KR102209777B1 - Method and system for controlling connection using private domain name - Google Patents

Abstract

The present invention relates to an access control method and system for authenticating access rights of a terminal using a personal domain name and a public key and controlling access to a private network. A method for controlling access to a private network using a personal domain name according to an embodiment of the present invention includes, by a service server, receiving a domain query message including a personal domain name and an electronic signature transmitted from a communication terminal; The service server interworking with the blockchain network to verify access rights to the private network; If the service server succeeds in verifying the access right to the private network, obtaining an access address of the private network corresponding to the personal domain name and the public key of the communication terminal from the blockchain network; And transmitting, by the service server, an access address of the private network to the communication terminal as a response to the domain query, and proceeding with the private network connection to the communication terminal.

Description

Method and system for controlling connection using private domain name}

The present invention relates to a method of controlling access to a private network, and more particularly, to a method and system for access control that authenticates access rights of a terminal using a personal domain name and a public key and controls access to a private network. About.

The domain name service is a service provided by changing a domain name recorded in English to an IP (Internet Protocol) address in the form of a number, and corresponds to a known service currently used in the Internet. In order to provide such a domain name service, a domain name service server is established on a network, and the domain name service server delivers an IP address to a terminal in response to a domain name query. Furthermore, a technology that can use a domain name expressed in another language instead of the existing English domain name was also developed. The following patent document discloses a system for using domain names in a language desired by a user on the Internet.

However, since these domain names are officially used, there is a problem that they are not specialized only for users. In particular, there is a problem in that users cannot use domain names that are easy to memorize and accessible due to the selection of domain names by companies and organizations.

In addition, the existing domain name service only returns an IP address, and there is a limit to service scalability.

Korean Patent Application Publication No. 10-2001-0066754 (published on 2001.01.

The present invention has been proposed to solve such a conventional problem, and an object of the present invention is to provide an access control method and system for controlling access by authenticating a private network access right of a communication terminal based on a personal domain name and a public key.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by examples of the present invention. In addition, it will be easily understood that the objects and advantages of the present invention can be realized by the means shown in the claims and combinations thereof.

A method of controlling access to a private network using a personal domain name according to the first aspect of the present invention to achieve the above object, is a domain query including a personal domain name and an electronic signature transmitted from a communication terminal. Receiving a message; The service server interworking with the blockchain network to verify access rights to the private network; If the service server succeeds in verifying the access right to the private network, obtaining an access address of the private network corresponding to the personal domain name and the public key of the communication terminal from the blockchain network; And transmitting, by the service server, an access address of the private network to the communication terminal as a response to the domain query, and proceeding with the private network connection to the communication terminal.

The method includes, by a security device included in the private network, receiving a connection request message from the communication terminal; And obtaining, by the security device, a public key of the communication terminal, and authenticating whether the obtained public key of the communication terminal is included in an access allowed list.

The method includes the steps of, by the security device, receiving a public key of another communication terminal allowed to access the private network from a manager terminal; Verifying, by the security device, a public key of the administrator terminal and authenticating whether the public key of the administrator terminal is set as a public key for an administrator; And if the security device succeeds in the authentication, storing the public key of the other communication terminal in the access allowed list.

The step of obtaining the access address of the private network from the blockchain network, wherein the service server generates an information request transaction including the personal domain name, the electronic signature, and the public key of the security device to the blockchain network. step; The blockchain network verifies the electronic signature to obtain the public key of the communication terminal, and a device additional transaction including the personal domain name, the public key of the communication terminal, and the public key of the security device is transferred to the blockchain. Retrieving whether or not it is stored and verifying the access authority; Extracting access address information of the private network from a block including the personal domain name, the public key of the security device, and the public key of the communication terminal when the blockchain network succeeds in verifying the access authority; And receiving, by the service server, an access address of the private network from the blockchain network.

The method includes the steps of: receiving, by a domain management server, a device addition request message including the personal domain name, the public key of the security device, and the public key of the communication terminal from the manager terminal; Generating, by the domain management server, a device addition transaction including the personal domain name, the public key of the security device, and the public key of the communication terminal to the blockchain network; And the block chain network checks the public key of the manager terminal, verifies whether the public key is set as the public key for the manager, and if the verification is successful, a block containing the device addition transaction is generated and the block It may further include storing in the chain.

A system for controlling access to a private network using a personal domain name according to the second aspect of the present invention to achieve the above object, upon receiving a domain query message including a personal domain name transmitted from a communication terminal, In connection with a network, verification of the private network access authority of the communication terminal is performed, and if the access authority to the private network is successfully verified, an access address of the private network corresponding to the private domain name and the public key of the communication terminal A service server for acquiring from the blockchain network and transmitting an access address to the private network to the communication terminal as a response to the domain query message; And when the communication terminal is successfully verified by performing verification of the communication terminal, based on at least one of a token and a use ticket received from the communication terminal connected to the access address, and responsible for the security of the private network. It includes a security device that allows a private network access to the communication terminal.

The present invention has an advantage of improving convenience in accessing a private network by enabling a user's terminal to be connected to a private network through input of a personal domain name.

In addition, since the present invention comprehensively uses a personal domain name, public key, electronic signature, etc. recognized only by a user to authenticate access rights of a private network, there is an effect of improving the security of the private network.

In addition, the present invention has an advantage that a user can access a private network using different terminals as needed by implementing a system capable of registering access rights of other terminals through an administrator terminal.

In addition, the present invention has an advantage of maximizing convenience in using a personal domain name, since it is possible to provide a personal domain name for only a user regardless of overlapping with an existing public domain name.

