KR20040101616A - System and method for managing user's contents access privilege on wireless Internet, computer readable recording medium having user's contents access privilege management software stored therein - Google Patents

Abstract

PURPOSE: A system and a method for managing a content access authority of a user using a mobile terminal on the wireless Internet, and a computer-readable recording medium storing software for the same are provided to secure contents by managing an access authority for the contents when the user uses the contents by using the mobile terminal. CONSTITUTION: A role information assigner(511) manages content access policy information of a content providing server, and assigns role information matched with basic information of the user based on the content access policy information if issuance of a WAC(Wireless Attribute Certificate) for the user is requested. The role information assigner stores the role information and the basic information for issuing the WAC of the user to each field of the WAC. A certificate generator(512) generates an attribute certificate by encrypting the information stored in each field of the WAC with an encryption algorithm. A certificate output part(513) transfers the WAC to the mobile terminal of the user through a gateway and stores the WAC in a directory server.

Description

System and method for managing user's contents access privilege on wireless Internet, computer readable recording medium having user's contents access privilege management software stored therein}

The present invention relates to a system and a method for managing access rights of user contents on the wireless Internet, and more particularly, to a server (i.e., content) having a mobile terminal (eg, a mobile phone, a PDA, etc.) for providing various contents on the wireless Internet. The present invention relates to a system and method for managing content access rights for users who want to use content by accessing a server, and a computer-readable recording medium recording user content access right management software.

Recently, as the wireless Internet technology and the computing function of the mobile terminal are rapidly developed, the use of contents through the wireless internet with the mobile terminal is gradually increasing. As such, as the use of content on the wireless Internet increases, the security problem of the content is gradually raised.

Currently, as the use of content through the wired Internet is becoming more common, a security system called a public key infrastructure (PKI) is used to secure the content. PKI is a complex security system environment that provides encryption and digital signature using public key cryptographic algorithm. It encrypts incoming and outgoing contents using public key consisting of encryption key and decryption key, and uses digital certificate (or user certificate). It is a system that authenticates.

This PKI system has the advantage of securing the safety and reliability of electronic transactions and information distribution, but because it is a security system limited to user authentication, it does not restrict access to specific resources (systems, applications) of authenticated users in various application environments. have. As a result, PMI (Privilege Management Infrastructure) system, which protects the contents by differentiating the authority to the user so that the user can access only specific resources, is emerging as a new information security infrastructure system. If the PKI system is a security system limited to user authentication, the PMI system is a system that systematically manages the authority for accessing specific resources to authenticated users. Recently, the utilization of the PMI system is gradually increasing as the demand for system integration is increasing as each company expands the computer system.

As described above, a wireless public key infrastructure (WPKI) system is gradually being used to secure contents through the wireless Internet as in the wired Internet. Like the PKI system on the wired Internet, the wireless PKI system authenticates users who use contents through the wireless Internet to secure the stability and reliability of M-Commerce (Mobile-Commerce).

However, since the wireless PKI system is a security system limited to authentication of users who use contents on the wireless Internet, the wireless PKI system does not restrict the use (access) of a user's specific contents under various contents providing environments. Therefore, there is a need for a new security system that systematically manages users' access rights to various contents on the wireless Internet to secure the contents.

Accordingly, the present invention has been made to solve the conventional problems as described above, the wireless Internet to secure the content by managing the access rights to the content when using the content using the mobile terminal of the user on the wireless Internet It is an object of the present invention to provide a user-readable content management system and method thereof, and a computer-readable recording medium having recorded therein user content access right management software.

1 is a configuration diagram schematically showing an environment in which a user content access right management system is operated on a wireless Internet according to the present invention;

2A and 2B are schematic configuration diagrams of a user content access right management system according to the present invention;

3 is a flowchart illustrating a method for managing user content access rights according to the present invention;

4 is a flowchart illustrating a method of operating a content providing server using a user content access right management system according to the present invention.

