KR102664208B1 - Service providing method based on user network profile - Google Patents

Abstract

The present invention includes (A) a service user eligibility authentication step of determining whether the user has legitimate authority to use the service; (B) requesting a service from a user terminal whose service usage qualifications have been authenticated to the gateway; (C) forming a connection, by the gateway, with a service server corresponding to a service requested by a user whose service usage qualifications are authenticated; and (D) providing a service provided by a service server to an authenticated user by the gateway relaying the service. There is an effect of being able to provide services without doing so.

Description

Service provision method based on user network profile {SERVICE PROVIDING METHOD BASED ON USER NETWORK PROFILE}

The present invention relates to a method of providing a service based on a user network profile. More specifically, the present invention relates to a method of providing a service without exposing the address of the service server by using the network profile and gateway for the user using the service. It is about how to provide services.

Due to the recent development of information and communication technology, the development of information provision technology that provides information on various fields in real time to a large number of subscribers through at least one service provision server through a data communication network is actively underway.

Meanwhile, when a user accesses the service providing server using a computer terminal and wishes to exchange communications, the service providing server is a server to be protected, and information security technology is actively being developed to which a security system protected by a security server is applied. Is in progress.

Additionally, for safe access to in-house information servers used by companies or financial institutions, permissions must be restricted in detail by user, task, or role, and loop around connections must be blocked.

In general, when a user requests a connection using a specific protocol such as SSH (secure shell), TELNET, or RDP (remote desktop protocol), the connection port for that protocol is usually statically determined, and the connection is made through that connection port.

However, when connecting to this normal default port, there is a problem in that it is vulnerable to hacking through port scanning or scanning using PING.

In particular, after connecting to a predetermined service server among a plurality of service servers, there has been a problem that a bypass connection is possible from the predetermined service server to another service server.

Patent Document 1: Republic of Korea Patent Publication No. 10-0951716 (2010.03.31) Patent Document 2: Republic of Korea Patent Publication No. 10-1513195 (2015.04.17)

The present invention is intended to solve the problems of the prior art as described above. The purpose of the present invention is to provide information and communication services without exposing the address of the service server by using the network profile and gateway for users using the service. The goal is to provide a method of providing services.

Another purpose of the present invention is to provide a service provision method that operates regardless of security equipment such as existing firewalls and VPNs and does not allow bypass access from a given service server to another service server. .

One aspect of the present invention for achieving the above object is (A) a service user eligibility authentication step of determining whether the user has legitimate authority to use the service; (B) requesting a service from a user terminal whose service usage qualifications have been authenticated to a gateway; (C) forming a connection, by the gateway, with a service server corresponding to a service requested by a user whose service usage qualifications are authenticated; and (D) the gateway relaying and providing the service provided by the service server to the authenticated user.

In the method of providing a service based on a user network profile according to an embodiment of the present invention, the (A) step is (A1) the user terminal transmits authentication request information to the access control server to provide a user network profile. requesting provision; (A2) a user management server (API/Management Server) authenticating the information included in the authentication request information with information stored in a database to create the user network profile according to the request of the access control server; (A3) the access control server creating a user network profile based on user authentication by the user management server; and (A4) transmitting the user network profile to the authenticated user terminal by the access control server.

Additionally, the authentication request information includes user information, which is information about a user using the user terminal; device information that is unique information of the user terminal itself; It may be configured to include service server connection information, which is information about connection to the service server.

Additionally, the user network profile includes user authentication information (AuthToken) that proves that the user is an authenticated user; Device authentication information (DeviceToken) that proves that the user terminal is an authenticated device; It may be configured to include service server access authentication information (AccessToken) that proves that the user is a user authorized to access the corresponding service server.

Additionally, the user authentication information (AuthToken) may be generated by coding using the user ID, access time, and unique value for each user.

In addition, the device authentication information (DeviceToken) may be generated by coding using the device's unique ID.

Additionally, the service server access authentication information (AccessToken) may be generated by coding using the service ID, user information, authentication time, and unique key for each service server.

