KR102346480B1 - A macro-based application account management system - Google Patents

Abstract

The present invention relates to a macro-based application account management system capable of managing an account of an application by proxy through an account management system installed between a user terminal and an application server, while writing each account management job of the application as a macro, and executing a macro selected by a user. The macro-based application account management system includes: a user authentication part performing user authentication on a user account of each user terminal; a macro management part storing and managing a macro script, which performs an account management job of each application of the application server, in advance; a management request reception part receiving a request of the account management job of the application from the user terminal; and an account management processing part selecting and executing the macro script corresponding to the received request of the account management job, in accordance with the corresponding request. In accordance with the system, the macro-based application account management system can manage an account by writing an account management job as a macro between a user terminal and a server and executing the macro, thereby integrally managing the account regardless of the type of a server system, while maintaining a function of the server.

Description

A macro-based application account management system { A macro-based application account management system }

The present invention includes an account management system between the user terminal and the application server to manage the account on behalf of the application, write each account management task of the application as a macro, and execute the selected macro according to the user's selection, a macro-based application It is about an account management system.

In general, an application server provides an account management interface to a user to create an account, and the user accesses the application server through the created account and uses the corresponding application. Therefore, if anyone knows the application account, they can access the application server, access the security data in the server, or execute a task that has a significant impact on the system. Therefore, in the case of an application server requiring security, operations such as creation, modification, or deletion of an account (or application account) must be strictly controlled.

According to the prior art, a function for account management is developed and configured differently depending on the type of the target system. Therefore, all various target systems cannot be managed integrally by one integrated management system.

Specifically, when the target system is a server, network device, or database, the conventional account management system accesses the target system from the outside and controls it through a command script, or installs a management program in the target system to execute a command script when an event occurs to control the account [Patent Document 1]. That is, it is controlled so that a command can be selected and executed only within the command set registered in advance for each user account.

In addition, in the case of an application, account-related data is directly inserted, modified, or deleted in the database of an individual application. Alternatively, it is implemented to call the account creation, modification, and deletion functions through the API agreed upon between the developers. Alternatively, a standardized protocol such as Open Authorization (OAuth 2.0) may be used to allow other applications to share accounts with each other to control.

Alternatively, regardless of the system type, TACACS (Terminal Access Controller Access Control System), RADIUS (remote authentication dial-in user services), Kerberos, LDAP (lightweight directory access protocol) authentication, etc. There is a way to manage it. For example, there is an Active Directory method of Microsoft Corporation using the LDAP protocol.

In particular, when the target system is an application, there are many program systems to which a standardized API negotiated between companies to manage accounts does not exist, or to which Oauth, a standard protocol, is not applied. For such a program system, it is necessary to analyze the databases or related files related to each and every application in question. However, if the database or related files are encrypted, there is no method for account management.

Therefore, technology that can manage accounts in an integrated way for all servers, network devices, databases, as well as applications is required.

Korean Patent Registration No. 10-2118380 (2020.06.04. Announcement)

An object of the present invention is to solve the above-described problems, by providing an account management system between the user terminal and the application server to manage the account of the application on behalf of the application, and write each account management task of the application as a macro, and the user It is to provide a macro-based application account management system that executes the selected macro according to the selection of the user.

In order to achieve the above object, the present invention relates to a macro-based application account management system installed between one user terminal and at least one application server, and a user authentication unit for performing user authentication for a user account of each user terminal. ; a macro management unit for storing and managing in advance a macro script for performing an account management operation in each application of the application server; a management request reception unit for receiving a request for an account management operation of the application from the user terminal; and an account management processing unit that selects and executes a macro script corresponding to the request in response to the received account management job request.

In addition, in the present invention, in the macro-based application account management system, the system, each user's accessible applications, and access rights for storing and managing information (hereinafter referred to as management authority information) about the application accounts manageable of the application Further comprising a management unit, wherein the management request receiving unit is characterized in that, according to the management authority information, it is characterized in that it restricts to accept only a request for an account management operation related to an application allowed to the corresponding user account or a usable application account.

