KR102305368B1 - OAuth-based Secure Access Control System and Method for IoT Environment - Google Patents

Abstract

The present invention discloses an OAuth-based secure access control system and method for an IoT environment. A client providing an IoT service according to an aspect of the present invention; a user terminal accessing the client to receive an IoT service; a resource server in which information of the user terminal is stored; and an authorization server that registers the client and issues a token; an access control method in an OAuth-based secure access control system for an IoT environment, including: a client authentication step of redirecting to an authorization server through the authentication server to authenticate the client; and a user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication; and a token issuing step in which the authorization server issues an access token to the client.

Description

OAuth-based Secure Access Control System and Method for IoT Environment

The present invention relates to an OAuth-based secure access control system and method for an IoT environment, and more particularly, to a secure Internet of Things (IoT) environment, secure OAuth ( Open Authorization)-based access control system and method.

Recently, the IoT environment continues to develop as it becomes the center of the 4th industrial revolution. As a result, various IoT services have been released, making our lives easier. As the core technologies of the 4th industrial revolution along with IoT, cloud, big data, and mobile technologies are receiving attention and being studied, and smart home, healthcare, smart factory, and smart city services that converge each technology are paying attention as results. are receiving For these services, various sensor devices are connected to the Internet, and the sensor device, communication technology, and interface are organically connected to operate. Major manufacturers in each country are releasing various types of IoT devices, and oneM2M and IETF are working on standardization of IoT communication technology so that these various IoT devices can communicate smoothly.

On the other hand, in the IoT environment, security should be considered as various devices communicate with various communication technologies. When a variety of heterogeneous devices communicate, the security vulnerabilities of each device may gather to create new security vulnerabilities, and privacy-related issues may also occur in the process of processing the data collected by the sensor device. In particular, privacy-related issues are very important in IoT. Taking smart home service as an example, smart home service data generated at home is sensitive data most closely related to the daily life of smart home users. Because it is also possible to check the power consumption and cycle, the gas valve lock status, and whether there is a user in the health care device or at home, if this data is exposed, the user can suffer financial damage, and there is a possibility of injury by breaking into the house. can exist. As such, as many IoT services have recently appeared, authentication of users and protection of privacy are essential, and a detailed study on this is required.

Korean Patent Publication No. 10-2017-0096815 (published on Aug. 25, 2017)

The present invention has been proposed to solve the above problems, in which a client providing an IoT service accesses a resource server and an authorization server of another service in which the user's information is registered for user authentication, thereby accessing an external user authentication information resource. The purpose is to provide an OAuth-based secure access control system and method for the IoT environment that acquires access rights through

Other objects and advantages of the present invention may be understood by the following description, and will be more clearly understood by an embodiment of the present invention. Further, it will be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the claims.

A client that provides an IoT service according to an aspect of the present invention for achieving the above object; a user terminal accessing the client to receive an IoT service; a resource server in which information of the user terminal is stored; and an authorization server that registers the client and issues a token; an access control method in an OAuth-based secure access control system for an IoT environment, including: a client authentication step of redirecting to an authorization server through the authentication server to authenticate the client; a user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication; and a token issuing step in which the authorization server issues an access token to the client.

The client authentication step may include, by the user terminal, transmitting a service request message to the client; transmitting, by the client, information after encryption using the public key of the user terminal; accessing, by the user terminal, an authorization server through a redirect URI; performing, by the authorization server, user authentication by identifying a client to be accessed by the user terminal; and transmitting, by the authorization server, the authentication code and the redirect URI of the client to the user terminal.

The user authentication step in which the user terminal receives a certificate from the client and performs user authentication by verifying the certificate through an authorization server is characterized in that the user authentication is performed by verifying through an ECQV implicit certificate.

In the user authentication step, in which the user terminal receives a certificate from the client and performs user authentication by verifying the certificate through an authorization server, the user terminal selects an arbitrary integer and ECQV generated by the user terminal from the elliptic curve is implicit Calculating a random value for the certificate, the user terminal accesses the client through the redirect URI of the client, and sending a random value for the ECQV implicit certificate generated by the user terminal to request the issuance of the ECQV implicit certificate characterized in that

In the user authentication step, in which the user terminal is issued a certificate to the client, and performs user authentication by verifying the certificate through an authorization server, the client selects an arbitrary integer, It is characterized in that ECQV implicit certificate information and ECQV implicit signature information are generated using the value of , the private key of the client, and a random number generated in the client authentication step.