And, in the step (B), the user terminal may request the gateway to provide a service included in the user network profile provided from the access control server.

In addition, in the step (C), (C1) the gateway extracts user authentication information (AuthToken) and service server access authentication information (AccessToken) from the user network profile received from the user terminal, and connects the access control server to the access control server. Steps provided to; (C2) If the user authentication information matches the authentication information of the user network profile created in step (A3), the access control server determines the address and port of the service server corresponding to the service server access authentication information. transmitting to the gateway; and (C3) requesting, by the gateway, to connect to the service server with the service server address using a port received from the access control server.

And, in the step (D), the gateway may relay and deliver data provided from the service server to the user terminal.

Additionally, the user terminal connection port of the gateway may be created as a dynamic port and updated and set each time the gateway connects to the user terminal.

Additionally, the service server connection port of the gateway may be created as a dynamic port and updated and set each time the gateway connects to the service server.

Additionally, the user network profile may include an expiration time (ExpireDate), which is information about the validity time of the user network profile.

Additionally, the expiration time may be set to be shorter depending on the security level of the service server, as the security level increases.

Additionally, the user network profile may include validity information indicating whether the user network profile is valid.

And, the validity information may be session information indicating a connection session.

In addition, the validity information includes a limited data amount so that the access control server can discard the corresponding user network profile when a preset data capacity is provided according to the amount of data provided by the gateway to the user terminal. It may be composed.

The method of providing a user network profile-based service according to the present invention encrypts information about users, servers, and terminals through user authentication information (AuthToken), service server access authentication information (AccessToken), and device authentication information (DeviceToken). Since only the gateway information is provided to the user, server information about the service being used is not exposed to the user, which has the effect of completely blocking hacking.

In addition, according to the present invention, even if information is exposed through the use of user authentication information and service server access authentication information generated differently depending on conditions (time, session), it cannot be used after the period, which has the effect of safely protecting server information. There is.

Additionally, according to the present invention, a separate dynamic port is used each time a gateway and a user or a gateway and a service server are connected, thereby effectively protecting the gateway from hacking and information leakage.

1 is a block diagram of a service provision system including devices for providing services according to the present invention.
Figure 2 is a block diagram showing the procedure for providing services according to the present invention for each device.
Figure 3 is a configuration diagram of authentication request information and user network profile according to the present invention.
Figure 4 is a block diagram showing the flow of information for each device for providing services according to the present invention.

Since the present invention can be modified in various ways and have various implementation examples, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all transformations, equivalents, and substitutes included in the spirit and technical scope of the present invention. In describing the present invention, if it is determined that a detailed description of related known technologies may obscure the gist of the present invention, the detailed description will be omitted.

Terms such as first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

The present invention relates to a service provision method that can provide a service without exposing the address of the service server using a network profile and gateway for users using the service.

Hereinafter, the method for providing a service based on a user network profile of the present invention will be described in more detail with reference to a preferred implementation example and the accompanying drawings. In this regard, Figure 1 is a block diagram of a service providing system including devices for providing services according to an implementation of the present invention, and Figure 2 shows the order of providing services according to the present invention for each device. It is a block diagram, and FIG. 3 is a configuration diagram of authentication request information and user network profile used in the present invention, and FIG. 4 is a block diagram showing the flow of information for each device for providing the service according to the present invention.

First, referring to FIG. 1, the user network profile-based service provision method of the present invention includes a user terminal 100, an access control server 200, a user management server 300, a database 400, and a gate. It may be provided by a service provision system including the way 500 and the service server 600.

The user terminal 100 requests authentication of service use qualifications by transmitting authentication request information to the access control server 200, and when service use qualifications are authenticated, requests service to the gateway 500. This is a device for using the service provided by the service server 600. Examples of the user terminal 100 include, but are not limited to, a personal computer (PC) or a mobile phone, and may include various communication devices that can be connected to the service operator's server through a wired/wireless communication network.