Further, in the present invention, in a macro-based application account management system, the account management operation includes an account creation operation for newly creating an application account, an account modification operation for changing the password of an existing application account, and an existing application account is divided into the type of account deletion operation to delete, the macro management unit writes and stores a macro script for each application, for each type of account management operation, and the account management processing unit determines the application and operation type of the operation to be performed It is characterized in that the corresponding macro script is selected and the corresponding macro script is executed.

In addition, in the present invention, in a macro-based application account management system, the macro management unit sets a part for inputting an account or password value in the macro script as a variable, and the account management processing unit converts the variable part of the macro script into an application It is characterized in that it is executed by replacing the value of the account or password.

In addition, in the present invention, in a macro-based application account management system, the macro script logs into the application server as a supervisor account, then creates, corrects, or deletes an account, and then logs in the supervisor account. It is characterized in that it includes an out command.

In addition, in the present invention, in a macro-based application account management system, the macro script is a series of interface commands or application client screen input by a user in the corresponding application server in order to access the corresponding application server and perform an account management operation. It is characterized in that it is written by combining commands for setting the object on the screen in order.

As described above, according to the macro-based application account management system according to the present invention, an account management task is created as a macro between the user terminal and the server and the account is managed by executing it, while maintaining the function of the server side as it is, The effect of integrated account management is obtained regardless of the type of server system.

1 is a block diagram of an entire system for implementing the present invention.
2 is a block diagram of a configuration of a macro-based application account management system according to an embodiment of the present invention.
3 is a pseudo code illustrating a macro script according to an embodiment of the present invention.
4 is an exemplary screen for requesting an account management operation according to an embodiment of the present invention.
5 is an exemplary diagram of screens of an application client according to an embodiment of the present invention;

Hereinafter, specific contents for carrying out the present invention will be described with reference to the drawings.

In addition, in demonstrating this invention, the same part is attached|subjected by the same code|symbol, and the repetition description is abbreviate|omitted.

First, the configuration of the entire system for carrying out the present invention will be described with reference to FIG. 1 .

As shown in FIG. 1 , the entire system for implementing the present invention includes a user terminal 10 , at least one application server 40 , and an account management system 30 for managing accounts of the application server 40 . is composed In addition, the user terminal 10 and the account management system 30 are connected through a network (not shown). In addition, it may be configured to further include a database 80 for storing necessary data.

First, the user terminal 10 is a computing terminal used by a user, such as a PC, a notebook computer, a tablet PC, a smart phone, a phablet, and the like. In addition, the user terminal 10 has a network function that can be connected to the application server 40 or the account management system 30 through a network (not shown). In addition, the user terminal 10 may have a program system installed and executed.

In addition, an account management client (not shown) is installed in the user terminal 10, accesses the account management system 30 through the account management client, and performs an account management operation. The account management operation refers to an operation such as creating, modifying, or deleting an account (or application account) of the application server 40 .

In addition, an application client (not shown) is installed in the user terminal 10 , accesses the application server 40 through the application client, and uses a service provided to the application server 40 . The application client (not shown) is a program system for a user to remotely access the application server 40 and use an application service of the server. As an example, the communication client is a web browser, a dedicated client program system of an application server, or the like. Preferably, the application client is a program in the form of a GUI (graphical user interface) interface.

Next, at least one application server 40 is installed. That is, a plurality of application servers 40 may be installed.

Each application server 40 receives an access request from the user terminal 10 through a network (not shown), and provides an application service by allowing access according to the request.

The application or application service is a business management system of a company or institution, an enterprise resource planning system (ERP), a mail service system, and the like. That is, the application service is a service provided online, and the corresponding service is provided through a GUI interface.

