KR101351243B1 - Method and system for application authentication - Google Patents

Abstract

Disclosed are an application authenticating method and a system thereof. A method for performing execution authentication according to the execution of an application in an authentication device includes the steps of: collecting execution environment information according to an application execution command; performing the execution authentication of the application; and controlling the execution of the application according to an application execution condition. [Reference numerals] (110) User terminal; (120) Service server; (130) Authentication server

Description

Method and system for application authentication

The present invention relates to a method and a system capable of performing user and execution authentication for an executed application.

Recently, with the development of information and communication technology, various Internet services (for example, electronic commerce, financial transactions, content provision, use of various information, etc.) are provided to users through user terminals such as computers and smart phones.

In order to use an Internet service provided through the Internet, an ID and password must be entered through a web page or authenticated through an electronic authentication process. However, such current methods are vulnerable to malicious code or site phishing, which makes it difficult to prevent data leakage or data forgery / falsification.

An object of the present invention is to provide a method and apparatus capable of authenticating an application program executed in a user terminal.

Accordingly, the present invention can prevent data leakage or data forgery / falsification due to malicious code or site phishing.

According to one aspect of the invention, an apparatus and system for performing authentication in response to application execution are provided.

According to an embodiment of the present invention, an apparatus for performing authentication according to an application execution, the apparatus comprising: a memory for storing a plurality of applications and applications for authentication; And a processor for executing the authentication application, wherein the authentication application collects execution environment information according to another application execution command, compares the collected execution environment information with authentication setting conditions set in the other application, and provides the processor with the other application. When the execution authentication is successful by performing the execution authentication, the apparatus for application authentication may be provided to control to execute the other application according to the other application execution condition.

The authentication application obtains user information for executing the other application before collecting the execution environment information or simultaneously with collecting the execution environment information, and performs user authentication using the user information.

The user information is at least one of identification information, a certificate, and an electronic signature of the user.

The execution environment information,

At least one of identification information of a medium on which the application is executed, network information of the executed medium, and an execution time.

The execution condition is,

At least one of whether to allow network access, whether to edit data according to the execution of the application, and whether to allow output or storage.

When the output or storage permission is output or storage permission, the execution condition may include an output medium or a storage medium or a storage location.

The output medium, the storage medium, or the storage location may be registered and set by a user or an administrator.

The authentication application,

When the execution authentication fails, the execution of the application according to the execution command may be blocked.

According to another embodiment of the present invention, a system for performing authentication according to application execution, comprising: a service server for receiving a specific application execution request from a user terminal; And receiving an application authentication request according to the application execution request from the service server, acquiring user information and execution environment information from the user terminal according to the authentication request, performing user authentication and execution authentication, and then user authentication and execution. An authentication system including an authentication server for controlling an application according to the execution request to be executed through the service server upon successful authentication may be provided.

According to another aspect of the present invention, a method of performing execution authentication according to application execution is provided.

According to an embodiment of the present invention, a method of performing execution authentication according to an application execution in an authentication device, the method comprising: collecting execution environment information according to an application execution command; Performing execution authentication for the application by comparing the collected execution environment information with authentication setting conditions set for the application; And if the execution authentication succeeds, controlling the application to be executed according to the application execution condition.

Before the step of collecting the execution environment information,

The method may further include obtaining user information for executing the application, and performing user authentication using the user information.

The user information is at least one of user identification information, certificate and electronic signature,

The execution environment information,

At least one of identification information of a medium on which the application is executed, network information of the executed medium, and an execution time;

The execution condition is,

At least one of whether to allow network access, whether to edit data according to the execution of the application, and whether to allow output or storage.

When the output or storage permission is output or storage permission, the execution condition may include an output medium or a storage medium or a storage location.

The output medium, the storage medium, or the storage location may be registered and set by a user or an administrator.

If the execution authentication fails, the method may further include blocking the execution of the application according to the execution command.

