KR101811285B1 - Method for authentication of cloud system based on additional authentication device and cloud system therefor - Google Patents

Abstract

A method of authenticating a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention includes the steps of: (a) registering a supplementary authentication apparatus of a computing device in a server; And (b) the server authenticating the computing device in response to a service request of the computing device, wherein, in step (a), in response to a request to register a supplemental authentication device of the computing device, And transmits a response data sequence of the supplementary authentication apparatus corresponding to the challenge data sequence to the server in the form of an index-response data sequence, wherein the index-challenge data sequence is transmitted to the server, Wherein the server registers the additional authentication device of the computing device with the server by associating the index-response data string with the ID of the computing device and storing the index-response data in the database of the server, and in the step (b) In response to a service request of the device, Requesting response data of the additional authentication device corresponding to the random index to the device and storing response data corresponding to the random index received from the computing device in the random index according to the ID of the computing device stored in the database of the server And authenticates the computing device if it matches the corresponding response data.

Description

TECHNICAL FIELD [0001] The present invention relates to an authentication method for a cloud system based on an additional authentication apparatus,

The present invention relates to a cloud system authentication method and a cloud system thereof, and more particularly, to a cloud system and a method for performing authentication of a cloud system based on a supplementary authentication apparatus such as a physical copy protection function.

The cloud system is a computing service that pays a large amount of IT resources by using virtualization technology and distributed processing technology to charge computing resources (memory, CPU, storage, etc.) to the Internet. In other words, cloud computing is an Internet-based user-oriented on-demand outsourcing service technology that integrates computing resources (memory, CPU, storage, etc.) existing in different physical locations into one through virtualization technology.

If the Internet is provided, you can use your own computing environment regardless of time and place, charge a fee for the time you use, and all services such as hardware / software and after services can be provided in a cloud computing environment Therefore, system maintenance and repair costs, hardware / software purchase cost, and energy savings can be expected.

As cloud computing services become more prominent, many IT giants are competing to offer cloud computing services. Cloud computing services can be broadly divided into public cloud services and private cloud services.

Public cloud services provide cloud services to the unspecified number of people through the Internet. Public cloud services do not mean free or open data and sources, and provide services such as user access control and billing. Public clouds are vulnerable to privacy because service providers manage user information and share all resources.

A private cloud service is a service that provides a computing environment such as a public cloud service and manages services, data, and processes directly from a specific company or organization. For security reasons, it is a closed cloud service model that can be accessed only by authorized persons while avoiding contact with outside.

Meanwhile, as described above, the cloud system has the advantage of easily storing and browsing the IT resources, while the private information stored in the individual devices of the conventional users is stored in the external server, This can lead to many problems.

For example, the hacking of iCloud has caused an outbreak of personal photos of American celebrities, including Jennifer Lawrence (August 31, 2014), causing private multimedia There may be a problem that data is leaked. Conventionally, private multimedia data is often stored in a portable storage device such as a hard disk or a USB of a personal computer, and is often stored only in a storage space of a portable computing device such as a smart phone. However, by storing the multimedia information in a cloud system so that the multimedia information can be shared by various devices, the possibility of information leakage through hacking or the like has increased dramatically compared with personal computing devices.

Therefore, cloud systems should emphasize the importance of security compared to other services, and there have been many efforts to maintain security. The most common authentication method is to register the user's desired account and password in the cloud system, and then provide the service only when the correct account and password are confirmed for the subsequent service request.

However, the ID-password type authentication system as described above has a high possibility of account and password leakage through phishing, and there is a concern that account and password information may be leaked through continuous access attempts using a continuously flowing password list There are many cases in which data is leaked due to a poor password set-up due to a lack of security awareness of service users.

KR 10-2014-0059485 A

A problem to be solved by the present invention is to create a physical password by using a supplementary authentication device such as a physically unclonable function (PUF), thereby making it impossible to replicate a password, so that privacy-related information such as private multimedia data It is possible to prevent an outflow of economic information such as authorized authentication information, generate an index and a challenge data string in the server, transmit the index and the challenge data string to the computing device, and discard the challenge information so that the entire information of the additional authentication device built in the computing device Since only the response data, which is a part of the additional authentication device, is stored in the server, the additional authentication device information of the computing device can be safely stored even if the information stored in the database of the server is leaked, In addition authentication device To provide an authentication method of a cloud system.

Another problem to be solved by the present invention is to create a physical password by using a supplementary authentication device such as a physically unclonable function (PUF) to make it impossible to replicate a password, thereby generating privacy-related information such as private multimedia data And authentication information, and generates an index and a challenge data string from the server, transmits the index and the challenge data string to the computing device, and discards the challenge information, thereby storing the entire information of the additional authentication device built in the computing device Is stored in the server, only the response data, which is part of the additional authentication device, is stored in the server, so that the additional authentication device information of the computing device can be securely stored even if information stored in the database of the server is leaked, , Additional authentication device To provide a cloud-based system.

It should be understood, however, that the present invention is not limited to the above-described embodiments, but may be variously modified without departing from the spirit and scope of the invention.

According to an aspect of the present invention, there is provided a method of authenticating a cloud system based on a supplementary authentication apparatus,

(a) registering a supplementary authentication device of a computing device with a server; And

(b) the server authenticating the computing device in response to a service request of the computing device,

Wherein, in step (a), in response to a request to register a supplementary authentication device of the computing device, the server generates and transmits a certain range of index-challenge data strings to the computing device, Response data string of the additional authentication device to the server in the form of an index-response data string, and the server stores the index-response data string in association with the ID of the computing device in the database of the server, Registering the additional authentication device of the computing device with the server,

Wherein, in step (b), in response to a service request of the computing device, the server requests the computing device of the response data of the supplementary authentication device corresponding to the random index, and responds to the random index received from the computing device The response data corresponding to the random index corresponding to the ID of the computing device stored in the database of the server matches the response data corresponding to the random index.

In the authentication method of a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, in the step (a), the server generates an index-challenge data string of the specific range and transmits the index- And then discard the challenge data string.