The following drawings attached to the present specification illustrate preferred embodiments of the present invention, and serve to further understand the technical idea of the present invention together with specific details for carrying out the invention, so the present invention is described in such drawings. It is limited to matters and should not be interpreted.
1 is a diagram showing a configuration of an access control system according to an embodiment of the present invention.
2 is a flowchart illustrating a method of sharing a public key between a communication terminal and a security device according to an embodiment of the present invention.
3 is a flowchart illustrating a method of registering a personal domain name by an administrator terminal according to an embodiment of the present invention.
4 is a flowchart illustrating a method of obtaining, by an administrator terminal, an access address of a private network in response to a domain query according to an embodiment of the present invention.
5 is a flowchart illustrating a method for a manager terminal to access a private network according to an embodiment of the present invention.
6 is a flowchart illustrating a method of registering access rights of other terminals in an administrator terminal according to an embodiment of the present invention.
7 is a flowchart illustrating a method of obtaining an access address of a private network by another terminal permitted to access the private network according to an embodiment of the present invention.
8 is a flowchart illustrating a method of accessing a private network by another terminal permitted to access the private network according to an embodiment of the present invention.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, whereby those of ordinary skill in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a configuration of an access control system according to an embodiment of the present invention.

As shown in Figure 1, the access control system according to an embodiment of the present invention is a plurality of communication terminals (110, 120, 130), domain management server 200, service server 300, DNS server (Domain Name Service Server) 400, a blockchain network 500 and a private network 700.

Each of the communication terminals 110, 120, and 130, the DNS server 400, the service server 300, the domain management server 200, and the private network 700 communicate with each other through the communication network 600. The communication network 600 includes a mobile communication network and a wired communication network. The blockchain network 500 may also communicate with the domain management server 200 and the service server 300 through the communication network 600, or may communicate through another communication network.

Blockchain network 500 is connected to a plurality of nodes, and performs verification of the transaction. In addition, each node belonging to the blockchain network 500 performs verification of the transaction when a transaction occurs. In addition, each node included in the blockchain network 500 records transactions and shares a blockchain having a connection structure between blocks. The above transaction occurs when a personal domain name is registered/deleted/changed or a connection address is requested. In addition, the block may include a public key for an administrator, a public key of a security device, an access address of the private network 700, a personal domain name, and a use ticket, and additionally, access to the access address is permitted (i.e., private network It may also contain the public key of another terminal that is allowed to access it. The use ticket is information generated based on the current year, date, and time, and may be time information listing the current year, date, and time. In particular, a used ticket generated in the future is a value greater than a used ticket generated in the past. Have.

When a transaction requesting information occurs in the blockchain network 500, each node included in the blockchain network 500 verifies the transaction, and if the verification is successful, corresponds to a personal domain name and one or more public keys. The private network access address that is used may be extracted from the blockchain and transmitted to the domain management server 200.

The communication terminals 110, 120, 130 are communication devices such as smartphones, tablet computers, personal computers, servers, etc., and the communication terminals 110, 120, 130 include personal domain applications 111, 121, for personal domain services. 131) is installed. The personal domain applications 111, 121, and 131 generate a private key and a public key exclusively for users. Each user may register a personal domain name using the personal domain application 111, 121, and 131. At this time, the personal domain application (111, 121, 131) generates a transaction including an electronic signature, a personal domain name, and additional information through the domain management server 200, and converts the block containing the transaction into the blockchain network 500 ) Can be registered. In addition, the personal domain applications 111, 121, and 131 of the communication terminals 110, 120, and 130 may obtain an access address of the private network based on the personal domain name.

The DNS server 400 serves to provide an IP address corresponding to a domain name. In particular, the DNS server 400 checks the domain name in a domain name query, and when a code representing a personal domain (hereinafter, referred to as a'personal domain code') is included in the domain name query, the domain name query Pass it to 300.

The service server 300 is a server that provides a personal domain name service, and upon receiving a domain name query including a personal domain name and a service code (eg, a hexadecimal string) from the DNS server 400, the personal domain name and The access address of the private network corresponding to one or more public keys is obtained from the blockchain network 500, and the obtained access address is provided to the communication terminals 110, 120, 130. The service server 300 verifies whether the domain name contains a service code, checks the format of the service code, and if the service code check is successful, a transaction requesting the access address of the private network It can be generated by the network 500.

The domain management server 200 performs a function of registering, changing, or deleting a personal domain name in the blockchain network 500. When the domain management server 200 receives a request for registration of a personal domain name from the personal domain application 111, 121, 131 of the communication terminal 110, 120, 130, the electronic signature, the public key of the security device 710, By generating a transaction including a personal domain name and additional information in the blockchain network 500, a personal domain name can be registered in the blockchain network 500.

In addition, the domain management server 200 receives a device addition request from the communication terminals 110, 120, 130, and generates a device addition transaction including an electronic signature and a public key to the blockchain network 500, Public keys of other communication terminals can be registered in the blockchain as authorized information.

Although it has been described that the domain management server 200 and the service server 300 are implemented separately from each other, the domain management server 200 and the service server 300 may be integrated and implemented in a single server form.

The private network 700 is a network formed in a home or a company, and includes one or more communication devices 720, and in particular, includes a security device 710.

The communication device 720 is a communication device capable of communicating, and may include, for example, a gateway, a router, an IP camera, an IPTV, and an IP-based wall pad.

The security device 710 is included in the private network 700 and performs a security function between the public communication network 600 and the private network 700. Specifically, when the security device 710 receives an access request message including a service code and a personal domain name from the communication terminals 110, 120, 130, the communication terminal 110, 120, 130 It authenticates whether or not it is possible to access the private network 700, and allows the communication terminals 110, 120, and 130 to selectively connect to the private network 700 according to the authentication result. The security device 710 generates a private key and a public key, and distributes the public key to an administrator terminal. In addition, the security device 710 obtains the public key of the administrator terminal, sets the public key of the administrator terminal as a public key for administrators, and stores it. The security device 710 may store a mapping table in which a use ticket and a personal domain name are mapped. In addition, the security device 710 stores the public key of the other communication terminal allowed to access in addition to the public key of the administrator terminal. The security device 710 records and manages the public key of the other communication terminal allowed to access the access allowed list.

