KR100875020B1 - User terminal based integrated authentication system and method - Google Patents

Abstract

The present invention relates to a user terminal-based integrated authentication system and method thereof, comprising: a first process of performing user authentication at the request of a user terminal and then connecting an authentication session between the user terminal and the authentication server according to the result; A second process of transmitting, from the authentication server to the user terminal, a list of a system for allowing access among the session management policy and a system to which the work is allowed, and one of the work target systems in the list of the system for allowing access from the user terminal; Selecting and transmitting to the authentication server, a third process of transmitting a list of work permission commands for the selected work target system to the user terminal, and logging in to the selected work target system in the user terminal and then the work permission command. A fourth process of inputting a desired command from a list, and the user And a fifth step of determining whether a corresponding user has access right to the selected target target system by executing a command to the selected target target system and receiving a result when the user has the access right. And a technique for installing an agent only on a user terminal to handle integrated authentication without having to install an agent for access authentication, authorization authentication, and job history management on the proxy server.

Description

Integrated terminal based authentication system and method thereof

1 is a block diagram of a user terminal-based integrated authentication system according to an embodiment of the present invention.

2 is a flow chart showing an authentication method of a user terminal based integrated authentication system according to an embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: user terminal 200: VPN server

300: authentication server 400: management server

500: log server 600: router

700: Target System 800: Internet Network

The present invention relates to a user terminal-based integrated authentication system and method thereof, and more particularly, to the agent only in the user terminal without installing an agent for access authentication, authorization authentication, and work history management in the operating facility and proxy server. It is a technology to install and handle integrated authentication.

In general, the conventional authentication system installs an agent in a user PC (user terminal) and an operation facility (server) to manage access authentication, authorization authentication, and work history, and the proxy between the user PC (user terminal) and the operation facility. By using a server, a proxy server was used to perform connection authentication, authorization authentication, and job history management.

The first method of installing agents for both user PCs (user terminals) and operating facilities (servers) is that there are various types of operating facilities, and it is difficult and expensive to install agents in the operating facilities due to the influence of OS and applications. there was. In addition, the method of installing the agent in the operation facility requires continuous agent update and reinstallation for each operation facility when the function is advanced, and may require a reboot of the operation facility. ), There is a problem that expensive initial investment cost is required to install the agent in both () and the operation facility (server).

Although the second method of installing the agent on the proxy server solves the problems of the first method such as cost because it is not necessary to install the agent on the operation facility, the following problems remain.

First, since the proxy server must perform connection authentication, authorization authentication, job log, and session management for all sessions of the user, a problem occurs in which all sessions in use at the time of proxy server failure are simultaneously disconnected.

In addition, since the proxy server plays an intermediate role, the session speed degradation such as Telnet and FTP occurs when a large number of sessions are formed at the same time, causing user inconvenience.

Therefore, the present invention for solving the above-described problem is to install the agent only in the user terminal to handle the integrated authentication, without the need to install the agent for access authentication, authorization authentication, and job history management in the operating facility and proxy server There is a purpose.

In addition, the present invention has an object to increase the convenience of the user by periodically changing the ID and password of the operation facility automatically.

In the user terminal-based integrated authentication method according to an embodiment of the present invention for achieving the above object, after performing the user authentication at the request of the user terminal, the authentication session is connected between the user terminal and the authentication server according to the result. A second process of transmitting, from the authentication server to the user terminal, a session management policy and a list of access permission systems listing a system to which access is allowed, and a list of access permission systems at the user terminal; Selecting one work target system and transmitting the selected work target system to the authentication server; and a third process of transmitting a work permit command list for the selected work target system to the user terminal; and logging in the selected work target system from the user terminal. A fourth command for inputting a desired command from the list of work permission commands And a fifth process of determining, by the user terminal, whether the user has access to the selected work target system and executing a command on the selected work target system to receive a result when the user has the access right. It is characterized by.

In addition, the user terminal-based integrated authentication system according to an embodiment of the present invention, the user terminal including an agent for connection authentication, authorization authentication, and operation history management, and when the authentication session with the user terminal is connected, the Sends a list of access control systems that list the session management policy and the target systems among the target systems, and sends a list of work permission commands for the selected system when one target system is selected from the list of access allowed systems. And a virtual private network server for transmitting the user authentication request of the user terminal to the authentication server and determining whether to connect to the VPN according to the result.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a block diagram of a Total Access Control System (TACS) according to an embodiment of the present invention.

