KR101323583B1 - Method for managing authontication on web application using ocsp and appartus there of - Google Patents

Method for managing authontication on web application using ocsp and appartus there of Download PDF

Info

Publication number
KR101323583B1
KR101323583B1 KR1020120005162A KR20120005162A KR101323583B1 KR 101323583 B1 KR101323583 B1 KR 101323583B1 KR 1020120005162 A KR1020120005162 A KR 1020120005162A KR 20120005162 A KR20120005162 A KR 20120005162A KR 101323583 B1 KR101323583 B1 KR 101323583B1
Authority
KR
South Korea
Prior art keywords
web application
certificate
application
ocsp
authentication
Prior art date
Application number
KR1020120005162A
Other languages
Korean (ko)
Other versions
KR20130093817A (en
Inventor
최상기
이원용
Original Assignee
주식회사 인프라웨어
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 주식회사 인프라웨어 filed Critical 주식회사 인프라웨어
Priority to KR1020120005162A priority Critical patent/KR101323583B1/en
Priority to PCT/KR2012/005254 priority patent/WO2013108969A1/en
Publication of KR20130093817A publication Critical patent/KR20130093817A/en
Application granted granted Critical
Publication of KR101323583B1 publication Critical patent/KR101323583B1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates

Abstract

The present application relates to a web application authentication technology, and a web application authentication management method according to an embodiment of the disclosed technology provides a user capable of connecting to an application providing server and an OCSP authentication server for providing web application installation data electronically signed with a predetermined certificate. It is performed at the terminal. The web application authentication management method includes (a) acquiring identification information of a certificate from web application installation data received from the application providing server, and (b) applying the certificate to the OCSP authentication server based on the acquired identification information. Requesting status information for the web application and (c) installing the web application by allocating domain authority of the web application based on the status information received from the OCSP authentication server. According to the disclosed technology of the present application, by performing an authentication procedure with the OCSP authentication server in the execution step of the web application, it is possible to correct the authority based on the authentication information of the web application, thereby ensuring the authority of the installed web application. It has the effect of compensating fluidly.

Description

Web application authentication management method using OCP and web application authentication device using the same {METHOD FOR MANAGING AUTHONTICATION ON WEB APPLICATION USING OCSP AND APPARTUS THERE OF}

The present application relates to a web application authentication technology, and more particularly, a web application authentication management method using OCSP that can effectively change the authority of an installed application based on the certificate information of the OCSP when the web application is executed, and the web using the same. It relates to an application authentication device.

With the development of the Internet and computing technologies, software has evolved from simple media-based to network-based and from OS-based to various application-based.

One type of such conventional software is a web application. The web application refers to application software that performs a predetermined function using a network such as the Internet based on a web browser. In such a web application, managing the authority granted by the operating system of the user terminal is a very important issue. This is because a malicious application such as a Trojan can be easily installed on a user terminal by exploiting a web application.

Conventionally, in granting the authority of such a web application, the user by digitally signing the web application with a predetermined certificate, using the authentication server to identify the creator or issuer of the application, and provide the user with a safety level thereof. Based on this information, manual authority management was possible.

However, the conventional rights management technology of the web application is fixed to the authority authenticated at the installation stage of the web application to set the rights of the web application. Therefore, in case of an error caused by the authentication server or a connection error with the authentication server in the installation step, there is a limit that a cumbersome additional procedure such as deleting and reinstalling the web application is required in order to correct an incorrectly set permission. .

The present application additionally performs an authentication procedure with the OCSP authentication server in the execution phase of the web application to enable the correction of authority based on the authentication information of the web application, thereby flexibly compensating the authority of the installed web application. To provide web application authentication management technology using OCSP.

In addition, the present application executes the authentication procedure with the OCSP authentication server as a background process in the execution phase of the web application, the web application using OCSP that can flexibly compensate for the rights while maintaining the performance of the web application being executed efficiently We want to provide certification management technology.