In particular, the application service refers to a service that is given a specific right by an administrator or the like and can only be used by a user who has been granted the right. In this case, the authority includes receiving an application account.

That is, the application server 40 grants an application account and provides a corresponding application service only through the granted application account.

In this case, the application account is divided into a supervisor account that can manage the account and a general account that can use the application service but cannot manage the account.

Preferably, when the application server 40 is connected to the supervisor account, it provides an interface such as a screen or page for managing the account, and provides an account management service through the corresponding account management interface. Account management includes creation, modification, and deletion of application accounts.

In addition, the application server 40 does not provide an account management service when a general account is accessed. More preferably, an interface for account management is not provided.

On the other hand, the application server 40 performs authentication (or application account authentication) using the application account and password for server access, permits server access only when the application account authentication passes, and provides server services do.

Next, the account management system 30 is a system installed on a network (not shown) between the user terminal 10 and the application server 40, and in response to an account management request from the user terminal 10, the application server 40 ) and perform account management.

In addition, the account management system 30 stores and manages the available application information (or application list) for each user in advance. The corresponding application information is registered in advance by an administrator or the like. The administrator sets the applications that can be accessed according to each user's authority.

In addition, the account management system 30 processes an account management task for a specific application according to a user's request. Account management tasks include creation, modification, and deletion of applications.

In addition, the account management system 30 stores the work results of the account management work by each user. That is, each user's account information (account and password, etc.) of the corresponding application is stored.

In addition, the account management system 30 stores account information (account and password, etc.) for the supervisor account of the application server 40 in advance, and when performing an account management operation, accesses the stored supervisor account to account perform administrative tasks;

In addition, the account management system 30 manages a user account for each user, and performs authentication (or user authentication) for the user account. That is, the account management system 30 performs an account management operation only for users who have passed user authentication.

In addition, the account management system 30 for each application, the account management task of the corresponding application server 40 is prepared in advance as a macro script and stored, and by executing the stored macro, the account management task of the user request is processed. .

The macro or macro script refers to a sequential combination of a series of interface commands input by a user in order to access the application server 40 and perform an account management task. When a macro is executed, a combination (or command combination) of a series of interface commands of the corresponding macro or macro script is sequentially executed again and repeated. Accordingly, when a macro or a macro script is executed, the corresponding series of commands (or combinations of commands) are input in the same form as when the user inputs a series of commands for account management. Through this, account management work is performed automatically.

Next, the database 80 includes a user information DB 81 for storing user authentication information, a permission information DB 82 for storing allowable application information for each user, and the like, and a macro for performing account management for each application. It is composed of a macro DB 83 for storing scripts, and an account information DB 84 for storing account information and authentication information for the application server. However, the configuration of the database 80 is only a preferred embodiment, and in developing a specific device, it may be configured in a different structure according to the database construction theory in consideration of the ease and efficiency of access and search.

Next, a detailed configuration of the macro-based application account management system 30 according to an embodiment of the present invention will be described with reference to FIG. 2 .

As shown in Fig. 2, the account management system 30 according to an embodiment of the present invention includes a user authentication unit 31 for performing user authentication, and an access right management unit for storing and managing usable application information of each user ( 32), a macro management unit 33 for storing a macro for performing an account management operation for each application server, a management request receiving unit 34 for receiving a management request for an application account from a user, and account management for the application It is composed of an account management processing unit 35 for processing.

First, the user authentication unit 31 manages a user account for each user, and performs authentication (or user authentication) on the user account.

Preferably, various authentication methods such as an ID/password method and biometric authentication may be applied for authentication or user authentication for a user account. In addition, a user account is identified by a user ID.

The user account is different from the application account described above. That is, the application account is an account registered and managed in the application server 40 , and the user account is an account registered and managed in the account management system 30 . In addition, the user account is an account uniquely granted to each user, and the application account may be shared by a plurality of users.

