KR102157743B1 - Method for controlling user access to resources in system using sso authentication - Google Patents

Abstract

Disclosed is a system for providing information to users. The system comprises: a service provider server for providing a service which provides information to members; a user terminal for accessing the service provider server and inquiring the information; and an SSO server for issuing authentication information of the user terminal. The service provider server includes a resource management unit for classifying resources managed by the service provider server in accordance with roles defined based on the role based access control (RBAC); a role management unit for managing the information on the roles and allocating at least one of the roles to a user; and a rights management unit for managing access rights to resources, and granting at least one access rights to each of the roles. Resources contain information, and the user terminal may be configured to log in to the service provider server by authentication based on the SSO server, but to retrieve information by accessing only resources with the access rights in accordance with the assigned role.

Description

How to control user access to resources in a system using SSO authentication {METHOD FOR CONTROLLING USER ACCESS TO RESOURCES IN SYSTEM USING SSO AUTHENTICATION}

The present invention relates to a security method, and more particularly, to a method for controlling a user's access to a resource in a system using SSO (Single Sign On) authentication.

Single Sign-On (SSO) is a system that allows users to use multiple sites or services with a single login, and is gaining attention because users can conveniently use them without entering a lot of personal information. In the case of individuals, the inconvenience of having to record personal information such as ID and password as well as name and phone number for each site in order to access the site is done in one operation, and the inconvenience is eliminated. It has the advantage of maximizing marketing because it is possible.

However, in the case of SSO authentication, since various services can be used through one authentication, there is a possibility that the user may access all the resources (or data) provided by the service provider with only one authentication, so confidentiality or security is required. There is a problem in that data that is to be used or data that needs to be accessed may be leaked or stolen.

A method for controlling user access to resources in a system using SSO authentication may be provided.

The technical problem to be achieved by this embodiment is not limited to the technical problem as described above, and other technical problems may be inferred from the following embodiments.

The system includes a service provider server for providing a service that provides information to users, a user terminal for accessing the service provider server to inquire the information, and an SSO server for issuing authentication information of the user terminal. And, the service provider server, a resource management unit for classifying the resources managed by the service provider server according to the roles defined based on RBAC (Role Based Access Control), manages information on the roles, and among the roles A role management unit for allocating at least one to a user, and a rights management unit for managing access rights to the resources, and for granting at least one access authority to each of the roles, and the resources include the information Including, the user terminal may be configured to log in to the service provider server with integrated authentication based on the SSO server, but to inquire the information by accessing only resources with access rights according to the assigned role.

The authority management unit may manage APIs that can be used by each of the roles.

The information includes hospital discount information, and the rolls are assigned to a first roll that may be assigned to an employee of a first company affiliated with the service provider, and an employee of a second company affiliated with the service provider. And a third role that can be assigned to a user who is not an affiliate employee of the service provider, and the first role is given access rights to more resources than the second role, and the second role The second role may be given access rights to more resources than the third role.

The server to which a user can access based on SSO authentication includes a resource management unit for classifying resources managed by the server according to roles defined based on Role Based Access Control (RBAC), and managing information on the roles, and the A role management unit for allocating at least one of the roles to a user, and a rights management unit for managing access rights to the resources, and for granting at least one access right to each of the roles, the server, It is connected to an SSO server for the SSO authentication, and the resources may include information that the user can inquire.

The information includes hospital discount information, and the rolls include a first roll that can be assigned to an employee of a first company affiliated with the server operator, and an employee of a second company affiliated with the server operator. A second role to be assigned, or a third role that can be assigned to a user who is not an affiliate employee of the operator of the server, and the first role is granted access rights to more resources than the second role , The second roll may be given access rights to more resources than the third roll.

In a system using Single Sign On (SSO) authentication, it is possible to control user access to resources by assigning roles to which different rights are granted to a plurality of users. It is possible to implement a system that is flexible to change while maintaining security policy consistency. This method can be widely applied to corporate welfare malls, premium services, and membership services with some degree of closure.

