KR102576794B1 - Intergraged authentication service system for multi-application and operation method thereof - Google Patents

Abstract

According to an embodiment of the present invention, an integrated authentication service system for multiple applications and a method of operating the same are provided. The method includes the steps of a reverse proxy server transmitting a log-in request received from a web browser of a user terminal to an authentication server; In response to the connection request, the authentication server verifies the user's credentials; When the user's qualifications are recognized, the authentication server generates an access token and a refresh token; The authentication server storing the refresh token in a token cache and transmitting the access token, user information, and an access token hash generated in response to the access token to the reverse proxy server. ; and the reverse proxy server storing the access token in the token cache of the authentication token server and transmitting the access token hash to the user terminal.

Description

Integrated authentication service system for multiple applications and operation method thereof {INTERGRAGED AUTHENTICATION SERVICE SYSTEM FOR MULTI-APPLICATION AND OPERATION METHOD THEREOF}

The present invention relates to an integrated authentication service system for multiple applications with enhanced security and a method of operating the same.

As services such as financial services, shopping services, and medical services via the Internet become popular, technologies for identifying and authenticating individual identities online have become important. Additionally, as the number of cases where a user uses multiple services simultaneously increases, integrated authentication technology (SSO, single sign on) has been introduced to allow access to multiple Internet services through one authentication.

This integrated authentication service has the advantage of relieving the inconvenience of performing repeated authentication every time you use multiple services. However, if your authentication information is stolen, others can access multiple services through that authentication information. There was a problem that security could be weak because of this.

Therefore, there is a need for an integrated authentication technology that has existing convenience while having stronger security performance.

The present invention was devised to solve the above problems, and the purpose of the present invention is to provide an integrated authentication service system for multiple applications with further enhanced security and a method of operating the same.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

According to an embodiment of the present invention, a method of operating an integrated authentication service system for multiple applications is provided. The method includes the steps of a reverse proxy server transmitting a log-in request received from a web browser of a user terminal to an authentication server; In response to the connection request, the authentication server verifies the user's credentials; When the user's qualifications are recognized, the authentication server generates an access token and a refresh token; The authentication server storing the refresh token in a token cache and transmitting the access token, user information, and an access token hash generated in response to the access token to the reverse proxy server. ; and the reverse proxy server storing the access token in the token cache of the authentication token server and transmitting the access token hash to the user terminal.

According to an exemplary embodiment, the access token hash and the validity period of the access token hash may be stored in the form of a cookie by the web browser of the user terminal.

According to an exemplary embodiment, the reverse proxy server receiving a request to use an API (application programming interface) for running at least one of a plurality of applications from a web browser of the user terminal - the API use request includes the access token Contains information about hashes - ; the reverse proxy server inserting the access token corresponding to the access token hash into the API use request by referring to the token cache of the authentication token server and transmitting it to the API server; Verifying the validity of the access token by the API server in response to the API use request; And if the access token is valid, the API server transmits permission to use the API to the user terminal through the reverse proxy server.

According to an example embodiment, if the access token is invalid, the API server forwarding a token update request to the authentication server; In response to the token update request, the authentication server confirms whether a valid refresh token corresponding to the access token exists; If the valid refresh token exists, the authentication server updates the access token and the access token hash and transmits them to the reverse proxy server; and the reverse proxy server storing the updated access token in the token cache of the authentication token server and transmitting the updated access token hash to the user terminal.

According to an exemplary embodiment, the reverse proxy server transmits a log-out request received from a web browser of the user terminal to the authentication server - the log-out request includes information about the access token hash Includes - ; In response to the connection release request, the authentication server deleting the refresh token from the authentication server's token cache; and the reverse proxy server deleting the access token from the token start of the authentication token server and transmitting a result of disconnection to the user terminal.

According to an embodiment of the present invention, an integrated authentication service system for multiple applications is provided. The system includes a reverse proxy server that receives a log-in request from a web browser of a user terminal; In response to the connection request transmitted from the reverse proxy server, the user's qualifications are verified, and if the user's qualifications are recognized, an access token and a refresh token are generated, and the generated refresh token an authentication server that stores in a token cache; and an authentication token server including a token cache for storing the access token, wherein the authentication server receives the access token, the user information, and the access token hash generated in response to the access token. When delivered to the reverse proxy server, the reverse proxy server may store the access token in the token cache of the authentication token server and transmit the access token hash to the user terminal.

