KR102356725B1 - Authentication and Policy Management Methods Using Layer Blockchain - Google Patents

Abstract

The present invention relates to an authentication and policy management method using a hierarchical blockchain. An authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention includes: a client in which an application is installed; In the authentication and policy management method using a hierarchical block chain including a management server that verifies and inquires information on transaction events generated by an authentication server, the step of requesting authentication for a transaction or event performed by a client to the authentication server And, the authentication server creates an authentication log for transactions and events performed by the client, registers the authentication log in the hierarchical blockchain, and records authentication logs for transactions and events in which the authentication and policy of the client are changed or modified It includes the steps of regenerating, re-registering it in the hierarchical blockchain, and verifying and inquiring logs of transactions and events registered in the hierarchical blockchain.

Description

Authentication and Policy Management Methods Using Layer Blockchain

The present invention relates to an authentication and policy management method using a hierarchical blockchain. More specifically, it relates to an authentication and policy management method using a hierarchical block chain for collecting user authentication, security policies, and usage logs using a distributed information sharing structure.

In most server-client structured software products and cloud-based SaaS environments that are gradually dominant in the market, server user authentication and security policies, as well as log collection that can verify such user software behavior, are concentrated on the server. As the number of users and companies increases, the server's dependence on authentication, policies, and logs increases.

Although we provide distributed technology methods based on blockchain in various ways for authentication, etc., we collect logs of security actions in conjunction with authentication and security policies, and use blockchain as a reliable integrity verification method for each log. It is difficult to effectively apply it in terms of the number and capacity of generated logs.

In particular, the Bitcoin blockchain technology has disadvantages such as the use of many PC resources and restrictions on transaction types due to the Proof of Work used in the consensus process. When blockchain is introduced into the service created by , there is a burden of sharing a large amount of block (ledger) information, and a more efficient resource use method is needed for the consensus method.

This basic block chain structure reduces the shortcomings of PC resource usage and transaction type restrictions, and expands it to a smart contract, a programmable transaction format under specific conditions, and Proof of Stake (Proof of Stake) that allows network consensus with fewer resources. Although various altcoins and altchains such as the stake method have been developed and proposed, in the same way, in the above work and work environment, where relatively high transactions/events per unit time are inevitable, the integrity of sub-detailed information is abandoned and DB and big data It is used in a structure that manages the form, and it is described with reference to the patent document as follows.

(Patent Document 1) relates to an authentication information management server that supports authentication information and destruction methods. It provides a method for safely handling up to the destruction of

However, in the aforementioned (Patent Document 1), comparison with a certain value such as a hash value of authentication information extracted in the process of authentication is preceded, and through this, the destruction transaction is also safely performed, while the authentication method and authentication target are disconnected from the server. It does not provide a way to process a large number of transactions and events occurring per unit time.

(Patent Document 2) relates to a simplified account registration and user authentication service method and authentication server. is provided on the basis of PKI (Public Key Infrastructure).

However, the aforementioned (Patent Document 2) does not provide an effective block chain structure with capacity and resources for an event transaction instead of an authentication method when disconnected from the server and a security policy and authentication that occur after the authentication of the subject to be authenticated.

(Patent Document 3) relates to a programmable blockchain and an integrated ID-based authentication method. According to this, through a blockchain-based authentication server that can store programming contents such as smart contracts such as Ethereum, encrypted storage of user information, and other It provides advantages such as sharing of authentication servers and logging in with multiple authentication servers.

However, the aforementioned (Patent Document 3) does not provide an effective block chain structure for capacity processing for an authentication method, security policy, and security target event transaction when the server is disconnected.

Therefore, authentication and policy sharing and log collection technology reflecting the hierarchical block chain structure to effectively collect and audit security action logs in an environment that requires high transaction/event occurrence per unit time while using the advantages of blockchain integrity and security this is being requested

Republic of Korea Patent Publication No. 10-1799343 Republic of Korea Patent Publication No. 10-1816650 Republic of Korea Patent Publication No. 10-2018-0129027

An object of the present invention is to solve operational problems when a server is disconnected in user authentication, security policy, and log collection, etc. using a distributed information sharing structure, but to provide a large amount of block ledger for logs that occur in large capacity due to the characteristics of authentication and policy. In order to solve the problem of sharing, it is to provide an authentication and policy management method using a hierarchical block chain to solve the overload of data.