The security device 710 may be implemented as hardware or software, or may be implemented through a combination of hardware and software. In addition, the security device 710 may be coupled to the communication device 720 through a USB port or the like. The security device 710 may perform short-range wireless communication such as Bluetooth communication, Wi-Fi communication, infrared communication, and Zigbee communication.

Hereinafter, an administrator terminal capable of assigning access rights to the private network 700 will be described by referring to the first communication terminal 110.

2 is a flowchart illustrating a method of sharing a public key between a communication terminal and a security device according to an embodiment of the present invention.

Referring to FIG. 2, when the security device 710 is installed in the private network 700, the security device 710 obtains an IP address of the communication device 720 included in the private network 700 (S201). . The security device 710 may be a hardware module, and in this case, the security device 710 may be combined or integrated with a core device that processes and relays data in the private network 700, such as a gateway and a router. . In another embodiment, the security device 710 may be implemented in software and mounted on any one device included in the private network 700.

Next, when the personal domain application 111 is installed in the first communication terminal 110, the personal domain application 111 generates a private key and a public key exclusively for the user (S203). Next, the first communication terminal 110 searches for a security device 710 in the vicinity through short-range wireless communication (eg, Wi-Fi communication), and wirelessly connects the searched security device with a Wi-Fi protected setup (WPS). It becomes (S205). At this time, the access password may be set in the security device 710, and the first communication terminal 110 transmits the access password to the security device 710 to successfully authenticate the connection, It can be connected by wireless communication.

Next, the personal domain application 111 of the first communication terminal 110 transmits the public key of the first communication terminal 110 to the security device 710 (S207), and the security device 710 is the first The public key of the communication terminal 110 is stored as an administrator public key (S209). In other words, when the first public key is registered through short-range wireless communication, the security device 710 may store the public key as an administrator public key.

Then, the security device 710 generates its own private key and public key (S211). Subsequently, the security device 710 receives the security information including its serial number and the IP address of the communication device 720 included in the private network 700 (ie, the private network access address) and its own public key. It transmits to the communication terminal 110 (S213). Meanwhile, the security device 710 may be implemented in a form capable of communicating by itself, and in this case, the security device 710 may transmit its own IP address to the first communication terminal 110. In other words, the security device 710 provides the IP address to the first communication terminal 110 when its own IP address exists, whereas its own IP address does not exist and the private network 700 is specified. In the case of being combined with a device, the IP address of the communication device 720 included in the private network 700 may be acquired and transmitted to the first communication terminal 110.

Then, the first communication terminal 110 stores the serial number of the security device 710, the IP address of the communication device 720, and the public key of the security device 710 included in the security information (S215).

According to this registration procedure, the first communication terminal 110 and the security device 710 share a public key between each other, and the first communication terminal 110 is the communication device 720 included in the private network 700. Obtain an IP address.

3 is a flowchart illustrating a method of registering a personal domain name by an administrator terminal according to an embodiment of the present invention.

Referring to FIG. 3, the personal domain application 111 of the first communication terminal 110 receives a domain name from a user and adds a preset personal domain code (eg, kt.tin) to the input domain name. Create a personal domain name (S301).

Next, the personal domain application 111 is the security information of the private network 700 (that is, the communication device IP address, the serial number of the security device 710), the public key of the security device 710 and the first communication terminal ( 110) and generates a use ticket based on the current time and date (S303). Next, the personal domain application 111 sets the use ticket as original text data, and digitally signs the use ticket with the user's private key (S305). Depending on the embodiment, the personal domain application 111 combines one or more of a personal domain name, the security information, and a use ticket, and sets the combined information as original data, so that the personal domain of the first communication terminal 110 You can also sign electronically with a key.

Subsequently, the personal domain application 111 transmits a domain registration request message including the personal domain name, use ticket, security information, public key and electronic signature of the security device 710 to the domain management server 200 (S307). .

Then, the domain management server 200 generates a domain registration transaction including the personal domain name, use ticket, public key of the security device 710, security information, and electronic signature to the blockchain network 500 (S309). . Subsequently, each node included in the blockchain network 500 obtains the public key of the first communication terminal 110 by verifying the electronic signature. At this time, each node included in the blockchain network 500 may obtain the public key of the first communication terminal 110 from an electronic signature through a known electronic signature verification algorithm. The electronic signature verification algorithm may be performed based on a smart contract.

Subsequently, when each node included in the blockchain network 500 succeeds in verifying the electronic signature and obtains the public key of the first communication terminal 110, the personal domain name and the first communication terminal 110 are disclosed. It is checked whether a block including both the key and the public key of the security device 710 is stored in the blockchain, and a duplicate check is performed on the personal domain name (S311). Here, not only the personal domain name is double-checked, it is checked whether a block having all of the user public key, the public key of the security device 710, and the personal domain name exists. Incidentally, even though the personal domain name is the same, if any one of the user public key and the public key of the security device 710 is different, the service can be used. That is, in the present invention, when users are different from each other and user public keys are different from each other, the same personal domain may be used between users.

Next, each node of the block chain network 500 checks that the block having both the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name does not exist in the block chain. Otherwise, a token dedicated to the first communication terminal 110 is generated (S313). The token may be a numeric string or a string, or a combination of numbers and letters, and is randomly generated according to a preset algorithm (eg, a random number generation algorithm). The token is used to authenticate the access of the first communication terminal 110 to the private network 700.