By providing an application program authentication method and apparatus according to an embodiment of the present invention, it is possible to authenticate the application running on the user terminal, and as a result prevent data leakage or data forgery / forgery due to malicious code or site phishing Can be.

1 is a block diagram showing a configuration of an authentication system for authenticating an application according to an embodiment of the present invention.
2 is a block diagram schematically illustrating an internal configuration of a user terminal according to an embodiment of the present invention;
Figure 3 is a block diagram schematically showing the internal configuration of the authentication server according to an embodiment of the present invention.
4 is a flowchart illustrating a method of performing authentication for an application according to an embodiment of the present invention.
5 is a flowchart illustrating a method of performing authentication for an application according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of an authentication system for authenticating an application according to an embodiment of the present invention.

Referring to FIG. 1, the authentication system includes a user terminal 110, a service server 120, and an authentication server 130.

The user terminal 110 is a means for installing at least one application on the user terminal 110 and executing the installed application. According to another embodiment, the application may be executed through the service server 120, and in this case, the user terminal 110 may receive and display an execution screen according to the execution of the application through the service server 120.

That is, the user terminal 110 may execute an application installed in the user terminal 110, access the service server 120 to execute a specific application, and then display an execution screen through the user terminal 110. have.

As the type of the user terminal 110, for example, the same may be applied to an electronic device such as a mobile communication terminal, a notebook computer, a personal computer, a PDA, a tablet PC, and the like.

The service server 120 is a means for providing and displaying a screen (hereinafter referred to as an execution screen) according to application execution to the user terminal 110 after executing a specific application at the request of the user terminal 110.

In FIG. 1, it is assumed that the service server 120 is included in the authentication system. However, the service server 120 may not be included according to an implementation method.

That is, when a specific application is executed through the service server 120, data operation, data storage, etc. according to the execution of the application is performed in the corresponding service server 120, the user terminal 110 is only an execution screen according to the application execution Can be provided and expressed.

The authentication server 130 is a means for performing authentication on the application in accordance with the application execution of the user terminal 110.

For example, the authentication server 130 is a means for controlling the execution of the application requested to be executed according to the authentication result by performing authentication on the application requested to be executed through the user terminal 110 or the service server 120. . Here, the authentication result may be any one of authentication success and authentication failure.

For example, the authentication server 130 may primarily perform user authentication for executing an application, and if the first authentication succeeds, the medium authentication may be performed as the second authentication. Here, the medium authentication may be an authentication for the device and the connected network to the user terminal 110.

A method of performing use authentication for an application in the authentication server 130 will be described in more detail with reference to the accompanying drawings below.

In FIG. 1, it is assumed that the authentication server 130 performs use authentication for an application, but use authentication for an application may be performed in the user terminal 110.

2 is a block diagram schematically illustrating an internal configuration of a user terminal according to an embodiment of the present invention.

Referring to FIG. 2, the user terminal 110 includes a communication means 210, a touch screen 215, a memory 220, and a processor 225.

Although not shown in FIG. 2, the communication means 210 may include an antenna and RF data transmission / reception means. The communication means 210 is a means for transmitting and receiving data with other devices (eg, the service server 120 or the authentication server 130) through a communication network.

The touch screen 215 is a means for receiving various control commands for controlling the user terminal 110 from the user, control commands for controlling the execution of an application, or expressing various data in the form of visual information.

In FIG. 2, it is assumed that an input means for receiving data or a control command from a user and an output means for displaying data in the form of visual information are integrated into one component (ie, a touch screen). According to an implementation method, the user terminal 110 may include an input means and an output means in separate configurations.

The memory 220 stores various applications necessary for operating the user terminal 110 and an authentication application for performing execution authentication on the application according to the execution of the application. Of course, in addition to the memory 220 may store a certificate, an electronic signature, etc. issued through a certification authority to authenticate the holder of the user terminal 110.

