KR101229128B1 - Management method of several kinds of hash passwords with verification keys - Google Patents

Abstract

The present invention relates to a variety of hash password management method using a verification key, to provide a hash password management method for managing a variety of hash passwords using a verification key in a system that must manage passwords with different hash methods for each service.

To this end, the present invention, a hash password management method, comprising: generating a plurality of hash passwords and generating a verification key using the generated plurality of hash passwords; A verification key management step of storing and managing the generated verification key; A verification key comparison step of comparing the verification key generated with the current hash password with the stored verification key; And a password synchronization step of performing password synchronization when the verification key is inconsistent as a result of the comparison, wherein the verification key generation step includes processing a plurality of hash passwords by processing various one-way hashes when the password is first generated or changed. And generate a verification key by calculating the generated hash passwords.

Provisioning system, hash password management, verification key, password synchronization, reset

Description

Management method of several kinds of hash passwords with verification keys}

The present invention relates to the field of provisioning technology based on customer subscription in a subscription processing system, and more particularly, a hash for encrypting and managing a hash password in a provisioning system for provisioning a password having a different hash method for each service system to various systems. It's about password management.

In an embodiment of the present invention, a case in which the present invention is applied to a provisioning system will be described as an example. However, the present invention may be applied to a system in which a hash method for each service needs to manage different passwords. Note that it is not limited to this provisioning system.

In accordance with the password encryption requirements of the Act on the Promotion of Information and Communication Network Utilization and Information Protection, and the Enforcement Decree of the Act on the Promotion of Information and Communication Network Utilization and Information Protection, the existing system and the new When a password is linked to a system and a system having a different work type, the hash method may not be uniform for each service system according to encryption technology and a service providing method.

Here, provisioning refers to providing a service by configuring information necessary for using a service that a customer uses based on a customer subscription.In the case of a service performing user authentication, provisioning authentication information such as an ID and a password is also provided. Is part of.

According to the revised Information and Communication Network Act, passwords must be stored in one-way encryption, but the encryption method is not specified, and legacy authentication is difficult to apply to access authentication systems, service authentication systems, web authentication systems, and new encryption methods. When provisioning authentication information to various systems such as systems, it is necessary to use various encryption methods for each system situation.

For example, a particular system already uses encryption in various legacy systems, but if it is difficult to change the encryption method in a legacy system, the encryption system of the legacy system should be applied. This makes it virtually difficult to unify encryption.

Conventionally, in the situation where the unification of the encryption method is difficult, in the case of performing different encryption for each system for the protection of personal information, it is impossible to compare the encrypted data, so even if the encryption value of a specific system is changed for unknown reasons There was a problem that can not know itself. Looking at the conventional password encryption management method in detail with reference to Figure 1 as follows.

1 is a flowchart illustrating a process in a case where a failure occurs while managing hash passwords in various manners in a provisioning system that does not manage a conventional verification key. The user terminal 11, the provisioning system 12, and a connection are illustrated in FIG. The service is provided through the authentication system 13 and the service authentication systems 14 and 15.

First, a brief review of the subscription and service provision procedure, the user terminal 11 requests the service subscription through the web or subscription system. The provisioning system 12 then provisions the service information requested by the user terminal 11 via the web or subscription system to the access authentication system 13 and the service authentication systems 14, 15. Then, the connection authentication system 13 and the service authentication systems 14 and 15 provide a connection service or a specific service to the user terminal 11 based on the service information received from the provisioning system 12.

Meanwhile, referring to the provisioning process with reference to FIG. 1, when the user terminal 11 resets a password and requests the provisioning system 12 to configure a password through the web (101), the provisioning system 12 may be configured. After generating a hash value (password hash) using a hash that is different from system to system using the password received from the user terminal 11 (102) and transmits the hash value to each system (103 to 105). For example, as shown in FIG. 1, the SHA-1 hash value is transmitted to the connection authentication system 13 (103), and the MD5 hash value is transmitted to the service authentication system A 14 (104). The HAS160 hash value is passed to the authentication system B 15 (105).

When provisioning is completed as described above, the user terminal 11 uses the access service, service A, and service B as the newly configured password in the process (106 to 108), the password of the service authentication system A (14) When an error occurs (109), a complaint is filed that only Service A cannot be used to enter the same password (110 to 113).

At this time, it is difficult to determine whether the above-mentioned service usage complaint is a problem of the system providing the service A, a problem of the network providing the service A, or a setting problem of the customer, or a complaint caused by a wrong password. There was a problem.

That is, the prior art as described above has a problem that it is difficult to determine the cause of the error for civil complaints due to password encryption, it is a problem of the present invention to solve this problem.

Accordingly, an object of the present invention is to provide a hash password management method for managing various hash passwords using a verification key in a system in which passwords having different hash methods are managed for each service.