Subsequently, the block chain network 500 generates a block having the domain registration transaction and the token, and stores the personal domain name in the block chain by connecting the generated block with the existing block (S315). At this time, each node of the blockchain network 500 sets the public key of the first communication terminal 110 as the administrator public key and stores it in a block. In other words, each node of the blockchain network 500 may set the public key of the first communication terminal 110, which is the user's public key, as the administrator public key when a personal domain name is first stored in the blockchain.

Subsequently, the blockchain network 500 notifies the success of the transaction to the domain management server 200 (S317). Then, the domain management server 200 notifies the domain registration success response to the personal domain application 111 (S319). The personal domain application 111 of the first communication terminal 110 deletes other data except the public key of the security device 710 from among the security information stored in the first communication terminal 110 when the personal domain name is normally registered. I can. That is, since the personal domain application 111 is registered with the personal domain name in the blockchain network 500, only the public key of the security device 710 is stored, and then the IP address of the communication device 720 and the security The serial number of the device 710 can be deleted.

4 is a flowchart illustrating a method of obtaining, by an administrator terminal, an access address of a private network in response to a domain query according to an embodiment of the present invention.

Referring to FIG. 4, the personal domain application 111 of the first communication terminal 110 receives a domain name from a user, and includes the input domain name and a personal domain code (eg, kt.tin). Create a name (S401). Next, the personal domain application 111 generates a user ticket based on the current date and time (S403). Subsequently, the personal domain application 111 extracts the public key of the security device 710 being stored (S405).

Next, the personal domain application 111 selects the use ticket as original text data, and electronically signs the selected original text data with the private key of the first communication terminal 110 (S407).

Subsequently, the personal domain application 111 converts the use ticket, the public key and the electronic signature of the security device 710 into a service code having a certain format (for example, a character string in hexadecimal form) (S409), and the converted The domain query message including the service code and the personal domain name is transmitted to the DNS server 400 (S411).

Then, the DNS server 400 checks whether a personal domain code (eg, kt.tin) is included in the personal domain name included in the domain query message, and if the personal domain code is included, the domain query message is It is transmitted to the service server 300 (S413, S415).

Then, the service server 300 checks the service code and personal domain name included in the domain query message, checks whether the service code has a preset normal range of digits, and the service code is in advance. It is checked whether or not it has been converted to a set format (eg, hexadecimal) (S417). When the service code is successfully checked, the service server 300 generates an information request transaction including the service code and a personal domain name to the blockchain network 500 (S419).

Then, each node of the blockchain network 500 restores the use ticket, the public key of the security device 710, and the electronic signature to the state before being converted to the service code (S421). Restoring the use ticket, destination public key, and electronic signature may be performed based on a smart contract.

Next, each node of the blockchain network 500 verifies the restored electronic signature and extracts the public key of the first communication terminal 110 from the electronic signature (S423).

If the electronic signature verification is successful, the blockchain network 500 checks the restored use ticket (ie, the use ticket included in the information request transaction), and the public key of the first communication terminal 110, the security device 710 ), the most recently stored block including the public key and the personal domain name is checked in the blockchain network 500, the use ticket included in the most recently stored block is compared with the restored use ticket, and the restoration One used ticket is verified (S425). At this time, if the use ticket included in the information request transaction is larger than the use ticket included in the most recently stored block, the blockchain network 500 determines that the use ticket verification is successful. Otherwise, the use ticket is verified. Treat it as failed. The blockchain network 500 may determine that data forgery has occurred when verification of the use ticket fails.

If the use ticket verification is successful, the blockchain network 500 generates a block including the information request transaction, connects it with an existing block, and stores the generated block in the block chain (S427). In addition, the blockchain network 500 checks a block including the personal domain name and the public key of the first communication terminal 110 in the block chain, and the IP address of the communication device 720 and the first communication in the block The token of the terminal 110 is extracted (S429). Subsequently, the blockchain network 500 transmits a transaction processing message including the extracted IP address of the communication device 720 and the token of the first communication terminal 110 to the service server 300 (S431).

Then, the service server 300 transmits the IP address of the communication device 720 and the token of the first communication terminal 110 to the personal domain application 111 of the first communication terminal 110 as a response to the domain query. Do (S433).

According to this procedure, when the first communication terminal 110 transmits a domain query message including a service code and a personal domain name, the personal domain name, the public key of the security device 710, and the first communication terminal 110 The IP address and token corresponding to the public key of are received as response information.

5 is a flowchart illustrating a method for a manager terminal to access a private network according to an embodiment of the present invention.

The procedure according to FIG. 5 proceeds after the procedure of FIG. 4.

5, the personal domain application 111 of the first communication terminal 110 checks the communication device IP address and token of the private network 700 received from the service server 300 (S501), and FIG. In step S409 of, the service code converted into a predetermined format, the personal domain name, and the access request message including the token are transmitted to the communication device 720 having the identified IP address (S501 and S503).

Then, the security device 710 that controls access to the private network 700 obtains the access request message, and transfers the service code in the form of a predetermined format included in the message to the original use ticket and the security device 710. After restoring the public key and the electronic signature, the restored electronic signature is verified, and the public key of the first communication terminal 110 is obtained from the electronic signature (S505).

Next, when the security device 710 succeeds in verifying the electronic signature and obtains the public key of the first communication terminal 110, the security device 710 checks the use ticket and the personal domain name included in the access request message, and the personal domain name Check the most recently used ticket mapped to and in the mapping table stored in it.

Subsequently, the security device 710 compares the use ticket checked in the mapping table with the use ticket included in the access request message, and verifies the use ticket (S507). At this time, if the use ticket included in the access request message is larger than the most recent use ticket mapped with the personal domain name in the mapping table, the security device 710 determines that the use ticket verification is successful, otherwise Treated as a failure to verify the use ticket.

If either of the verification of the electronic signature or the verification of the use ticket fails, the security device 710 transmits a connection failure message to the personal domain application 111 of the first communication terminal 110, and the first communication terminal ( 110) is blocked from accessing the communication device 720.