In order to solve the above problem,

An authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention comprises: a client installed with an application program; , In the authentication and policy management method using a hierarchical block chain comprising a management server that verifies and inquires information about the transaction event generated by the authentication server,

(a) requesting the authentication server to authenticate the transaction or event performed by the client;

(b) generating, by the authentication server, an authentication log for transactions and events performed by the client, and registering the authentication log in a hierarchical block chain;

(c) regenerating authentication logs for transactions and events in which the authentication and policy of the client are changed or modified, and re-registering them in the hierarchical blockchain; and

(d) verifying and inquiring logs of transactions and events registered in the hierarchical block chain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, the hierarchical block chain includes a main block chain and a lower block chain,

The sub-block chain includes a sub-block transaction that generates a detailed transaction record based on the type of event or transaction log when an entity generates a specific event or transaction log; and

a sub-block header capable of confirming an accumulated result value of a transaction or event log that occurred between objects based on detailed information on one or more of the sub-block transactions and summary information on the total sum of accumulated events or transaction logs; includes,

The main block chain includes: a main block transaction in which a log registered in a lower block header is provided and registered in the lower block chain; and

a main block header capable of receiving detailed information included in the main block transaction and checking accumulated result values of transaction logs or event logs recorded in one or more lower block headers formed in the lower block chain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, the client creates one or more transactions or event logs or information of policy acceptance results in the detailed information of the lower block transaction,

The sub-block transaction generates a unique transaction ID within the designated unit time timeslot based on the block generation rule, and creates a new block when it exceeds the timeslot range and includes the log summary information of transactions and events, the main block can be sent to the chain.

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, the step (a) includes inputting the authentication identification number of the client, and a public key and a private key for the authentication identification number transmitting the authentication identification number to the authentication server after generating each ; including,

The secret key may include at least one of a password, a PIN, and signature data.

In addition, in the authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention, in step (b), the authentication server verifies the validity of the authentication identification number provided from the client, and verifies the generating a log on the validity of the authentication identification number and transmitting the log to the main block chain; and

The log result of the generated validity is transmitted to the client, and when the client is valid, information including signature information and authentication information transmitted to the main block chain is generated in the lower block chain, and the information is transmitted to the client. transmitting;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, the lower block chain generates a lower block transaction including log, policy acceptance, and log collection of the client's transaction or event. can do.

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, when any one of the client's policy or security is changed, the transaction or event including the changed identification authentication information is changed. regenerating a log in the authentication server and re-registering the generated information in the main block chain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, in step (c), the authentication policy registered in the main block chain in the management server or the client is changed by the authentication server. or determining whether a correction has been made;

generating a log of a transaction or event including the changed or modified authentication policy contents, and registering the generated log in the main block chain;

the client inquiring information registered in the main block chain, verifying the validity of the registered information, and verifying the public key signature of the subject included in the client; and

executing, by the client, whether a client function is activated, generating a log, accessing a resource of the client, and executing a service including execution information in the client, and applying it to the sub-blockchain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, when the client executes the changed policy, a new log including one or more security logs, policy execution results and resource access is generated, , recording the new log in the detailed transaction details of the lower block chain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, in step (d), the log to be inquired from the management server is inquired into the main block chain, and the log verifying the included ID to determine the total number of events or transactions summarized in the log;

requesting detailed information from the sub-blockchain by the subject connected to the ID; and

Inquiring, by a node connected to the lower block chain, detailed transaction information in the lower block chain;

may include

In addition, in the authentication and policy management method using the hierarchical block chain according to an embodiment of the present invention, when the node requests a part of the transaction summary information included in the main block chain, it is stored in the time slot of the main block chain. inquiring detailed information of a transaction or event included in the sub-blockchain by reverse-extracting the included transaction ID;

may include

In addition, in the authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention, when information stored in an external distributed file structure or DB is additionally queried from the inquired transaction information, the node Inquiring the distributed file structure or information stored in the DB through the protocol of the node;

may include

These solutions will become more apparent from the following detailed description of the invention based on the accompanying drawings.

Prior to this, the terms or words used in the present specification and claims should not be construed in their ordinary and dictionary meanings, and the inventor may properly define the concept of the term in order to best describe his invention. It should be interpreted as meaning and concept consistent with the technical idea of the present invention based on the principle that it is possible.