Integrated authentication system of the present invention, the user terminal 100, virtual private network (virtual private network) server 200, authentication server 300, management server 400, log server 500, router (ROUTER; 600) , And the target system 700 is configured.

The user terminal 100 can implement Telnet, FTP, and SSH services, and can automatically log in to the target system 700 (operational facility) without an additional authentication procedure, and the IP of the target system 700. Download list and each ID / Password. In addition, the user terminal 100 downloads a list of work permission commands for an operation facility, periodically transmits a heartbeat to inform the client that the client is running for session management, and manages a session management policy for client operation. Download and perform user log transfer functions (access authentication, authorization authentication, and job log). Here, the user terminal 100 is preferably an operator terminal for performing integrated management and management of the work target system 700. In addition, the user terminal 100 may be connected through the authentication server 300, the management server 400, the log server 500 and the Internet network 800, which is an operation facility.

The VPN server 200 performs a function (NAT) of making a connection IP of various users into one representative IP. In addition, if authentication is successful by performing user authentication in the authentication server 300, the VPN server 200 forms VPN tunneling with the user terminal 100.

The authentication server 300 stores session management policy information, access permission system list (operational facility information such as IP list, ID and password of operation facilities for each operator, that is, target systems), user information, and operation permission command list information. It performs user authentication and transmits session management policy information, access permission system list, work permission command list, etc. to the user terminal 100 to perform authentication on the work target system 700.

The management server 400 performs a client policy setting function, user access control policy setting function by user, organization, user and operation ID and password management function, and session monitoring and statistics management function. In particular, the management server 400 of the present invention automatically changes the ID and password of the target system 700 to provide a single sign-on (SSO) service and transmits to the target system 700.

The log server 500 collects, stores, and manages user access authentication, authorization authentication, and work logs.

The router 600 is connected between the VPN server 200 and the target system 700 and each of the servers 300 to 500 to route signals.

The target system 700 includes facilities with access rights, facilities without access rights, and the like.

Hereinafter, an integrated authentication method according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

First, the management server 400 performs a user registration (S101), and transmits the resulting user information to the authentication server 300 to store (S102). At this time, the authentication server 300 preferably stores the connection target facility information, operator information, access list information, authorization list information, RBAC (Role Base Access Control) information and the like in advance.

The user terminal 100 on the user side receives an ID and password from the user and transmits the ID and password to the VPN server 200 (S103 and S104).

Thus, the VPN server 200 requests the user authentication by passing the ID and password to the authentication server 300 (S105).

Thereafter, the authentication server 300 compares the transmitted ID and password with the ID and password registered in the internal DB to perform user authentication (S106), and notifies the VPN server 200 of the user authentication result (S106). S107).

Accordingly, the VPN server 200 determines whether the authentication is successful by viewing the received authentication result (S108). If the authentication fails, the VPN server 200 notifies the user terminal 100 that the connection has failed (S109). A session is established between the 100 and the VPN server 200 (S110).

Thereafter, a new session is automatically configured by a direct authentication session request between the user terminal 100 and the authentication server 300 (S111, S112). At this time, the authentication session request between the user terminal 100 and the authentication server 300 is transmitted through the Internet network (800).

Subsequently, the authentication server 300 transmits the session management policy to the user terminal 100 through the Internet network 800 (S113). In this case, the session management policy indicates that the user terminal 100 transmits log information to the log server 500 every few seconds or minutes, how to load balance, timer related information, and that the client of the user terminal 100 is running. It includes information such as a period for transmitting a heartbeat signal to inform.

Thereafter, the authentication server 300 transmits to the user terminal 100 the list of the system allowing access of the work target system 700 (S114). In this case, the authentication server 300 transmits the IP list of the plurality of target systems and the IDs and passwords of the target systems 700.

When the request and list transmission and reception between the authentication server 300 and the user terminal 100 of the process S111 ~ S114 is transmitted and received through encryption . Encryption communication between the authentication server 300 and the user terminal 100 uses SSL (Secure Socket Layer), the operation principle is as follows. The user terminal 100 extracts the public key from the certificate of the authentication server received from the authentication server 300 and encrypts and transmits an arbitrary string for generating a session key with the public key of the authentication server 300, and then sends the authentication server 300. ) Share an arbitrary string by decrypting the encrypted string using the private key, and encrypts the message by creating a session key through the shared string.

