KR20050066052A - Selective identification system based identification policies and identification method therefor - Google Patents

Abstract

The present invention relates to an optional authentication system based on an authentication policy for authenticating a user by matching an authentication method required by an application server that a user wants to access with an authentication method that can be presented by the user, and a user authentication method suitable for the same.

Selective authentication system based on the authentication policy according to the present invention is an authentication policy for authenticating a user is set, an application server for allowing the user's access with reference to the authentication result of the authentication server; And an authentication server for authenticating a user at the request of the application server, wherein the authentication server includes user-authentication method information indicating authentication methods owned by the user, application server-authentication representing an authentication policy set in the melting server. A database in which policy information and the like are registered; And an authentication method determination module for selecting an authentication method suitable for the application server by referring to the database, wherein the user is authenticated by an authentication method selected by the authentication method determination module among the authentication methods registered by the user. .

The authentication method according to the present invention facilitates the design of the authentication policy of the application server by allowing the user to authenticate by matching the authentication method required by the server that the user wants to access with the authentication methods that the user can present, and allows the user to This has the effect of simplifying access to application servers.

Description

Selective identification system based identification policies and identification method therefor}

The present invention relates to an authentication method, and in particular, an optional authentication system based on an authentication policy for authenticating a user by matching an authentication method required by a server to be accessed by a user and an authentication method that can be presented by the user, and a user authentication method suitable thereto. It is about.

Modern information systems are able to provide quality services to users by connecting multiple servers, content providers, domains, etc. to wired / wireless networks. But on the other hand, information systems are also exposed to potential threats from unauthorized third parties. To address this problem, information systems provide data authentication, data confidentiality, entity authentication, authorization, and the like. Data authentication is generally accomplished through two factors: data integrity and data origin authentication. Data integrity is intended to assure the recipient of the data that the data has not been altered during transmission, and data sender authentication is intended to verify the identity of the data sender to the recipient. Data confidentiality is intended to protect its contents from being disclosed while the data is being transmitted. Entity authentication is to prove that an entity is the person who accesses the information system.

In most information systems, the most commonly used authentication methods are passwords, and there are other methods such as fingerprints, fingerprints (fingerprints), irises, certificates, and cookies. The user first registers the password he wishes to use in the system, and then authenticates himself using the registered password every time he logs in to the system. An authenticated user is considered to be a trusted user, and the system grants the authenticated user permission to access the resources he provides.

On the other hand, it is becoming increasingly important for users to access resources in different places or to allow users to access specific resources in different places. For example, an employee of a company may access resources distributed across domains at his workplace or may access a company's resources at his home.

Single Sign On (SSO) provides a method of authenticating users in multiple domains with a single login in a system environment with different domains. As for the technology related to SSO, Korean Patent Publication No. 2003-4818 (published on June 18, 2003), 2003-33630 (published on June 1, 2003), 2003-75809 (published on September 26, 2003), 2002-11608 (Published Feb. 9, 2002) and the like.

However, in the prior art, user authentication relies on a single authentication method. In the push-based authentication process where the application server directly authenticates the user, if the application server A authenticates the user using the authentication method a, while the application server B authenticates the user using the authentication method b, the user Can only access the respective application servers by different authentication methods.

On the other hand, a pull-based authentication process in which an application server authenticates a user through an authentication server is a form in which the application server omits the authentication process by a push method by trusting the authentication result provided by the authentication server. . In this case, since the application server does not know the authentication method of the authentication server, it is impossible to change the authentication method of the user who accesses it even if the internal policy or the environment changes.

On the other hand, the user can not select the appropriate authentication method according to the situation from among the various authentication methods owned by him. To illustrate this in detail, it is assumed that a user can use authentication methods based on a password and a certificate. If the application server requires authentication by certificate and the user cannot provide a certificate, there is no way for the user to access the application server.

The present invention is devised to solve the above problems, and provides an authentication system that allows an application server to select an authentication method of a user receiving a service from the user and allows the user to select one of two or more authentication methods. For that purpose.

Another object of the present invention is to provide a user authentication method suitable for the above system.