For example, suppose that user A's user account is userA, and user B's user account is userB. At this time, the user A may be authenticated as the user account userA in the account management system 30 and access (or log in) to the application server with the hiware account, which is the application account. In addition, user B may be authenticated as a user account userB in the account management system 30 as an upper level administrator of user A, and may access the application server 40 with a hiware account that is an application account. As a result, both users A and B can access the same application account (hiware account). That is, although users A and B have different user accounts, they can access the same application account.

Next, the access authority management unit 32 stores and manages management authority information such as each user's accessible applications and manageable application accounts.

That is, the management authority information is an application (or application server) that each user or each user account can access, or an application account manageable by the corresponding application.

Management authority information is registered and stored in advance by an administrator or the like.

Next, the macro management unit 33 stores and manages macro scripts for performing account management for each application in advance.

A macro or macro script refers to a combination of a series of interface commands input by a user in order to access an application server and perform an account management task. When a macro script is executed, a combination (or command combination) of a series of interface commands of the macro script is sequentially executed again and repeated. Accordingly, when the macro is executed, the corresponding series of commands (or combinations of commands) are input in the same form as when the user inputs a series of commands for account management. Through this, account management work is performed automatically.

The interface command refers to commands input by the user interface. That is, the interface commands refer to commands that a user inputs to access an application server to perform an account management job and perform a job on a corresponding screen. Preferably, the interface command consists of commands by way of a GUI interface.

Preferably, the interface command is a command on an application client (not shown). The application server 40 provides services to a server and a client system. That is, the client program is executed on the client side, and an interface is provided on the client side through the client screen. Therefore, the screen where the user enters the command is the client interface screen.

For example, the macro script of the account creation operation may be configured by sequentially combining the following commands. In this case, it is assumed that the application client has already been executed.

(1) Command to go to the login screen

(2) Command to click the input box of the application account

(3) A command to enter the supervisor account in the corresponding input box

(4) Command to click the input box to enter the password

(5) A command to input the password of the supervisor account in the corresponding input box

(6) Command to enter the OK button

(7) Commands to move to the account management screen or account management page

(8) Command to click the Create Account button

(9) Command to click the box to enter a new application account

(10) A command to enter a new application account in the corresponding input box

(11) command to click the create button

(12) Command to click logout button in supervisor account

As another embodiment, a macro script may be written by recognizing an object on the screen of each application client and executing a command on the corresponding object.

3 illustrates a pseudo code of a macro script for generating an application account. That is, as shown in FIG. 3 , it is possible to identify an object or object name on the screen of the application client, and write a macro script as a command for requesting a specific action on the corresponding object (hereinafter referred to as an object action command).

The object behavior command is a command or function (API function) provided by the operating system or a command processed by the platform program using the API function of the operating system.

In the example of FIG. 3 , the object action commands set_text, click_button, and the like are functions provided by the AutoHotkey program. set_text is a function (object action command) that sets the text value (input value in the box) of an object on the screen (object corresponding to the object name), and click_button is a function that clicks an object on the screen (or object action command).

On the other hand, the macro management unit 33 defines the account or password as an argument or variable in the command for inputting the account or password of the macro script, and sets the account or password as a command capable of inputting a different account name or password according to the argument value. do. That is, in the command to input the account value or password value, set it as an argument or variable instead of a specific value of the account value or password value.

In the example of FIG. 3 , the arguments or variables strAccountID and strPwd indicate an application account and password of a newly created application. The interface command (or statement) of "set_text ( <account box object name>, strAccountID )" uses strAccountID as a variable or argument, so the account ID changes depending on the value entered by the user.

In addition, each macro script is written (created) including the process of initially logging in to the supervisor account and logging out within the script. That is, each macro script logs in with the supervisor account when performing the account management task, performs the task in the supervisor account, and logs out after performing the task.

At this time, preferably, in the macro script, the command for inputting the supervisor account or password is set as an argument or variable. That is, it is set by replacing a specific account value or password value with an argument or variable.