Further, in the authentication method of the cloud system based on the additional authentication apparatus according to the embodiment of the present invention, the step (a)

(a-1) the computing device requesting the server to register the additional authentication device according to the device ID;

(a-2) the server generates a certain range of index-challenge data strings and transmits them to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index-challenge data string to the computing device Discarding the challenge data string after the request;

(a-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns, which are request parameters from the server, and storing them in an index-challenge table;

(a-4) the computing device acquiring a response data string of the additional authentication device corresponding to the challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And

(a-5) the server registers the additional authentication device of the computing device with the server by storing the index-response data string in association with the ID of the computing device in the database of the server .

Further, in the authentication method of the cloud system based on the additional authentication apparatus according to the embodiment of the present invention, the step (b)

(b-1) the computing device sending a device ID to the server and requesting a service from the server;

(b-2) the server requesting the computing device for the response data of the additional authentication device of the computing device corresponding to the random index;

(b-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;

(b-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device;

(b-5) the computing device sending the response data to the server in the form of random index-response data;

(b-6) the server obtaining response data corresponding to the random index according to the ID of the computing device from the database; And

(b-7) The server compares response data received from the computing device with response data obtained from the database, and when the response data received from the computing device and the response data obtained from the database match, And authenticating the computing device.

In addition, in the authentication method of the cloud system based on the additional authentication device according to an embodiment of the present invention, the additional authentication device may include a physically unclonable function (PUF).

Also, in the authentication method of the cloud system based on the additional authentication apparatus according to an embodiment of the present invention, the index may indicate the order of the corresponding response data in the response data string.

The authentication method of the cloud system based on the additional authentication apparatus according to an embodiment of the present invention may further include: (c) updating and discarding the authentication information of the computing device,

The step (c)

(c-1) the computing device requesting the server to update the authentication information while transmitting the device ID to the server, and deleting the authentication information stored in the index-challenge table of the computing device;

(c-2) the server generates and transmits a new specific range of index-challenge data string to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index- And discarding the challenge data string after requesting the challenge data string;

(c-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server and storing them in an index-challenge table;

(c-4) the computing device acquiring a response data string of the additional authentication device corresponding to the new challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And

(c-5) storing the index-response data sequence received from the computing device in the database of the server in association with the ID of the computing device.

Further, the authentication method of the cloud system based on the additional authentication apparatus according to the embodiment of the present invention may further include: (d) authenticating the server,

The step (d)

(d-1) requesting the server authentication while the computing device transmits a device ID and a random index to the server;

(d-2) the server obtaining response data corresponding to a random index associated with the device ID from the database and transmitting random index-response data to the computing device;

(d-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;

(d-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device; And

(d-5) The computing device compares the response data received from the server with the response data obtained from the additional authentication device, and if the response data received from the server and the response data acquired from the additional authentication device match And authenticating the server.

According to another aspect of the present invention, there is provided a cloud system based on a supplementary authentication apparatus,

Requesting the server to register a supplementary authentication apparatus according to the device ID, receiving a specific range of index-challenge data strings from the server, and storing the response data string of the additional authentication apparatus corresponding to the challenge data string in the index- To the server in the form of a message; And

Response data string from the computing device in response to the additional authentication device registration request of the computing device to generate and transmit the index-challenge data string of the specific range to the computing device, receive the index-response data string from the computing device, And registering the additional authentication device of the computing device by storing the row in association with the ID of the computing device in the database of the server,

Wherein the server requests response data of a supplementary authentication apparatus corresponding to a random index to the computing device in response to a service request of the computing device and transmits response data corresponding to the random index received from the computing device to the server And matches the response data corresponding to the random index according to the ID of the computing device stored in the database.

In a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, the server may generate the index-challenge data string of the specific range and transmit the index-challenge data string to the computing device and discard the challenge data string .

In addition, in the cloud system based on the additional authentication apparatus according to the embodiment of the present invention,

Wherein the computing device and the server perform the operations of: (a) registering the additional authentication device of the computing device with the server; and (b) authenticating the computing device in response to a service request of the computing device,

The operation (a)

(a-1) the computing device requesting the server to register the additional authentication device according to the device ID;

(a-2) the server generates a certain range of index-challenge data strings and transmits them to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index-challenge data string to the computing device Discarding the challenge data string after the request;

(a-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server and storing them in an index-challenge table;

(a-4) the computing device acquiring a response data string of the additional authentication device corresponding to the challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And

(a-5) registering, by the server, the additional authentication device of the computing device with the server by storing the index-response data string in association with the ID of the computing device in the database of the server .

In addition, in the cloud system based on the additional authentication apparatus according to the embodiment of the present invention, the operation (b)

(b-1) the computing device sending a device ID to the server and requesting a service from the server;

(b-2) the server requesting the computing device for the response data of the additional authentication device of the computing device corresponding to the random index;

(b-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;

(b-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device;

(b-5) the computing device sending the response data to the server in the form of random index-response data;

(b-6) the server obtaining response data for the random index according to the ID of the computing device from the database; And

(b-7) The server compares the response data received from the computing device with the response data obtained from the database, and if the response data received from the computing device and the response data acquired from the database match, And authenticating the computing device.

In addition, in the cloud system based on the additional authentication apparatus according to an embodiment of the present invention, the additional authentication apparatus may include a physically unclonable function (PUF).

In addition, in the cloud system based on the additional authentication apparatus according to an embodiment of the present invention, the index may indicate the order of the corresponding response data in the response data string.

Further, in a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, the computing device and the server further perform (c) operations of updating and discarding authentication information of the computing device,

The operation (c)

(c-1) the computing device requesting the server to update the authentication information while transmitting the device ID to the server, and deleting the authentication information stored in the index-challenge table of the computing device;

(c-2) the server generates and transmits a new specific range of index-challenge data string to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index- And discarding the challenge data string after requesting,

(c-3) storing, in the index-challenge table, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server;

(c-4) the computing device acquires a response data string of the additional authentication device corresponding to the new challenge data string from the supplementary authentication device and transmits the response data string to the server in the form of an index-response data string; And

(c-5) storing the index-response data sequence received from the computing device in the database of the server in association with the ID of the computing device.

