating the user's content rights Client mode; And it provides a method of verifying the authority of the Internet content, characterized in that the policy code cookie (Policy Code Cookie) method for controlling the resource access for each user using the authorization code written in the cookie is applied.

Therefore, the present invention can provide a differentiated service by changing the existing simple user authentication function into a structure that enables authority management for each service and content, and controlling access to allow / deny according to the user even for the same content. In addition, it is possible to smoothly operate the permission policy for real-time permission management by user level.

Description

Policy verificating system of internet contents and method therefore}

The present invention relates to a system and method for verifying authority of internet content. More specifically, in accessing wired / wireless Internet contents for applications and various additional services, it is determined whether or not to allow or disallow access according to the user's authority, and thus the authority verification technology for internet contents to selectively provide services. It is about.

The Internet is composed of terminals that can communicate with each other, or networks that include them, based on Transmission Control Protocol / Internet Protocol (TCP / IP), through which various information between different networks can be shared. Can be. Initially, the Internet provided services such as electronic mail, gopher, telnet, and File Transfer Protocol (FTP), but they were not widely spread due to limited text-based services.

However, the Internet has grown rapidly with the development of a new Internet service technology called the World Wide Web.

The web may provide various types of information content (text, image, video, audio, etc.) based on a communication protocol called HTTP (Hyper Text Transfer Protocol) and a language called Hyper Text Markup Language (HTML). In addition, the web initially provided a hypertext that simply links text information by a hyperlink technique that enables direct movement from one information to another. It implements hypermedia that directly connects images, video, and audio according to the demand.

As a result, the use of the Internet and the number of networks connected to the Internet have increased rapidly. Accordingly, the scope and content of information contained on the Internet has also increased extensively.

In this environment, various value-added services, etc., which have been performed in the past, are being applied to the Internet. In addition, new types of services are being developed. Here, the service provider (server system) under such an Internet environment operates a certain user identification and authentication mechanism for reasons of management and security of the user (client system). Accordingly, schedule identification information is given to each user for use of the server system, and an individual authentication procedure for the identification information is performed every time.

However, as mentioned above, according to the rapid expansion of the Internet environment, the existing operation method for the user identification and authentication has certain limitations.

First, since the meaning of the rights management of the content was not introduced, it was difficult to provide differentiated services according to the rights for each content and application for all contents, applications, and various services.

Second, only the authentication function of the existing simple user was provided, rather than the structure for the authority management per service / content.

Accordingly, an object of the present invention is to solve the above problems, and an object of the present invention is to 1) change an existing simple user authentication function to a structure that enables authority management for each service / content, and 2) allow access according to a user even with the same content. It is to provide a system and a method for verifying authority of Internet contents to allow / disallow and 3) provide policy operation for real-time authorization management of users.

As the technical idea for achieving the above object of the present invention

In the authority verification method of the Internet content,

An XSO authority verification client method that controls a URL accessed by the user through policy rule generation, authority check, and authority rule update-update process when authenticating a user's content rights; And

An authorization code cookie method for controlling access to resources by user using an authorization code written in a cookie is provided.

Hereinafter, with reference to the accompanying drawings, the configuration and operation of the embodiment of the present invention will be described in detail.

Definition of member rights in the present invention means member type (general member, non-member, special manager, authority manager, etc.), member status (waiting to join, rejection of membership, normal normal, voluntary termination, suspension of authority, termination of authority, normal paid, normal paid) Authorization code (Policy for waiting for approval, suspension of payment, termination of payment, etc.), member products (not available for purchase, purchase, etc.), membership classification (real name certification, restriction of 18 years old, wire / wireless certification, nationality acquisition, legal representative, corporation, etc.) code). That is, a service that wants to verify authorization may control access of resources for each user by using authorization codes.

Content authorization method according to the present invention is installed on the web server of each service XSO authorization verification client (Client) method and authorization management used when controlling the URL that the user accesses through a web server filter and authorization verification daemon. It is divided into a policy code cookie method used when it corresponds to an application service that cannot be performed by URL.

First, the XSO authority verification client method will be described with reference to FIGS. 1 to 4.