* Description of the symbols for the main parts of the drawings *

10: mobile terminal 20: gateway

30: content providing server 40: user authentication system

50: User Content Access Right Management System

51: user authority authentication server 511: role information assignment unit

512: certificate generation unit 513: certificate output unit

514: certificate control unit 52: directory server

In order to achieve the above object, a user content access right management method in the wireless Internet according to the present invention is (a) in connection with a server providing various contents on the wireless Internet for the content users set by the operator of the content providing server Obtaining policy information defining content access rights and roles for the rights; (b) when issuing a wireless attribute certificate for a predetermined user is requested from the content providing server, allocating user role information corresponding to basic information of the corresponding user based on the obtained content access policy information; (c) encrypting role information assigned to a user and basic information for issuing a wireless attribute certificate by using a predetermined encryption algorithm to generate a wireless attribute certificate; And (d) issuing the generated wireless attribute certificate to the mobile terminal of the corresponding user, and storing the issued wireless attribute certificate in a pre-installed directory server.

The user content access right management system on the wireless Internet according to the present invention for achieving the above object, if the issuance of a wireless attribute certificate for a predetermined content user is requested from the server for providing content on the wireless Internet, the content access policy previously obtained Based on the information, the user role information corresponding to the basic information of the user is assigned, and the wireless property certificate is generated based on the assigned role information and the basic information for issuing the wireless property certificate, and then the mobile terminal is sent to the mobile terminal of the user. Issuing user authority certificate server; And a directory server for storing the wireless attribute certificate generated by the user authority authentication server for each user.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of a user content access right management system and a method thereof over the wireless Internet according to the present invention.

1 is a configuration diagram schematically illustrating an environment in which a user content access right management system is operated in a wireless Internet according to the present invention. Referring to FIG. 1, an environment in which a user content access right management system according to the present invention operates includes a mobile terminal (eg, a mobile phone, a PDA, etc.) 10 capable of wireless internet, and the Internet 60 using the mobile terminal 10. A gateway 20 supporting access, a content providing server 30 providing content on the wireless Internet, a user authentication system 40, a user content access authority management system 50, and the Internet 60. .

First, prior to explaining the operation process of the environment in which the user content access right management system 50 according to the present invention through the interaction between the components shown in Figure 1, the content providing server 30, user authentication The operation of the system 40 and the user content access right management system 50 will be described.

The content providing server 30 manages content access policy information set by the operator in advance. The content access policy information is a policy that defines content access rights and roles for users who use various contents provided through the content providing server 30.

For example, assuming that the content providing server 30 is a shopping mall (or a shopping mall server), the shopping mall operator has authority such as a product provider, a product list manager, a product sales manager, a member, etc. to all users who use the website of the shopping mall. Subdivided into users with the user, and defines the role corresponding to each authority and manages it as content access policy information. Then, when a predetermined user accesses the shopping mall, the shopping mall provides a service only for the content access right given to the user. That is, if a user accessing the shopping mall has the authority as a shopping mall member, the shopping mall only provides the product purchasing environment to the user, but does not provide an environment such as registering or deleting a new product list.

The user authentication system 40 is a wireless public key infrastructure (WPKI) system, and issues and manages user certificates.

In general, the user authentication system 40 is composed of a registration authority (or a registrar server) (not shown), a certification authority (or a certification authority server) (not shown), and a directory server (not shown).

The registrar is an organization that receives requests for certificate issuance of users through off-line. The registrar is primarily responsible for verifying the identity of users and issuing certificates to users. , ID, password, content access right) to the certification authority.

When the certificate authority requests issuance of a certificate for a predetermined user from the outside, the certification authority generates a user certificate (WPKC: Wireless Public Key Certificate) based on the basic information about the user received from the registrar, and then generates the generated user certificate. Issued to the user (strictly speaking, mobile terminal) and stored in the directory server. As described above, the user authentication system 40 issues a user certificate through the interaction of the elements constituting the system. Hereinafter, a detailed description of the operation of the user authentication system 40 will be omitted as it is well known to those skilled in the art.

The user content access right management system 50 acquires basic user information by interworking with the user authentication system 40, and content access policy information set by the content providing server 30 operator by interworking with the content providing server 30. Acquire. When a request for issuing a wireless attribute certificate (WAC) for a predetermined user from the outside is performed, a wireless attribute certificate is generated based on the basic information and content access policy information of the user, and then the wireless attribute certificate is generated. Issue to the user (strictly speaking, mobile terminal). In this case, when the user accesses the content providing server 30 using the mobile terminal 10, the wireless property certificate is a certificate for authenticating the content access authority of the user and has role information on the content access authority.