1 shows a system using SSO authentication, according to an embodiment.
2 is a diagram illustrating that a user accesses all information provided by a service provider through SSO authentication, according to an embodiment.
3 shows a system for providing information to users, according to one embodiment.
4 is a flowchart illustrating a method for controlling access to resources of users accessed through SSO authentication by a server of a service provider, according to an embodiment.
5 illustrates a resource that users can access according to their assigned role, according to an embodiment.

In the following, some embodiments will be described clearly and in detail with reference to the accompanying drawings so that those with ordinary knowledge in the technical field to which the present invention pertains (hereinafter, ordinary technicians) can easily implement the present invention. will be.

In addition, the term "unit" used in the specification may mean a hardware component or circuit.

1 shows a system using SSO authentication, according to an embodiment.

Referring to FIG. 1, a system 1000 may include a user's terminal 1200, an SSO server 1400, and servers 1620, 1640, and 1660 of a service provider.

The terminal 1200 may provide necessary information to a user by executing an application or storing and managing data. According to an embodiment, the terminal 1200 may be a personal computer (PC), a notebook computer, a tablet PC, a portable game console, a smart phone, a wearable device, or a mobile device such as a camera, but is not limited thereto.

The SSO server 1400 may issue authentication information for a single sign-on (SSO) service that enables access to a plurality of servers through a single user authentication process. The terminal 1200 receives integrated authentication with the SSO server 1400, so that it can access the other plurality of servers 1620, 1640, and 1660 connected to the SSO server 1400 without a separate authentication process.

Servers 1620, 1640, and 1660 of a service provider may provide a service for providing various types of information to a user. For example, the server 1620 may provide hospital discount information to a user, and the user may access the server 1620 to inquire hospital discount information and obtain a discount coupon.

When an authentication request is received from the terminal 1200, the server 1620 verifies the terminal 1200 through authentication information issued from the SSO server 1400, and grants service access rights if the user is an authorized user. You can deny access. For example, when the terminal 1200 requests a connection to the server 1620, the server 1620 may request the terminal 1200 to receive authentication from the SSO server 1400. When the terminal 1200 receives authentication from the SSO server 1400, it may access the servers 1620, 1640, and 1660 connected to the SSO server 1400 without separate authentication.

However, the system 1000 has a weakness in that the user can access all servers or sites once the user passes the initial authentication process. Since the user can access all the resources of the servers 1620, 1640, and 1660 provided by the service providers connected to the SSO server 1400 only with the initial authentication, data requiring confidentiality or security or access need to be restricted. Data leakage or hijacking may occur.

2 is a diagram illustrating that a user accesses all information provided by a service provider through SSO authentication, according to an embodiment.

According to an embodiment, the user 2200 is an employee who is currently employed by company A. Company A has an alliance with a service provider, which is the operator of the server 1620, and the service provider can provide hospital discount information to employees of company A and issuing discount coupons to employees of company A. have.

In this embodiment, the user 2200 may access hospital discount information provided by the service provider through SSO authentication even without a separate subscription to the service provider's service. For example, the user 2200 may log in to the server 1620 by accessing the company A's intranet in which he is employed.

The user 2200 logs in to the server 1620 based on SSO authentication, and the 20% discount information for hospital A, 40% discount information for hospital A, 20% discount information for hospital B, and B managed by the server 1620 Get access to hospital's 40% discount information. However, due to the nature of SSO that can access multiple channels with the initially acquired authority, it needs to be established in the form of checking the authority qualification by setting a certain period for security. In order to overcome this problem, a role-based access control (RBAC) system may be used. Hereinafter, a method of controlling users accessed through SSO authentication in the server 1620 of the service provider based on RBAC will be described.

The RBAC system greatly simplifies the authority management by allowing access to only the minimum resources necessary for the user's role performance, and can provide flexibility in implementing corporate specific security policies. RBAC can control access by assigning roles to each user.

RBAC is a method in which an administrator grants some of his or her permissions to a general user, so that an unauthorized user can perform the task. The account that the administrator grants the user permission to use is a role. to be. According to an embodiment, in RBAC, an administrator role to which all system privileges are granted is a higher role, and at least one lower role to which some of the administrator's authority is granted may be hierarchically defined.

Fig. 3 shows a block diagram of a server of a service provider, according to an embodiment.