As shown in FIG. 1, the service machine 400 receives various types of information, that is, an HTTP request from the user terminal 200 through the Internet 100; The XSO server 500 is configured to receive an XML file containing a policy rule from the administrator tool 300 through the Internet 100.

In this case, the service machine 400 includes a web server filter 410 that receives an HTTP request from the user terminal 200, a web server 420 that processes a service providing request of the user terminal through the Internet, and the administrator tool. Authorization verification daemon 430 is provided to provide the service through the appropriate authentication process for the request of (300).

In addition, the XSO server 500 manages a series of connected authentication procedures linked to the web server 510 and the web server 510 for processing a service providing request of an administrator tool 300 through the Internet. The XSO authentication module 520, the XSO authorization module 530 for providing a corresponding service through an appropriate authentication procedure for the request of the administrator tool 300, and the authorization rule generated from the XSO authorization module 530 ( The authority rule DB 540 for storing a policy rule is provided.

Here, the web server 420, 510 is used to provide information to or receive input from the user or administrator. That is, the message transmitted between the client and the web server 420 (510) is transmitted according to the Hypertext Transfer Protocol (HTTP) protocol. In the HTTP protocol, a client sends a request message to a web server, which typically includes a Uniform Resource Locator (URL) representing a file about the request message. The request message may be included in one or more packets, the first packet usually comprising a URL. In response to the request message, the web server sends a result message to the client that includes the server's response to the request.

Subsequently, the process for verifying XSO authority according to the present invention is divided into 1) policy rule generation, 2) authority check, and 3) policy rule update. Looking at with reference to Figure 4 as follows.

First, a process of generating a policy rule will be described with reference to FIG. 2.

Authorization of the administrator (Policy Rule) is to use the administrator tool 300, and generates a cookie (Cookie) value containing the authorization rule and authorization code for each service (S600).

At this time, the cookie is generated by the success of the log-in and authentication process, and is generated by a combination of values referring to a DB value including ten authority rights items (member type, membership status, member product, etc.). do. In addition, the administrator tool 300 provides a form for inputting a URL mapped to an authorization code.

Then, the generated cookie value is stored as an XML document (S610).

Next, the process of the authority check will be described with reference to FIG. 3.

First, when the web server 420 and the XSO authority daemon 430 of the service machine 400 are driven (S700), the XSO authority daemon 430 is loaded and the XSO server 500 writes the authority rule of the corresponding service. Request a file (S710). At this time, the XSO authority daemon 430 loads the XML file into the memory (S720).

If the user requests a random web page in that state (S730). The web server filter 410 passes the HTTP request to the XSO authority daemon 430 (S740). At this time, the XSO authority daemon 430 checks the existence of the guide from the cookie of the HTTP request (S750).

After determining whether the guide exists, if there is no guide, a login page is returned to the user (S760).

At this time, if there is a guide, the authorization code is extracted from the cookie or the XML file containing the authorization code is searched and branched according to the corresponding rule (S765). After extracting the authorization code, it is checked whether the page requested by the user is accessible (S770).

After determining whether the page is accessible, if the access is possible, the page is returned to the user (S780). At this time, if access is not possible, an error message is returned to the user (S785).

Finally, the process of updating the policy rule will be described with reference to FIG. 4.

First, the administrator modifies the permission rule of an arbitrary service using the administrator tool 300 (S800). After modifying the permission rule, the update button is pressed (S810).

At this time, the XSO server authorization module 530 transmits the authorization update message to the web server 510 of the corresponding service (S820), and the web server filter 410 of the corresponding service updates the authorization message with the authorization verification daemon ( 430 and transmits to (S830).

Then, the authority verification daemon 430 receives an update message and requests an XML file of a new authority rule from the XSO server 500 (S840). After that, the XML file is loaded and then loaded into the memory (S850).

Next, the policy code cookie method of the content right verification method according to the present invention will be described.

The authorization code cookie method of the present invention can perform resource access control for each user by using the authorization code written in the cookie, and the user authorization code is written in the cookie when the user is authenticated.