Selective authentication system based on the authentication policy according to the present invention to achieve the above object

An authentication server configured to authenticate a user, the application server permitting the user's access with reference to the authentication result of the authentication server; And

An authentication server for authenticating a user by a request of the application server,

Here, the authentication server

A database in which user-authentication method information indicating authentication methods owned by a user, application server-authentication policy information indicating an authentication policy set in the melting server, and the like are registered;

An authentication method determination module for selecting an authentication method suitable for the application server by referring to the database;

Among the authentication methods registered by the user, the user may be authenticated by an authentication method selected by the authentication method determination module.

User authentication method according to the present invention to achieve the above another object is

An application server for allowing the user access by referring to the authentication result of the authentication server; An authentication server for authenticating a user at the request of the application server, wherein the authentication server includes user-authentication method information indicating authentication methods owned by the user and application server-authentication representing authentication policies set in the melting servers. In the authentication method of the authentication system which has a database in which policy information etc. were registered,

Receiving an authentication query from an application server for which access is requested by the user;

The method may include searching for an authentication method applicable to both a user and an application server by referring to the database, and authenticating the user by the found authentication method.

Hereinafter, the configuration and operation of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a configuration of an authentication system according to the present invention. The system shown in FIG. 1 authenticates the user 102 through the authentication server 100, and the application server 104 checks this and provides the service to the user 102.

In step-by-step description, the user 102 first requests the use of the service from the application server 104 (112), and the application server 104 inquires the authentication server 100 whether the user is authenticated (114). )

The authentication server 100 authenticates the user in response to the inquiry of the molten server 104, and if it is a legitimate user, generates an authentication token, encrypts it with the encryption key shared with the application server 104, and provides it to the application server 104. (116)

The application server 104 decrypts the authentication token from the authentication server 100 with its decryption key to confirm that the user is authenticated.

After confirming that the user is authenticated, the application server 104 provides a service to the user.

If the application server 104 does not receive an authentication token from the authentication server 100, the application server 104 directs the user 102 to the authentication server 100. (118)

The user 102 requests authentication from the authentication server 100. 122

The authentication server 100 compares the authentication policy of the application server 104 stored in the database with the authentication methods of the user and authenticates the user with an appropriate authentication method. When the authentication server 100 authenticates the user, the authentication token is encrypted with an encryption key shared with the application server 104 to be provided to the user, and the user 102 is guided to the application server 204. (124)

The user 102 presents the authentication token received from the authentication server 100 to the application server 104. (120) The application server 104 decrypts the authentication token provided from the user 102 with its decryption key. Confirm that is authenticated.

2 is a block diagram showing another example of an authentication system according to the present invention. The system shown in FIG. 2 authenticates the user 202 through the authentication server 200, and the application servers 204 and 206 confirm this to provide services to the user 202. Here, it is assumed that the application servers 204 and 206 have different authentication policies. For example, the melting server A 204 may authenticate by a password, and the application server B 206 may authenticate by a certificate.

The authentication server 200 has information about the authentication policies of the application servers 204 and 206 and information about various authentication methods registered by the user 202, and is one of the application servers 204 and 206. When authentication is requested from the user, the user 202 is authenticated with an authentication policy appropriate to the application server requesting authentication with reference to the information he has.

Here, the authentication policy includes at least an authentication method, and in addition, includes an application time, an application position, and the like of the authentication method. The authentication method refers to a specific means for authentication, and includes a password, fingerprint recognition, hydrology recognition, iris recognition, voiceprint recognition, recognition by a certificate, and the like.

The application time may be expressed as a certain time of the day, or may be expressed as a day, month, period, etc. The application location may be an IP (Internet Protocol) address or location information provided by a location-based service.

User 202 may own one or more authentication methods, and application servers 204 and 206 each own one authentication policy.

In order for the user 202 to access the application servers 202 and 204, first register the authentication methods that can be used by the authentication server 204. The authentication methods registered by the user 202 are registered in the database of the authentication server 200 as a user-authentication method shield. For example, a user name, a user's password (priority 1), a user's certificate (priority 2), and the like are recorded in the user-authentication method file.

The user 202 may determine the priority of currently available authentication methods among the owning authentication methods. For example, if both a password and a certificate can be used, the user 202 may set the password to be prioritized when registering with the authentication server 200.