The processor 225 may be configured to control internal components of the user terminal 110 (eg, the communication means 210, the touch screen 215, the memory 220, etc.) according to an embodiment of the present invention. Means.

In addition, the processor 225 is a means for executing various applications, authentication applications, and the like stored in the memory 220. The processor 225 may perform user authentication and execution authentication according to another application execution through the executed authentication application. As a result, the processor 225 may execute the authentication application in the background. In addition, the processor 225 may first execute the authentication application and perform user authentication and execution authentication for the other application via the executed authentication application, before executing the other application according to certain other application execution commands .

Although not separately described in FIG. 2, each application may have an authentication setting condition for the corresponding application by each user at the time of installing the application or at the time of execution after the application is installed (for example, at the time of initial execution). Of course, according to the implementation method, when the installation file for the application is downloaded to the user terminal 110 or after the application is installed, it is set by the distributor who distributes the application for the application or the administrator managing the application, etc. Authentication setting conditions may be set and stored with the application.

For example, an authentication application executed through the processor 225 performs user authentication on another application according to an execution command. In this case, the authentication application executed through the processor 225 may perform user authentication using at least one of user identification information, a certificate, and an enterprise signature to perform user authentication.

If the user authentication is successful by performing user authentication, the authentication application executed through the processor 225 collects execution environment information of the corresponding other application, compares the collected execution environment information with the authentication setting conditions set for the other application, and You can perform run authentication for that other application.

Here, the execution environment information is environment information on a device, a network, etc., on which the corresponding application is executed, for example, identification information (eg, MAC address, etc.) of a medium (ie, a terminal) on which the corresponding other application is to be executed, and a corresponding medium. It may be at least one of network information (eg, access port and IP address, etc.) and execution time of the.

The authentication application may perform execution authentication by collecting execution environment information according to an authentication setting condition set in another application according to the execution command, and determining whether the collected execution environment information matches the authentication setting condition. Here, the execution authentication may be authentication success or authentication failure.

If the execution authentication is successful authentication, the processor 225 may control to be executed according to an execution condition set in another application according to the corresponding execution command. For example, the execution condition may include at least one of whether to allow a network connection, whether to edit data according to application execution, and whether to allow output or storage.

If whether to allow the network connection is set to "no connection", the processor 225 may block the network function so that the network connection is not executed while the application is running.

In addition, when whether to edit the data is set to allow editing, the processor 225 may control to edit the data according to the execution of the application. However, if data editing is set to “non-editing”, the processor 225 may control data editing to be impossible according to application execution. In such a case, the user can simply check the data corresponding to the execution of the application.

In addition, when whether to allow output or storage is set to “allow output or storage,” the processor 225 may control the data to be output or stored in a specific medium through an external printer in correspondence to application execution.

In this case, when the output or storage permission is “allow output or storage”, the processor 225 may separately register and set an output medium or a storage medium corresponding to the corresponding application, and transmit data only to the corresponding output medium or storage medium. Can be controlled to output or save.

As such, when an output medium or a storage medium is separately set, when an output or storage command through the corresponding application is executed, the processor 225 checks the output medium or the storage medium and controls the data not to be output or stored when different. can do.

In FIG. 2, it is assumed that authentication for a specific application is performed by the user terminal 110.

Hereinafter, in FIG. 3, assuming that the authentication server 130 performs authentication for an application executed in the user terminal 110 or by a request of the user terminal 110, the configuration of the authentication server 130 will be described. It will be described in detail.

3 is a block diagram schematically illustrating an internal configuration of an authentication server according to an embodiment of the present invention.

Referring to FIG. 3, the authentication server 130 includes a communication means 310, a storage means 315, and a control means 320.

The communication means 310 is a means for transmitting and receiving data with other devices (for example, the user terminal 110) through a communication network.

The storage means 315 stores a plurality of applications, authentication setting conditions and execution conditions for each application. In this case, any one of the applications may be an authentication application for performing user authentication and execution authentication for another application.