According to an exemplary embodiment, the access token hash and the validity period of the access token hash may be stored in the form of a cookie by the web browser of the user terminal.

According to an exemplary embodiment, the reverse proxy server further includes an API server that provides an API (application programming interface) for running at least one of a plurality of applications, and the reverse proxy server receives an API use request from a web browser of the user terminal. If - the API use request includes information about the access token hash - , the access token corresponding to the access token hash is inserted into the API use request by referring to the token cache of the authentication token server and sent to the API server. The API server verifies the validity of the access token in response to the API use request, and if the access token is valid, permission to use the API can be delivered to the user terminal through the reverse proxy server.

According to an exemplary embodiment, if the access token is invalid, the API server forwards a token renewal request to the authentication server, and the authentication server responds to the token renewal request, Check whether a refresh token exists, and if a valid refresh token exists, the access token and the access token hash are updated and delivered to the reverse proxy server, and the reverse proxy server updates the token cache of the authentication token server. The access token may be stored, and the updated access token hash may be transmitted to the user terminal.

According to an exemplary embodiment, when the reverse proxy server forwards a log-out request received from a web browser of the user terminal to the authentication server - the log-out request includes information about the access token hash. Included - in response to the disconnect request, the authentication server deletes the refresh token from the authentication server's token cache, and the reverse proxy server deletes the access token from the authentication token server's token origin, and The result of disconnection may be delivered to the user terminal.

According to various embodiments of the present invention, the dedicated network is not exposed to the outside through a reverse proxy method, but instead of providing an access token for user access authentication directly to the user terminal, an encoded access token hash is provided in the form of a hash. By doing so, it is possible to provide an integrated authentication service system with further improved security.

The effects that can be obtained by the method and device according to the present invention are not limited to the effects mentioned above, and other effects not mentioned above will be clearly understood by those skilled in the art from the description below. It could be.

In order to more fully understand the drawings cited in the detailed description of the present invention, a brief description of each drawing is provided.
Figure 1 is a block diagram briefly illustrating the configuration of an integrated authentication service system for multiple applications according to an embodiment of the present invention.
Figure 2 is a flowchart for explaining a user's connection process in the integrated authentication service system according to an embodiment of the present invention.
Figures 3 and 4 are flowcharts for explaining the API use process in the integrated authentication service system according to an embodiment of the present invention.
Figure 5 is a diagram for explaining a user's disconnection process in the integrated authentication service system according to an embodiment of the present invention.
Figure 6 is a block diagram briefly illustrating the configuration of at least one server in the integrated authentication service system according to an embodiment of the present invention.

Since the technical idea of the present invention can be subject to various changes and can have various embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the technical idea of the present invention to specific embodiments, and should be understood to include all changes, equivalents, and substitutes included in the scope of the technical idea of the present invention.

In explaining the technical idea of the present invention, if it is determined that a detailed description of related known technology may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Additionally, numbers (eg, first, second, etc.) used in the description of the present invention are merely identifiers to distinguish one component from another component.

In addition, in the present invention, when a component is referred to as "connected" or "connected" to another component, the component may be directly connected or directly connected to the other component, but specifically Unless there is a contrary description, it should be understood that it may be connected or connected through another component in the middle.

In addition, terms such as "~unit", "~unit", "~ja", and "~module" described in the present invention refer to a unit that processes at least one function or operation, which refers to a processor, micro Processor (Micro Processer), Micro Controller, CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerate Processor Unit), DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA It can be implemented by hardware or software such as (Field Programmable Gate Array) or a combination of hardware and software.

In addition, it is to be clarified that the division of components in the present invention is merely a division according to the main function each component is responsible for. That is, two or more components, which will be described below, may be combined into one component, or one component may be divided into two or more components for more detailed functions. In addition to the main functions it is responsible for, each of the components described below may additionally perform some or all of the functions handled by other components, and some of the main functions handled by each component may be performed by other components. Of course, it can also be carried out exclusively by .

Hereinafter, embodiments of the present invention will be described in detail one by one.

Figure 1 is a block diagram briefly illustrating the configuration of an integrated authentication service system for multiple applications according to an embodiment of the present invention.

Referring to Figure 1, the integrated authentication service system includes a user terminal 10, a reverse proxy server 20, an API server 30, an authentication token server 40, an authentication server 50, a database server 60, and It may operate including the service server 70.

The user terminal 10 may include any device that can access the network. For example, the user terminal 10 may include a smartphone, tablet, PC, laptop, home appliance device, medical device, camera, wearable device, etc.