On the other hand, if both verification of the electronic signature and verification of the use ticket are successful, the security device 710 requests the domain management server 200 to verify the token included in the access request message (S509). At this time, the security device 710 transmits the token, the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name to the domain management server 200, and the verification succeeds. The use ticket and the personal domain name are mapped and recorded in the mapping table to maintain the up-to-dateness of the use ticket.

Next, the domain management server 200 transmits the token, the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name to the blockchain network 500 to perform token verification. Request (S511).

Then, each node of the blockchain network 500 checks the block including the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name, and is recently issued from the block. The token of the first communication terminal 110 is checked, and it is verified whether the token checked in the block matches the token received from the domain management server 200 (S513).

In addition, the blockchain network 500 transmits the token verification result to the domain management server 200, and the domain management server 200 transmits the token verification result to the security device 710 (S515).

If the token verification result is confirmed as failure, the security device 710 transmits a connection impossible message to the first communication terminal 110 and blocks access of the communication device 720 to the first communication terminal 110. On the other hand, if the token verification result is confirmed as a success, the security device 710 finally processes the user verification to be successful (S517), and transmits a message notifying that the communication device is allowed to access the personal domain application 111 (S519). , Allows the first communication terminal 110 to access the communication device 720.

Then, the personal domain application 111 may access the communication device 720 having the IP address through the security device 710 and use a service provided by the communication device 720 (S521).

Next, the security device 710 requests the domain management server 200 to regenerate the token (S523). In this case, the security device 710 transmits the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name to the domain management server 200.

Then, the domain management server 200 generates a transaction requesting regeneration of a token including the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name to the blockchain network 500. (S525), at least one node of the blockchain network 500 regenerates the token of the first communication terminal 110 (S527). And the node includes the regenerated token of the first communication terminal 110, the public key of the first communication terminal 110, the public key of the security device 710, and a personal domain name, indicating that the token has been reissued. A block is created, and this block is connected to an existing block and stored in the blockchain. Thereafter, when a domain query message including a personal domain name is generated in the first communication terminal 110 again, the regenerated token is obtained from the first communication terminal 110.

Meanwhile, in the above-described embodiment, two public keys (i.e., the public key of the security device and the public key of the first communication terminal) are stored in the blockchain together with the personal domain name and security information (i.e., IP address). As explained, either of the two public keys can be stored in the blockchain along with a personal domain name and security information. In this case, one public key (that is, the public key of the first communication terminal or the public key of the security device) and security information corresponding to the personal domain name are extracted from the blockchain network 500, and the first communication terminal 110 ) Can be provided. In addition, one public key (i.e., the public key of the first communication terminal or the public key of the security device) and the use ticket or token corresponding to the personal domain name are extracted from the blockchain network 500, and token verification or ticket verification This can be done in the blockchain network 500.

Meanwhile, the first communication terminal 110, which is a manager terminal, may register other communication terminals 120 and 130 that can access the private network 700.

6 is a flowchart illustrating a method of registering access rights of other terminals in an administrator terminal according to an embodiment of the present invention.

6, when the personal domain application 121 is installed in the second communication terminal 120, the personal domain application 121 generates a private key and a public key of the second communication terminal 120 (S601). ).

Next, the personal domain application 121 of the second communication terminal 120 transmits the generated public key of the second communication terminal 120 to the first communication terminal 110 (S603). At this time, the second communication terminal 120 may transmit a message including the public key of the second communication terminal 120 and describing the address of the first communication terminal 110 as a destination to the first communication terminal 110. Alternatively, the public key of the second communication terminal 120 may be transmitted to the first communication terminal 110 through short-range wireless communication.

Then, the personal domain application 111 of the first communication terminal 110 proceeds to register the second communication terminal 120 as a terminal accessible to the private network 700. First, the personal domain application 111 of the first communication terminal 110 receives a personal domain from an administrator, and generates a personal domain name by adding a personal domain code after the personal domain (S605).

In addition, the personal domain application 111 of the first communication terminal 110 extracts the public key of the security device 710 (S607), sets the original text data, and converts the original text data into the private key of the first communication terminal 110. Electronic signature is performed (S609). In this case, the personal domain application 111 of the first communication terminal 110 may use one or more of a public key or a personal domain name of the security device 710 as original text data. Subsequently, the personal domain application 111 of the first communication terminal 110 includes the personal domain name, the public key of the security device 710, the public key of the second communication terminal 120, and the access terminal including the electronic signature. The additional request message is transmitted to the domain management server 200 (S611).

Then, the domain management server 200 transfers the device addition transaction including the personal domain name, the public key of the second communication terminal 120, the public key of the security device 710, and an electronic signature to the blockchain network 500. It is generated (S613). And each node included in the blockchain network 500 verifies the electronic signature included in the device addition transaction, and extracts the public key of the first communication terminal 110 from the electronic signature (S615).

Subsequently, each node included in the blockchain network 500 verifies whether the public key (that is, the public key of the first communication terminal) extracted through electronic signature verification is registered in the blockchain as a public key for the administrator. (S617). At this time, each node of the blockchain network 500 generates a block including the public key extracted from the electronic signature (ie, the public key of the first communication terminal), the personal domain name, and the public key of the security device 710. By checking in the blockchain and checking whether the public key of the first communication terminal 110 is set as the public key for the administrator in this block, whether the public key of the first communication terminal 110 is the public key for the administrator To verify. In other words, the blockchain network 500 authenticates whether the first communication terminal 110 registering the access device to the private network 700 is an administrator terminal based on a public key and a personal domain name.

Next, the blockchain network 500 notifies the domain management server 200 that the device cannot be added if the public key of the first communication terminal 110 is not set as the administrator's public key, and domain management The server 200 notifies the first communication terminal 110 that the addition of the access terminal has failed.