The control means 320 is a means for controlling the internal components of the authentication server 130. In addition, the control unit 320 is a means for performing authentication for an application executed through the user terminal 110, such as the processor 225 of the user terminal 110. Since this is the same as described above, overlapping description will be omitted.

4 is a flowchart illustrating a method of performing authentication on an application according to an embodiment of the present invention. Each step performed below is performed by each internal component of the user terminal 110, but will be collectively described as a user terminal 110 for the convenience of understanding and explanation.

In operation 410, the user terminal 110 receives an input of a specific application execution command from the user.

In operation 415, the user terminal 110 receives or selects user information from the user according to an application execution command.

In operation 420, the user terminal 110 performs user authentication using input or selected user information. For example, the user terminal 110 may perform user authentication according to whether or not the previously stored user information and input or selected user information match.

The user terminal 110 may separately register and manage a user who can execute the application for each application. Accordingly, the user terminal 110 may receive or input user information corresponding to the execution of a specific application and check whether the corresponding user is a registered user.

If the authentication fails, the user terminal 110 blocks the execution of the application corresponding to the execution command in step 425.

However, if the authentication is successful as a result of the user authentication, in step 430 the user terminal 110 collects the execution environment information for the user terminal 110.

As described above, various setting conditions for executing the corresponding application may be set for each application. Accordingly, the user terminal 110 collects execution environment information corresponding to an application set in correspondence with an execution command.

As described above, the execution environment information is environment information on a device, a network, or the like on which the corresponding application is executed. For example, identification information (for example, a MAC address, etc.) of a medium (ie, a terminal) on which the corresponding application is to be executed. , At least one of network information (eg, an access port and an IP address) of the corresponding medium and an execution time.

In operation 435, the user terminal 110 performs execution authentication using the collected execution environment information and an authentication setting condition set for an application corresponding to the execution command.

As described above, the user terminal 110 may perform execution authentication for the corresponding application by comparing whether the authentication setting conditions set for each application match the corresponding execution environment information.

If the execution authentication is performed as a result of authentication failure, as shown in step 425, the user terminal may block execution of an application corresponding to the execution command.

However, if the execution authentication is performed, if the authentication is successful, the user terminal 110 controls the application to be executed according to the execution condition set in the application corresponding to the execution command in step 440.

Here, the execution condition may include at least one of whether to allow the network connection, whether to edit the data according to the execution of the application, or whether to allow the output or the storage. Since this is the same as described above, overlapping description will be omitted.

Although not separately described in FIG. 4, before the application is installed, authentication may be performed for the corresponding application even when downloaded. At this time, the user terminal 110, the application installation file may be composed of a plurality of individual installation files. When downloading the corresponding application installation file, the user terminal 110 may download the execution order of the individual installation files described in each application installation file and the size of each individual installation file. Accordingly, when installing the corresponding application, the application installation file may be authenticated by comparing the execution order and file size of the individual installation file with the downloaded individual installation file execution order and size. When authentication of each application installation file is completed, the user terminal 110 may store the corresponding application in a storage medium or a storage location specified in an execution condition.

5 is a flowchart illustrating a method of performing authentication for an application according to an embodiment of the present invention.

In operation 510, the user terminal 110 transmits an application execution request to the service server 120.

In operation 515, the service server 120 transmits an authentication request corresponding to the application execution request to the authentication server 130.

In operation 520, the authentication server 130 requests and obtains user information from the user terminal 110 in response to receiving the authentication request.

In step 525, the authentication server 130 compares the obtained user information with previously stored user information to perform user authentication.

If the authentication fails as a result of performing the user authentication, in step 530, the authentication server 130 controls the application to be blocked.

However, if authentication is successful as a result of performing user authentication, in step 535, the authentication server 130 collects and obtains execution environment information for executing an application for the user terminal 110.