In an embodiment, the user terminal 10 transmits a connection (log-in) request and/or a connection disconnection (log-out) request to the reverse proxy server 20 through a web browser, and multiple applications can be accessed with one authentication. By running at least one of the above, at least one service can be provided from the service server 70.

A reverse proxy server (reverse proxy server, 20) refers to a computer device or application program that allows a client (i.e., user terminal 10) to indirectly access other network services, and provides proxy communication between the client and the server. can be performed.

In other words, the reverse proxy server 20 can perform the function of transferring data, signals, requests, etc. between the user terminal 10 connected to a public network and other components connected through a private network. there is.

In this way, the reverse proxy server 20 can improve security by preventing other components of the integrated authentication service system from being exposed to the outside through a public network.

In an embodiment, reverse proxy server 20 stores the access token generated by authentication server 50 and/or the access token hash corresponding to the access token in the token cache. It is possible to store and transmit the access token hash to the user terminal 10. At this time, the access token hash is stored in the web browser of the user terminal 10, and accordingly, the user can receive multiple services through the access token hash with just one qualification verification.

The API server 30 provides an API (application programming interface) for running at least one of a plurality of applications to the user terminal 10 that has been approved for connection (i.e., has been granted an access token) through the reverse proxy server 20. can do.

A user can run at least one application through an API and receive at least one service from the service server 70.

The authentication token server 40 includes a token cache and, upon request from the reverse proxy server 20, can store or delete the access token and/or the access token hash generated by the authentication server 50.

For example, the authentication token server 40 stores the access token and/or the access token hash generated during the user's login process in the token cache, and may delete them from the token cache according to the user's disconnection request.

The authentication server 50 receives the connection request from the user terminal 10 through the reverse proxy server 20, verifies the user's qualifications, recognizes the user's qualifications, and generates an access token and a refresh token. can do.

In addition, the authentication server 50 transmits the access token and the corresponding encoded access token hash to the reverse proxy server 20, so that the web browser of the user terminal 10 can access the service server with one authentication through the access token hash. The user can be provided with multiple services from (70).

In addition, when the validity period of the access token hash or access token expires while the user is logged in, the authentication server 50 renews the access token hash or access token based on the refresh token and sends the updated access token hash to the reverse proxy. It can be provided to the user terminal 10 through the server 20.

Authentication server 50 may include a token cache to at least temporarily store access tokens, refresh tokens, and/or access token hashes.

The database server 60 may store various data, programs, etc. for the operation of the integrated authentication service system. For example, the database server 60 may store user information for identifying qualified users and various data for providing services by the service server 70.

The service server 70 may provide at least one service to a logged in user through at least one application driven by an API. In embodiments, services may include medical information analysis and/or medical information provision services based on medical data.

However, the configuration shown in FIG. 1 is illustrative and not limited thereto, and may be modified in various ways, such as omitting or integrating at least one configuration, depending on the embodiment.

Figure 2 is a flowchart for explaining a user's connection process in the integrated authentication service system according to an embodiment of the present invention.

In step S210, the web browser of the user terminal 10 transmits a log-in request to the reverse proxy server 20 through a public network (e.g., Internet, etc.), and the reverse proxy server 20 The received connection request can be delivered to the authentication server 50 through a dedicated network.

In an embodiment, the connection request includes unique information to identify the user terminal 10 and/or its user (e.g., terminal identification code (IMEI, International Mobile Equipment Identity), phone number, user ID (ID), IP address, biometric information, etc.) may be included.

In step S220, the authentication server 50 may verify the user's connection qualifications based on user information stored in the database server 60 in response to the received connection request.

If the user's qualifications are verified, in step S230, the authentication server 50 may generate an access token and a refresh token for the user's integrated access. Additionally, in an embodiment, the authentication server 50 may further generate an encrypted access token hash by encoding the generated access token in a predetermined manner.

At this time, the generated access token, refresh token, and/or access token hash may include information about each validity period.

Subsequently, the authentication server 50 may store the generated refresh token in the token cache. Depending on the embodiment, the authentication server 50 may further store the access token and/or the access token hash in the token cache.

Subsequently, in step S240, the authentication server 50 may transmit the access token, the access token hash generated correspondingly, and user information to the reverse proxy server 20.