Also, the macro management unit 33 creates and stores macros for each application and for each account management task. That is, a macro or macro script is created and saved for each type of work, such as account creation, account modification, and account deletion. In addition, each application creates, edits, and deletes macro scripts for each application separately and stores them.

Next, the management request receiving unit 34 receives a request for an account management operation for the application or the application server from the user or the user terminal (10). 4 illustrates a process in which account management is requested by a user.

Here, the managed account task is a task for the application account. Hereinafter, it will be described as an account for convenience of description, but the corresponding account represents an application account, not a user account.

Preferably, when there are multiple types of applications, the management request reception unit 34 selects and receives an application for performing an account management operation. In particular, the management request reception unit 34 may receive input by selecting only the applications permitted for the corresponding user or user account according to the management authority information. More preferably, after logging in from the login page of Fig. 4a, as shown in Fig. 4b, the management request reception unit 34 displays a list of applications accessible (or usable) from the corresponding user or user account, and selects one of the displayed applications. Select the application of and receive input.

In addition, the management request receiving unit 34 receives an argument value (or variable value) of the type of account management task to be performed for the corresponding application, and an argument (or variable) required for the corresponding task. Account management work is divided into account creation work, account modification work, account deletion work, and the like.

The account creation operation refers to the operation of creating a new account, and the arguments required for the account creation operation are the account name or account ID to be created and the account password to be newly set.

In addition, the account deletion operation refers to the operation of deleting the corresponding account. Account deletion does not require a separate argument.

In addition, the account modification operation refers to the operation of changing the password for the corresponding application account. The argument required for account modification is the password to be changed (new password). Or, preferably, the account modification operation is the operation of initializing a password and setting a new password in the prior art.

In addition, the management request reception unit 34 receives a management operation request only for the user or the application account assigned to the user account according to the previously defined (stored) management authority information.

Preferably, as shown in Fig. 4b, the management request reception unit 34 refers to the management authority information stored in advance, displays the application accounts usable in the corresponding application as a list, and restricts the selection of the application account from the list. In particular, by displaying usable application accounts and additional commands (such as an add button), it is possible to selectively input an existing application account or an additional command when a new one is created.

Also, as shown in FIG. 4C , the management request reception unit 34 may receive an account ID or password required for an account management operation of an application account.

Next, the account management processing unit 35 selects a macro script corresponding to the request according to the received account management job request, and executes the corresponding macro script.

In particular, the account management processing unit 35 executes the application client to execute the corresponding macro script on the interface screen of the application client. That is, each macro script executes commands for the interface on the interface screen of the application client being executed.

The application client is a client program as executed in the user terminal 10 , and operates as a server-client system in conjunction with the application server 40 . On the other hand, preferably, the account management processing unit 35 emulates an operating system in which the application client can be executed to execute the application client, or executes an application client executable in the operating system of the account management system 30 .

In addition, the account management processing unit 35 replaces the application account or password input at the time of the job request with an argument value (or variable value) for an argument (or variable) of the corresponding macro script, and executes the corresponding macro script. .

Previously, macro scripts were created and saved for each task type of each application. Accordingly, it is possible to search for the corresponding application according to the work request and the macro script corresponding to the type of work of the corresponding application. Executes the searched macro script.

At this time, the arguments or variables existing in the macro script are replaced with the account or password input when requested, and the corresponding macro script is executed. That is, the input account or password becomes the argument or variable value.

In addition, if the process of logging in with a supervisor account is included in each macro script, the variables of the supervisor account or password are replaced with the values of the supervisor account or password stored in advance and executed.

To this end, the account management processing unit 35 stores the account and password values for the supervisor account in advance.

In addition, the account management processing unit 35 stores each application account and password of the corresponding account, and when the account and password are changed by account management work, the account and password stored as a result of the change are updated.

In addition, if there are variables of the existing account and password in the macro script, the corresponding variables are replaced with the saved account and password, and the corresponding macro script is executed.