Among the embodiments, the web application authentication management method is performed in an application providing server for providing web application installation data digitally signed with a predetermined certificate and a user terminal connectable to an OCSP authentication server. The web application authentication management method includes (a) acquiring identification information of a certificate from web application installation data received from the application providing server, and (b) applying the certificate to the OCSP authentication server based on the acquired identification information. Requesting status information for the web application and (c) installing the web application by allocating domain authority of the web application based on the status information received from the OCSP authentication server.

Among the embodiments, the web application authentication apparatus is connectable to an application providing server and an OCSP authentication server for providing web application installation data digitally signed with a predetermined certificate. The web application authentication device includes a certificate validity determination unit and an application installation management unit. The certificate validity determining unit determines the validity of the certificate of the web application received from the application providing server. The application installation manager installs the received web application by assigning differential domain rights based on the validity provided by the certificate validity determining unit.

Among the embodiments, the recording medium records a program for executing the web application authentication management method. The program is a program that can be executed in an application providing server that provides web application installation data digitally signed with a predetermined certificate and a user terminal connectable to an OCSP authentication server. Obtaining identification information of a certificate from data, (b) requesting the OCSP authentication server for status information based on the obtained identification information, and (c) the status received from the OCSP authentication server And installing the web application by allocating domain authority of the web application based on the information.

According to the disclosed technology of the present application, by performing an authentication procedure with the OCSP authentication server in the execution step of the web application, it is possible to correct the authority based on the authentication information of the web application, thereby ensuring the authority of the installed web application. It has the effect of compensating fluidly.

In addition, according to the disclosed technology of the present application, by performing the authentication process with the OCSP authentication server as a background process in the execution phase of the web application, the effect that can flexibly compensate for the rights while maintaining the performance of the running web application efficiently There is.

1 is a reference diagram illustrating an example of a web application authentication apparatus, an application providing server, and an OCSP authentication server according to the disclosed technology.
2 is a block diagram illustrating an embodiment of a web application authentication apparatus according to the disclosed technology.
3 is a block diagram illustrating another embodiment of a web application authentication apparatus according to the disclosed technology.
4 is a reference table for explaining status information of a certificate provided in the disclosed technology.
5 is a flowchart illustrating an embodiment of a web application authentication management method according to the disclosed technology.

The description of the disclosed technique is merely an example for structural or functional explanation and the scope of the disclosed technology should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the disclosed technology should be understood to include equivalents capable of realizing technical ideas.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

It should be understood that the singular " include "or" have "are to be construed as including a stated feature, number, step, operation, component, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

The disclosed technology can be embodied as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all kinds of recording devices in which data can be read by a computer system. . Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the disclosed technology belongs, unless otherwise defined. Generally, the terms defined in the dictionary used are to be interpreted to coincide with the meanings in the context of the related art, and should not be interpreted as having ideal or excessively formal meanings unless clearly defined in the present application.

1 is a reference diagram illustrating an example of a web application authentication apparatus, an application providing server, and an OCSP authentication server according to the disclosed technology.

In the example shown in FIG. 1, the web application authentication apparatus 200 may be configured as a user terminal or may operate in cooperation with the user terminal as a separate device from the user terminal. Hereinafter, for convenience of description, the web application authentication apparatus 200 will be described on the assumption of an embodiment configured of at least some elements of a user terminal. However, the scope of the right of the web application authentication device according to the disclosed technology by this assumption is not limited. For example, the web application authentication device may be configured as a separate device having at least some components in hardware.

The application providing server 100 may provide an installation of a web application to the web application authentication apparatus 200. For example, the application providing server 100 may provide installation data of a web application to the web application authentication apparatus 200.

Here, the installation data can be digitally signed with a predetermined certificate. For example, it may be digitally signed as a certificate of the application provider.

The OCSP authentication server 300 may provide information on the validity of a certificate to the web application authentication apparatus 200 based on the Online Certificate Status Protocol (OCSP) protocol.

Information on the validity of the certificate provided by the OCSP authentication server 300 will be described later with reference to FIG. 4.

The web application authentication apparatus 200 may perform a predetermined authentication on the web application provided by the application providing server 100 and assign a differential domain authority according to the validity of the authentication to install the web client.