Meanwhile, in embodiments, the access token hash may be generated by the reverse proxy server 20. That is, in step S240, when the access token generated by the authentication server 50 is delivered to the reverse proxy server 20, the reverse proxy server 20 encodes and encrypts the access token in a predetermined manner to generate the access token hash. It can be implemented to generate

Subsequently, in step S250, the reverse proxy server 20 stores the access token and the access token hash in the token cache of the authentication token server 40, and transmits the access token hash to the user terminal 10 as a result of access approval. there is.

Next, in step S260, the web browser of the user terminal 10 may store the received access token hash and its validity period in the form of a cookie.

Hereinafter, as described in detail with reference to FIGS. 3 and 4, the web browser of the user terminal 10 accesses the API through the access token hash in a logged-in state, that is, in a state in which single authentication has been performed. Multiple applications can be run.

However, the method shown in FIG. 2 is an example and is not limited thereto, and may be modified in various ways depending on the embodiment.

Figures 3 and 4 are flowcharts for explaining the API use process in the integrated authentication service system according to an embodiment of the present invention.

Specifically, Figure 3 shows the process when the access token is valid, and Figure 4 shows the process when the access token is invalid.

First, referring to FIG. 3, in step S310, the web browser of the user terminal 10 may transmit a request to use an API for running at least one of a plurality of applications to the reverse proxy server 20 through a public network. At this time, the API use request may include information about the access token hash.

Subsequently, in step S320, the reverse proxy server 20 may refer to the token cache of the authentication token server 40, insert an access token corresponding to the access token hash into the API use request, and transmit it to the API server 30. .

For example, the reverse proxy server 20 may automatically insert an access token corresponding to the access token hash into the http(s) request header and transmit the API request to the API server 30.

Next, in step S330, the API server 30 may verify the validity of the access token inserted into the API in response to the API use request. For example, the API server 30 refers to the token cache of the authentication token server 40 or the token cache of the authentication server 50, checks the validity period of the access token, and expires the validity period of the received access token. The validity of the access token can be verified by checking whether or not.

Next, in step S340, if the access token is valid, the API server 30 transmits the API use permission to the reverse proxy server 20, and the reverse proxy server 20 can deliver this to the user terminal 10.

Accordingly, the user can receive necessary services or data from the service server 70 by running a plurality of applications through the API provided in the web browser of the user terminal 10.

Referring to FIG. 4, when the access token is invalid (particularly, when the validity period of the access token has expired), the integrated authentication service system can perform renewal of the access token. Here, steps S410 to S430 of FIG. 4 are the same as steps S310 to S330 of FIG. 3, so overlapping descriptions will be omitted.

For example, if it is determined that the validity period of the access token obtained from the API use request has expired, the API server 30 may transmit a token renewal request to the authentication server 50 in step S440.

Subsequently, in step S450, the authentication server 50 may refer to the token cache to check whether a valid refresh token exists corresponding to the access token received in the token update request.

If a valid refresh token exists, the process proceeds to step S460, where the authentication server 50 can update the access token and deliver the update result to the API server 30. Additionally, the authentication server 50 may generate an access token hash corresponding to the updated access token and transmit it to the reverse proxy server 20 along with the access token and user information.

Meanwhile, for example, when it is determined that a valid refresh token does not exist due to expiration of the validity period, the authentication server 50 transmits the result of renewal failure to the API server 30, and the API server 30 ) can deliver an alarm that the API is unavailable to the user terminal 10 through the reverse proxy server 20.

In step S470, the API server 30, which has received the update result, transmits API use permission to the reverse proxy server 20, and then, in step S480, the reverse proxy server 20 receives the information received from the authentication server 50. The updated access token and/or access token hash may be stored back in the token origin of the authentication token server 40, and the API use permission and the updated access token hash may be transmitted to the user terminal 10.

Next, in step S490, the web browser of the user terminal 10 stores the newly received access token hash and its validity period in the form of a cookie, and runs at least one of a plurality of applications through the API.

However, the methods shown in FIGS. 3 and 4 are illustrative and are not limited thereto, and may be modified in various ways depending on the embodiment.

Figure 5 is a diagram for explaining a user's disconnection process in the integrated authentication service system according to an embodiment of the present invention.

In step S510, the web browser of the user terminal 10 transmits a log-out request to the reverse proxy server 20 through the public network, and the reverse proxy server 20 dedicates the received log-out request. It can be transmitted to the authentication server 50 through the network. At this time, the connection release request may include information about the access token hash.

In an embodiment, the reverse proxy server 20 may further include referring to the token cache of the authentication token server 40 and inserting an access token corresponding to the access token hash into the disconnection request.