According to an embodiment of the present invention, in order to solve the disadvantage of being concentrated on the server that collects logs related to user authentication and security policy software use, it is applied as a distributed information sharing structure using a hierarchical block chain, but in large quantities per unit time. By minimizing the burden of sharing user log information that occurs, it is possible to escape from the disadvantages of the existing blockchain, such as the size of the ledger and the resources of the high consensus process.

1 is a block diagram showing the components of a hierarchical block chain according to an embodiment of the present invention.
2 is a relationship diagram showing the generation state of the first main block and the first sub-block of the hierarchical block chain according to an embodiment of the present invention.
3 is a flowchart illustrating an authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention.
4 is a flowchart illustrating a method of collecting authentication and logs of a hierarchical block chain of an authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention.
5 is a flowchart illustrating a method of collecting policy changes and logs of a hierarchical block chain in an authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention.
6 is a flowchart illustrating a method of verifying and inquiring a log registered in a hierarchical block chain of an authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention.

The specific aspects and specific technical features of the present invention will become more apparent from the following detailed description and embodiments in conjunction with the accompanying drawings. In the present specification, in adding reference numerals to the components of each drawing, it should be noted that the same components are given the same reference numerals as possible even if they are indicated on different drawings. In addition, in describing an embodiment of the present invention, if it is determined that a detailed description of a related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

In addition, in describing the components of the present invention, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the elements from other elements, and the essence, order, or order of the elements are not limited by the terms. When a component is described as being “connected”, “coupled” or “connected” to another component, the component may be directly connected to or connected to the other component, but another component is between each component. It should be understood that elements may also be “connected,” “coupled,” or “connected.”

Hereinafter, an embodiment of the present invention will be described in detail based on the accompanying drawings.

1 and 2, the hierarchical block chain according to an embodiment of the present invention includes a main ledger 1 including an initial main block 10 and one or more main block chains 11 and , a sub-ledger (2) containing the initial sub-block (20) and one or more sub-blockchains (21), and a node ( 3 ; Node) and a subject (4 ; Entity) connected to the sub-ledger 2 to record transaction or event information included in the sub-block chain 21.

The main ledger 1 consists of an initial main block 10 and one or more main block chains 11, and has a structure that is connected to the first node 3 in the initial main block (and main block chain 11), respectively. can be done

The initial main block 10 is a block first generated in the block chain, and includes authentication information including the signature and public key of the first generated subject 4, and is the first generated block after being generated in the first main block 10 The subject (4) can define the form or event and ID of the subject that can be created in advance through the digital signature, and through this, the ID (or address) of the subjects corresponding to the components of the block chain can be verified.

This initial main block 10 can create the subject 4 through either a passive method or an active method.

The passive method is a method that allows participation in the recently created block chain of the subject 4 only when an approved transaction or event is generated through the electronic signature of the subject 4, and the active method is a method in which a self-generated subject (4) including a public key can participate in the main blockchain (11) along with the creation of a sub-blockchain (21).

When the first main block 10 is created by selecting either the passive method or the active method, the ID of the subject 4 specified in advance can be specified by the subject 4 created first by signing the subject 4 in advance. and may include the internal network IP band of a specific organization or the ID of an employee registered in advance. Based on elements such as files, users, and PCs, it is possible to participate in the sub-ledger 2 through the approved verification transaction of the first main block 10 in the ecosystem mapped to the IP, which is the subject ID.

In addition, in both passive and active methods, when there is an untrusted malicious attack from the trusted subject (4), system reliability can be secured for less than 51% tampering like general BFT (Byzantine Fault Tolerance) verification. , when using points, mileage, and virtual currency according to the transaction type, the creation of a new subject can be created without limitation, including the initially created subject 4 and the authentication value of the block connected thereto.

The sub-ledger 2 includes the first sub-block 20 and one or more sub-block chains 21 as described above, and the sub-block created in the sub-ledger 2 is defined as the first sub-block 20, When an event or transaction is completed in the sub-block 20, or an event or transaction occurs from a new subject 4, the existing first sub-block 20 is changed to the lower block chain 21, and the new first sub-block 20 ) can be created.

At this time, the lower ledger 2 is connected to the second node 5, and the data stored in the lower ledger 2 can be stored in IFS or DB (6, 30), and the second node 5 is the data It can act as a node.