In addition, in a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, the computing device and the server further perform (d) an operation of authenticating the server,

The operation (d)

(d-1) the computing device requesting the server authentication while transmitting a device ID and a random index to the server;

(d-2) the server obtaining response data corresponding to a random index associated with the device ID from the database and sending random index-response data to the computing device;

(d-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;

(d-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device; And

(d-5) The computing device compares the response data received from the server with the response data obtained from the additional authentication device, and if the response data received from the server and the response data acquired from the additional authentication device match And authenticating the server.

In addition, in the cloud system based on the additional authentication apparatus according to the embodiment of the present invention,

A cloud application execution unit; And

Includes physical copy protection (PUF)

The cloud application execution unit,

Requesting the server to register a supplementary authentication apparatus according to a device ID, receiving a specific range of index-challenge data strings from the server, and transmitting the response data string of the supplementary authentication apparatus corresponding to the challenge data string to index- An authentication handler for transmitting to the server in the form of a column;

A packet generator for generating packet data by encapsulating data to be transmitted to the server;

A packet parser for analyzing packet data received from the server;

An index-challenge table for storing a specific range of index-challenge data columns received from the server; And

A first physical interface for transmitting data to or receiving data from the authentication handler and for physically connecting to the physical copy protection function (PUF)

The physical copy protection function (PUF)

A core circuit for outputting unique response data which can not be physically copied when arbitrary challenge data is input; And

And a second physical interface for transmitting data to or receiving data from the core circuit and for physically connecting the data to the first physical interface.

Further, in a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, the server may include an authentication management unit; And a database,

The authentication management unit,

Response data string received from the computing device in response to the additional authentication device registration request of the computing device, generating the index-challenge data string of the specific range and transmitting the index-challenge data string to the computing device, Registering a supplementary authentication device of the computing device by storing a response data string in association with the ID of the computing device in the database of the server, and in response to the service request of the computing device, Requesting response data corresponding to the random index corresponding to the random index received from the computing device and response data corresponding to the random index according to the ID of the computing device acquired from the database of the server, The authentication information handler authenticating the computing device,

A packet generator for encapsulating data to be transmitted to the computing device to generate packet data; And

A packet parser for parsing packet data received from the computing device,

The database may include an index-response table that stores the index-response data sequence received from the computing device in association with the ID of the computing device.

According to an authentication method and a cloud system of a cloud system based on a supplementary authentication device according to an embodiment of the present invention, a physical password is generated using a supplementary authentication device such as a physical unclonable function (PUF) It is possible to prevent the leakage of economic information such as privacy-related information and public authentication information such as private multimedia data by making it impossible to replicate the password, and generate indexes and challenge data strings of a specific range in the server and transmit them to the computing device Since the entire information of the additional authentication device built in the computing device is not stored in the server but only the response data of a specific range which is a part of the additional authentication device is stored in the server by discarding the challenge information, Even if the computer The additional authentication device information of the switching device can be safely stored, thereby enhancing security.

Accordingly, it is possible to eliminate the possibility of password leakage stored in a fixed computing device such as a portable computing device such as a smart phone or a personal PC, and it is possible to implement a password that is changed every time similar to the OTP. In addition, a security problem caused by a poor password setting can be suppressed.

According to the authentication method of the cloud system and the cloud system based on the additional authentication device according to the embodiment of the present invention, the entire information of the additional authentication device built in the computing device is not stored in the server, The hacker can not know the challenge-response information of the additional authentication device of the computing device even if the response data stored in the database of the server is leaked, because only a specific range of response data is stored in the server. Information of the additional authentication apparatus can be safely stored.

When a database of a server is leaked, a database of a server is updated through a process of registering an index and a response data string in a range other than the specific range again. Even if a hacker has a database of a previously hacked server , Personal information and data in the server can be safely kept.

In addition, according to an embodiment of the present invention, since the different indexes and responses are transmitted each time, the risk of data leakage can be extremely reduced.

In addition, according to the embodiment of the present invention, since the authentication information is protected by the PUF, authentication information can not be leaked to an external attack.

1 is a schematic diagram of a cloud system based on a supplemental authentication apparatus according to an embodiment of the present invention;
2 is a flowchart of an authentication method of a general cloud system;
3 is a diagram for explaining an authentication method of a cloud system based on a cloud system and a supplementary authentication device based on a supplementary authentication device according to an embodiment of the present invention.
4 is a detailed block diagram of a cloud server;
5 is a detailed block diagram of a computing device;
6 is a diagram illustrating an authentication information registration process;
7 is a diagram illustrating a process of updating and discarding authentication information;
8 illustrates a computing device authentication process;
9 is a diagram illustrating a cloud server authentication process.

For the embodiments of the invention disclosed herein, specific structural and functional descriptions are set forth for the purpose of describing an embodiment of the invention only, and it is to be understood that the embodiments of the invention may be practiced in various forms, The present invention should not be construed as limited to the embodiments described in Figs.

The present invention is capable of various modifications and various forms, and specific embodiments are illustrated in the drawings and described in detail in the text. It is to be understood, however, that the invention is not intended to be limited to the particular forms disclosed, but on the contrary, is intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprise", "having", and the like are intended to specify the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, , Steps, operations, components, parts, or combinations thereof, as a matter of principle.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be construed as meaning consistent with meaning in the context of the relevant art and are not to be construed as ideal or overly formal in meaning unless expressly defined in the present application .

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

1 is a schematic diagram of a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention. 1, a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention includes a cloud server 100 and a plurality of computing devices 102-1, 102-2, 102-3, 102-4 ).

One of the plurality of computing devices 102-1, 102-2, 102-3, and 102-4 may transmit and store data held by the computing device to the server 100 via the network, It can make a service request to the server 100 again as needed, and receive and utilize specific data again.

Here, the computing devices 102-1, 102-2, 102-3, and 102-4 may be a digital broadcasting terminal, a personal digital assistant (PDA), a smart phone, a tablet PC An Ipad, a 4G LTE (Long Term Evolution) terminal such as an International Mobile Telecommunication 2000 (IMT-2000) terminal, a Wideband Code Division Multiple Access (WCDMA) terminal, a Global System for Mobile Communication Packet Radio Service), UMTS (Universal Mobile Telecommunication Service) terminal, GPS using satellite, and multimedia devices. It will be apparent to those skilled in the art that the present invention may also be applied to fixed terminals such as digital TVs, desktop computers, and the like as well as portable terminals.