Next, the operation process of the environment in which the user content access right management system 50 according to the present invention will be described.

The user accesses the content providing server 30 using his mobile terminal 10. In this case, the gateway 20 and the Internet 60 support data transmission and reception between the mobile terminal 10 and the content providing server 30, and since each role and each interaction relationship are well known to those skilled in the art. Detailed descriptions will be omitted.

The content providing server 30 determines whether a user certificate exists in the internal memory (not shown) of the mobile terminal 10 when an arbitrary user connects using the mobile terminal 10. As a result, the user certificate exists. If not, the user certificate is requested to the user authentication system 40 through the Internet 60.

When the user authentication system 40 requests issuance of a user certificate for a predetermined user from the content providing server 30, the user authentication system 40 generates a certificate for the corresponding user by operating as mentioned above, and generates the user certificate of the user. Transfer to the terminal 10. At this time, the mobile terminal 10 receives the user certificate from the user authentication system 40 and stores it in a predetermined area of the internal memory. Here, a process of issuing a user certificate through mutual interworking between the content providing server 30 and the user authentication system 40 is a general description and a detailed description thereof will be omitted.

On the other hand, if the user is issued a user certificate to the mobile terminal 10, then access the content providing server 30, the content providing server 30 authenticates the user based on the user certificate stored in the mobile terminal 10 do. In this case, the process of authenticating the user based on the user certificate by the content providing server 30 is well known to those skilled in the art and a detailed description thereof will be omitted.

The content providing server 30 then authenticates the user with the user certificate, and then determines whether the wireless attribute certificate exists in the internal memory of the mobile terminal 10. At this time, if the wireless attribute certificate does not exist, the user content access right management system 50 requests issuance of the wireless attribute certificate for the user.

When the user content access right management system 50 requests issuance of a wireless property certificate for a predetermined user from the content providing server 30, the user content access right management system 50 generates a wireless property certificate by operating as described above, and generates the wireless property certificate. Transfer to the user's mobile terminal 10. At this time, the mobile terminal 10 receives the wireless attribute certificate from the user content access rights management system 50 and stores it in a predetermined area of the internal memory. As a result, the mobile terminal 10 stores a user certificate and a wireless attribute certificate.

Thereafter, when the user receives the user certificate and the wireless property certificate from the mobile terminal 10 and accesses the content providing server 30, the content providing server 30 searches for the internal memory of the corresponding mobile terminal 10 and wirelessly. After recognizing the attribute certificate, the user is restricted from accessing the content based on the role information included in the wireless attribute certificate. For example, if the role information is information defining a role related to a product purchase, the content providing server 30 recognizes that the user has the authority as a shopping mall member in response to the role information, and the user selects the shopping mall only for the product purchase. Restrict access.

Meanwhile, the user authentication system 40 and the user content access right management system 50 may be included in the content providing server 30 and implemented. However, in the present invention, as shown in FIG. 1, it is assumed that the user authentication system 40 and the user content access right management system 50 are implemented outside the content providing server 30.

2A and 2B are schematic configuration diagrams of a user content access right management system on a wireless Internet according to the present invention. Referring to FIG. 2A, the user content access right management system 50 according to the present invention is a user right. It consists of an authentication server 51 and a directory server 52. In this case, referring to FIG. 2B, the user authority authentication server 51 includes a role information assignment unit 511, a certificate generation unit 512, a certificate output unit 513, and a certificate control unit 514.

Directory server 52 stores wireless attribute certificates for users of mobile terminal 10.

The role information allocating unit 511 manages the content access policy information of the content providing server 30, and if a request for issuing a wireless property certificate for a predetermined user is requested, the role information allocating unit 511 applies the basic information of the corresponding user based on the content access policy information. Assign the corresponding role information. That is, the role information corresponding to the content access authority included in the basic user information is identified based on the content access policy information, and the role information is assigned as role information about the content access authority of the corresponding user.