In summary, in the macro script, the part set as a variable is the part to input the account or password. The account management processing unit 35 replaces the variable part with an actual account value or password value and executes it. In this case, the replaced account value or password value is an account or password value input when requested, a supervisor account or password value stored in advance, or an existing stored account or password value.

A process in which account management is processed is shown in FIGS. 3 and 5 . 5 shows an interface screen of an application client for account management, and FIG. 3 shows a macro script (a macro script for establishing a new account) of interface commands (or object action commands) on each screen. In particular, the macro script of FIG. 3 is a macro for creating a new account.

First, as shown in Fig. 3, the macro script executes the application client program. You can avoid inserting statements that run the application client in the macro script. In this case, the account management processing unit 35 executes the application client and then executes the macro script.

When the application client is executed, a login screen as shown in FIG. 5A appears. At this time, the macro script logs in with the supervisor account. That is, “set_text (<account box object name>, “admin” ) ...” etc. are interface commands executed on the login screen of FIG. 5A .

When the login button is clicked on the screen of FIG. 5A, the home screen of the corresponding account as shown in FIG. 5B is accessed. Also, when the <Account Management button> of FIG. 5B is clicked, it moves to the account management screen of FIG. 5C. In addition, when the Add (+) button is clicked on the account management screen of FIG. 5C , it moves to the new account creation screen of FIG. 5D . In the account creation screen of FIG. 5D , interface commands (commands) for inputting an account name, a password, etc. are executed to create an account.

According to the above configuration, the present invention does not need to analyze data of a database or file having an account for each application or to create an API to interlock application accounts in order to control the application accounts. In addition, according to the present invention, any application can control the application account simply by creating a macro script by imitating the action of the user controlling the application account.

As mentioned above, the invention made by the present inventors has been described in detail according to the above embodiments, but the present invention is not limited to the above embodiments, and various modifications can be made without departing from the gist of the present invention.

10: user terminal 20: administrator terminal
30: account management system 31: user authentication unit
32: access authority management unit 33: macro management unit
34: management request reception unit 35: account management processing unit
40: application server 80: database

Claims (6)

In the macro-based application account management system installed between one user terminal and at least one application server,
a user authentication unit for performing user authentication for a user account of each user terminal;
an access authority management unit for storing and managing information (hereinafter referred to as management authority information) on an accessible application of each user account, and an application account manageable of the corresponding application;
a macro management unit for storing and managing in advance a macro script for performing an account management operation in each application of the application server;
a management request reception unit for receiving a request for an account management operation of the application from the user terminal; and,
Includes an account management processing unit that selects and executes a macro script corresponding to the request according to the request of the received account management operation,
The management request reception unit limits to receive only the request for account management operation related to the application allowed to the corresponding user account or the available application account according to the management authority information,
The macro script is written by sequentially combining a series of interface commands input by the user in the application server or commands for setting objects on the application client screen in order to access the application server and perform account management, ,
The account management processing unit performs an account management operation only for users who have passed user authentication for a user account by the user authentication unit,
The user account is an account registered and managed in an account management system, and the application account is an account registered and managed by the application server.
delete The method of claim 1,
The account management task is divided into an account creation task for creating a new application account, an account modification task for changing the password of an existing application account, and an account deletion task for deleting an existing application account,
The macro management unit writes and stores a macro script for each application, for each type of account management task,
The account management processor selects a macro script corresponding to the type of application and the type of work to be performed, and executes the macro script.
According to claim 1,
The macro management unit sets a variable for inputting an account or password value in the macro script,
The account management processing unit is a macro-based application account management system, characterized in that the execution by replacing the variable part of the macro script with the value of the application account or password.
5. The method of claim 4,
The macro script is a macro-based application account, characterized in that it includes a command to log in to the application server as a supervisor account, create, modify, or delete an account, and then log out from the supervisor account. management system.
delete

Images