When executing the installed web client, the web application authentication apparatus 200 may perform predetermined authentication on the web application and change the domain authority or approve the execution of the web client according to the validity of the authentication.

The web application authentication apparatus 200 will be described in more detail below with reference to FIGS. 2 to 3.

2 is a block diagram illustrating an embodiment of a web application authentication apparatus 200 according to the disclosed technology.

Referring to FIG. 2, the web application authentication apparatus 200 may include a communication unit 210, a certificate validity determination unit 220, an application installation management unit 230, and an application execution management unit 240. In one embodiment, the web application authentication apparatus 200 may further include a memory unit 250.

The communication unit 210 may set or maintain a communication environment with the application providing server 100 or the OCSP authentication server 300.

The certificate validity determination unit 220 may communicate with the OCSP authentication server 300 to determine the validity of the certificate of the web application.

In one embodiment, the certificate validity determination unit 220 may provide certificate identification information to the OCSP authentication server 300 and request validity information for the corresponding certificate.

In one embodiment, the information on the validity of the certificate provided by the OCSP authentication server 300 may include state information of the corresponding certificate. Here, the state information may be information representing any one of a valid state, an undetermined state, and a discarded state. This will be described later in more detail with reference to FIG. 4.

The application installation manager 230 may set the differential domain authority according to the validity of the certificate to install the web application.

In more detail, the application installation managing unit 230 may check identification information regarding a certificate that electronically signs web application installation data received from the application providing server 100. The application installation management unit 230 may provide the identified identification information to the certificate validity determination unit 220 to receive status information on the corresponding certificate. The application installation management unit 230 may assign domain authority based on the status information of the corresponding application provided from the certificate validity determination unit 220, and the application installation management unit 230 confirms that the domain authority is above a certain level and correspondingly. You can install a web application.

In this case, the domain authority refers to the authority that the corresponding application differentially sets the range of resources that can be accessed or modified in the user terminal. As will be described later, domain rights can be divided including Trusted and Untrusted. According to an embodiment, it may include at least one partial trusted domain that differentially provides access or write access to only some resources between the trusted and untrusted domains.

In an embodiment, if the application state information corresponds to a valid state, the application installation manager 230 may install the web application by assigning it to a trusted domain.

In an embodiment, if the application state information corresponds to an undetermined state, the application installation manager 230 may install the web application by assigning it to an untrusted domain.

In one embodiment, the application installation management unit 230 may stop the installation of the web application if the status information of the application corresponds to the revoked state, and display a user interface including notification information indicating that the corresponding certificate corresponds to the revoked state. have.

When executing the installed web application, the application execution manager 240 may perform predetermined authentication on the web application and change the domain authority or approve the execution of the web client according to the validity of the authentication.

The application execution manager 240 may cache the current state information on the certificate of the installed web application at the first execution.

In more detail, the application execution manager 240 may determine whether the current execution is the first execution, and if the first execution, the application execution manager 240 may request the certificate validity determination unit 220 for the current status information on the certificate of the installed web application. The certificate validity determination unit 220 may request the OCSP authentication server 300 for the current state information of the corresponding certificate, and provide the application execution manager 240 with the state information received in response thereto. The application execution manager 240 may cache the received state information as response data.

In one embodiment, the application execution manager 240 may determine whether the current execution is the first execution based on the presence of cached data.

In more detail, the application execution manager 240 may check whether cached response data exists when the installed web application is executed, and if not, determine that the current execution is the first execution.

Here, the cached response data may have a predetermined validity period. As described above, the disclosed technology caches the state information of the certificate of the web application, and executes the web application without performing a separate authentication process while the stored state information is valid (within the validity period). Can provide fast performance.

The application execution manager 240 may determine whether to execute the web application by determining the validity of cached response data (status information).

In more detail, the validity of the cached response data may be determined. If the validity of the cached response data is not valid, the certificate validity determination unit 220 may determine whether the certificate of the web application is executed and determine whether to execute the certificate.

In one embodiment, the application execution manager 240 may cache the current state information as response data.