This sub-block chain 21 is a sub-block transaction 23 and one or more sub-block transactions that generate detailed transaction records based on the nature and transaction type of the event when the subject 4 generates a transaction of a specific event. It includes a lower block header 22 that can check the accumulated result values of transactions and events that have occurred between objects based on detailed information on (23) and summary information on the sum of accumulated events or transactions. The result value referred to in the sub-block header 22 includes the total number of occurrences of each event or the total number of simple events with respect to the transactions occurring in the sub-ledger 2, and refers to a programmatically definable result value, and the main ledger (1) ) is a value required in the process of making a block transaction.

As shown in Figures 1 to 3, the authentication and policy management method using a hierarchical block chain according to an embodiment of the present invention is a client 40 in which an application program is installed, and the validity of the authentication requested by the client 40 It may include an authentication server 50 that verifies and generates a transaction event for the verified validity, and a management server 60 that verifies and inquires information on the transaction event generated by the authentication server 50 .

The client 40 is a server on which an application program is installed, a user accesses and generates a transaction or event, and may include a personal PC or a smart device.

The authentication server 50 may verify the authentication and policy of the log of the transaction or event requested by the client 40 , and transmit the verified log to the main block chain 11 .

The management server 60 performs a function of managing one or more clients 40 and the authentication server 50 .

The authentication and policy management method including the client 40, the authentication server 50 and the management server 60 includes the steps of requesting authentication for a transaction or event performed by the client 40 to the authentication server (S10); , the authentication server 50 generates an authentication log for the transaction and event performed by the client 40, and registers the generated authentication log in the hierarchical block chain (S10a), and the log is changed due to authentication and policy change Or, when a modification occurs (S20), regenerating the authentication log for the log, re-registering it in the hierarchical block chain (S20a) and verifying and inquiring the log of transactions and events registered in the hierarchical block chain (S20a) It may include a step (S30).

As shown in FIGS. 1, 2 and 4, in the method of collecting the authentication and log of the hierarchical block chain, the authentication server 50 may request authentication for a transaction or event performed by the client 40 ( S10).

The client 40 may receive the user's authentication identification number including login using an application program and transmit it to the authentication server 50 . Here, the authentication identification number generates a public key and a private key (secret key), respectively, and the private key may be configured to include at least one of a password, a Pin, and signature data (S11).

At this time, the client 40 may generate the subject 4 including the unique ID and transmit it to the authentication server 50, and after performing user authentication, receive a unique ID from the authentication server 50 to the subject ( 4) can be generated, and a unique ID of the client 40 can be generated by adopting any one of the above two methods.

The authentication server 50 verifies the validity of the authentication identification number provided from the client 40, and when it is determined that the verified authentication identification number is valid information, information on the validity of the authentication identification number and the subject for the authentication identification number Including (4), it can be registered in the main block chain 11 (S12).

In addition, the authentication server 50 transmits the result of the valid authentication identification number to the application program of the client 40, and when the client 40 is valid, the authentication identification number (signature) transmitted to the main block chain 11 information) and information including authentication information may be generated in the first sub-block 20 (S13).

The information generated in the first sub-block 20 can generate the sub-block transaction 23 including the log of the transaction or event of the client 40, policy acceptance, and log collection (S14).

Here, when the data information of the lower block transaction 23 is greater than the amount of data set in the management server 60 , it may be separately stored in the external IFS or DB 30 .

Here, when any one of the policy or security of the client 40 is changed from the authentication server 50 through the management server 60 and the client 40, a log of transactions or events including the changed identification authentication information can regenerate and request re-registration to the upper main block chain 11 (S15).

In addition, when the client 40 detects a transaction or event log of authentication information and policy change through the main block chain 11 , inquires the detected log, and the policy corresponding to the subject 4 connected to the detected log In this case, it can be registered in the main block chain 11 by reflecting the changed policy contents.

For example, when the authority and authentication of the client 40 are invalidated, the application program installed in the client 40 may perform the cessation of use of the client 40 ( S16 ).

After the authentication information is generated in the main block chain 11 through the above method, the client 40 can create one or more transaction or event logs or information of policy acceptance results in the detailed information of the sub-block transaction 23. There is (S17).

The sub-block transaction 23 can generate a unique transaction ID within the designated unit time timeslot based on the block generation rule, and when it exceeds the timeslot range, a new sub-block is created to store log summary information of transactions and events. It can be configured to include, and can transmit log summary information to the main block chain 11 . The main block chain 11 may generate the main block transaction 13 based on the received summary information.

At this time, even if the transaction or event log generated within the unit time range is changed, if the subject 4 is changed, a new sub-blockchain can be created and information can be registered (S18).