Subsequently, in step S520, in response to the connection release request, the authentication server 50 may delete the refresh token corresponding to the access token from the token cache. For example, the authentication server 50 may detect an access token hash or a refresh token corresponding to the access token from the token cache and delete it.

Subsequently, in step S530, the reverse proxy server 20 may delete the access token and/or the access token hash from the token cache of the authentication token server 40 and transmit the deletion result to the authentication server 50. For example, reverse proxy server 20 forwards a delete request to authentication token server 40, and in response, authentication token server 40 deletes the access token and/or access token hash from the token cache and then deletes the access token. Deletion of the access token, etc. can be performed by transmitting the result to the reverse proxy server 20.

Subsequently, in step S540, the authentication server 50 transmits the disconnection result to the reverse proxy server 20, and the reverse proxy server 20 transmits it to the user terminal 10, thereby completing the disconnection.

However, the method shown in FIG. 5 is an example and is not limited thereto, and may be modified in various ways depending on the embodiment.

Figure 6 is a block diagram briefly illustrating the configuration of at least one server in the integrated authentication service system according to an embodiment of the present invention.

Here, the server may include at least one of a reverse proxy server 20, an API server 30, an authentication token server 40, an authentication server 50, a database server 60, and a service server 70.

As shown in FIG. 6, the server may include a communication unit 610, an input unit 620, a memory 630, and at least one processor 640. However, the server components are not limited to the examples described above. For example, a server may include more or fewer components than those described above. In addition, at least two of the communication unit 610, input unit 620, memory 630, and processor 640 may be implemented in the form of a single chip.

The communication unit 610 can transmit and receive data from the outside. The communication unit 610 may include a wired or wireless communication unit. When the communication unit 610 includes a wired communication unit, the communication unit 610 includes a local area network (LAN), a wide area network (WAN), a value added network (VAN), and a mobile communication network ( It may include one or more components that enable communication through a mobile radio communication network, a satellite communication network, and a combination thereof. In addition, when the communication unit 610 includes a wireless communication unit, the communication unit 610 can transmit and receive data or signals wirelessly using cellular communication, wireless LAN (e.g., Wi-Fi), etc. You can. In an embodiment, the communication unit may transmit and receive data or signals with an external device or external server under the control of the processor 640.

The input unit 620 can receive various user commands through external manipulation. To this end, the input unit 620 may include or connect one or more input devices. For example, the input unit 620 may be connected to various input interfaces such as a keypad and mouse to receive user commands. To this end, the input unit 620 may include not only a USB port but also an interface such as Thunderbolt. Additionally, the input unit 620 may include or be combined with various input devices such as a touch screen and buttons to receive external user commands.

The memory 630 may store programs and/or program instructions for operating the processor 640, and temporarily or permanently store input/output data. The memory 630 is a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, SD or XD memory, etc.), and RAM. , SRAM, ROM, EEPROM, PROM, magnetic memory, magnetic disk, and optical disk may include at least one type of storage medium.

Additionally, the memory 630 can store various network functions and algorithms, and can store various data, programs (one or more instructions), applications, software, commands, codes, etc. for driving and controlling the server.

The processor 640 can control the overall operation of the server. The processor 640 may execute one or more programs stored in the memory 630. The processor 640 may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to embodiments of the present disclosure are performed. There may be a plurality of processors 640, and the processor 640 may perform server operations by executing a program stored in the memory 630.

Methods according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

Additionally, methods according to embodiments of the present invention may be included and provided in a computer program product. Computer program products are commodities and can be traded between sellers and buyers.

A computer program product may include a S/W program and a computer-readable storage medium in which the S/W program is stored. For example, a computer program product may include a product in the form of a S/W program (e.g., a downloadable app) distributed electronically by the manufacturer of an electronic device or through an electronic marketplace (e.g., Google Play Store, App Store). there is. For electronic distribution, at least part of the S/W program may be stored in a storage medium or temporarily created. In this case, the storage medium may be a manufacturer's server, an electronic market server, or a relay server's storage medium that temporarily stores the SW program.

A computer program product, in a system comprised of a server and a client device, may include a storage medium of a server or a storage medium of a client device. Alternatively, if there is a third device (eg, a smartphone) in communication connection with the server or client device, the computer program product may include a storage medium of the third device. Alternatively, the computer program product may include the S/W program itself, which is transmitted from a server to a client device or a third device, or from a third device to a client device.