In the user authentication step, in which the user terminal is issued a certificate to the client, and performs user authentication by verifying the certificate through an authorization server, the user terminal uses the received ECQV implicit certificate and signature to obtain a private key for the current session and It is characterized by generating a public key and transmitting an implicit certificate to the authentication server.

In the user authentication step, in which the user terminal is issued a certificate to the client, and performs user authentication by verifying the certificate through the authorization server, the authorization server performs the ECQV implicit signature and the user value and identifier for the public key for the current session It is characterized in that the public key of the user is calculated based on the information.

An OAuth-based secure access control system for an IoT environment according to another aspect of the present invention for achieving the above object includes: a client providing an IoT service; a user terminal accessing the client to receive an IoT service; a resource server in which information of the user terminal is stored; and an authorization server that registers the client and issues a token, wherein the user terminal redirects the client to the authorization server through the client to authenticate the client in order to receive the IoT service from the client.

The user terminal is characterized in that it receives an ECQV certificate from the client, and transmits the certificate to an authorization server to request user authentication.

The authorization server verifies the ECQV certificate, and issues an access token to the client to access the resource of the user terminal.

According to one aspect of the present invention, since authentication can be performed without leaving user information in a client providing an IoT service, there is an effect of protecting privacy for a user in an IoT environment.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. .

The following drawings attached to this specification illustrate preferred embodiments of the present invention, and serve to further understand the technical spirit of the present invention together with specific contents for carrying out the invention, so the present invention is in such drawings It should not be construed as being limited only to the stated matters.
1 is an example of a retransmission attack that may occur in an OAuth scenario;
2 is an example of a CSRF attack that may occur in an OAuth scenario;
3 is an example of a client authentication step scenario in an OAuth-based secure access control system according to an embodiment of the present invention;
4 is an example of a scenario of user authentication and token generation in the OAuth-based secure access control system according to an embodiment of the present invention.

The above-described objects, features and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, and accordingly, those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in the description of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, the “… The term “unit” means a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

OAuth (Open Authorization) is a standard that defines the content that can authorize the Internet-connected IoT service client to access the user's resources stored in an external resource server without sharing the user's information. When OAuth is used, the client authenticates the user through an external authorization server to provide the service, and then grants the client the right to access the resource server. Through this, the client does not need a separate authentication process, so that various services can be integrated and used. OAuth was first published in 2010 by the IETF OAuth Working Group as the OAuth 1.0 protocol standard RFC5849. Recently, RFC6749, a standard for the OAuth 2.0 framework, has been published, and standardization work according to the communication method between each communication object is in progress.

OAuth operates between four entities. The OAuth object includes a user (User, Resource owner), a resource server (Resource server, Service provider), a client (Client, Consumer), and an authorization server (Authorization server). A user is a user of a service having an account in the resource server. In the description of the present embodiment, the user may be a portable terminal possessed by a user capable of transmitting and receiving information. That is, in the description of the present embodiment, the user may be a portable terminal such as a mobile phone possessed by the user that can receive the service by connecting to the client providing the IoT service through a network. For example, it may mean a user who is subscribed to a service that provides OAuth, such as Google, Facebok, Naver, and the like. The resource server may be a server that manages user resources such as Google and Facebook in the above example. A client can be a client service or application that uses OAuth to access a resource server on behalf of a user, and an authorization server can be a server that authenticates the user and issues an access token to the client.

Meanwhile, as a method for performing user authentication, there may be an Elliptic Curve Qu-Vanstone (ECQV) implicit certificate. A general certificate contains identification information and is created by binding the ID of a specific entity to a public key. A certificate is generated by a Certificate Authority (CA) consisting of a signature generated based on an identity element, a public key, and data. After that, the validity of the certificate can be verified by verifying the signature using the public key of the CA. This type of certificate is called an explicit certificate because it explicitly verifies the signature of the certificate. On the other hand, an implicit certificate is a variant of a public key certificate that is not explicitly validated based on the CA's public key. The CA's public key is used to reconstruct the entity's public key from the implicit certificate. A certificate is said to be an implicit certificate if the entity's public key encoded with the implicit certificate can be reconstructed from the CA's public key. ECQV is an implicit certificate that uses an elliptic curve and has a smaller key size and faster verification speed than public key certificates. Therefore, it may be suitable for resource-limited environments such as IoT environments.