In more detail, the application execution manager 240 checks the validity period of the cached response data. If the current time exceeds the validity period, the application execution manager 240 uses the certificate validity determination unit 220 to determine the current validity of the certificate of the web application. State information can be obtained. The application execution manager 240 may check the current validity of the web application based on the current status information, and if valid, store the current status information as response data.

Here, the validity period of the response data may be indicated as the period signature for the certificate. For example, in providing the status information, the OCSP authentication server 300 may further provide information on the validity period for the corresponding status information, and the information on the validity period may be displayed as the period signature.

In one embodiment, the application execution management unit 240 re-confirms the domain authority by using the current state information when the installed web application is executed, and if the domain authority may be changed, it is automatically reflected to reflect the domain authority of the web application. You can reset the permissions.

In more detail, as described above, when (i) the initial execution of the application or (ii) the validity period of the response data has expired, the application execution manager 240 uses the certificate validity determination unit 220 to install the web application. You can check the current status of the certificate. The application execution manager 240 may compare the current status information with the response data (status information when installed), and if the two status information are different from each other, reset the domain authority based on the current status information.

In this embodiment, the automatic correction of the authority of the web application can be made to provide a more accurate and convenient web application execution environment to the user. For example, in the past, when the first web application is installed with the wrong domain authority, the domain authority cannot be changed unless it is manually deleted and reinstalled. However, the disclosed technology is incorrectly set during the initial installation. Even if the domain authority is changed due to the change of the domain authority or the authority of the provider, it can be automatically reflected and reset to provide a more convenient web application execution environment.

If there is no cached response data (at the time of first execution) or expires, the application execution manager 240 may generate a new separate thread to receive the current state information and perform it in the background. For example, the certificate validity determination unit 220 may be generated and function as a thread unit, and when the application execution management unit 240 confirms that the cached response data does not exist (at the first execution) or expires, the certificate validity determination unit Request 220 to create a new thread (a thread that communicates with the OCSP authentication server to obtain status information).

The memory unit 250 is a storage means for cache storing response data and the like. In the above description, the cached response data and the like may be stored using the memory unit 250.

3 is a block diagram illustrating another embodiment of the web application authentication apparatus 200 according to the disclosed technology.

Referring to another embodiment disclosed in FIG. 3, the web application authentication apparatus 200 may further include a signature generator 260. While the embodiment disclosed in FIG. 2 relates to an example in which the OCSP authentication server 300 provides a signature regarding the validity period included in the status information, another embodiment disclosed in FIG. 3 provides a signature for the period. The present invention relates to an embodiment that can also be generated by the authentication device 200.

The signature generator 260 may generate a period signature included in the response data. For this purpose, the signature generator 260 may include a predetermined time stamping means.

In more detail, when the application execution manager 240 receives the first or current status information on the installed web application, the application execution manager 240 may check whether a signature for a period exists in the corresponding status information. If not present, the application execution manager 240 may request the signature generator 260 to generate the signature for the period by providing information about the valid period. The application execution manager 240 may store the period signature generated by the signature generator 260 as response data in association with the state information.

FIG. 4 is a reference table for describing status information of a certificate provided in the disclosed technology. Referring to FIG. 4, the status information of the certificate will be described in more detail.

As described above, the state information for the certificate may be expressed as any one of a valid state, an indeterminate state, and a revocation state.

The good state indicates that the certificate is valid, and the disclosed technology may set a right as a trusted domain for the web application corresponding to the valid state certificate.

An unkown indicates that the certificate cannot be validated, and the disclosed technology may set the authority as an untrusted domain for the web application corresponding to the uncommitted certificate.

Revoked indicates that the certificate has been revoked. According to the disclosed technology, in the case of the web application corresponding to the certificate in the revoked state, the installation step is not permitted, and in the execution step, the user terminal may be informed that the current certificate has been revoked and refused to be executed.

5 is a flowchart illustrating an embodiment of a web application authentication management method according to the disclosed technology.