Accordingly, the user terminal 100 views the IP list of the target systems, selects the desired target system 700, and transmits the result to the authentication server 300 (S115). The authentication server 300 selects the selected target object. The task permission command list for the system 700 is transmitted to the user terminal 100 (S116). In this case, the work permission command list refers to a list of work permission commands available for the target system 700.

Thereafter, the user terminal 100 logs in to the selected work target system 700 using the received ID and password (S117) to enable access to the corresponding work target system 700, and then the user. Receive a command from (S118).

The user terminal 100 compares the list of work permission commands received from the authentication server 300 with the commands input by the user, and determines whether the user has the authority to perform the input command for the selected target system 700. (S119).

As a result of the determination of step S119, if there is access authority, the user terminal 100 requests execution of a command to the selected work target system 700 through the VPN server 200 (S120), and the work target system 700 After executing the command, the result is transmitted to the user terminal 100 through the VPN server 200. On the other hand, the user terminal 100 rejects the execution of the command if the user does not have access to the target system.

In this case, FIG. 2 discloses an example of determining whether a corresponding user has authority to the selected work target system 700, and may be given a command execution authority according to a user. For example, if the operator A grants all rights to the mail server (target system), and the operator B gives only the read only permission to the mail server, it is determined whether to execute the command separately. It is desirable to be able to.

Accordingly, the user terminal 100 transmits log information to the log server 500 through the Internet network (S122). In this case, the user terminal 100 transmits log information in real time or at a predetermined period according to the session management policy received in step S113, and the log information includes access authentication log information, log information denied command execution, and command execution. Include work history.

Thereafter, the authentication server 300 periodically determines whether or not an abnormal session of the user terminal 100 (S123), blocks the abnormal session (S124), and manages the statistical information related to such authentication server 400 By transmitting (S124), the management server 400 to store the authentication statistics information (S125).

On the other hand, the log server 500 transmits the log statistics information to the management server 400 (S126), so that the log management information is stored in the management server 400 (S127).

The storing of the authentication statistics information (S125) and the storing of the log statistics information (S127) disclose an example of storing the authentication statistics information first in FIG. 2, but may also store the log statistics information first.

Thereafter, the management server 400 changes the password of the target system 700 and transmits the password to the target system 700 (S128). Therefore, the ID and password of the target system (operational facility) is automatically changed periodically in the management server 400 to support Single Sign-On (SSO) service, thereby greatly improving user convenience. .

On the other hand, during the process of S101 ~ S128, in order to maintain the authentication session with the authentication server 300, the user terminal 100 periodically transmits the heart beat information (Heart Beat) information to the authentication server (300) Preferably, the user terminal 100 downloads and reflects a client operation management policy set by an administrator, such as a log transmission cycle and a load balancing method.

In addition, by applying the converted IP to the access control list (ACL) of the network device (router) using the network address translation (NAT) function of the VPN server 200, the unauthorized access of the unauthorized user is fundamental. To limit it.

As described above, the present invention does not install a separate agent in the operation facility, and installs a client only in the user terminal so that various facilities can be accommodated at a low cost.

In addition, the present invention is an authentication system that operates in a push sequence (Push Sequence) method by adding the authorization authentication function in addition to the authentication authentication function of the general authentication server telnet (single) for a variety of heterogeneous systems with only one login (Single Sign On) process Allows you to implement systems that ensure the legitimate use of Telnet), FTP, and SSH services.

In addition, the user terminal 100 of the present invention blocks illegal access of unauthorized persons without permission, provides authority authentication and work log functions, and stores various details thereof in a database to provide various statistical analysis functions.

As described above, the present invention integrates heterogeneous equipment such as network equipment or server facilities and performs connection authentication, authorization control, and perfect logging to effectively block an operator's mistake or illegal access by unauthorized users. have.

  In addition, the present invention has the effect of providing the convenience, the auditing function through the tracking of accidents at the time of accident tracking, capacity expansion near infinity, etc. by automating the management of the ID and password for the operation facility.

In addition, the present invention has an effect that can greatly improve the convenience of the user by periodically changing the ID and password of the operating facility.

