KR102016976B1 - Unified login method and system based on single sign on service - Google Patents

Abstract

According to an embodiment of the present invention, even if the integrated login window based on the SSO service is presented on the screen of the user terminal, the corresponding SSO service after inputting the user ID so that the user can confirm whether the corresponding login window is provided from a valid SSO server The confirmation number is presented on the service screen, and provides an authentication form verification technology that can confirm the SSO confirmation number with the user's mobile SSO confirmation app. Here, the SSO server that confirms whether the integrated login window is provided by the party SSO server, after providing the login window according to the SSO login window access request, receives the user ID, and the user ID required to generate the SSO server confirmation value. SSO server variable can be delivered to SSO confirmation server, and SSO server confirmation value generated by SSO confirmation server can be received and delivered to display SSO server confirmation value in user login window.

Description

Method and system for mutual authentication based on single sign-on service {UNIFIED LOGIN METHOD AND SYSTEM BASED ON SINGLE SIGN ON SERVICE}

The present invention relates to a method and system for mutual authentication based on single sign on (SSO) service, and more particularly, to confirm whether a corresponding login form is provided from a true SSO service in performing integrated login based on SSO service. It relates to a method and a system.

Various SSO services are provided, such as social login, in which a user can use the service after logging in with one account without registering for various services.

Looking at the alternative working flow of SSO services implemented by technologies such as SAML, OAuth 2.0, and OpenID Connect depending on the implementation method, SSO services are implemented as follows. That is, in the case of the SSO service, the user does not attempt to authenticate with the ID and password subscribed to the online service, instead of attempting to authenticate with the integrated SSO service, in the integrated login window provided by the integrated SSO service. Enter your integrated ID and password, and once authenticated, you will be able to access your first online service.

However, if you forge the SSO Service's integrated login window to steal the user's authentication information to steal the SSO Service's integration ID and password, the user assumes that login window is the login window of the SSO service and enters the account information to authenticate the user. Information can be stolen. If an integrated SSO account is compromised, the security of all online services for that user available as an SSO service is compromised.

In order to prevent this, the SSO server has been strengthened so that a second authentication method such as OTP can be input after entering an ID and password. However, if the ID and password input window is followed by an OTP input window, access to the SSO service is prevented. You can't stop it.

Therefore, a new technology that does not steal authentication information is needed for the hacking service disguised as SSO service.

In the present invention, when the SSO service-based integrated login window is presented to the user terminal, when the user ID is input, the corresponding SSO service confirmation number is presented in the login form so that the user can confirm whether the corresponding login window is provided from a legitimate SSO server. Provides a method and system for checking the SSO confirmation number in the user's mobile app.

In addition, the present invention is a SSO service for using a variety of online services through providing user authentication information for one integrated account, when the user authentication information input screen is a forged screen for stealing user authentication information, the user of the SSO service Provides a device and system that allows the user to explicitly verify the authenticity of the SSO service after entering a user ID for the integrated account.

According to an aspect of the present invention, even if the integrated login window based on the SSO service is presented on the screen of the user terminal, the SSO service after inputting the user ID so that the user can check whether the corresponding login window is provided from a legitimate SSO server. The confirmation number is presented on the service screen, and provides an authentication form verification technology that can confirm the SSO confirmation number with the user's mobile SSO confirmation app.

Here, the SSO server that confirms whether the integrated login window is provided by the party SSO server, after providing the login window according to the SSO login window access request, receives the user ID, and the user ID required to generate the SSO server confirmation value. SSO server variable can be delivered to SSO confirmation server, and SSO service confirmation value generated by SSO confirmation server can be received and delivered to display SSO server confirmation value in user login window.

According to an embodiment of the present invention, when a user uses various online services using an integrated account of the SSO service, the SSO service confirmation value for confirming the authenticity of the SSO service after inputting a user ID in the corresponding login window is specified. It provides a secure integrated user authentication service.

1 and 2 are views showing the overall flow of the SSO verification server and mobile SSO checker (mobile app) that can confirm whether the integrated login window is provided in a true SSO server according to an embodiment of the present invention.
3 is a diagram illustrating an example of a screen for allowing an integrated login window displayed on a user terminal to be driven with an SSO confirmation value.
4 illustrates an example of a screen related to an SSO login window having an SSO confirmation value and an implementation confirmation window on a mobile SSO confirmer.
5 and 6 illustrate a standard flow of operation of an Oauth2 authentication server performing an SSO function and a service connected thereto.
7 to 10 are flowcharts showing an embodiment of an SSO verification server and a mobile SSO verifier equipped with a service verification function for an Oauth2 authentication server.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, numerals (eg, first, second, etc.) used in the description process of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, throughout the specification, when one component is referred to as "connected" or "connected" with another component, the one component may be directly connected or directly connected to the other component, but in particular It is to be understood that, unless there is an opposite substrate, it may be connected or connected via another component in the middle.