In addition, the role information allocating unit 511 stores the role information of the corresponding user and basic information for issuing the wireless property certificate (for example, version information on the wireless property certificate, owner information, issuer information, etc.) for each field of the wireless property certificate. Store in

Here, an example of the structure of the radio attribute certificate according to the present invention is shown in Table 1 below.

Version Information Owner information Issuer Information Signature Information Serial Number Information Expiration date information Attribute Information Issuer Identification Information Additional Information

As shown in Table 1, the wireless attribute certificate has a version field, a holder field, an issuer field, a signature field, a serial number field, and an expiration date. It consists of a information period field, an attribute field, an issuer unique identifier field, and an extension field.

In this case, version information of the wireless property certificate is recorded in the version information field, and basic information (for example, name, ID, password, content access authority, etc.) of the owner of the wireless property certificate, that is, the user, is recorded in the owner information field. In the issuer information field, information (eg, issuer name, etc.) of the issuer who issued the wireless attribute certificate is recorded. The electronic signature of the user is recorded in the signature information field, and the serial number of the wireless attribute certificate granted by the user content access right management system 50 when the wireless attribute certificate is issued is recorded in the serial number information field. In the information field, information on the validity period of the radio attribute certificate is recorded. In addition, role information of the corresponding user is recorded in the attribute information field, and identification information (eg, a specific code number of the issuer) of the issuer who issued the wireless attribute certificate is recorded in the issuer identification information field, and an additional information field. Information other than the information mentioned may be recorded.

Subsequently, the certificate generation unit 512 generates the attribute certificate by encrypting the information recorded in each field of the radio attribute certificate by the role information assignment unit 511 using a predetermined encryption algorithm.

The certificate output unit 513 transfers the generated wireless attribute certificate to the mobile terminal 10 of the user through the gateway 20, and stores the wireless attribute certificate in the directory server 52.

When the certificate controller 514 receives a request for issuing a wireless property certificate for a predetermined user from the content providing server 30 through the gateway 20, the role information allocating unit 511 may issue a wireless property certificate for the corresponding user. The certificate generator 512 and the certificate output unit 513 are controlled.

3 is a flowchart illustrating a method for managing access rights of user contents in the wireless Internet according to the present invention. As shown in FIG. 3, in the method for managing user content access right according to the present invention, if a request for issuing a wireless attribute certificate for a predetermined user is requested from a predetermined content providing server 30 (s100), the previously obtained content is obtained. The content access policy information of the providing server 30 is checked (s102).

Based on the content access policy information, role information corresponding to basic information of the corresponding user is allocated (S104).

Thereafter, the role information allocated in step S104 and basic information for issuing the wireless attribute certificate are recorded in each field of the wireless attribute certificate, and then the wireless attribute certificate is generated by encrypting the information recorded in the respective field (s106).

Finally, the wireless attribute certificate generated in step s106 is transmitted to the user's mobile terminal 10, and the wireless attribute certificate is stored in the directory server (52 in FIG. 2) (s108).

4 is a flowchart illustrating a method of operating a content providing server using a user content access right management system according to the present invention. Referring to FIG. 4, first, when a user accesses a content access server 30 using his mobile terminal 10 (s200), the content providing server 30 initially initializes the mobile terminal 10. A screen (eg, a login screen, etc.) is provided (s202).

Then, it is checked whether a user certificate exists in the internal memory (not shown) of the mobile terminal 10 (s204). If the user certificate is verified (s206), the user is authenticated and whether a wireless attribute certificate exists in the internal memory. Check whether or not (s210, s212).

On the other hand, if the user certificate is not confirmed (s206), the user authentication system 40 requests issuance of a certificate for the corresponding user (s208). In this case, the user authentication system 40 operates as already mentioned, generates a certificate for the user, and then transmits the generated certificate to the mobile terminal 10.

Then, if the mobile terminal 10 stores the user certificate issued from the user authentication system 40 in the internal memory, the content providing server 30 based on the internal memory of the mobile terminal 10 whether the user certificate exists After performing the steps s204 and s206 and the user authentication step s210, the step S212 is performed to confirm the existence of the wireless attribute certificate.