As shown in Figs. 1, 2 and 5, the method of collecting the policy change and log of the hierarchical blockchain is the authentication server 50, the management server 60 or the client 40, the main blockchain 11 It judges whether the authentication policy registered in the authentication policy has been changed or modified, and if it is determined that the authentication policy has been changed or modified, it creates a log of transactions or events including the changed or modified authentication policy contents, and stores the generated log on the main blockchain. It can be registered in (11) (S21). At this time, it can be created in the form of a single transaction (UTXO) of the main block chain and included in the block.

When a transaction or event log is detected in relation to the security policy change through the main block chain 11, the client 40 may inquire the detected log and perform validation of the inquired log (S22) .

Here, it is checked whether the transaction block to be validated, the electronic signature of the first created subject 4, and the public key signature of the subject 4 connected to the client 40 are included, and the policy is applied to the client ( In the case of the policy of the subject 4 connected to 40), the changed policy may be reflected in the client 40 to be executed.

The client 40 may create a new log including one or more security logs, policy execution results, and resource access while executing the changed policy, and register the new log in the detailed transaction details of the lower block transaction 23 .

The sub-block transaction 23 can generate a unique transaction ID within the designated unit time timeslot based on the block generation rule, and when it exceeds the timeslot range, a new sub-block is created to store log summary information of transactions and events. It can be configured to include, and can transmit log summary information to the main block chain 11 . The main block chain 11 may generate the main block transaction 13 based on the received summary information (S24).

At this time, even if the transaction or event log generated within the unit time range is changed, when the subject of the subject 4 is changed, a new sub-blockchain can be created and information can be registered (S25).

As shown in FIGS. 1, 2 and 6, the method of verifying and inquiring logs registered in the hierarchical block chain is to inquire the log to be inquired from the management server 60 to the main block chain 11, By verifying the ID included in one log, the required information can be collected by checking the total number of events or transactions summarized in the log (S31).

Among the collected information, the subject 4 connected to the ID can directly inquire the detailed transaction history by requesting the detailed information recorded in the lower block chain 21 .

When the details of the event or transaction log are required, the subject corresponding to the above ID requests the sub-blockchain 21 corresponding to the details of the same ID (S32), and the node 3 sends the sub-blockchain 21 ), it is possible to additionally inquire the detailed transaction information recorded in (S33). At this time, if the IFS or DB 30 exists, the node 3 may inquire the IFS or DB 30 information through the protocol (S34).

At this time, the above-mentioned node 3 may request all of the transaction summary information included in the main block chain 11, or may request a partial transaction of the transaction summary information. For example, when a partial transaction of transaction summary information is requested, when an event or transaction log occurs, a corresponding transaction ID may be generated on a time unit basis within a given timeslot period.

Accordingly, on the basis of the time at which the transaction occurred, a transaction ID per unit time is generated under the period in which the time difference occurs with the previous block data based on the time at which the transaction occurred, and based on this, detailed information of the transaction or event log can be requested from the lower block chain 21 based on this.

For example, when the estimated transaction ID does not exist, it is possible to sequentially request generation of the next transaction ID, repeat the steps, and receive information on the existing transaction.

Although the present invention has been described in detail through one embodiment, this is for describing the present invention in detail, and the authentication and policy management method using the hierarchical block chain according to the present invention is not limited thereto. And, terms such as "include", "comprise", or "have" described above mean that the corresponding component may be embedded unless otherwise stated, so excluding other components is It should be construed as being able to further include other components rather than other components, and all terms including technical or scientific terms are generally understood by those of ordinary skill in the art to which the present invention belongs, unless otherwise defined. has the same meaning as being

In addition, the above description is merely illustrative of the technical idea of the present invention, and various modifications and variations are possible for those of ordinary skill in the art to which the present invention pertains without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but rather to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

1 - Primary Ledger 2 - Sub Ledger
3 - first node (node) 4 - principal
5 - 2nd node 6 - IFS/DB
10 - first main block 11 - main block chain
12 - main block header 13 - main block transaction
14 - Main block transaction 20 - First sub-block
21 - sub block chain 22 - sub block header
23 - Sub-block transaction 30 - IFS / DB
40 - client 50 - authentication server
60 - management server

Claims (12)