In the database of the authentication server 200, information on the set authentication policies is registered as an authentication policy feed. The authentication policy has elements such as authentication method, application time, and application location. For example, the authentication policy may be {password, working hours, in-house}, {certificate, working hours, outside the company}. If the authentication policy is {Password, Working Hours, In-House}, it indicates that the workplace authenticates with a password within working hours.

In the database of the authentication server 200, information about the authentication policy applied to the application servers 204 and 206 is registered as a cited application server-authentication policy feed. For example, the application server-authentication policy file records the application server name and the authentication policy set in the application server.

3 illustrates a configuration of a database provided in the authentication server 200 illustrated in FIG. 2. The database 300 of the authentication server 200 registers information necessary for authentication, that is, authentication policy information, user-authentication method information, and application server-authentication policy information.

Examples of contents stored in each of the fields 300a to 300c of the database 300, that is, the authentication policy file, the user-authentication method file, and the application server-authentication policy file, are as follows.

Authentication Policy Feed: Authentication Policy 1 = {Password, 00:09 18:00, In-house}

Certification Policy2 = {Certificate, 18:00 09:00, Outside}

Certification Policy 3 = {fingerprint, 18:00 09:00, outside}

Application Server-Authentication Policy: Application Server A = {Authentication Policy 1, Authentication Policy 2}

                    Application Server B = {Authentication Policy 2, Authentication Policy 3}

User-Authentication Method: User1 = {Password (Priority 1), Certificate (Priority 2) ,,,,}

User2 = {Password (Priority 1), Fingerprint (Priority 2) ,,,}

The authentication server 200 refers to the database 300 to find an authentication method that can be applied to both the user and the application server accessed by the user, and authenticates the user 202 by the found authentication method. For example, if a user 1 who can use a password and a certificate wants to access the application server 1 in-house within working hours, the authentication server 200 authenticates the user 1 by a password. In addition, when the user 1 wants to access the application server 1 outside the office hours, the authentication server 200 authenticates the user 1 by the certificate.

Selecting an authentication method suitable for the application server is performed by the authentication method determination module 302 shown in FIG. The authentication method determination module 302 compares the current time, the location of the user, and the authentication policy of the application server that the user wants to access to find one or more authentication methods. Select an authentication method. The authentication server 200 authenticates the user 202 by the authentication method determined by the authentication method determination module 302.

The user authentication method in the system shown in FIG. 2 is performed as follows.

First, the user 202 requests the application server A 204 to use the service (212).

Application server A (204) inquires the authentication server 200 whether the user is authenticated (214).

The authentication server 200 refers to the database 300 to find an authentication method that can be applied to both the user and the application server, and authenticates the user 202 by the found authentication method. For example, when user 1 who can use the password and certificate wants to access the application server A in-house within working hours, the authentication server 200 authenticates the user 1 by the password.

The authentication server 200 encrypts the authentication result with the encryption key shared with the application server A 204 to generate an authentication token, and provides the authentication token to the application server A 204.

The application server A 204 decrypts the authentication token from the authentication server 200 with its decryption key to check whether the user is authenticated.

Upon confirmation that the user is authenticated, application server A 204 provides the requested service to user 202.

If the application server 204 does not receive the authentication token, the application server A 204 directs the user 202 to the authentication server 200. (218)

The user 202 requests the authentication server 200 to authenticate.

The authentication server 200 refers to the database 300 to find an authentication method that can be applied to both the user and the application server, and authenticates the user 202 by the found authentication method. When the user is authenticated, the authentication server 200 generates an authentication token, encrypts it with the encryption key shared with the application server A 204, provides the user, and guides the user 202 to the application server 204. (224)

On the other hand, when the user 202 accesses the application server B 206 which authenticates the user by the authentication policy 2 outside the working hours, the authentication server 200 authenticates the user 202 by the certificate.

In the authentication system according to the present invention, when the application server wants to change the authentication method, it is only necessary to register a new authentication policy in the authentication server 202. For example, the application server A may change the authentication policy 1, that is, the authentication using an in-house password during working hours to authenticate using an in-house certificate during working hours. User 1 may respond to a change in the application server A's authentication policy by prioritizing the certificate, and user 2 will be asked to issue a certificate.