The access control server 200 is the main server of the service operator, and has the function of creating a user network profile, which is information about service use qualifications necessary to request a service from the gateway 500, and providing it to the user terminal 100. Perform. By this, the user's access to the service server 600 that requires security is controlled, and access to the gateway 500, such as requesting a connection to the gateway 500 and terminating the connection, is controlled.

The user management server 300 is a server connected to the access control server 200 to manage information about users, and manages data necessary for creating a user network profile stored in the database 400, which will be described later. An authentication process is performed by comparing the authentication request information requested from the access control server 200 with the information stored in the database 400.

The database 400 performs the function of storing and updating various data necessary to provide the service of the present invention and providing it to the access control server 200 and the user management server 300.

The gateway 500 excludes direct connection between the user terminal 100 and the service server 600, preventing information about the service server 600 from being directly exposed to the user, and providing information about the service server 600. This is to perform the function of relaying data to the user terminal 100. Detailed functions of the gateway 500 will be described in more detail later.

The service server 600 is a server for providing services that users want to use, and may be configured to collectively include a number of servers requiring security according to the type of service used by the user.

Hereinafter, the method for providing a service based on a user network profile according to the present invention will be described in more detail with reference to FIGS. 2 to 4.

The method of providing a service based on a user network profile of the present invention basically includes (A) a service use qualification authentication step to determine whether the user has legitimate authority to use the service, and (B) a service use qualification authentication step to determine whether the user has legitimate authority to use the service. A service is requested from a gateway, (C) the gateway establishes a connection with a service server corresponding to the service requested from a user whose service user qualifications are authenticated, and (D) an authenticated user. It may be configured to include the step of the gateway relaying and providing a service provided by a service server.

In the service usage qualification authentication step (A), the user first transmits authentication request information to the access control server 200 using the user terminal 100 to request service usage qualification authentication (S110). .

Subsequently, the access control server 200, which has received the authentication request information (S210), requests authentication for the information included in the authentication request information to the user management server 300 (API/Management Server). Accordingly, the user management server 300 authenticates that the information included in the authentication request information has legitimate qualifications based on the information in the database 400 and transmits it back to the access control server 200.

Here, the authentication request information required to request authentication as to whether the user is legitimately qualified to use the service includes user information, which is personal information about the individual user using the user terminal 100, and user terminal 100 ) It may be configured to include device information, which is unique information about the device itself, and server connection information, which is information about connection to the service server 600.

The user information may include, for example, information such as the user's name, affiliation, and position. The device information may include a device unique ID. Additionally, the server connection information may include the contents of the service the user wishes to use.

As described above, the access control server 200, which has received authentication for the authentication request information from the user management server 300, creates a user network profile based on this (S220) and transmits it to the user terminal 100 (S230). , the service user eligibility authentication stage ends.

Here, the user network profile includes user authentication information (AuthToken) that proves that the user is an authenticated user, device authentication information (DeviceToken) that proves that the user terminal 100 is an authenticated device, and the user's connection to the server. It may be configured to include service server access authentication information (AccessToken) that proves that this is an authorized user.

At this time, the user authentication information (AuthToken) is coded using the user ID, access time, and unique value for each user and is generated in an encrypted form.

In addition, the device authentication information (DeviceToken) is generated in an encrypted form using CPU Id, HDD Id, MAC Address, etc. for PCs, and in encrypted form using the device's unique ID for other devices. I do it.

In addition, the service server access authentication information (AccessToken) is coded using the service ID, user information, authentication time, and unique key for each service server and is generated in an encrypted form.

Accordingly, according to the present invention, information about users, servers, and terminals is transmitted and received in encrypted form, and access is only possible when an authenticated user (AuthToken) has access rights (AccessToken) to the server from an authenticated device (DeviceToken). Because this is possible, it is possible to fundamentally block users who are not eligible to use the service from accessing the server.

Hereinafter, steps (B) to (D) will be described where a user whose service usage qualifications are verified as described above requests a service, receives data, and uses the service.

First, the user who receives the user network profile as described above (S120) uses the user terminal 100 to request a service by transmitting the user network profile to the gateway 500 (Gate Way) (S130).