2 is a flowchart of an authentication method of a general cloud system. As described above, in the case of the cloud service, there is an advantage that the IT resources can be easily stored and browsed. On the other hand, private information stored in the individual devices of the conventional users is stored in an external server As a result, many problems may arise when such information is leaked.

Therefore, the importance of security is emphasized in comparison with any other services. Therefore, in order to provide the information included in the cloud server 200 only to users with legitimate rights, There were many cases of use.

Referring to FIG. 2, an account and password-based authentication method of a general cloud system performs a registration process of a user account when using the first service.

More specifically, the computing device 202 transmits an account and password registration request including an account name and a corresponding password to be used in the cloud server 200 (S210). Upon receiving the request, the cloud server 200 registers the account and the password included in the request in a storage unit (not shown) associated with the cloud server 200 (S212), thereby completing registration of the corresponding computing device in the cloud system do. In addition, the server 200 sends a response to the computing device 202 indicating that the account and password have been registered, and the computing device 202 stores the account and password to prepare for future use.

The computing device 202 may then use the cloud system, store the data that was formed in the computing device 202 in the cloud server 200, and may receive and use the stored data again.

More specifically, the computing device 202 transmits a service request to the cloud server 200 (S218). The request is transmitted via HTTP, the request is pre-registered, and includes the account and password that were stored in the device.

The cloud server 200 determines whether the service is available based on the account and the password included in the service request (S220). If the account and password information match, the cloud server 200 provides the service requested by the computing device 202.

However, as described above, the ID-password type authentication system has a high possibility of account and password leakage through phishing, and there is concern that account and password information may be leaked through continuous access attempts using a continuously flowing password list There are many cases where data is leaked due to lack of security setting due to insufficient security awareness of service users.

In order to solve such a problem, an authentication method of a cloud system based on a supplementary authentication apparatus according to an embodiment of the present invention, and a cloud system of the cloud system may include a supplementary authentication apparatus such as a physically unclonable function (PUF) Can be used. The PUF is a security technology for generating a key that is physically non-reproducible by utilizing inherent hardware characteristics of a specific device such as, for example, a semiconductor process variation. A PUF module present in each computing device 102-1, 102-2, 102-3, 102-4 may generate a plurality of challenges and corresponding responses thereto.

3 is a diagram for explaining a cloud system authentication method based on a cloud system and a supplementary authentication apparatus based on a supplementary authentication apparatus according to an embodiment of the present invention.

The cloud system 300 based on the additional authentication apparatus according to an embodiment of the present invention shown in FIG. 3 includes a computing device 304 and a cloud server 302. Although only one computing device 304 is shown in FIG. 3 for ease of illustration, there may be a plurality of computing devices 304 in the cloud system.

The computing device 304 includes a cloud application performing unit 310 and a physical copy protection function (PUF) 314 as a supplementary authentication device. The server 302 includes an authentication management unit 306 and a database 308, .

In one embodiment of the present invention, the computing device 304 includes a physical copy protection function (PUF) 314 as a supplemental authentication device, but is not limited to one embodiment of the present invention.

The cloud application execution unit 310 may include a cloud application 311 executed in a processor (not shown) of the computing device 304 or may include a hardware block that performs each function of the cloud application 311 Or a combination of software and hardware that performs each function of the cloud application.

The authentication management unit 306 of the server 302 may include authentication management software executed in a processor (not shown) of the server 302 or may include a hardware block that performs each function of the authentication management software Or a combination of software and hardware to perform each function of the authentication management software.

The operation of the cloud system 300 based on the additional authentication apparatus according to an embodiment of the present invention configured as described above will be described in connection with the authentication method of the cloud system based on the additional authentication apparatus according to an embodiment of the present invention .

A method of authenticating a cloud system based on a supplemental authentication device according to an embodiment of the present invention includes the steps of registering the PUF 314 of the computing device 304 with the server 302 (S320, S322, S324, S326) The server 302 includes steps S330, S332, S334, and S336 of authenticating the computing device 304 in response to a service request of the computing device 304. [

The steps S320, S322, S324, and S326 of registering the PUF 314 of the computing device 304 with the server 302 will be described.

In step S320, the computing device 304 requests the server 302 to register the PUF 314 according to the device ID.

In step S322, the server 302 generates and transmits a specific range of index-challenge data strings to the computing device 304 and determines the PUF of the computing device 304 corresponding to the particular range of index- Requests the computing device 304 for a response data string of the challenge data 314 and discards the challenge data string.

In step S324, the computing device 304 stores, in the index-challenge table 312, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server 302, And obtains the response data string of the PUF 314 from the PUF 314 and transmits it to the server 302 in the form of an index-response data string. In one embodiment of the present invention, the index indicates the order of the corresponding response data in the response data string, but an embodiment of the present invention is not limited thereto.

The server 302 stores the index-response data string in the database 308 of the server 302 in association with the device ID of the computing device 304 in step S326, Registers the PUF 314 of the computing device 304 with the server 302 and notifies the computing device 304 that the registration was successful.

Next, the server 302 will explain the steps S330, S332, S334, and S336 of authenticating the computing device 304 in response to a service request of the computing device 304. [

In step S330, the computing device 304 transmits the device ID to the server 302 and requests the server 302 for a service.

In step S332, the server 302 requests the computing device 304 for the response data of the PUF 314 of the computing device 304 corresponding to the random index.

In step S334, the computing device 304 obtains challenge data corresponding to the random index from the index-challenge table 312, obtains response data corresponding to the challenge data from the PUF 314, And transmits the obtained response data to the server 302 in the form of random index-response data.

In step S336 the server 302 obtains response data for the random index according to the device ID of the computing device 304 from the database 308 and receives response data from the computing device 304 And the response data obtained from the database to authenticate the computing device 304 if the response data received from the computing device 304 matches the response data obtained from the database 308, The device 304 determines whether the requested service can be provided and notifies the computing device 304 of the availability of the requested service.