That is, in the present invention, in a system in which passwords having different hash methods are managed for each service, when various one-way hashes are allowed for each service system, a verification key for determining password matching / mismatch between hash passwords may be additionally generated. Management to determine discrepancies due to random password changes that may occur due to system misoperation, provide a basis for performing password synchronization in the event of password mismatch, and promptly handle customer complaints. Its purpose is to provide a hash password management method.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention which are not mentioned can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

In accordance with another aspect of the present invention, there is provided a hash password management method, comprising: generating a plurality of hash passwords and generating a verification key using the generated plurality of hash passwords; A verification key management step of storing and managing the generated verification key; A verification key comparison step of comparing the verification key generated with the current hash password with the stored verification key; And a password synchronization step of performing password synchronization when the verification key is inconsistent as a result of the comparison, wherein the verification key generation step includes processing a plurality of hash passwords by processing various one-way hashes when the password is first generated or changed. And generate a verification key by calculating the generated hash passwords.

As described above, the present invention is used in a provisioning system or the like in an Internet service, so that even if a password error occurs in some systems while operating various hash passwords, the verification key can be used to check whether the hash method is inconsistent with another password. It also has the effect of managing various hash passwords and accurately handling related customer complaints.

The above objects, features, and advantages will become more apparent from the detailed description given hereinafter with reference to the accompanying drawings, and accordingly, those skilled in the art to which the present invention pertains may share the technical idea of the present invention. It will be easy to implement. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

And throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between. Also, when a component is referred to as " comprising "or" comprising ", it does not exclude other components unless specifically stated to the contrary .

First, a summary of the technical gist of the present invention is as follows.

According to the present invention, when generating various hash passwords from text passwords, a value (validation key) for verifying consistency is generated and managed separately, so that even if there is no text password in a provisioning system or the like, the matching of passwords hashed differently is different. Make sure to check.

In other words, in the provisioning system for managing and provisioning a password by one-way hashing for personal information protection, in the case of allowing various one-way hashes for each service system to be provisioned, a hash password is generated in various ways when provisioning. By creating and managing an additional verification key that can determine password matching / mismatch between hash passwords, when a customer complaint is raised due to a hash password mismatch later, a mismatch of passwords generated by different hash methods using the verification key By determining whether or not a password mismatch occurs, a password reset provides a basis for performing password synchronization between service systems and promptly handles customer complaints.

2 is a flowchart illustrating a method for managing a hash password when a failure occurs while managing hash passwords in various manners in a provisioning system managing a verification key according to the present invention, and verifying a password in a provisioning system and a database (DB). When a password error occurs in the service authentication system A 14 while managing the key, the verification key is used to determine whether there is a mismatch between the passwords generated by different hash methods. This shows the process of performing password synchronization between the servers.

First, referring to the provisioning process with reference to FIG. 2, when the user terminal 11 resets a password and requests the provisioning system 12 to configure a password through the web (201), the provisioning system 12 may be configured. Generate a hash value (hereinafter, referred to as a "multiple hash password" as a hash value of a password) using a different hash for each system from the password received from the user terminal 11 (202). Using a hash value (multiple hash passwords) (such as a hash operation or an OR operation) to generate a single verification key (A) at the same time (203), each system transmits only the corresponding hash value (204 to 206) In the provisioning system, the generated verification key A is managed. For example, as shown in FIG. 2, the SHA-1 hash value is transmitted to the connection authentication system 13 (204), and the MD5 hash value is transmitted to the service authentication system A 14 (205). The authentication system B 15 passes the HAS160 hash value (206).

When the provisioning is completed as described above, the user terminal 11 uses the access service, service A, and service B as the newly configured password in the process (207 to 209), the password of the service authentication system A (14) When an error occurs (210) it is complained that service A cannot be used to enter the same password (211).

In this case, the provisioning system 12 analyzes the cause of error using the verification key A (212). That is, the provisioning system 12 obtains the SHA-1 hash value (hash password) from the connection authentication system 13, obtains the MD5 hash value from the service authentication system A 14, and HAS160 from the service authentication system B 15. After obtaining a hash value and newly generating a verification key B, the generated verification key B is compared with the corresponding verification key A currently managed (212). As a result of the comparison, when the service usage error complaint raised by the user terminal 11 is a complaint caused by a wrong password (213), the user terminal 11 is requested to reset the password (214), and the password reset ( (215) to match the password to ensure normal use of the service.

That is, the present invention allows the provisioning system to additionally generate and manage a verification key at the time of provisioning various hash passwords, so that in the case of a mismatch between hash passwords, it is possible to determine and take appropriate measures.

3 is a view for explaining the components of the provisioning database (DB) and verification key generation process according to the present invention.

As shown in FIG. 3, all of the provisioned hash values (multiple hash passwords) are calculated (hash operation or OR operation) to generate one verification key. At this time, a verification key is generated through a hash function similar to the hash function used in generating a hash value by hashing a password.