A client in which an application program is installed, an authentication server that verifies the validity of the authentication requested by the client and generates a transaction event for the verified validity, and a management server that verifies and inquires information on the transaction event generated by the authentication server In the authentication and policy management method using a hierarchical block chain comprising:
(a) requesting the authentication server to authenticate the transaction or event performed by the client;
(b) generating, by the authentication server, an authentication log for transactions and events performed by the client, and registering the authentication log in a hierarchical block chain;
(c) regenerating authentication logs for transactions and events in which the authentication and policy of the client are changed or modified, and re-registering them in the hierarchical blockchain; and
(d) verifying and inquiring logs of transactions and events registered in the hierarchical block chain; includes,
The hierarchical blockchain includes a main blockchain and a sub-blockchain,
The sub-block chain includes a sub-block transaction that generates a detailed transaction record based on the type of event or transaction log when an entity generates a specific event or transaction log; and
a sub-block header capable of confirming an accumulated result value of a transaction or event log that occurred between objects based on detailed information on one or more of the sub-block transactions and summary information on the total sum of accumulated events or transaction logs; includes,
The main block chain includes: a main block transaction in which a log registered in a lower block header is provided and registered in the lower block chain; and
Accumulated result values of transaction logs or event logs recorded in one or more sub-block headers formed in the sub-block chain by receiving detailed information included in the main block transaction (the sum of each event for the transaction log recorded in the sub-ledger) or the main block header that can check the total number of occurrences of simple events); including,
The client creates one or more transaction or event logs or information of policy acceptance results in the detailed information of the sub-block transaction,
The sub-block transaction generates a unique transaction ID within the designated unit time timeslot based on the block generation rule, and creates a new block when it exceeds the timeslot range and includes the log summary information of transactions and events, the main block send to the chain,
The step (c) includes: the authentication server determining whether the authentication policy registered in the main block chain in the management server or the client has been changed or modified;
generating a log of a transaction or event including the changed or modified authentication policy contents, and registering the generated log in the main block chain;
the client inquiring information registered in the main block chain, verifying the validity of the registered information, and verifying the public key signature of the subject included in the client; and
executing, by the client, whether a client function is activated, generating a log, accessing a resource of the client, and executing a service including execution information in the client, and applying it to the sub-blockchain; Authentication and policy management method using a hierarchical block chain that includes.
delete delete The method according to claim 1,
In step (a), a user's authentication identification number including login is received using an application program installed in the client, a public key and a private key for the authentication identification number are generated, respectively, and then the authentication identification number is authenticated. sending to the server; including,
The secret key is an authentication and policy management method using a hierarchical block chain including at least one of a password, a PIN, and signature data.
5. The method according to claim 4,
The step (b) includes: the authentication server verifying the validity of the authentication identification number provided from the client, generating a log for the validity of the verified authentication identification number, and transmitting the log to the main block chain; and
The log result for the generated validity is transmitted to the application program, and when the log result is valid, information including signature information and authentication information transmitted to the main block chain is generated in the lower block chain, and the sending to the client;
Authentication and policy management method using a hierarchical block chain that includes.
6. The method of claim 5,
The sub-block chain is an authentication and policy management method using a hierarchical block chain that generates sub-block transactions, including log of the client's transaction or event, policy acceptance, and log collection.
6. The method of claim 5,
when any one of the client's policy or security is changed, regenerating a log of transactions or events including changes in the changed identification authentication information in the authentication server, and re-registering the generated information in the main block chain;
Authentication and policy management method using a hierarchical block chain that includes.
delete The method according to claim 1,
generating a new log including one or more security logs, policy execution results, and resource access when the client executes the changed policy, and recording the new log in the detailed transaction details of the sub-blockchain;
Authentication and policy management method using a hierarchical block chain that includes.
The method according to claim 1,
The step (d) may include querying the log to be inquired from the management server on the main block chain, verifying the ID included in the searched log, and confirming the total number of events or transactions summarized in the log;
requesting detailed information from the sub-blockchain by the subject connected to the ID; and
Inquiring, by a node connected to the lower block chain, detailed transaction information in the lower block chain;
Authentication and policy management method using a hierarchical block chain that includes.
11. The method of claim 10,
When the node requests a part of the transaction summary information included in the main block chain, the transaction ID included in the time slot of the main block chain is reverse-extracted to inquire the details of the transaction or event included in the sub block chain to do;
Authentication and policy management method using a hierarchical block chain that includes.
11. The method of claim 10,
when the information stored in an external distributed file structure or DB is additionally inquired from the inquired transaction information, the node inquiring the distributed file structure or information stored in the DB through the protocol of the node;
Authentication and policy management method using a hierarchical block chain that includes.

Images