4 to 9, the cloud system based on the authentication method of the cloud system and the additional authentication apparatus based on the additional authentication apparatus according to the embodiment of the present invention will be described in detail.

FIG. 4 is a detailed block diagram of the cloud server 302 shown in FIG. 3, and FIG. 5 is a detailed block diagram of the computing device 304 shown in FIG.

The cloud server 420 shown in FIG. 4 includes an authentication management unit 400 and an authentication information database 408. The computing device 520 shown in FIG. 5 includes a cloud application execution unit 500 and a physical replication (PUF) < / RTI >

4, the authentication management unit 400 includes an authentication information handler 406, a packet generator 404 for generating packet data by encapsulating data to be transmitted to the computing device 520, And a packet parser 402 for analyzing the packet data received from the packet parser 402.

The database 408 includes an index-response table 410 that stores an index-response data sequence received from the computing device 520 in association with the device ID of the computing device 520.

The authentication information handler 406 processes the registration request of the computing device 520 and responds to the registration request and generates an index-challenge data stream to be transmitted to the computing device 520, Response data table 410 when the computing device 520 is registered, and determines whether the index-response data string is updated.

That is, the authentication information handler 406 generates a certain range of index-challenge data strings in response to the PUF 512 registration request of the computing device 520 (FIG. 5) and transmits the index-challenge data sequence to the computing device 520, Response data string corresponding to the index-challenge data string of the specific range received from the computing device 520 and associating the index-response data string with the device ID of the computing device 520, Registers the PUF 512 of the computing device 520 by storing it in the database 408 of the server 420 and responds to the random index to the computing device 520 in response to the service request of the computing device 520 The response data corresponding to the random index received from the computing device 520 is transmitted to the server 520, (520) corresponding to the random index according to the device ID of the computing device (520) acquired from the database (408) of the computing device (420).

4, when the packet is received, data is analyzed through the packet parser 402, and the analyzed data is processed in the authentication information handler 406. [ If necessary, the authentication information handler 406 performs generation, reading, and writing of the index-response table 410, and the processed data is encapsulated as a packet through the packet generator 404.

Meanwhile, the cloud application execution unit 500 of the computing device 520 shown in FIG. 5 requests the cloud server 420 to register the PUF 512 according to the device ID, An authentication handler 506 for receiving the challenge data string and transmitting the response data string of the PUF 512 corresponding to the challenge data string in the form of an index-response data string to the server 420; A packet parser 504 for analyzing the packet data received from the server 420 and a packet parser 504 for receiving packet data from the index- (508) for receiving data from the authentication handler (506) and for sending data to the authentication handler (506) and for receiving data from the physical copy protection function (PU And a first physical interface 510 for physically connecting to the physical interface (F)

The physical copy protection function (PUF) 512 includes a core circuit 514 for outputting unique response data that can not be physically copied when arbitrary challenge data is input, a core circuit 514 for transmitting data to the core circuit 514, And a second physical interface 516 for receiving data from the core circuit 514 and physically connecting to the first physical interface 510.

The authentication handler 506 requests the server 420 to register the computing device 520 and requests the server 420 to provide a cloud service and generates the index-challenge table 508, And transmits the challenge data to the PUF 512 to receive the response data from the PUF 512. [

5, when a packet arrives, the data is analyzed through the packet parser 504, and the interpreted data is processed in the authentication handler 506. [

The authentication handler 506 performs generation, read, and write processing of the index-challenge table 508. A separate physical interface 510 or 516 is required because the PUF 512 is physically connected between the cloud application execution unit 500 and the PUF 512. The challenge data imported through the first and second physical interfaces 510 and 516 is used to generate response data in the core circuit 514 and send the response data back to the first physical interface 510 via the second physical interface 516 . The data processed in the authentication handler 506 is encapsulated as a packet through the packet generator 502.

The authentication information registration process, the authentication information update and revocation process, the computing device authentication process, and the cloud server authentication process will now be described in detail with reference to FIGS. 6 to 9, respectively.

First, the authentication information registration process shown in FIG. 6 will be described.

Referring to FIG. 6, in step S600, the authentication handler 506 of the computing device 520 requests the authentication information handler 406 of the cloud server 420 to register the PUF 512 according to the device ID.

In step S602, the authentication information handler 406 of the server 420 generates a certain range of index-challenge data strings and sends them to the authentication handler 506 of the computing device 520, After requesting the authentication handler 506 of the computing device 520 for the response data string of the PUF 512 of the computing device 520 corresponding to the data string, discards the challenge data string. The index-challenge data stream may include, for example, the number of indices (N); Update date; Index # 1; Challenge # 1; Index # 2; Challenge # 2; Index # 3; Challenge # 3; ..., index #N; May include the form of challenge #N. N is an integer of 1 or more.

In step S604 and step S606, the authentication handler 506 of the computing device 520 receives from the authentication information handler 406 of the server 420 the number of indexes, the update date, the index-challenge data string And stores it in the index-challenge table 508.

In step S608, the authentication handler 506 of the computing device 520 requests the PUF core circuit 514 of the response data string of the PUF 512 corresponding to the challenge data string. The challenge data stream includes challenge # 1; Challenge # 2; Challenge # 3; ..., and challenge #N.

In step S610, the PUF core circuit 514 sends a response data string corresponding to the challenge data string to the authentication handler 506. [ The response data sequence includes response # 1; Response # 2; Response # 3; ..., < / RTI > response #N.

In step S612, the authentication handler 506 sends the response data string to the authentication information handler 406 of the server 420. [ Wherein the response data sequence comprises a number of indices (N); Index # 1; Response # 1; Index # 2; Response # 2; Index # 3; Response # 3; ..., index #N; And may include the form of response #N.

In step S614, the authentication information handler 406 associates the index-response data string with the device ID of the computing device 520 and stores it in the authentication information database 408 of the server 420 as the index-response table 410 So that the server 420 registers the PUF 512 of the computing device 520 with the server 420.

In step S616, the authentication information handler 406 of the server 420 notifies the authentication handler 506 of the computing device 520 that authentication information registration succeeded.

The authentication information update and discard process shown in FIG. 7 will be described.