As described above, when a user requests a service from the gateway 500 using the user terminal 100, the gateway 500 first collects user authentication information from the user network profile received from the user terminal 100 (S510). ((AuthToken) and service server access authentication information (AccessToken) are extracted (S520) and then transmitted to the access control server 200 (S520).

The access control server 200, which has received the user authentication information and the service server access authentication information as described above, determines that the user authentication information is included in the user network profile created as described above and transmitted to the user terminal 100. If the authentication information matches (S240), the address and port of the service server 600 corresponding to the service server access authentication information received from the gateway 500 are transmitted to the gateway 500 (S250).

Next, the gateway 500 requests a connection to the service server 600 using the server address using the port received from the access control server 200 (S530) (S540). Afterwards, when a connection is made with the service server 600 using the server address (S610), the gateway 500 relays and delivers the data provided by the service server 600 to the user terminal 100 to provide the service. (S570).

At this time, the gateway 500 may create a dynamic port for connecting to the user terminal 100 (S560). Here, the dynamic port may be updated and set each time the gateway 500 connects to the user terminal 100.

Additionally, the gateway 500 can create a connection port for connecting to the service server 600 as a dynamic port. Here, the dynamic port may be updated and set each time the gateway 500 connects to the service server 600.

Accordingly, according to the present invention, a separate dynamic port is used each time the gateway 500 and the user terminal 100 and the gateway 500 and the service server 600 are connected, so the You can protect yourself safely by blocking hacking and information leaks.

In particular, since the data provided from the service server 600 is not transmitted directly to the user terminal 100 but is transmitted only through the gateway 500, only the gateway 500 information is provided to the user. Accordingly, according to the present invention, server information about the service being used is not exposed to the user, making it possible to completely prevent hacking.

Here, according to one implementation of the present invention, the user network profile may be configured to include an expiration time (ExpireDate), which is information about the validity time of the user network profile.

As a result, since the service is continuously changed by using the service for the time allowed through control of the expiration time when using the service, even if the user network profile is leaked, unauthorized terminals (users) can enter the gate through the leaked user network profile in the future. When accessing the way 500, there is an effect of blocking access through expiration of the expiration time.

In particular, according to this implementation, the expiration time may be set to be shorter according to the security level of the service server 600, as the security level is higher. For example, when accessing a server where confidentiality is important and using the service, the service use time is set short and the user authentication process is performed frequently. The service server 600, where security is more important, limits accessibility to the server as much as possible. You can.

According to another implementation of the present invention, the user network profile may be configured to include validity information indicating whether the user network profile is valid.

At this time, the validity information may be session information indicating a connection session. For example, the session information may be newly set and updated each time the user accesses the access control server 200.

Here, the session may be set for each service server to which the user terminal 100 is connected, may be set for each connection/disconnection unit of the user terminal, or may be set for a preset work unit.

In addition, the validity information allows the access control server 200 to discard the user network profile when a preset data capacity is provided according to the amount of data provided by the gateway 500 to the user terminal 100. It can be configured to include a limited amount of data. In other words, after the user receives certain data, the connection is interrupted and the connection can be continued only when the user newly enters authentication request information.

In other words, even if an unauthorized terminal (user) accesses the gateway 500 through a leaked user network profile in the future, when receiving a large amount of data, a re-authorization process is performed according to the limited data amount, Data leakage can be prevented.

Furthermore, the preset data capacity may be set differently depending on the user's security level and/or job class.

For example, a user in a business class (security level) who receives data from the service server and processes it minimizes inconvenience in performing work by increasing the data capacity set, and mainly views data from the service server. The majority of users in the business class (security level) can maximize security by minimizing the data volume set.

Accordingly, according to the present invention, access to the server is controlled using a user network profile that is created differently depending on conditions (time, data amount, session), so even if the user network profile is exposed, the set conditions, that is, the set time or data, are controlled. When the amount or session elapses, it becomes impossible to connect to the server through this, so it becomes impossible to continuously connect to the service server through this.