On the other hand, each node of the blockchain network 500 generates a token dedicated to the second communication terminal 120 when the public key of the first communication terminal 110 is set as a public key for an administrator. And, each node of the blockchain network 500, the device addition transaction and the second communication terminal 120 in which the public key of the second communication terminal 120 is registered as a public key permitted to access the private network. A new block including a token is created, and the new block is connected to the existing block and stored in the blockchain (S619). Accordingly, the second communication terminal 120 is registered in the blockchain as a device that can access the private network 700.

Next, the blockchain network 500 notifies the success of the transaction to the domain management server 200 (S621). Then, the domain management server 200 notifies the first communication terminal 110 that the addition of the access terminal has been successful (S623). Subsequently, the personal domain application 111 of the first communication terminal 110 extracts the public key of the security device 710 and transmits the public key of the security device 710 to the second communication terminal 120. (S625).

Next, the personal domain application 111 of the first communication terminal 110 proceeds with a procedure of obtaining a private network access address (S627). Specifically, as shown in FIG. 4, the personal domain application 111 of the first communication terminal 110 electronically signs a new use ticket with the private key of the first communication terminal 110, and then, the use ticket and the security device ( 710) and converts the digital signature into a service code having a certain format. In addition, the personal domain application 111 of the first communication terminal 110 transmits a domain query message including a service code and a personal domain name to the DNS server 400. The domain query message is transmitted to the service server 300, and the service server 300 generates an information request transaction to the blockchain network 500, restores the service code to the original state in the blockchain network 500, and signs the electronically. By verifying, the public key of the first communication terminal 110 is obtained, and a use ticket is verified. If the service server 300 successfully verifies the use ticket, a new block containing the transaction is created and stored in the blockchain, and the blockchain network 500 includes the personal domain name, the public key of the security device 710, and The IP address of the communication device 720 corresponding to the public key of the first communication terminal 110 (that is, the access address of the private network) and the token of the first communication terminal 110 are transmitted to the first communication terminal 110 do.

When the first communication terminal 110 obtains the IP address and the token of the communication device 720, the personal domain application 111 of the first communication terminal 110 provides the service code, the personal domain name, and the first communication. A device addition request message including the token of the terminal 110 and the public key of the second communication terminal 120 is transmitted to the communication device 720 having the identified IP address (S629).

Then, the security device 710 that controls access to the private network 700 obtains the device addition request message, and proceeds with a verification step as in steps S505 to S517 of FIG. 5. Specifically, the security device 710 restores the service code to its original state, performs a use ticket verification, and if the verification is successful, maps the use ticket and the personal domain name and stores it in a mapping table, and the access request message The included token verification is requested to the domain management server 200, and the result of the token verification performed in the blockchain network 500 is received.

If either of the use ticket verification and token verification fails, the security device 710 notifies the first communication terminal 110 that the device cannot be added. On the other hand, if both the use ticket verification and the token verification are successful, the security device 710 checks whether the public key of the first communication terminal 110 is stored for an administrator, and the first communication terminal 110 Whether the user of is an administrator is authenticated (S631).

Next, if the public key of the first communication terminal 110 is stored for the administrator, the security device 710 uses the public key of the second communication terminal 120 included in the device addition request message to the access allowed list. And transmits to the first communication terminal 110 that the device addition is normally completed (S633).

According to the above-described procedure, the public key of the second communication terminal and the public key of another terminal may be registered in the blockchain and the security device 710 as identification information of the accessible terminal.

7 is a flowchart illustrating a method of obtaining an access address of a private network by another terminal permitted to access the private network according to an embodiment of the present invention.

Since FIG. 7 is similar to FIG. 4, portions overlapping with FIG. 4 in FIG. 7 are compressed and summarized, and differences will be mainly described.

Referring to FIG. 7, the personal domain application 121 of the second communication terminal 120 generates a personal domain name including a personal domain code based on the domain name input from the user, and uses a ticket based on the current date and time. And extracts the public key of the security device 710 received from the first communication terminal 110 (S701 to S705). In addition, the personal domain application 121 of the second communication terminal 120 sets the use ticket as original text data, electronically signs the private key of the second communication terminal 120, and electronic signature, use ticket and security device ( After converting the public key of 710) into a service code (S707, S709), a domain query message including the service code and domain name is transmitted to the DNS server 400 (S711).

The DNS server 400 transmits the domain query message to the service server 300 as the personal domain code is included in the domain query message (S713, S715). Then, the service server checks the service code included in the domain query message, and if the check is successful, generates an information request transaction including the service code and the personal domain name to the blockchain network 500 (S717, S719).

Then, the nodes of the blockchain network 500 restore the electronic signature included in the service code, the public key of the security device 710, and the use ticket, and then verify the restored electronic signature to the second communication terminal 120. ) To extract the public key (S721, S723).

Subsequently, whether there is a block including a device addition transaction having the personal domain name, the public key of the security device 710 and the public key of the second communication terminal 120, the nodes of the blockchain network 500 By searching the block chain, the authority to access the private network of the second communication terminal 120 is checked (S725). That is, the nodes check whether the public key of the second communication terminal 120 is registered in the blockchain by the manager terminal 110.

Subsequently, after performing the use ticket verification (S727), if both the access authority verification and the use ticket verification are successful, the block chain network 500 generates a block including the information request transaction and connects it with the existing block to The created block is stored in the blockchain (S729). In addition, the block chain network 500 includes the IP address of the communication device 720 and the second communication in a block including the personal domain name, the public key of the security device 710 and the public key of the second communication terminal 110. The token of the terminal 120 is extracted (S731). Subsequently, the blockchain network 500 transmits a transaction processing message including the extracted IP address of the communication device 720 and the token of the second communication terminal 120 to the service server 300 (S733).