7, in step S700, the authentication handler 506 of the computing device 520 checks the authentication information update date with reference to the index-challenge table 508, and in step S702, the authentication of the computing device 520 The authentication handler 506 of the computing device 520 deletes the previous index-challenge table 508 in step S704 and the previous handler 506 stored in the index-challenge table 508 Delete the authentication information.

The authentication handler 506 of the computing device 520 requests the authentication information handler 406 to update the authentication information while transmitting the device ID to the authentication information handler 406 of the server 420 in step S706.

In step S708, the authentication information handler 406 of the server 420 checks the update date.

In step S710, the authentication information handler 406 of the server 420 generates a new specific range of index-challenge data string and sends it to the authentication handler 506 of the computing device 520 and sends the index-challenge data string corresponding to the index- Requesting the computing device 520 a response data string of the PUF 512 of the computing device 520 and discarding the challenge data string. The new index-challenge data stream comprises a number of indices (N); Update date; Index # 1; Challenge # 1; Index # 2; Challenge # 2; Index # 3; Challenge # 3; ..., index #N; May include the form of challenge #N.

In step S712 and step S714 the authentication handler 506 of the computing device 520 receives from the authentication information handler 406 of the server 420 the number of indexes, And stores it in the index-challenge table 508.

In step S716, the authentication handler 506 of the computing device 520 requests the PUF core circuit 514 for the response data string of the PUF 512 corresponding to the challenge data string. The challenge data stream includes challenge # 1; Challenge # 2; Challenge # 3; ..., and challenge #N.

In step S718, the PUF core circuit 514 sends a response data string corresponding to the challenge data string to the authentication handler 506. [ The response data sequence includes response # 1; Response # 2; Response # 3; ..., < / RTI > response #N.

In step S720, the authentication handler 506 sends the response data string to the authentication information handler 406 of the server 420. [ Wherein the response data sequence comprises a number of indices (N); Index # 1; Response # 1; Index # 2; Response # 2; Index # 3; Response # 3; ..., index #N; And may include the form of response #N.

In step S722, the authentication information handler 406 associates the index-response data string with the device ID of the computing device 520 and stores it in the index-response table 410 of the authentication information database 408 of the server 420 So that the server 420 registers the PUF 512 of the computing device 520 with the server 420.

In step S724, the authentication information handler 406 of the server 420 notifies the authentication handler 506 of the computing device 520 that authentication information update is successful.

The computing device authentication process shown in FIG. 8 will be described.

In step S800, the authentication handler 506 of the computing device 520 sends the device ID to the authentication information handler 406 of the server 420 and requests the server 420 for a cloud service.

The authentication information handler 406 of the server 420 sends a PUF 512 of the computing device 520 corresponding to the random index (random index #X) to the authentication handler 506 of the computing device 520 at step S802 Of the response data. In the above, X is an integer between 1 and N.

In step S804 and step S806, the authentication handler 506 of the computing device 520 obtains challenge data (challenge #X) corresponding to the random index (random index #X) from the index-challenge table 508. [

In step S808 and step S810, the authentication handler 506 of the computing device 520 acquires from the PUF core circuit 514 the response data (response #X) corresponding to the challenge data (challenge #X).

In step S812, the authentication handler 506 of the computing device 520 sends the response data (response #X) to the authentication information handler (420) of the server 420 in the random index-response data type (index # 406, respectively.

The authentication information handler 406 of the server 420 sends response data (response #X) to the random index (index #X) in accordance with the device ID of the computing device 520 to the authentication information handler 406 in step S814 and step S816, From the index-response table 410 in the database 410.

In step S818 the authentication information handler 406 of the server 420 compares the response data received from the authentication handler 506 of the computing device 520 with the response data obtained from the index- And if the response data received from the authentication handler 506 of the computing device 520 matches the response data obtained from the index-response table 410, the computing device 520 is authenticated.

In step S820, the authentication information handler 406 of the server 420 notifies the authentication handler 506 of the computing device 520 about availability of the cloud service.

The cloud server authentication process will be described with reference to FIG.

In step S900, the authentication handler 506 of the computing device 520 sends the device ID and the random index (device ID; random index #X) to the authentication information handler 406 of the server 420, request.

In step S902 and step S904, the authentication information handler 406 of the server 420 acquires from the index-response table 410 the response data (response #X) corresponding to the random access associated with the device ID.

In step S906, the authentication information handler 406 sends the index-response data (index #X; response #X), which is response data corresponding to the random index (index #X), to the authentication handler 506 ).

In steps S908 and S910, the authentication handler 506 of the computing device 520 obtains challenge data (challenge #X) corresponding to the random index (index #X) from the index-challenge table 508 .

In step S912 and step S914, the authentication handler 506 of the computing device 520 acquires from the PUF core circuit 514 the response data (response #X) corresponding to the challenge data (challenge #X).

The authentication handler 506 of the computing device 520 compares the response data received from the authentication information handler 406 of the server 420 with the response data obtained from the PUF core circuit 514 in step S916 And authenticates the server 420 when the response data received from the authentication information handler 406 of the server 420 and the response data obtained from the PUF core circuit 514 match.

In one embodiment of the invention, the authentication element is a device ID, an index and a number of response data of the computing device 304, 520, and the data stored in the database 308, 408 of the server 302, (302, 520) and a plurality of response data.

In one embodiment of the present invention, the authentication method is based on ascertaining how many responses are requested for authentication, and the responses corresponding to the random indices indicating the order of the response data, i.e., the computing device (302, 520) By comparing whether the response data corresponding to the random index obtained from the PUFs 314 and 512 of the server 302 or 420 matches the response data corresponding to the random index stored in the server 302 or 420.

As described above, in the case of a computing device that does not have a PUF associated with the challenge-response data, the service associated with the device ID can not be provided, and the password can not be copied by generating a physical password. It is possible to prevent leakage of such privacy-related information and economic information such as authorized authentication information.

Accordingly, it is possible to eliminate the possibility of password leakage stored in a fixed computing device such as a portable computing device such as a smart phone or a personal PC, and it is possible to implement a password that is changed every time similar to an OTP. In addition, a security problem caused by a poor password setting can be suppressed.