Subsequently, in step 540, the authentication server 130 performs execution authentication using the collected execution environment information and the authentication setting conditions set for the application corresponding to the execution command.

If the execution authentication is performed as a result of the authentication failure, the authentication server may control the execution of the application to be blocked in step 530.

However, if the authentication is successful as a result of execution authentication, in step 545, the authentication server 130 controls the application to be executed according to the execution condition set in the application.

In addition, although not separately illustrated in FIG. 5, the authentication server 130 may perform authentication for an administrator managing each application. That is, when an administrator executes a specific application to update (eg, patch), add, or delete an application managed by the service server 120, the administrator receives input or selection of identification information about the administrator. In addition, the administrator may be authenticated by comparing with the stored administrator information.

On the other hand, the method for performing the use authentication for the application according to an embodiment of the present invention can be implemented in the form of program instructions that can be executed through various electronic means for processing information can be recorded in the storage medium. The storage medium may include program instructions, data files, data structures, and the like, alone or in combination.

Program instructions to be recorded on the storage medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software. Examples of storage media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic-optical media such as floppy disks. hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

110: User terminal
120: service server
130: authentication server

Claims (17)

In the method for performing the execution authentication according to the execution of the application in the authentication device,
Collecting execution environment information according to an application execution command;
Performing execution authentication for the application by comparing the collected execution environment information with authentication setting conditions set for the application; And
If the execution authentication succeeds, controlling to execute the application according to the application execution condition,
The application execution condition is,
At least one of whether to allow network access, whether to edit data according to the execution of the application, and whether to allow output or storage.
The method according to claim 1,
Before the step of collecting the execution environment information,
Acquiring user information for executing the application, and performing user authentication using the user information.
The method of claim 2,
And the user information is at least one of user identification information, a certificate, and an electronic signature.
The method according to claim 1,
The execution environment information,
And at least one of identification information of a medium on which the application is executed, network information of the executed medium, and an execution time.
delete The method according to claim 1,
If the output or storage permission is output or storage permission, the execution condition includes an output medium or a storage medium or a storage location.
The method of claim 6,
And the output medium, the storage medium, or the storage location are registered and set by a user or an administrator.
The method according to claim 1,
If the execution authentication fails, blocking the execution of the application according to the execution command.
In the apparatus for performing authentication according to the application execution,
A memory storing a plurality of applications and applications for authentication;
Including a processor for executing the authentication application,
The authentication application collects execution environment information according to another application execution command, compares the collected execution environment information with authentication setting conditions set in the other application, and executes execution authentication for the other application, thereby successfully executing execution authentication. In this case, characterized in that the control to run the other application according to the other application execution conditions,
The other application execution condition,
And at least one of whether to allow network access, whether to edit data according to the execution of the application, and whether to allow output or storage.
10. The method of claim 9,
The authentication application,
Apparatus for application authentication, characterized in that to obtain the user information to run the other application before the collection of the execution environment information or at the same time the collection of the execution environment information, the user information using the user information .
11. The method of claim 10,
And the user information is at least one of user identification information, a certificate, and an electronic signature.
10. The method of claim 9,
The execution environment information,
And at least one of identification information of a medium on which the application is executed, network information of the executed medium, and an execution time.
delete 10. The method of claim 9,
And if the output or storage permission is output or storage permission, the execution condition comprises an output medium or a storage medium or a storage location.
15. The method of claim 14,
And the output medium, the storage medium or the storage location are registered and set by a user or an administrator.
10. The method of claim 9,
The authentication application,
If the execution authentication fails, the device for application authentication, characterized in that to block the execution of the application according to the execution command.
1. A system for performing authentication according to application execution,
A service server for receiving a specific application execution request from a user terminal; And
Receives an application authentication request according to the application execution request received from the service server, obtains user information and execution environment information from the user terminal according to the authentication request, performs user authentication and execution authentication, user authentication and execution authentication And an authentication server for controlling an application according to the execution request to be executed through the service server upon success.

Images