Then, the service server 300 transmits the IP address of the communication device 720 and the token of the second communication terminal 120 to the personal domain application 121 of the second communication terminal 120 as a response to the domain query. Do (S735).

According to this procedure, when the second communication terminal 120 registered by the manager terminal 110 transmits a domain query message including a service code and a personal domain name, it responds with the IP address and token of the security device 710. Receive as information.

8 is a flowchart illustrating a method of accessing a private network by another terminal permitted to access the private network according to an embodiment of the present invention.

The procedure according to FIG. 8 follows FIG. 7. In addition, since FIG. 8 is similar to FIG. 5, portions overlapping with FIG. 5 in FIG. 8 are compressed and summarized, and differences will be mainly described.

Referring to FIG. 8, the personal domain application 121 of the second communication terminal 120 stores the communication device IP address of the private network 700 and the token of the second communication terminal 120 received from the service server 300. After checking (S801), the connection request message including the service code, the personal domain name, and the token is transmitted to the communication device 720 having the checked IP address (S803).

Then, the security device 710 of the private network 700 receives the access request message, restores the service code to its original state, and verifies the restored electronic signature to obtain the public key of the second communication terminal 120. Extract (S805).

Next, the security device 710 compares the value of the use ticket included in the connection request message with the value of the use ticket stored in the mapping table, and verifies forgery of the use ticket (S807). Subsequently, the security device 710 checks whether the public key of the second communication terminal 120 extracted through electronic signature verification is recorded in the access allowed list, so that the second communication terminal 120 can access the private network. Whether it is a terminal is authenticated (S809).

If either of the use ticket verification and access authorization authentication fails, the security device 710 transmits a connection impossible message to the second communication terminal 120 and blocks access to the second communication terminal 120 .

On the other hand, if both the access authorization authentication and the use ticket verification are successful, the security device 710 requests the domain management server 200 to verify the token included in the access request message (S811). At this time, the security device 710 transmits the token, the public key of the second communication terminal 120, the public key of the security device 120, and a personal domain name to the domain management server 200, and the verification succeeds. The use ticket and the personal domain name are mapped and recorded in the mapping table to maintain the up-to-dateness of the use ticket.

Next, the domain management server 200 transmits the token, the public key of the second communication terminal 120, the public key of the security device 710, and the personal domain name to the blockchain network 500 to perform token verification. Request (S813).

Then, the nodes of the blockchain network 500 check a block including the public key of the second communication terminal 120, the public key of the security device 710, and a personal domain name, and this block or this block and The latest token recorded in the connected block is checked, and it is verified whether the latest token checked in the block matches the token received from the domain management server 200 (S815). In addition, the blockchain network 500 transmits the token verification result to the domain management server 200, and the domain management server 200 transmits the token verification result to the security device 710 (S817).

If the token verification result is confirmed as failure, the security device 710 transmits a connection impossible message to the second communication terminal 120. On the other hand, if the security device 710 confirms that the token verification result is successful, the user verification is finally performed. A successful process is performed (S819), and a message informing the access permission of the communication device is transmitted to the second communication terminal 120 (S821), and the second communication terminal 120 is allowed to access the communication device 720. .

Then, the personal domain application 121 of the second communication terminal 120 can access the communication device 720 having the IP address through the security device 710 and use the service provided by the communication device 720. Yes (S823).

Next, as the token is used, the security device 710 requests a token regeneration to the domain management server 200 (S825), and the domain management server 200 is the public key of the second communication terminal 110 and the security A transaction requesting regeneration of a token including a public key and a private domain name of the device 710 is generated to the blockchain network 500 (S827). Subsequently, the node of the blockchain network 500 regenerates the token, and then the regenerated token, the public key of the second communication terminal 110, the public key of the security device 710, and a personal domain name are included. A block indicating that this has been reissued is generated, and the block is connected with the existing block and stored in the blockchain (S829).

Meanwhile, the electronic signature verification is not performed in the security device 710 but may be performed in the blockchain network 500. In this case, the security device 710 transmits the service code received from the first communication terminal 110 or the second communication terminal 120 to the domain management server 200, and the domain management server 200 Can be transmitted to the blockchain network 500 to request verification of the electronic signature. In addition, the domain management server 200 may receive the public key of the communication terminal as a result of verifying the electronic signature from the blockchain network 500 and transmit it to the security device 710.

As another embodiment, the token is not used, and electronic signature and verification of the use ticket may be performed in the security device 710. In this case, generation of the token may be omitted in the blockchain network 500, and the security device 710 may selectively allow the terminal to access the private network 700 based on the use ticket and the electronic signature.

Meanwhile, in the above-described embodiment, it has been described that a block corresponding to domain identification information and a public key is stored in the block chain network 500, but the block chain network 500 may be changed into a database format and applied to the present invention. In this case, the database stores and manages a module that issues a token, a module that verifies an electronic signature, a module that verifies a use ticket, a module that manages the public key of another terminal that is allowed to access the private network, and the access address of the private network. Module, etc., may be included to perform the functions of the blockchain network 500 described above in the database.

In addition, in the above-described embodiment, it has been described that the security device 710 performs both use ticket verification and token verification, but user verification may be performed by performing only either use ticket verification or token verification.

While this specification includes many features, such features should not be construed as limiting the scope or claims of the invention. In addition, features described in separate embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in a single embodiment herein may be individually implemented in various embodiments, or may be properly combined and implemented.

Although the operations have been described in a specific order in the drawings, it should not be understood that such operations are performed in a specific order as shown, or as a series of consecutive sequences, or that all described operations are performed to obtain a desired result. . Multitasking and parallel processing can be advantageous in certain environments. In addition, it should be understood that classification of various system components in the above-described embodiments does not require such classification in all embodiments. The above-described program components and systems may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. This process can be easily carried out by a person of ordinary skill in the art to which the present invention pertains, and thus will not be described in detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those of ordinary skill in the technical field to which the present invention belongs. It is not limited by the drawings.