Meanwhile, in order to provide enhanced security, the server 302, 420 requests the computing device 304, 520 for the response data of the PUF 314, 512 corresponding to the random index, The step of the devices 304 and 520 transmitting the response data of the PUFs 314 and 512 corresponding to the indexes to the servers 302 and 420 may be performed through a Secure Socket Layer .

In addition, the services provided through the cloud servers 302 and 420 may include a plurality of services that enable easy storage and browsing of IT resources. For example, the service may be related to transmission of multimedia data, or may involve transmission and storage of information relating to online financial transactions, such as account information.

As described above, according to the cloud system based on the authentication method of the cloud system and the additional authentication device based on the additional authentication device according to the embodiment of the present invention, the PUFs 314 and 512 embedded in the computing devices 304 and 520, The server 302 or 420 generates a specific range of indexes and challenge data strings and transmits the indexes and challenge data strings to the computing devices 304 and 520 The entire information of the additional authentication device built in the computing devices 304 and 520 is not stored in the server but only a specific range of response data, which is a part of the additional authentication devices 314 and 512, Even if response data stored in the databases 308 and 408 of the servers 302 and 420 are leaked out, the hacker can not access the additional authentication device 314 of the computing devices 304 and 520 Response information of the computing devices 304 and 520 can not be known and information of the additional authentication devices 314 and 512 of the computing devices 304 and 520 can be safely stored.

When the databases 308 and 408 of the servers 302 and 420 are leaked, the indexes and the response data strings of the ranges other than the specific range are registered again and the databases 308 and 408 of the servers 302 and 420 ), Even if the hacker has a database of previously hacked servers, personal information and data within the server can be safely kept.

In addition, according to an embodiment of the present invention, since the different indexes and responses are transmitted each time, the risk of data leakage can be extremely reduced.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims. It will be understood.

100, 200, 302, 420: Cloud server
102-1 through 102-4, 202, 304, 520: computing devices
300: Cloud system 308: Server database
310: Cloud Application Performer 312: Index-Challenge Table
314, 512: PUF 400: Authentication Manager
402, 504: a packet parser 404, 502: a packet generator
406: Authentication information handler 408: Authentication information database
410: Index-response table 506: Authentication handler
508: Index-Challenge Table 510: First Physical Interface
514: PUF core circuit 516: second physical interface

Claims (18)