Although many IoT services are emerging recently, user authentication and protection of privacy are essential. The IoT-OAS structure provides various access control policies according to users and services based on the token supplied by the authorization server by applying OAuth in the IoT environment. However, there is a security vulnerability in OAuth itself. Attack methods that weaken security on the OAuth service may include a retransmission attack and a Cross Site Request Forgery (CSRF) attack.

FIG. 1 is an example of a retransmission attack that may occur in an OAuth scenario, and FIG. 2 is an example of a CSRF attack that may occur in an OAuth scenario.

1, in the retransmission attack, an access control token is issued by retransmitting the request message and authentication code to the authorization server through the request message and authentication code stolen by an external attacker in the step of transmitting the service request message and authentication code to the user and client. This is an attack you can take. To prevent this, the validity of the authentication code issued when the user and the authorization server perform authentication must be checked using a message verification technique such as HMAC (Hash-based Message Authentication).

As shown in Fig. 2, the CSRF attack is an attack that induces an external attacker to execute an attacker's forged request while a user who is already logged in uses a service. The attacker forges the request message of a specific client and sends a hyperlink using phishing, etc., so that the user executes it. The user who clicks on it sends a forged request message to the client, and by executing it, it provides the resource of the logged-in user to the attacker.

As such, in order to improve the problem of weakening security on the OAuth service, an OAuth-based secure access control system and method according to the present invention will be described with reference to FIGS. 3 to 4 .

3 is an example of a client authentication step scenario in an OAuth-based secure access control system according to an embodiment of the present invention, and FIG. 4 is a user in an OAuth-based secure access control system according to an embodiment of the present invention. This is an example of an authentication and token generation phase scenario.

First, the concept of the present invention will be briefly described.

The present invention relates to an OAuth-based access control system designed to be secure against retransmission attacks and CSRF attacks in an IoT environment, and can be divided into a client authentication stage, user authentication and token issuance stages. Prior to a description of an embodiment of the present invention, symbols used in the following description will be defined as follows.

* ; Participating entities (U: User, C: Client, AS: Authorization Server, RS: Resource Server)

* _ID ; Identifier of the participating entity

h(·) ; one-way hash function

r _C ; Random value for the current session created by the client

r _U ; Arbitrary value for user generated ECQV implicit certificate

u _U ; User's ECQV Implicit Certificate

PR _* , PU _* ; An entity's private and public key pair

G ; Creation point on an elliptic curve of order q

Session _ID ; Identifier of the current session generated by the authorization server

TS; timestamp

LT; LifeTime that the resource server can provide through tokens

3 to 4 , the OAuth-based secure access control system according to the present embodiment includes a client 100 that provides an IoT service, and a user terminal 200 that accesses the client 100 to receive the IoT service. , a resource server 300 in which information of the user terminal 200 is stored; and an authorization server 400 that registers the client 100 and issues a token. In this case, the user terminal 200 may authenticate the client 100 by redirecting to the authorization server 400 through the client 100 in order to receive the IoT service from the client 100 . Meanwhile, the user terminal 200 may receive an ECQV certificate from the client 100 and transmit the certificate to the authorization server 400 to request user authentication. Also, the authorization server 400 may verify the ECQV certificate and issue an access token to the client 100 to access the resource of the user terminal 200 .

As shown in FIG. 3 , in the client 100 authentication step, the client 100 redirects to the authorization server 400 through the user to authenticate the client 100 . A more detailed process related to client 100 authentication is as follows.

Step 1. When the user sends a Hello message to the client 100 as follows, a request for the corresponding service is transmitted. In this case, the user's request may be executed through the user's mobile device or a device such as a PC.

Hello: Request(nonce)

이다.Step 2. The client 100 transmits the following information encrypted through the user's public key. The following information includes its identifier C _ID , the redirect URI of the authorization server 400, and an arbitrary value generated by the client 100

am.

Response:

Step 3. The user accesses the authorization server 400 through the redirect URI, and sends _{C ID} and r _U.

Step 4. The authorization server 400 checks the client 100 to which the user wants to access and performs the first user authentication process. Then, the final user authentication is verified through the ECQV implicit certificate.

Step 5. The authorization server 400 transmits the authentication code and URI _C , which is the redirect URI of the client 100, to the user.