110, 120, 130: communication terminal
111, 121, 131: Private domain application
200: domain management server 300: service server
400: DNS Server 500: Blockchain Network
600: communication network 700: private network
710: security device 720: communication device

Claims (14)

delete delete As a method of controlling access to a private network using a personal domain name,
Receiving, by the service server, a domain query message including a personal domain name and an electronic signature transmitted from the communication terminal;
The service server interworking with the blockchain network to verify access rights to the private network;
If the service server succeeds in verifying the access right to the private network, obtaining an access address of the private network corresponding to the personal domain name and the public key of the communication terminal from the blockchain network;
Transmitting, by the service server, an access address of the private network to the communication terminal as a response to the domain query to proceed with access to the private network to the communication terminal;
Receiving, by a security device included in the private network, a connection request message from the communication terminal;
Obtaining, by the security device, a public key of the communication terminal and authenticating whether the obtained public key of the communication terminal is included in an access allowed list;
Receiving, by the security device, a public key of another communication terminal permitted to access the private network from a manager terminal;
Verifying, by the security device, a public key of the administrator terminal and authenticating whether the public key of the administrator terminal is set as a public key for an administrator; And
If the authentication is successful, by the security device, storing the public key of the other communication terminal in the access allowed list. As a method of controlling access to a private network using a personal domain name,
Receiving, by the service server, a domain query message including a personal domain name and an electronic signature transmitted from the communication terminal;
The service server interworking with the blockchain network to verify access rights to the private network;
If the service server succeeds in verifying the access right to the private network, obtaining an access address of the private network corresponding to the personal domain name and the public key of the communication terminal from the blockchain network;
Transmitting, by the service server, an access address of the private network to the communication terminal as a response to the domain query to proceed with access to the private network to the communication terminal;
Receiving, by a security device included in the private network, a connection request message from the communication terminal; And
And allowing a private network connection to the communication terminal when the security device checks the token or the use ticket in the access request message and, if the token or the use ticket is successfully verified, Control method. delete The method according to claim 3 or 4,
Obtaining an access address of the private network from the blockchain network,
Generating, by the service server, an information request transaction including the personal domain name, the electronic signature, and the public key of the security device to a blockchain network;
The blockchain network verifies the electronic signature to obtain the public key of the communication terminal, and a device additional transaction including the personal domain name, the public key of the communication terminal, and the public key of the security device is transferred to the blockchain. Retrieving whether or not it is stored and verifying the access authority;
Extracting access address information of the private network from a block including the personal domain name, the public key of the security device, and the public key of the communication terminal when the blockchain network succeeds in verifying the access authority; And
And receiving, by the service server, an access address of the private network from the blockchain network. The method of claim 6,
Receiving, by a domain management server, a device addition request message including the personal domain name, the public key of the security device, and the public key of the communication terminal from a manager terminal;
Generating, by the domain management server, a device addition transaction including the personal domain name, the public key of the security device, and the public key of the communication terminal to the blockchain network; And
If the blockchain network checks the public key of the administrator terminal and verifies whether the public key is set as the administrator's public key and if the verification is successful, a block containing the device addition transaction is generated and the blockchain Storing in the; access control method comprising a further. As a system that controls access to a private network using a personal domain name,
Upon receiving the domain query message including the personal domain name transmitted from the communication terminal, it interworks with the blockchain network to verify the private network access authority of the communication terminal, and if the access authority to the private network is successfully verified , Obtaining an access address of the private network corresponding to the personal domain name and the public key of the communication terminal from the blockchain network, and transmitting the access address to the private network to the communication terminal as a response to the domain query message A service server; And
Responsible for the security of the private network, and if the communication terminal is successfully verified by performing verification of the communication terminal based on at least one of a token and a use ticket received from the communication terminal connected to the access address, the communication Access control system comprising; a security device that allows access to a private network to the terminal. The method of claim 8,
The security device,
The access control system, characterized in that it additionally authenticates the access right of the communication terminal by checking whether the public key of the communication terminal is included in an access permission list. The method of claim 9,
The security device,
And receiving a public key of another communication terminal permitted to access the private network from an administrator terminal, and storing the public key of the other communication terminal in the access permission list. The method of claim 9,
The security device,
Comparing the use ticket and the stored use ticket to verify forgery and alteration of the use ticket, and permitting a private network connection to the communication terminal when authentication of access authority is successful and verification of the use ticket is successful. Access control system. The method of claim 9,
The security device,
It is characterized in that it verifies whether the received token matches the token issued in the blockchain network, and permits access to the private network to the communication terminal when the authentication of access authority is successful and the verification of the token is successful. Access control system. The method of claim 8,
When the service server generates an information request transaction including the personal domain name, the electronic signature, and the public key of the security device, the electronic signature is verified to obtain the public key of the communication terminal, and the personal domain name, the It searches whether a device addition transaction including the public key of the communication terminal and the public key of the security device is stored in the blockchain to authenticate the access right to the private network, and if the authentication of the access right is successful, the personal domain A block chain network that extracts access address information of the private network from a block including a name, a public key of the communication terminal, and a public key of the security device and transmits the information to the service server; access control further comprising: system. The method of claim 13,
A device addition request message including the personal domain name, the public key of the security device, and the public key of the communication terminal is received from an administrator terminal, and the personal domain name, the public key of the security device, and the public key of the communication terminal are received. Domain management server for generating a device addition transaction including a block chain network; further comprising,
The blockchain network,
The public key of the manager terminal is checked, and if the verification is successful by verifying whether the public key is set as the public key for the manager, a block containing the device addition transaction is generated and stored in the blockchain. Access control system.

Images