3, a first user, a second user, and a third user access or log in to the server 3000 through SSO authentication using a first smartphone, a second smartphone, and a third smartphone, respectively. can do.

According to an embodiment, a security policy manager (eg, an operator of the server 3000) may grant a role to a user and grant access rights to a resource to the role. According to an embodiment, the RBAC model applicable to the server 3000 may include Core RBAC, Hierarchical RBAC, Constrained RBAC, and Consolidated RBAC.

Each RBAC system may include a reference monitor. The reference monitor is implemented in the form of an Execution Monitor (EM) and can control all access to resources by users. Each area of the implemented RBAC model (Permission Assignment(PA), User Assignment()), such as whether the user is appropriate to be granted the role, whether the granted permission has access rights to the resource, and access rights to access the resource. UA), session_roles, etc.) can check whether there is a security problem and decide whether to allow or not.

The server 3000 may include a resource management unit 3200, a role management unit 3400, and an authority management unit 3600.

The resource management unit 3200 may classify resources managed by the server 3000 according to roles defined based on Role Based Access Control (RBAC). For example, the resource management unit 3200 includes a first resource that can only be accessed by an administrator (for example, an operator of the server 3000), and a second resource that can only be accessed by a user assigned a first role. , The second role can be classified and managed as a third resource that can only be accessed by the assigned user.

Referring to FIG. 5, the resource may include hospital discount information. The resource management unit 3200 may manage 10% discount information of hospital A and 10% discount information of hospital B as resources accessible to a general member (eg, a user assigned a general member role). The resource management unit 3200 manages the 20% discount information of hospital A and 20% discount information of hospital B as resources that can only be accessed by users who are employed by company B (for example, users who are assigned company B role). can do. The resource management unit 3200 can manage the 40% discount information of Hospital A as a resource that can be accessed only to users who are employed by Company A and Company C (for example, users assigned to Company A role or Company C role). have. The resource management unit 3200 may manage the 40% discount information of hospital B as a resource that can only be accessed by a user who is employed by company A (for example, a user who has been assigned a role of company A). The resource management unit 3200 may manage the 20% discount information of hospital B as a resource that can only be accessed by a user who is employed by company C (for example, a user who has been assigned a role of company C).

Referring back to FIG. 3, the role management unit 3400 manages information on roles defined based on RBAC, and assigns at least one of the roles to each of the first user, the second user, and the third user. I can.

The role management unit 3400 includes a first role having access rights to all resources of the server 3000, a second role having access rights to some resources of the server 3000, and some other resources of the server 3000. You can manage the third role with access rights. The range of resources that the second role can access may be larger than the range of resources that the third role can access.

For example, when the first user is a general member, the role management unit 3400 may allocate a general member role to the first user. When the second user is an employee of the company A, the role management unit 3400 may allocate the company A role to the second user. The role management unit 3400 may allocate the company B roll to the third user when the third user is an employee of the company B. In this embodiment, company A and company B may be affiliates of an operator (eg, a service provider) of the server 3000. The general member role may be a role assigned by a user other than an employee who is currently employed by an affiliate of the operator (eg, service provider) of the server 3000.

For example, a first user assigned a general member role may access general hospital discount benefit information provided by the server 3000 and store the discount coupon in his first smart phone. The second user assigned the corporate role A may access special hospital discount benefit information provided by the server 3000 and store the special discount coupon in his second smart phone. The third user who has been assigned the corporate role B may access special hospital discount benefit information provided by the server 3000 and store the special discount coupon in his third smart phone.

Referring back to FIG. 5, when the first user, the fifth user, or the sixth user accesses the server 3000 through SSO authentication through the company A's intranet, the role management unit 3400 provides the first user to the first user. A role can be assigned. When the fourth user accesses the server 3000 through SSO authentication through the company B's intranet, the role management unit 3400 may allocate the company B roll to the fourth user. The role management unit 3400 may allocate a general member role to the second user if the second user is not an employee of an affiliate company of the service provider. When the third user accesses the server 3000 through SSO authentication through the company C's intranet, the role management unit 3400 may allocate the company C role to the third user.