Hereinafter, an embodiment of a web application authentication management method will be described with reference to FIG. 5. Since an embodiment to be described below is performed in the web application authentication apparatus 200, the contents corresponding to each other are not overlapped, but those skilled in the art will describe one embodiment of the web application authentication management method to be described later from the above description. You will understand it more clearly.

When the web application authentication apparatus 200 receives the web application installation data from the application providing server 100 (step S510, YES), the web application authentication apparatus 200 may obtain identification information of the certificate from the received web application installation data (step S520).

The web application authentication apparatus 200 may request status information on the certificate from the OCSP authentication server 300 based on the acquired identification information (step S530).

When the web application authentication apparatus 200 receives the status information from the OCSP authentication server 300 (step S540, YES), the web application authentication apparatus 200 may allocate the domain authority of the web application based on the received status information (step S550). If the status information is not received (step S540, NO), the web application authentication apparatus 200 may request the status information again after waiting for a predetermined time (step S541) (step S530).

The web application authentication apparatus 200 may grant the assigned domain authority to install the web application (step S560).

Here, the state information may be information regarding any one of a valid state, an undetermined state, and a discarded state.

In an embodiment of step S550, the web application authentication apparatus 200 may allocate different domains according to the state information. In more detail, the web application authentication apparatus 200 may allocate the web application to the trusted domain when the state information corresponds to the valid state. The web application authentication apparatus 200 may allocate the web application to an untrusted domain when the state information corresponds to an undetermined state.

In an embodiment of step S550, the web application authentication apparatus 200 may stop the installation if the status information corresponds to the discarded state. In more detail, the web application authentication apparatus 200 may stop the installation of the web application if the status information corresponds to the revoked state, and display a user interface including notification information indicating that the certificate corresponds to the revoked state. .

In an embodiment, the web application authentication management method may further include checking and storing current state information of the installed web application at the first execution of the web application.

In more detail, the web application authentication apparatus 200 may receive the current state information on the certificate of the installed web application from the OCSP authentication server 300 and cache it as response data at the first execution of the installed web application.

For example, the web application authentication apparatus 200 determines whether the execution of the installed web application corresponds to the first execution, and if it is determined as the first execution, the current state of the certificate of the web application installed in the OCSP authentication server 300. You can request information. The web application authentication apparatus 200 may cache the current state information received from the OCSP authentication server 300 as response data.

In an embodiment, the web application authentication apparatus 200 may determine whether the first execution is performed based on the presence of cached response data. In more detail, the web application authentication apparatus 200 may check whether cached response data exists when the installed web application is executed, and if not, determine the current execution as the first execution.

In one embodiment, the web application authentication management method may determine whether to validate the certificate by determining the validity of the stored response data when the web application is executed.

In more detail, the web application authentication apparatus 200 determines the validity of cached response data when executing the installed web application, and if it is not valid, uses the OCSP authentication server 300 to validate the current validity of the certificate of the web application. You can determine whether or not to run.

For example, the web application authentication apparatus 200 checks the validity period of the cached response data, and if the current time exceeds the validity period, the web application authentication apparatus 200 sends the OCSP authentication server 300 the current status information on the certificate of the web application. You can request The web application authentication apparatus 200 may check the current validity based on the current status information received from the OCSP authentication server 300, and if valid, store the received current status information as response data.

In one embodiment, the web application authentication management method may automatically reset the domain authority based on the current state information.

In more detail, when the web application authentication apparatus 200 executes the installed web application, the web application authentication apparatus 200 checks the current state information provided from the OCSP authentication server 300, and if the domain authority can be changed, the domain authority of the installed web application is changed. Can be reset automatically.