In addition, throughout the specification, when a part is said to "include" a certain component, it means that it may further include other components, without excluding the other components unless otherwise stated. In addition, the terms "unit", "module", and the like described in the specification mean a unit that processes at least one function or operation, which means that it may be implemented by one or more pieces of hardware or software or a combination of hardware and software. . In addition, Push ID represented in the present specification means a push token that is typically expressed by mobile app developers, and a push message service refers to a message service provided by an app in a mobile operating system such as Google or Apple.

1 and 2 are views showing the overall flow of the SSO check server and mobile SSO checker (mobile app) that can confirm whether the integrated login window is provided in the true SSO server according to an embodiment of the present invention. In addition, Figure 3 is a diagram showing an example of the screen that allows the integrated login window displayed on the user terminal can be driven with the SSO confirmation value, Figure 4 is an implementation on the SSO login window and mobile SSO checker having the SSO confirmation value It is a figure which shows the screen example regarding a confirmation window. Hereinafter, an embodiment of the present invention will be described in detail with reference to the example screens of FIGS. 3 and 4 based on the flowcharts of FIGS. 1 and 2.

1 and 2 are a series of procedures executed successively in accordance with an embodiment of the present invention. In addition, in FIG. 1 and FIG. 2, a user terminal is a computing device used by a user to access an online service, and generically refers to various terminals such as a user's PC and a smartphone. 1 and 2, the mobile SSO authenticator is an application program (i.e., an agent program for authentication purposes) designed to perform service authentication and user authentication in performing SSO-based integrated login according to an embodiment of the present invention. ). The mobile SSO authenticator may be installed directly in the user's own authentication terminal (for example, a smartphone, etc.), but may be provided separately as a dedicated authentication terminal. In addition, although the user terminal and the mobile SSO confirmer are illustrated as physically separated objects in FIGS. 1 and 2, they need not necessarily be the same. For example, when the user terminal is a smartphone and the mobile SSO authenticator is installed in the smartphone, it may be implemented in one object. However, for convenience and concentration of description, it will be described below on the assumption that the user terminal is a PC and the mobile SSO checker is an app installed in the user's smartphone.

1 and 2, when a user accesses a service using a terminal and selects SSO login [see S1 of FIG. 1], the online service (ie, an online service server) is connected to the SSO login window access information. To the user terminal (see S2 of FIG. 1). At this time, it is obvious that various additional information such as a session value, a redirect URI value, and an SSO client ID value may be provided together according to the SSO implementation.

The user requests the SSO server to access the login window using the SSO login window access information through the user terminal [see S3 of FIG. 1], and accordingly, the SSO server provides the corresponding login window [see S4 of FIG. 1]. At this time, the login window provided to the user by the SSO server is SSO service confirmation value in addition to the SSO integration ID and password input form, as illustrated through (a) and (b) of Figure 3 (see SSO verification code of Figure 3) It is obvious that the form can be configured to display a) or it can be configured to enter only the SSO Integration ID and display the SSO service confirmation without the user password entry form.

Accordingly, when the user inputs the integrated ID into the SSO login window displayed on the user terminal, the corresponding ID value is transmitted to the SSO server (see S5 of FIG. 1).

In this case, the SSO server may pass a specific variable value to enable the SSO verification server to generate the SSO server verification value associated with the ID and the SSO session and request the SSO server verification value (see S6 in FIG. 1). In this case, the SSO server may transmit the unique value of the first online service server that the user terminal has passed to the SSO server to the SSO verification server, or may generate an arbitrary value of its own and deliver it to the SSO verification server, and log in to the user terminal. It may pass any predefined unique value to the SSO checking server, such as the session ID of the server created to provide the window. In S6 of FIG. 1, a server variable value is illustrated, but various values may be used in addition to the variable value.

The SSO verification server may generate the SSO service confirmation value using the received ID and the SSO server variable [see S7 of FIG. 1], and may transmit the generated SSO service confirmation value to the SSO server again (see S8 of FIG. 1). In addition, the SSO verification server may forward the generated SSO service verification value or verification value generation variable to the mobile SSO verifier via the mobile network (see S12 in FIG. 1). At this time, it is obvious that the SSO service confirmation value may be generated by a predetermined rule such as a private key value related to ID and a generation time in the SSO server variable received from the SSO server in generating the SSO service confirmation value.

The SSO server transmits the SSO service confirmation value received from the SSO confirmation server to the user terminal so that the SSO service confirmation value can be displayed in the login window displayed on the screen of the user terminal [S9 and S10 of FIG. 1, FIG. 4 (a)]. Thereafter, the SSO server may wait until the user consent for the confirmation of the SSO service check value is completed or periodically check whether the user consent is completed (see S11 of FIG. 1).

In addition, the mobile SSO checker expresses the SSO service check value received from the SSO check server through the corresponding app screen [see S13 in FIG. 1], or generates an SSO check value using the check value generating variable received from the SSO check server. Can be displayed through the app screen.

At this time, according to the implementation method, the user checks whether the SSO service check value displayed through the app screen of the mobile SSO checker matches the SSO service check value displayed in the SSO login window in the terminal. It is obvious that the user password can be entered directly or the user can be automatically logged in without inputting the user password through the value received from the mobile SSO checker app.