As shown in FIG. 4 , in the user authentication and token issuance step, the user receives an ECQV certificate from the client 100 , verifies the ECQV certificate through the authorization server 400 , performs end user authentication, and then the authorization server (400) is a step for issuing an access token to the client (100).

를 계산한다. 이후 사용자는 URI_C를 통해 클라이언트(100)에 접근하고, R_U를 전송하여 ECQV 묵시적 인증서 발급을 요청한다.Step 1. The user selects a random integer r _U and selects an elliptic curve

to calculate Since the user can access the client 100 via the URI _C, and transmits the R _U requests the ECQV implicit certificate issuance.

Step 2. The client 100 selects an arbitrary integer k, and uses R _U , the private key PR _C of the client 100, and a random number r generated in the client 100 authentication step of Equation 1 below. create information P _U is the ECQV implicit certificate, and y _U is the ECQV implicit signature.

[Equation 1]

_{Step 3. The user generates a private key q U} and a public key Q _U for the current session as shown in Equation 2 below using the received ECQV implicit certificate and signature. Thereafter, implicit certificates y _U and Q _U are transmitted to the authentication server.

[Equation 2]

Step 4. The authorization server 400 calculates the public key PU _U of the user based on the user values for _{y U} and Q _{U and the identifier U ID} as shown in Equation 3 below. When PU _U is normally created, an arbitrary number r for the user and the current session is implicitly authenticated, and user authentication is finally completed.

[Equation 3]

Step 5. The authorization server 400 issues an access token to the client 100 after the user is authenticated. The client 100 accesses the resource server 300 using the issued token to obtain a user's resource, and provides an IoT service to the user.

Methods according to an embodiment of the present invention may be implemented as an application or implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the computer-readable recording medium are specially designed and configured for the present invention, and may be known and used by those skilled in the art of computer software. Examples of the computer-readable recording medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD-ROM, a DVD, and a magneto-optical medium such as a floppy disk. media) and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment herein may be implemented in various embodiments individually, or may be implemented in appropriate combination.

Although operations have been described in a particular order in the drawings, it should not be understood that such operations are performed in the specific order as illustrated, or that all described operations are performed in a continuous sequence, or to obtain a desired result. Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The app components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible without departing from the technical spirit of the present invention. It is not limited by the drawings.

100 : client
200: user terminal
300 : resource server
400: Authorization server

Claims (10)

delete delete delete delete clients providing IoT services; a user terminal accessing the client to receive an IoT service; a resource server in which information of the user terminal is stored; and an authorization server that registers the client and issues a token; an access control method in an OAuth-based secure access control system for an IoT environment comprising:
a client authentication step of redirecting, by the user terminal, to an authorization server through the client to authenticate the client in order to receive the IoT service from the client;
a user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication; and
Including, by the authorization server, a token issuing step of issuing an access token to the client;
The client authentication step is
transmitting, by the user terminal, a service request message to the client;
transmitting, by the client, information after encryption using the public key of the user terminal;
accessing, by the user terminal, an authorization server through a redirect URI;
performing, by the authorization server, user authentication by identifying a client to which the user terminal intends to access; and
Including, by the authorization server, the authentication code and the redirect URI of the client to the user terminal;
A user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication,
Characterized in performing user authentication by verifying through ECQV implicit certificate,
A user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication,
The user terminal selects a random integer, and calculates a random value for the ECQV implicit certificate generated by the user terminal on the elliptic curve,
The user terminal accesses the client through the redirect URI of the client, and sends an arbitrary value for the ECQV implicit certificate generated by the user terminal to request the issuance of the ECQV implicit certificate,
A user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication,
The client selects a random integer, and the ECQV implicit certificate information and ECQV implicit signature information are generated using the random value for the ECQV implicit certificate generated by the user terminal, the client's private key, and a random number generated in the client authentication step. Access control method, characterized in that the creation. 6. The method of claim 5,
The user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication,
An access control method, characterized in that the user terminal generates a private key and a public key for the current session using the received ECQV implicit certificate and signature, and transmits the implicit certificate to the authentication server. 7. The method of claim 6,
The user authentication step in which the user terminal receives a certificate from the client, verifies the certificate through an authorization server, and performs user authentication,
An access control method, characterized in that the authorization server calculates the user's public key based on the user value and identifier information for the ECQV implicit signature and the public key for the current session. delete delete delete

Images