It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the following claims It can be understood that

100: application providing server
200: web application authentication device
210: communication unit 220: certificate validity determination unit
230: application installation management unit 240: application execution management unit
250: memory 260: signature generation unit
300: OCSP Authentication Server

Claims (13)

In the web application authentication management method performed in the application providing server for providing the web application installation data digitally signed with a predetermined certificate and the user terminal connectable to the OCSP authentication server,
(a) acquiring identification information of a certificate from web application installation data received from the application providing server;
(b) requesting status information about the certificate from the OCSP authentication server based on the obtained identification information; And
(c) assigning a domain authority of the web application based on the state information received from the OCSP authentication server and installing the web application;
The step (c)
If the state information corresponds to a valid state, allocating the web application to a trusted domain; And
And if the state information corresponds to an indeterminate state, allocating the web application to an untrusted domain.
2. The method of claim 1,
Information about any of valid, undetermined, and retired states
Web application authentication management method characterized in that.
delete 2. The method of claim 1, wherein step (c)
Stopping the installation of the web application if the state information corresponds to a discarded state; And
Displaying a user interface including notification information indicating that the certificate corresponds to a revocation status;
Web application authentication management method comprising a.
The method of claim 1, wherein the web application authentication management method is
(d) receiving the current state information of the certificate of the installed web application from the OCSP authentication server and cache it as response data upon first execution of the installed web application;
Web application authentication management method characterized in that it further comprises.
The method of claim 5, wherein step (d)
(d-1) determining whether execution of the installed web application corresponds to initial execution;
(d-2) requesting current status information of a certificate of a web application installed in the OCSP authentication server, if determined to be the first execution; And
(d-3) caching current state information received from the OCSP authentication server as the response data;
Web application authentication management method comprising a.
The method of claim 6, wherein step (d-1)
Checking whether cached response data exists when the installed web application is executed; And
Determining that the current execution is the first execution if it does not exist as a result of the checking;
Web application authentication management method comprising a.
The method of claim 5, wherein the web application authentication management method is
(e) determining the validity of the cached response data when executing the installed web application, and if it is not valid, determining whether to execute by checking the current validity of the certificate of the web application using the OCSP authentication server. ;
Web application authentication management method characterized in that it further comprises.
The method of claim 8, wherein step (e)
(e-1) checking the validity period of the cached response data;
(e-2) if the current time exceeds the validity period, requesting the OCSP authentication server for current status information on the certificate of the web application; And
(e-3) checking the current validity based on current status information received from the OCSP authentication server, and if valid, storing the received current status information as the response data;
Web application authentication management method comprising a.
The method of claim 2, wherein the web application authentication management method is
(e) checking the current state information provided from the OCSP authentication server when executing the installed web application, and automatically resetting domain authority of the installed web application if the domain authority can be changed;
Web application authentication management method characterized in that it further comprises.
A web application authentication apparatus connectable to an application providing server and an OCSP authentication server that provide web application installation data digitally signed with a predetermined certificate,
Certificate validity determination unit for determining the validity of the certificate of the web application received from the application providing server; And
An application installation management unit for installing the received web application by assigning differential domain authority based on the validity provided by the certificate validity determining unit;
The installation management unit
If it is determined that the certificate of the web application is valid, assign the web application to a trusted domain,
And if it is determined that the certificate of the web application is not valid, allocating the web application to an untrusted domain.
The apparatus of claim 11, wherein the web application authentication device is
Receives the current status information of the certificate of the installed web application from the OCSP authentication server and caches it as response data upon first execution of the installed web application, and determines the validity of the cached response data if it is executed later. If not, the application execution management unit for determining whether or not to execute by checking the current validity of the certificate of the web application using the OCSP authentication server;
Web application authentication apparatus further comprises.
A recording medium having recorded thereon a program for executing a web application authentication management method,
The program is a program that can be executed in an application providing server for providing web application installation data digitally signed with a predetermined certificate and a user terminal connectable to an OCSP authentication server.
(a) a function of acquiring identification information of a certificate from web application installation data received from the application providing server;
(b) requesting status information on the certificate from the OCSP authentication server based on the obtained identification information; And
(c) assigning a domain authority of the web application based on the state information received from the OCSP authentication server and installing the web application;
(C) function is
Allocating the web application to a trusted domain if the state information corresponds to a valid state; And
And assigning the web application to an untrusted domain if the state information corresponds to an undetermined state.
KR1020120005162A 2012-01-17 2012-01-17 Method for managing authontication on web application using ocsp and appartus there of KR101323583B1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
KR1020120005162A KR101323583B1 (en) 2012-01-17 2012-01-17 Method for managing authontication on web application using ocsp and appartus there of
PCT/KR2012/005254 WO2013108969A1 (en) 2012-01-17 2012-07-02 Method for managing web application authentication by using ocsp, and apparatus for authenticating web application by using same