As a result, the first, fifth, and sixth users who access the server 3000 through SSO authentication can access only 40% discount information for hospital A and 40% discount information for hospital B. The second user who accesses the server 3000 through SSO authentication can access only the 10% discount information for hospital A and 10% discount information for hospital B. A third user who accesses the server 3000 through SSO authentication can access only 40% discount information for hospital A and 20% discount information for hospital B. The fourth user who accesses the server 3000 through SSO authentication can access only 20% discount information for hospital A and 20% discount information for hospital B.

Referring again to FIG. 3, the permission management unit 3600 hierarchically manages permission for resource access, and may grant at least one permission to each of the roles. For example, the authority managed by the authority management unit 3600 may include lower authority corresponding to each of the resources and at least one higher authority including a plurality of lower authority. The permission may include at least one of a permission to access a lower resource and a permission to access a higher resource. The permission to access the upper resource may include the permission to access all the lower resources of the parent resource.

According to an embodiment, the authority management unit 3600 may enumerate defined roles and manage application program interfaces (APIs) that can be used according to the roles. For example, the authority management unit 3600 collects APIs that can be used by a first library, a collection of APIs that can be used by a first role, a second library, and a third role. You can manage your third library.

4 is a flowchart illustrating a method for controlling access to resources of users accessed through SSO authentication by a server of a service provider, according to an embodiment.

In step S4100, the user's terminal may attempt to log in by accessing the server of the service provider. For example, a user may attempt to log in to a server that provides a service providing hospital discount benefit information by entering an ID and password in his or her terminal.

In step S4200, the server of the service provider may request the user terminal to receive authentication from the SSO server.

In step S4300, the user terminal receives authentication from the SSO server, so that the user terminal may log in to the server of the service provider (S4400).

In step S4500, the server of the service provider may determine the user's role based on the login information of the user terminal. According to an embodiment, the server of the service provider may allocate at least one of predefined roles to the user terminal.

In step S4600, the user terminal may access only limited resources among the resources managed by the server of the service provider according to the role assigned to the user terminal.

The descriptions are intended to provide exemplary configurations and operations for implementing the present invention. The technical idea of the present invention will include not only the embodiments described above, but also implementations that can be obtained by simply changing or modifying the above embodiments. In addition, the technical idea of the present invention will also include implementations that can be achieved by easily changing or modifying the embodiments described above.

Claims (5)

A service provider server for providing a service for providing information to users;
A user terminal for accessing the service provider server to inquire the information; And
Includes an SSO server for issuing authentication information of the user terminal,
The service provider server,
A resource management unit for classifying resources managed by the service provider server according to roles defined based on Role Based Access Control (RBAC);
A roll management unit for managing information on the rolls and assigning at least one of the rolls to a user; And
And a rights management unit for managing access rights to the resources and granting at least one access rights to each of the roles,
The resources include the information,
The user terminal, a system configured to log in to the service provider server with integrated authentication based on the SSO server, and to inquire the information by accessing only resources with access rights according to the assigned role. The method of claim 1,
The authority management unit manages APIs that can be used by each of the roles. The method of claim 1,
The information includes hospital discount information,
The rolls include a first roll that can be assigned to an employee of a first company affiliated with the service provider, a second roll that can be assigned to an employee of a second company affiliated with the service provider, and Including a third role that can be assigned to users who are not affiliate employees,
The first roll is granted access rights to more resources than the second roll,
The system in which the second role is given access rights to more resources than the third role. In the server that users can access based on SSO authentication,
A resource management unit for classifying resources managed by the server according to roles defined based on Role Based Access Control (RBAC);
A roll management unit for managing information on the rolls and assigning at least one of the rolls to a user; And
And a rights management unit for managing access rights to the resources and granting at least one access rights to each of the roles,
The server is connected to the SSO server for the SSO authentication,
The resources are a server including information that the user can search. The method of claim 4,
The information includes hospital discount information,
The roles are, a first roll that can be assigned to an employee of a first company affiliated with the server operator, a second roll that can be assigned to an employee of a second company affiliated with the server operator, or the server Including a third role that can be assigned to a user who is not an affiliate employee of the operator of,
The first roll is granted access rights to more resources than the second roll,
The second role is a server to which access rights to more resources are granted than the third role.

Images