In addition, the preferred embodiment of the present invention for the purpose of illustration, those skilled in the art will be able to various modifications, changes, replacements and additions through the spirit and scope of the appended claims, such modifications and changes are the following claims Should be seen as belonging to.

Claims (19)

Performing a user authentication at the request of a user terminal and then connecting an authentication session between the user terminal and the authentication server according to the result; A second step of transmitting, from the authentication server to the user terminal, a connection management system list listing a session management policy and a list of work target systems which are allowed access to the work target system; A third step of transmitting a work permit command list for the selected work target system to the user terminal when the work target system selected from the list of access permission systems is transmitted to the authentication server; A fourth step of logging in the selected work target system from the user terminal and receiving a desired command from the work permit command list; And And a fifth process of determining, by the user terminal, whether the user has access right to the selected work target system and executing a command on the selected work target system to receive a result when the user has the access right. Integrated terminal authentication method characterized in that the user terminal. The method of claim 1, wherein the first process comprises: And after establishing VPN tunneling between the user terminal and the VPN server, connecting an authentication session between the user terminal and the authentication server. The session management policy of claim 1, wherein Log information transmission cycle, timer-related information, the user terminal based integrated authentication method comprising the transmission period information of the heartbeat (HeartBeat) signal for notifying that the client of the user terminal is running. The method of claim 1, wherein the list of the access permission system of the second process User terminal-based integrated authentication method comprising the IP list, ID and password of the target system to which access is permitted. The method of claim 1, wherein the fifth process comprises: And determining whether there is the access right by using the work permission command selected from the work permission command list in the user terminal. The method of claim 1, And a sixth process of transmitting and storing log information to the log server by the user terminal. The method of claim 6, wherein the sixth process, The user terminal-based integrated authentication method according to the session management policy, characterized in that for transmitting the log information in real time or at regular intervals. The method of claim 6 or 7, wherein the log information of the sixth process, User authentication based on the user terminal, characterized in that it comprises access authentication log information, log information denied execution of the command, and the operation history of the command. The method of claim 6, And a seventh process of statistically transmitting the log information in the log server and transmitting the stored log information to a management server. The method of claim 6, An eighth step of determining, by the authentication server, an abnormal session of the user terminal; And And a ninth process of blocking the abnormal session in the authentication server and transmitting and storing authentication statistical information to a management server. The method of claim 4, wherein User terminal-based integrated authentication method characterized in that the management server to support the single-sign-on (SSO) service by periodically changing the ID and password of the target system in the access allowable system list periodically . A user terminal including an agent for access authentication, authorization authentication, and work history management; When the authentication session with the user terminal is connected, the access management system list including the session management policy and the system to which access is allowed is transmitted to the user terminal, and one work target system of the access allowable system list is transmitted. If selected, the authentication server for transmitting a list of work permission commands for the selected work target system; And a virtual private network server configured to transmit the user authentication request of the user terminal to the authentication server and determine whether to connect to the VPN according to the result. The method of claim 12, wherein the session management policy of the authentication server, Log information transmission cycle, timer related information, the transmission terminal information of the heartbeat (HeartBeat) signal for notifying that the client of the user terminal is running, characterized in that it comprises a user terminal based. The system of claim 13, wherein the list of the system allowing access to the authentication server is as follows. Integrated terminal authentication system based on the user terminal, characterized in that it includes an IP list, ID and password of the target system to which access is permitted. The method of claim 14, wherein the user terminal, Upon receiving the task permission command list from the authentication server, the user ID based on the selected task target system is automatically entered and logged in, and then the desired task permission command is input from the task permission command list. Authentication system. The method of claim 15, wherein the user terminal, And determining whether the corresponding user has access to the selected work target system by using the work permission command. The method of claim 16, wherein the user terminal, If the corresponding user has the access right, requests for executing the command to the selected work target system, and receives the result. The method of claim 17, A log server that receives and manages log information including access authentication log information, log information denied command execution, and a job history on which the command is executed from the user terminal; And And a management server configured to receive, store, and manage log statistics information from the log server and authentication statistics information from the authentication server, and to register and manage user information. The method of claim 18, wherein the management server Integrated terminal authentication system based on the user terminal, characterized in that for automatically changing the ID and password of the target system in the list of the system to allow access to the selected target system.

Images