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
KR1020120005162A KR101323583B1 (en) 2012-01-17 2012-01-17 Method for managing authontication on web application using ocsp and appartus there of

Publications (2)

Publication Number Publication Date
KR20130093817A KR20130093817A (en) 2013-08-23
KR101323583B1 true KR101323583B1 (en) 2013-10-30

Family

ID=48799373

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020120005162A KR101323583B1 (en) 2012-01-17 2012-01-17 Method for managing authontication on web application using ocsp and appartus there of

Country Status (2)

Country Link
KR (1) KR101323583B1 (en)
WO (1) WO2013108969A1 (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102358883B1 (en) * 2021-04-26 2022-02-08 허정 A system for controlling the opening and closing of the door, and a method therefor

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2006079223A (en) * 2004-09-08 2006-03-23 Nec Corp Application program management apparatus, management method used therefor and program therefor
KR20060123470A (en) * 2004-01-09 2006-12-01 코아스트리트 리미티드 Signature-efficient real time credentials for ocsp and distributed ocsp

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7254831B2 (en) * 2002-12-04 2007-08-07 Microsoft Corporation Sharing a sign-in among software applications having secured features
JP4108461B2 (en) * 2002-12-04 2008-06-25 株式会社リコー Authentication system, authentication distribution server, authentication method and program

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20060123470A (en) * 2004-01-09 2006-12-01 코아스트리트 리미티드 Signature-efficient real time credentials for ocsp and distributed ocsp
JP2006079223A (en) * 2004-09-08 2006-03-23 Nec Corp Application program management apparatus, management method used therefor and program therefor

Also Published As

Publication number Publication date
KR20130093817A (en) 2013-08-23
WO2013108969A1 (en) 2013-07-25

Similar Documents

Publication Publication Date Title
CA3087858C (en) Authentication and authorization using tokens with action identification
US11563581B2 (en) Shared registration system
US9626137B2 (en) Image forming apparatus, server device, information processing method, and computer-readable storage medium
US8713646B2 (en) Controlling access to resources on a network
US9154504B2 (en) Device apparatus, control method, and relating storage medium
CA2650463C (en) System and method for tracking the security enforcement in a grid system
CN112597472B (en) Single sign-on method, device and storage medium
CN107017989B (en) Method and apparatus for domain name operation verification code generation and/or verification
US20120297455A1 (en) Target-based access check independent of access request
US9401911B2 (en) One-time password certificate renewal
US9003490B2 (en) Using entitlement certificates to manage product assets
KR101795592B1 (en) Control method of access to cloud service for business
KR101832535B1 (en) Trustworthy device claims as a service
US20140150055A1 (en) Data reference system and application authentication method
CN116415217A (en) Instant authorization system based on zero trust architecture
EP3570517B1 (en) Authentication technique making use of emergency credential
US9027107B2 (en) Information processing system, control method thereof, and storage medium thereof
WO2016045042A1 (en) Method and device for managing content in secure element
KR101323583B1 (en) Method for managing authontication on web application using ocsp and appartus there of
CN106936794B (en) Method and device for changing secret key and method and device for setting secret key
US11818128B2 (en) Migration of user authentication from on-premise to the cloud
EP3766221B1 (en) Relying party certificate validation when client uses relying party's ip address
EP2332053B1 (en) Authentication of services on a partition
CN115242528A (en) Log-in method of Kubernets cluster management panel
CN115242527A (en) Method and device for logging in Kubernets cluster management panel

Legal Events

Date Code Title Description
A201 Request for examination
E902 Notification of reason for refusal
E701 Decision to grant or registration of patent right
GRNT Written decision to grant
FPAY Annual fee payment

Payment date: 20161005

Year of fee payment: 4

FPAY Annual fee payment

Payment date: 20170926

Year of fee payment: 5

LAPS Lapse due to unpaid annual fee