When the user confirmation regarding the SSO service confirmation value is completed [see S14 of FIG. 2], the mobile SSO confirmer forwards the user confirmation value to the SSO confirmation server [see S15 of FIG. 2]. At this time, it is apparent that the user confirmation input method may be additionally provided with various user authentication means such as a simple confirmation button input, a biometric device installed in the mobile terminal, a pattern input, and a FIDO.

The SSO confirmation server may receive the user confirmation value delivered from the mobile SSO confirmer, and may verify whether the received user confirmation value is a confirmation value of a party user (see S16 of FIG. 2). In this case, the verification of the user confirmation value may be verified using a predetermined method previously matched with the mobile terminal. If the received user confirmation value is verified, the SSO confirmation server sends the verification result to the SSO server (see S17 of FIG. 2).

Accordingly, the SSO server may receive the user confirmation result and transmit the user ID and the SSO service confirmation result based on the user consent confirmation request for the SSO service confirmation (see S18 of FIG. 2). At this time, the user ID and the SSO service confirmation result value may be the same as the confirmation value according to the existing user ID and password match, it is obvious that the confirmation result delivered may vary depending on the implementation method. When implemented using the OAuth 2.0 standard technology, the SSO service check result value may use a token value for account information authentication according to a user ID and password match (see FIG. 6 or FIG. 9).

The user terminal attempts to log in to the online service server using the received result value [see S19 of FIG. 2], and the online service server may verify again with the SSO server whether the received result value is issued from the SSO server [ S20 and S21 of FIG. 2]. After verifying the SSO login attempt, the SSO server may transmit a result value to the online service server, whereby the online service server provides a service to the user terminal (see S22 of FIG. 2).

According to another embodiment of the present invention, the SSO verification server may be placed in the SSO verification server so that only the SSO server registered in advance may request the SSO verification server to generate the SSO service confirmation value. It can also hold information issued by the SSO verification server.

In addition, although the embodiments of the present invention have been described above with reference to FIGS. 1 and 2, the above-described core technical features of the present invention may be implemented in combination with an OAuth 2.0 technology, which is a standard technology. 5 and 6 attached herein illustrate an SSO service operation flow according to standard technology. When the SSO service according to the OAuth 2.0 technology is combined with the core technical features described above through the present specification, it may be implemented according to the flowchart of FIGS. 7 to 10.

Here, the procedures of reference numerals 1 to 6 of FIG. 7 are the same as those of reference numerals 1 to 6 of FIG. 5, and the procedures from reference numeral 31 of FIG. 9 to reference numeral 42 of FIG. 10 are illustrated in FIG. The procedures are the same as those from 8 to 19 of FIG. 6. That is, when the SSO service according to the OAuth 2.0 technology is combined with the core technical features of the present invention, a series of procedures from reference numeral 7 of FIG. 7 to reference numeral 30 of FIG. 9 may be added according to an embodiment of the present invention. have.

The single sign-on service-based mutual authentication method according to the above-described embodiment of the present invention may be implemented as computer readable codes on a computer readable recording medium. Computer-readable recording media include all kinds of recording media having data stored thereon that can be decrypted by a computer system. For example, there may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, and the like. The computer readable recording medium can also be distributed over computer systems connected over a computer network, stored and executed as readable code in a distributed fashion.

Although the above has been described with reference to embodiments of the present invention, those skilled in the art may variously modify the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. And can be changed easily.

Claims (5)

In the mutual authentication system based on SSO (Single Sign On) service,
An SSO verification server that performs an operation for verifying the authenticity of the SSO server for the integrated login procedure for the online services subscribed to the SSO service, and a mobile SSO verifier installed on the mobile device,
The SSO confirmation server generates an SSO service confirmation value for authenticity confirmation of the SSO server in response to the user's integrated login request for the online service through the access terminal, and the generated SSO service confirmation value is determined by the access terminal. The SSO service confirmation value is transmitted to the SSO server and the mobile SSO verifier so that it can be posted through the integrated login confirmation window on the screen and the app screen of the mobile SSO verifier.
The SSO server, the SSO service-based mutual authentication system for transmitting the SSO service confirmation value to the access terminal so that the SSO service confirmation value received from the SSO confirmation server is displayed on the integrated login confirmation window.
The method of claim 1,
The SSO verification server,
SSO service base, which receives the integration ID and SSO server variable value input from the user from the SSO server and generates the SSO service confirmation value using the SSO server variable value in a predetermined manner according to the received integration ID. Mutual authentication system.
The method of claim 1,
The SSO verification server,
When the user confirmation value according to the user confirmation regarding the SSO service confirmation value is received from the mobile SSO confirmer, the verification is performed on the received user confirmation value in a predetermined manner, and as a result of the verification, the received user confirmation value is received. And a user authentication result is transmitted to the SSO server when it is determined to be a legitimate value corresponding to the user according to the integrated ID, thereby enabling an integrated login procedure through the SSO server to be executed.
The method of claim 1,
The SSO server,
Providing an integrated login window according to the SSO login window access request through the access terminal, and when the integration ID of the user is received through the access terminal, transferring the integration ID and the SSO server variable to the SSO verification server. , SSO service based mutual authentication system.
delete

Images