In operation S212, when it is determined that the wireless attribute certificate exists in the internal memory of the mobile terminal 10 (s214), the role information of the user is extracted from the corresponding wireless attribute certificate, and the user is limited to the extracted role information. Service to be accessible (s218). For example, if the role information of the user defines a role in charge of product sales, the content providing server 30 recognizes that the user has authority as a product sales manager in response to the role information, and the user is required to sell the product. Service to register, modify, etc. the result accordingly.

On the other hand, if the wireless attribute certificate is not confirmed in step S212 (s214), the user content access rights management system 50 requests the issue of the wireless attribute certificate for the user (s216). At this time, the user content access right management system 50 operates as mentioned above to generate a wireless property certificate for the user and transmits it to the mobile terminal 10 to issue a wireless property certificate.

Thereafter, when the mobile terminal 10 stores the wireless user certificate issued from the user content access right management system 50 in the internal memory, the content providing server 10 wirelessly based on the internal memory of the corresponding mobile terminal 10. After performing the steps (s212 and s214) of checking the existence of the attribute certificate, the service is performed to allow the user to access the content based on the role information included in the wireless attribute certificate (S218).

Meanwhile, the above-described embodiment of the user content access right management system according to the present invention can be written as a program that can be executed on a computer. And, it can be implemented in a general-purpose digital computer for operating the program using a medium used in the computer. The medium includes a storage medium such as a magnetic storage medium (eg, ROM, floppy disk, hard disk, etc.) and an optical reading medium (eg, CD-ROM, DVD, etc.).

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

According to the present invention, there is an advantage that it is possible to secure the content more effectively by issuing a wireless attribute certificate to the users using the content provided on the wireless Internet through the mobile terminal to manage the content access rights of the users.

Claims (5)

(a) acquiring policy information defining content access rights and roles for the content users set by the operator of the content providing server in association with a server providing various contents on the wireless Internet; (b) when issuing a wireless attribute certificate for a predetermined user is requested from the content providing server, allocating user role information corresponding to basic information of the corresponding user based on the obtained content access policy information; (c) encrypting role information assigned to a user and basic information for issuing a wireless attribute certificate by using a predetermined encryption algorithm to generate a wireless attribute certificate; And (d) issuing the generated wireless attribute certificate to the user's mobile terminal, and storing the issued wireless attribute certificate in a directory server provided therein. Way. The method of claim 1, wherein step (b) Obtaining basic information about a predetermined user from a user authentication system for issuing and managing a certificate for a content user, and issuing a wireless attribute certificate for the user from a content providing server, accesses the content obtained in step (a). Recognizing role information corresponding to the content access authority information included in the basic information of the user based on the policy information and assigning the role information to the user characterized in that the user content access rights management method on the wireless Internet. A computer-readable recording medium having recorded thereon software for implementing the method of any one of claims 1 and 2 to be performed by an information processing apparatus. When issuance of a wireless property certificate for a predetermined content user is requested from a server providing content on the wireless Internet, the user role information corresponding to the basic information of the corresponding user is allocated based on the previously obtained content access policy information, A user authority authentication server for generating a wireless attribute certificate based on role information and basic information for issuing a wireless attribute certificate and then issuing it to the mobile terminal of the user; And And a directory server for storing the wireless property certificate generated by the user rights authentication server for each user. The method of claim 4, wherein the user authority authentication server Acquire / manage policy information defining content access rights and roles for the content users set by the content providing server's administrator, and obtain the wireless property certificate for a given user from the content providing server. A role information allocator for allocating user role information corresponding to the basic information of the corresponding user based on the received content access policy information; A certificate generator for generating a wireless property certificate by encrypting the assigned role information and basic information for issuing the wireless property certificate by using a predetermined encryption algorithm; A certificate output unit which transmits the generated wireless attribute certificate to a mobile terminal of a corresponding user and stores the wireless attribute certificate in a directory server; When the issuance of a wireless property certificate of a predetermined user is requested from the content providing server, the wireless terminal is configured with a certificate controller for controlling the role information allocator, the certificate generator, and the certificate output unit to issue the wireless property certificate for the user. User Content Access Right Management System on Wireless Internet.