4 is a flowchart illustrating various hash password management methods using a verification key according to the present invention.

First, when generating a plurality of hash passwords (hash values), the provisioning system generates one verification key using the generated plurality of hash passwords (401). That is, the provisioning system generates a plurality of hash passwords (hash values) by processing the password in various one-way hashes whenever the password is first generated or changed, and calculates the generated hash passwords (hash values) (hash operation or OR operation) to generate one verification key at the same time.

Thereafter, the generated verification key is stored and managed (402). That is, the provisioning system stores and manages the generated verification key when provisioning the generated plurality of hash passwords (hash values).

Thereafter, when checking whether the various one-way hash passwords match, the verification key generated with the current one-way hash password is compared with the previously generated and stored verification key (403). That is, in the provisioning system, a new verification key is generated using the hash password configured in the current access authentication system and service authentication systems when necessary, such as customer complaint, and then stored and managed in the newly created verification key and provisioning system. Compares the verification keys and checks whether various hash passwords match.

Thereafter, according to the comparison result, a check is made whether or not the various hash passwords match (404). If the verification keys are different from each other and the various hash passwords are confirmed to be inconsistent, the password synchronization operation is performed (405). That is, as a result of comparing the verification keys, if there is a mismatch, the provisioning system requests the user terminal to reset the password and matches the password through password reset so that the service is normally used. In this case, the provisioning system may further perform a process of displaying a password validation check error on the user terminal.

On the other hand, if it is confirmed that the verification result 404, the verification key is matched with each other and the various hash passwords match, it is determined as another error and performs the corresponding error processing process known in the known (406).

As described above, the present invention is used in systems that need to manage passwords with different hash methods for each service, for example, a provisioning system, to determine whether there is a mismatch between hash passwords while operating various one-way hash passwords. It provides a basis for managing various hash password synchronizations.

For example, provisioning a password in a provisioning system, provisioning a SHA-1 hashed password with a connection authentication system, provisioning an MD5 hashed password with a service authentication system, and then changing only the MD5 hashed password for unknown reasons during operation. In this case, the customer is requested to complain that the user is authenticated with the same ID / PWD, but the service is not authenticated. In this case, if the password is encrypted, the encrypted password alone does not determine whether the access authentication password and the service authentication password are the same. As a result, the user may not respond to the complaint without knowing the exact cause and may not take appropriate measures. However, in the case of managing the verification key, it can be seen that the above complaint is caused by a password mismatch, so that the password can be immediately reset.

Meanwhile, the method of the present invention as described above can be written in a computer program. And the code and code segments constituting the program can be easily deduced by a computer programmer in the field. In addition, the written program is stored in a computer-readable recording medium (information storage medium), and read and executed by a computer to implement the method of the present invention. The recording medium may include any type of computer readable recording medium.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

The present invention can be used for a system (eg, a provisioning system) that has to manage passwords having different hash methods for each service.

1 is a flowchart illustrating a process in a case where a failure occurs while managing hash passwords in various manners in a provisioning system that does not manage a conventional verification key.

2 is a flowchart illustrating a hash password management method when a failure occurs while managing hash passwords in various manners in a provisioning system managing a verification key according to the present invention;

3 is a view for explaining the components of the provisioning database (DB) and verification key generation process according to the present invention,

4 is a flowchart illustrating various hash password management methods using a verification key according to the present invention.

DESCRIPTION OF THE REFERENCE NUMERALS

11: user terminal 12: provisioning system

13: access authentication system 14, 15: service authentication system

Claims (6)

delete In the hash password management method, A verification key generating step of generating a plurality of hash passwords and generating a verification key using the generated plurality of hash passwords; A verification key management step of storing and managing the generated verification key; A verification key comparison step of comparing the verification key generated with the current hash password with the stored verification key; And As a result of the comparison, a password synchronization step of performing a password synchronization according to the verification key mismatch, The verification key generation step, A hash password management method for generating a plurality of hash passwords by generating a plurality of hash passwords by processing various one-way hashes when the password is first generated or changed, and generating a verification key by calculating the generated plurality of hash passwords. The method of claim 2, The verification key comparison step, When checking whether the various one-way hash passwords match, after generating a new verification key using each hash password set in the current systems, the newly generated verification key is compared with the verification key stored and managed. Hash password management method. The method according to claim 2 or 3, The password synchronization step, As a result of the comparison, as the verification key is inconsistent, a password reset is requested to the user terminal, and the password is matched through the password reset. 5. The method of claim 4, Displaying a password validation error on the user terminal as a result of the comparison inconsistent verification key; Hash password management method further comprising. 5. The method of claim 4, The verification key management step, And storing the generated verification key when provisioning the generated plurality of hash passwords.

Images