At this time, if each service accesses the MDB every time for user authority check, a large system configuration is required. As the number of services requiring authorization verification increases, the system grows.

The way to write on Cookie is as follows.

[Permission Code Cookie]

POLICY_CODE = 5E581A20F5FF3DDBEC43

The cookie POLICY_CODE is encrypted using the XSO library and can be decrypted through the CP authentication module.

The cookie value of the decrypted POLICY_CODE is as follows.

5E581A20F5FF3DDBEC43 → code 1 = ACB101100

As described above, the authorization code cookie method may be applied to a C / S program such as chat and a service that wants to control user access using a authorization code directly from a web server page such as ASP or JSP.

As described above, according to the system and method for verifying the authority of the Internet content according to the present invention, the existing simple user authentication function is changed into a structure that enables authority management for each service and content, and even the same content is allowed / disallowed according to the user. Differentiated services can be provided by controlling access. In addition, it is possible to smoothly operate the policy (policy) for real-time authorization management by user level.

1 is an overall configuration diagram of an XSO authority verification module of a content authority verification method according to an embodiment of the present invention.

2 is a flowchart illustrating a process of generating a policy rule of an XSO authority verification process.

3 is a flow chart showing the authority check process of the XSO authority verification process.

4 is a flowchart illustrating a process of updating an authority rule of an XSO authority verification process.

<Description of Symbols for Major Parts of Drawings>

100: internet 200: user terminal

300: Administrator Tool 400: Service Machine

410: Web server filter 420: Web server

430: Authorization Verification Daemon 500: XSO Server

510: web server 520: XSO authentication module

530: XSO authorization module

Claims (7)

In the authority verification system of the Internet content, A service machine for receiving various types of information from a user terminal through the Internet; An XSO server that receives an XML file containing a policy rule from an administrator tool through the Internet; The service machine includes a web server filter for receiving an HTTP request from a user terminal; A web server for processing a service providing request of a user terminal through the Internet; And an authority verification daemon for providing a corresponding service through an appropriate authentication procedure for the request of the administrator tool. The XSO server includes a web server for processing a service providing request of an administrator tool through the Internet; An XSO authentication module for managing a series of connected authentication procedures in association with the web server; An XSO authorization module for providing a corresponding service through an appropriate authentication procedure for a request of the administrator tool; And an authorization rule DB for storing the authorization rule generated from the XSO authorization module. In the authority verification method of the Internet content, When the user authenticates the user's content authority, the administrator inputs a cookie key value containing the authorization rule and authorization code for each service by using the administrator tool, and the authorization rule for storing the value entered by the administrator as an XML document. An XSO authority verification client method that controls a URL accessed by a user through policy rule generation, authority check, and authority rule update-update process; And Authorization code method of the Internet content characterized in that the authorization code cookie method is applied to control the resource access for each user using the authorization code written in the cookie. delete The method of claim 2, wherein the administrator tool provides a form for inputting a URL mapped to an authorization code. The method of claim 2, wherein the authority check process Running a web server and an XSO authorization daemon of the service machine; Requesting an XML file in which an authorization rule of a corresponding service is written to an XSO server when the XSO authorization daemon is loaded; When the user requests any web page, the web server filter passes the HTTP request to the XSO authorization daemon; Checking the presence of a guide from a cookie of an HTTP request in the XSO privilege daemon; After determining whether the guide exists, if there is no guide, returning a login page to the user, and if there is a guide, extracting an authorization code from a cookie or querying an XML file containing the authorization code and branching according to a corresponding rule; Extracting the authorization code and checking whether the page requested by the user is accessible; And determining whether the page is accessible, returning the page to the user if the access is possible, and returning an error message to the user if the access is not possible. delete The method of claim 2, wherein the updating process of the authorization rule An administrator modifying an authorization rule of any service using an administrator tool; Modifying the permission rule and then pressing an update button; Transmitting, at the XSO server authorization module, a permission update message to the web server of the service; Transmitting an update message to the authority verification daemon in the web server filter of the corresponding service; Receiving an update message from the authority verification daemon and requesting an XML file of a new authority rule from an XSO server; And receiving the XML file and loading it into a memory.