In this case, one of the server, the client device, and the third device may execute the computer program product to perform the method according to the disclosed embodiments. Alternatively, two or more of a server, a client device, and a third device may execute the computer program product and perform the methods according to the disclosed embodiments in a distributed manner.

For example, a server (eg, a cloud server or an artificial intelligence server, etc.) may execute a computer program product stored on the server and control a client device connected to the server to perform the method according to the disclosed embodiments.

Although the embodiments have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present invention defined in the following claims are also included in the scope of the present invention. belongs to

Claims (11)

In a method of operating an integrated authentication service system for multiple applications,
A reverse proxy server transmitting a log-in request received from a web browser of a user terminal to an authentication server;
In response to the connection request, the authentication server verifies the user's credentials;
When the user's qualifications are recognized, the authentication server generates an access token and a refresh token;
The authentication server storing the refresh token in a token cache and transmitting the access token, user information, and an access token hash generated in response to the access token to the reverse proxy server. ; and
The reverse proxy server storing the access token in a token cache of an authentication token server and transmitting the access token hash to the user terminal. According to claim 1,
The method wherein the access token hash and the validity period of the access token hash are stored in the form of a cookie by the web browser of the user terminal. According to claim 2,
Receiving, by the reverse proxy server, a request to use an API (application programming interface) for running at least one of a plurality of applications from a web browser of the user terminal - The API use request includes information about the access token hash - ;
the reverse proxy server inserting the access token corresponding to the access token hash into the API use request by referring to the token cache of the authentication token server and transmitting it to the API server;
Verifying the validity of the access token by the API server in response to the API use request; and
If the access token is valid, the API server transmits API use permission to the user terminal through the reverse proxy server. According to claim 3,
If the access token is invalid, the API server forwarding a token renewal request to the authentication server;
In response to the token update request, the authentication server confirms whether a valid refresh token corresponding to the access token exists;
If the valid refresh token exists, the authentication server updates the access token and the access token hash and transmits them to the reverse proxy server; and
The method further comprising: the reverse proxy server storing the updated access token in the token cache of the authentication token server and transmitting the updated access token hash to the user terminal. According to claim 2,
Forwarding, by the reverse proxy server, a log-out request received from a web browser of the user terminal to the authentication server - the log-out request includes information about the access token hash -;
In response to the connection release request, the authentication server deleting the refresh token from the authentication server's token cache; and
The method further comprising: the reverse proxy server deleting the access token from the token start of the authentication token server and transmitting a result of disconnection to the user terminal. In an integrated authentication service system for multiple application access,
A reverse proxy server that receives a log-in request from the web browser of the user terminal;
In response to the connection request transmitted from the reverse proxy server, the user's qualifications are verified, and if the user's qualifications are recognized, an access token and a refresh token are generated, and the generated refresh token an authentication server that stores in a token cache; and
An authentication token server including a token cache for storing the access token,
When the authentication server transmits the access token, user information, and an access token hash generated in response to the access token to the reverse proxy server,
The reverse proxy server stores the access token in the token cache of the authentication token server and transmits the access token hash to the user terminal. According to claim 6,
The system wherein the access token hash and the validity period of the access token hash are stored in the form of a cookie by the web browser of the user terminal. According to claim 7,
It further includes an API server that provides an API (application programming interface) for running at least one of the plurality of applications,
When the reverse proxy server receives an API use request from the web browser of the user terminal - the API use request includes information about the access token hash -
Referring to the token cache of the authentication token server, inserting the access token corresponding to the access token hash into the API use request and transmitting it to the API server,
The API server verifies the validity of the access token in response to the API use request, and if the access token is valid, transmits API use permission to the user terminal through the reverse proxy server. According to claim 8,
If the access token is invalid, the API server transmits a token renewal request to the authentication server,
In response to the token update request, the authentication server verifies whether a valid refresh token corresponding to the access token exists, and if a valid refresh token exists, updates the access token and the access token hash, and performs the reverse. Forwarded to proxy server,
The reverse proxy server stores the updated access token in the token cache of the authentication token server and transmits the updated access token hash to the user terminal. According to claim 7,
When the reverse proxy server forwards a log-out request received from the web browser of the user terminal to the authentication server - the log-out request includes information about the access token hash -
The authentication server, in response to the disconnection request, deletes the refresh token from the token cache of the authentication server,
The reverse proxy server deletes the access token from the token origin of the authentication token server and delivers the disconnection result to the user terminal. A computer program stored in a recording medium for executing the method of any one of claims 1 to 5.