An example of selecting an authentication method by the user in the authentication system according to the present invention will be described.

Assume that the melting server B 206 uses the authentication policy 2 and the authentication policy 3, and the priority of the user 2 is set to fingerprint.

In this case, since the authentication server is set to authenticate the user by a fingerprint or a certificate, and the priority of user 2 is set as the fingerprint, the authentication server responds to user 2 in the process of authenticating the user in response to application server B's authentication inquiry. You will be asked to submit a fingerprint.

Unfortunately, authentication fails if the user is unable to submit fingerprints. As a result, the application server B 206 does not receive the authentication token from the authentication server 200, and guides the user 202 to the authentication server 200.

In this case, the user 202 may be authenticated by changing the priority from fingerprint to certificate. When the user is authenticated, the authentication server 200 generates an authentication token, encrypts it with the encryption key shared with the application server B 206, provides the user to the user, and guides the user 202 to the application server B 206. . The user 202 provides the authentication token provided from the authentication server 200 to the application server B 206, and the application server B 206 checks this and provides a service to the user 202.

As described above, the authentication method according to the present invention facilitates the design of the authentication policy of the application server by matching the authentication method required by the server that the user wants to access with the authentication methods that the user can present to authenticate the user. It has the effect of simplifying the user access to these application servers.

In addition, the authentication method according to the present invention has the effect that the user can selectively use a variety of authentication methods owned by him.

1 shows a configuration of an authentication system according to the present invention.

2 is a block diagram showing another example of an authentication system according to the present invention.

FIG. 3 shows a configuration of a database provided in the authentication server shown in FIG. 2.

Claims (10)

An authentication server configured to authenticate a user, the application server permitting the user's access with reference to the authentication result of the authentication server; And An authentication server for authenticating a user by a request of the application server, Here, the authentication server A database in which user-authentication method information indicating authentication methods owned by a user, application server-authentication policy information indicating an authentication policy set in the melting server, and the like are registered; An authentication method determination module for selecting an authentication method suitable for the application server by referring to the database; Selective authentication system based on the authentication policy, characterized in that for authenticating the user by the authentication method selected by the authentication method determination module among the authentication methods registered by the user. The method of claim 1, wherein the authentication policy information further includes information indicating an application time and an application location, and the authentication method determination module refers to time information when the user accesses the server, location information of the user, and the database. Selective authentication system based on the authentication policy, characterized in that for selecting the appropriate authentication method for the server. 3. The selective authentication system based on an authentication policy according to claim 2, wherein the application time represents a certain time of day, day of week, month, period, and the like. The selective authentication system based on the authentication policy of claim 2, wherein the application location is location information provided by an IP address or location-based service. The method of claim 2, The user-authentication method information has information indicating the priority of these authentication methods in addition to the authentication methods owned by the user, and the authentication method determination module selects by priority if there are a plurality of authentication methods suitable for the server. Optional authentication system based on authentication policy. An application server for allowing the user access by referring to the authentication result of the authentication server; An authentication server for authenticating a user at the request of the application server, wherein the authentication server includes user-authentication method information indicating authentication methods owned by the user and application server-authentication representing authentication policies set in the melting servers. In the authentication method of the authentication system which has a database in which policy information etc. were registered, Receiving an authentication query from an application server for which access is requested by the user; A method of authenticating a user, comprising: finding an authentication method applicable to both a user and an application server by referring to the database, and authenticating the user by the found authentication method. The apparatus of claim 6, wherein the authentication policy information further includes information indicating an application time and an application location, wherein the time information when the user accesses the server and the location information of the user, and the authentication suitable for the server are referred to the database. A method for authenticating a user, characterized by selecting a method. 8. The user authentication method according to claim 7, wherein the application time represents a certain time of day, day of week, month, period, and the like. The user authentication method of claim 8, wherein the application location is location information provided by an IP address or location-based service. The method of claim 6, The user-authentication method information has information indicating the priority of these authentication methods in addition to the authentication methods owned by the user, and if there are a plurality of authentication methods suitable for the server, the user authentication method is selected by priority. .