Although the preferred embodiments of the present invention have been described above, those skilled in the art can add, change, delete or add components without departing from the spirit of the present invention as set forth in the patent claims. The present invention may be modified and changed in various ways, and this will also be included within the scope of rights of the present invention.

For example, each component described as single may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form. The scope of the present invention is indicated by the claims described below rather than the detailed description above, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. do.

The present invention relates to a service provision method that can provide a service without exposing the address of the service server using a network profile and gateway for users using the service. According to the present invention, an authenticated user Since only users can access the authenticated server through an authenticated device, it is possible to provide services without exposing as much information about the service server as possible.

100: user terminal
200: Access control server
300: User management server
400: database
500: gateway
600: service server
A: User information
B: Device information
C: Server connection information
a: user authentication information
b: device authentication information
c: Server connection authentication information

Claims (15)

(A) Service user eligibility authentication step to determine whether the user has legitimate authority to use the service;
(B) requesting a service from a user terminal whose service usage qualifications have been authenticated to a gateway;
(C) the gateway establishing a connection with a service server corresponding to a service requested by a user whose service usage qualifications are authenticated; and
(D) the gateway relays and provides the service provided by the service server to the authenticated user; and is performed including:
The (A) step is,
(A1) the user terminal transmits authentication request information and requests the access control server to provide a user network profile;
(A2) a user management server (API/Management Server) authenticating the information included in the authentication request information with information stored in a database to create the user network profile according to the request of the access control server;
(A3) the access control server creating a user network profile based on user authentication by the user management server; and
(A4) transmitting the user network profile to the authenticated user terminal by the access control server; and comprising:
The above authentication request information is:
User information, which is information about the user using the user terminal;
device information that is unique information of the user terminal itself;
Service server connection information, which is information about connection to the service server; and includes:
The user network profile is,
User authentication information (AuthToken) that proves that the user is an authenticated user;
Device authentication information (DeviceToken) that proves that the user terminal is an authenticated device;
Service server access authentication information (AccessToken) that proves that the user is a user authorized to access the service server; and includes:
The user authentication information (AuthToken) is generated by coding using the user ID, access time, and unique value for each user:
The device authentication information (DeviceToken) is coded and generated using the device's unique ID:
The service server access authentication information (AccessToken) is coded and generated using the service ID, user information, authentication time, and unique key for each service server:
The (C) step is,
(C1) the gateway extracting user authentication information (AuthToken) and service server access authentication information (AccessToken) from the user network profile received from the user terminal and providing them to the access control server;
(C2) If the user authentication information matches the authentication information of the user network profile created in step (A3), the access control server determines the address and port of the service server corresponding to the service server access authentication information. transmitting to the gateway; and
(C3) requesting, by the gateway, to connect to the service server using the port received from the access control server to the service server address; and comprising:
The (D) step is,
The gateway relays and delivers data provided from the service server to the user terminal:
The user network profile is,
An expiration time (ExpireDate), which is information about the validity time of the user network profile, is included, and the expiration time is set according to the security level of the service server, so that the higher the security level, the shorter the expiration time is:
The user network profile is,
Contains validity information indicating whether the user network profile is valid:
The validity information is,
When a preset data capacity is provided according to the amount of data provided by the gateway to the user terminal, it is configured to include a limited data amount so that the access control server can discard the corresponding user network profile, and the preset data A method of providing a service based on a user network profile, wherein capacity is set according to the user's work class.
delete delete delete delete delete delete According to paragraph 1,
The (B) step is,
A method of providing a service based on a user network profile, characterized in that the user terminal requests a service included in the user network profile provided from the access control server to the gateway.
delete delete According to paragraph 1,
The user terminal access port of the gateway is created as a dynamic port,
A method of providing a service based on a user network profile, characterized in that the setting is updated each time the gateway connects to the user terminal.
According to paragraph 1,
The service server connection port of the gateway is created as a dynamic port,
A method of providing a service based on a user network profile, characterized in that the setting is updated each time the gateway connects to the service server.
delete delete According to paragraph 1,
The validity information is,
A method of providing a service based on a user network profile, characterized in that session information indicates an access session.

Images