(a) registering a supplementary authentication device of a computing device with a server; And
(b) the server authenticating the computing device in response to a service request of the computing device,
Wherein, in step (a), in response to a request to register a supplementary authentication device of the computing device, the server generates and transmits a certain range of index-challenge data strings to the computing device, Response data string of the additional authentication device to the server in the form of an index-response data string, and the server stores the index-response data string in association with the ID of the computing device in the database of the server, Registering the additional authentication device of the computing device with the server,
Wherein, in step (b), in response to a service request of the computing device, the server requests the computing device of the response data of the supplementary authentication device corresponding to the random index, and responds to the random index received from the computing device Authenticate the computing device if the response data corresponding to the random index matches the response data corresponding to the random index according to the ID of the computing device stored in the database of the server,
Wherein in the step (a), the server generates the index-challenge data string of the specific range, transmits the index-challenge data string to the computing device, discards the challenge data string,
The step (a)
(a-1) the computing device requesting the server to register the additional authentication device according to the device ID;
(a-2) the server generates a certain range of index-challenge data strings and transmits them to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index-challenge data string to the computing device Discarding the challenge data string after the request;
(a-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns, which are request parameters from the server, and storing them in an index-challenge table;
(a-4) the computing device acquiring a response data string of the additional authentication device corresponding to the challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And
(a-5) registering, by the server, the additional authentication device of the computing device with the server by storing the index-response data string in association with the ID of the computing device in the database of the server , A method of authentication of a cloud system based on an additional authentication device. delete delete The method according to claim 1,
The step (b)
(b-1) the computing device sending a device ID to the server and requesting a service from the server;
(b-2) the server requesting the computing device for the response data of the additional authentication device of the computing device corresponding to the random index;
(b-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;
(b-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device;
(b-5) the computing device sending the response data to the server in the form of random index-response data;
(b-6) the server obtaining response data corresponding to the random index according to the ID of the computing device from the database; And
(b-7) The server compares response data received from the computing device with response data obtained from the database, and when the response data received from the computing device and the response data obtained from the database match, And authenticating the computing device based on the additional authentication device. The method according to claim 1,
Wherein the additional authentication device includes a physically unclonable function (PUF). The method according to claim 1,
Wherein the index indicates the order of the corresponding response data in the response data string. The method of claim 4,
(c) updating and discarding the authentication information of the computing device,
The step (c)
(c-1) the computing device requesting the server to update the authentication information while transmitting the device ID to the server, and deleting the authentication information stored in the index-challenge table of the computing device;
(c-2) the server generates and transmits a new specific range of index-challenge data string to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index- And discarding the challenge data string after requesting the challenge data string;
(c-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server and storing them in an index-challenge table;
(c-4) the computing device acquiring a response data string of the additional authentication device corresponding to the new challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And
(c-5) associating the index-response data sequence received from the computing device with the ID of the computing device and storing the index-response data sequence in the database of the server, wherein the authentication method of the cloud system . The method of claim 4,
(d) authenticating the server,
The step (d)
(d-1) requesting the server authentication while the computing device transmits a device ID and a random index to the server;
(d-2) the server obtaining response data corresponding to a random index associated with the device ID from the database and transmitting random index-response data to the computing device;
(d-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;
(d-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device; And
(d-5) The computing device compares the response data received from the server with the response data obtained from the additional authentication device, and if the response data received from the server and the response data acquired from the additional authentication device match And if so, authenticating the server. Requesting the server to register a supplementary authentication apparatus according to the device ID, receiving a specific range of index-challenge data strings from the server, and storing the response data string of the additional authentication apparatus corresponding to the challenge data string in the index- To the server in the form of a message; And
Response data string from the computing device in response to the additional authentication device registration request of the computing device to generate and transmit the index-challenge data string of the specific range to the computing device, receive the index-response data string from the computing device, And registering the additional authentication device of the computing device by storing the row in association with the ID of the computing device in the database of the server,
Wherein the server requests response data of a supplementary authentication apparatus corresponding to a random index to the computing device in response to a service request of the computing device and transmits response data corresponding to the random index received from the computing device to the server Authenticates the computing device if it matches the response data corresponding to the random index according to the ID of the computing device stored in the database,
The server generates the index-challenge data string of the specific range, transmits the index-challenge data string to the computing device, discards the challenge data string,
Wherein the computing device and the server perform the operations of: (a) registering the additional authentication device of the computing device with the server; and (b) authenticating the computing device in response to the service request of the computing device,
The operation (a)
(a-1) the computing device requesting the server to register the additional authentication device according to the device ID;
(a-2) the server generates a certain range of index-challenge data strings and transmits them to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index-challenge data string to the computing device Discarding the challenge data string after the request;
(a-3) receiving, by the computing device, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server and storing them in an index-challenge table;
(a-4) the computing device acquiring a response data string of the additional authentication device corresponding to the challenge data string from the supplementary authentication device and transmitting the response data string to the server in the form of an index-response data string; And
(a-5) registering, by the server, the additional authentication device of the computing device with the server by storing the index-response data string in association with the ID of the computing device in the database of the server , A cloud system based on an additional authentication device. delete delete The method of claim 9,
The operation (b)
(b-1) the computing device sending a device ID to the server and requesting a service from the server;
(b-2) the server requesting the computing device for the response data of the additional authentication device of the computing device corresponding to the random index;
(b-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;
(b-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device;
(b-5) the computing device sending the response data to the server in the form of random index-response data;
(b-6) the server obtaining response data for the random index according to the ID of the computing device from the database; And
(b-7) The server compares the response data received from the computing device with the response data obtained from the database, and if the response data received from the computing device and the response data acquired from the database match, The method comprising: authenticating the computing device. The method of claim 9,
The additional authentication device includes a physically unclonable function (PUF). The method of claim 9,
Wherein the index indicates the order of the corresponding response data in the response data string. The method of claim 12,
Wherein the computing device and the server further perform: (c) updating and discarding authentication information of the computing device,
The operation (c)
(c-1) the computing device requesting the server to update the authentication information while transmitting the device ID to the server, and deleting the authentication information stored in the index-challenge table of the computing device;
(c-2) the server generates and transmits a new specific range of index-challenge data string to the computing device, and sends a response data string of the additional authentication device of the computing device corresponding to the index- And discarding the challenge data string after requesting,
(c-3) storing, in the index-challenge table, the number of indexes, update dates, and index-challenge data columns that are request parameters from the server;
(c-4) the computing device acquires a response data string of the additional authentication device corresponding to the new challenge data string from the supplementary authentication device and transmits the response data string to the server in the form of an index-response data string; And
(c-5) associating an index-response data sequence received from the computing device with the ID of the computing device and storing the index-response data sequence in a database of the server. The method of claim 12,
Wherein the computing device and the server further perform: (d) authenticating the server,
The operation (d)
(d-1) the computing device requesting the server authentication while transmitting a device ID and a random index to the server;
(d-2) the server obtaining response data corresponding to a random index associated with the device ID from the database and sending random index-response data to the computing device;
(d-3) the computing device obtaining challenge data corresponding to the random index from the index-challenge table;
(d-4) the computing device acquiring response data corresponding to the challenge data from the supplemental authentication device; And
(d-5) The computing device compares the response data received from the server with the response data obtained from the additional authentication device, and if the response data received from the server and the response data acquired from the additional authentication device match And if so, authenticating the server. Requesting the server to register a supplementary authentication apparatus according to the device ID, receiving a specific range of index-challenge data strings from the server, and storing the response data string of the additional authentication apparatus corresponding to the challenge data string in the index- To the server in the form of a message; And
Response data string from the computing device in response to the additional authentication device registration request of the computing device to generate and transmit the index-challenge data string of the specific range to the computing device, receive the index-response data string from the computing device, And registering the additional authentication device of the computing device by storing the row in association with the ID of the computing device in the database of the server,
Wherein the server requests response data of a supplementary authentication apparatus corresponding to a random index to the computing device in response to a service request of the computing device and transmits response data corresponding to the random index received from the computing device to the server Authenticates the computing device if it matches the response data corresponding to the random index according to the ID of the computing device stored in the database,
The server generates the index-challenge data string of the specific range, transmits the index-challenge data string to the computing device, discards the challenge data string,
The computing device includes:
A cloud application execution unit; And
Includes physical copy protection (PUF)
The cloud application execution unit,
Requesting the server to register a supplementary authentication apparatus according to a device ID, receiving a specific range of index-challenge data strings from the server, and transmitting the response data string of the supplementary authentication apparatus corresponding to the challenge data string to index- An authentication handler for transmitting to the server in the form of a column;
A packet generator for generating packet data by encapsulating data to be transmitted to the server;
A packet parser for analyzing packet data received from the server;
An index-challenge table for storing a specific range of index-challenge data columns received from the server; And
A first physical interface for transmitting data to or receiving data from the authentication handler and for physically connecting to the physical copy protection function (PUF)
The physical copy protection function (PUF)
A core circuit for outputting unique response data which can not be physically copied when arbitrary challenge data is input; And
And a second physical interface for transmitting data to, or receiving data from, the core circuit and physically coupling the first physical interface to the core circuit. 18. The method of claim 17,
The server comprises:
An authentication management unit; And a database,
The authentication management unit,
Response data string received from the computing device in response to the additional authentication device registration request of the computing device, generating the index-challenge data string of the specific range and transmitting the index-challenge data string to the computing device, Registering a supplementary authentication device of the computing device by storing a response data string in association with the ID of the computing device in the database of the server, and in response to the service request of the computing device, Requesting response data corresponding to the random index corresponding to the random index received from the computing device and response data corresponding to the random index according to the ID of the computing device acquired from the database of the server, The authentication information handler authenticating the computing device,
A packet generator for encapsulating data to be transmitted to the computing device to generate packet data; And
A packet parser for parsing packet data received from the computing device,
Wherein the database comprises an index-response table that stores the index-response data sequence received from the computing device in association with an ID of the computing device.

Images