KR20060091870A - Upnp network system and method for providing user authentication service - Google Patents

Abstract

The present invention relates to a UPnP (Universal Plug and Play) network system and method for providing a user authentication service. The present invention comprises an authentication server for providing a service for issuing, verifying and destroying a user certificate, and an authentication device for providing a service for establishing, maintaining, and terminating an authenticated connection based on the user certificate. The control point CP calls a user certificate issue action and a discard action provided by the authentication server, and invokes an authenticated connection establishment action, an authenticated connection maintenance action, and an authenticated connection termination action provided by the authentication device. In addition, the authentication device may call a user authentication verification action provided by the authentication server to verify a user certificate delivered by the CP to establish an authenticated connection with the CP, and if the CP does not call the authenticated connection maintenance action at predetermined intervals. Disconnect from authenticated connection. Therefore, it is possible to confirm the identity of the user in the UPnP network, thereby providing a differentiated service for each user.

UPnP, User Authentication, CP, Authentication Server, Authentication Device, Action, Service

Description

UPnP network system and method for providing user authentication service

1 is a table defining state variables of a user authentication server (UAS) service according to the present invention;

FIG. 2 illustrates an xml schema of a variable representing a certificate containing information about a user.

3 illustrates an example of a user certificate written according to a schema format including elements constituting a certificate.

4 is a table defining actions of the UAS service according to the present invention;

FIG. 5 is a table defining arguments of RequestCertificate () action, which is one of UAS service actions,

6 is a table defining independent variables of the VerifyCertificate () action, which is one of UAS service actions,

7 is a table defining independent variables of the DestroyCertificate () action, which is one of UAS service actions,

8 is a table defining state variables of a user authentication device (UAD) service according to the present invention;

9 is a table defining actions of the UAD service according to the present invention;

10 is a table defining independent variables of the SendUserCertificate () action, which is one of the UAD service actions.

11 is a table defining an independent variable of the InvalidateUserCertificate () action, which is one of UAD service actions,

12 is a table defining an independent variable of the KeepUserCertificate () action, which is one of UAD service actions,

Figure 13 illustrates the interaction between each component for user authentication according to the present invention.

The present invention relates to a Universal Plug and Play (UPnP) network system and method for providing a user authentication service, and more particularly, to a system and method for authenticating a user in a UPnP network and providing a service using this information. It is about.

UPnP (Universal Plug and Play) is a network structure that connects all kinds of devices such as information appliances, wireless devices, and PCs. This provides easy connection between devices or the Internet in a standardized way without user intervention on a non-administrator network such as a home or small office.

UPnP extends the concept of Plug and Play, which used to control devices from traditional PCs, to connect devices to the network using Web protocols without requiring any user intervention. Thus, the device can access the network at any time and can inform other devices connected to the network of the IP address or function. You can also disconnect from the network without affecting other devices.

The UPnP network consists of devices that provide services and CPs that control the devices. Devices that provide services can be broadly divided into UPnP AV (Audio / Video) devices and UPnP Basic Devices that perform multimedia data services.

The CP discovers various devices on the network, discovers what those devices serve, controls them, and receives events. Through this process, the CP that obtains information about the UPnP devices operates by calling an action on the UPnP device and responding to the UPnP device.

So far, all UPnP devices have provided services when requests come from the CP, regardless of the user requesting the action. For example, UPnP devices that provide AV content such as video, music, and photo files had to respond to service requests from legitimate CPs.

However, this approach has many problems. For example, some of the provided media files should be restricted for viewing by age, while others may only be allowed for viewing by specific individuals or groups. Thus, in the UPnP network, it has been difficult to provide differentiated services for each user.

Accordingly, the present invention was created in view of the above situation, and an object of the present invention is to provide a method for providing differentiated services for each user in a UPnP network.

In addition, another object of the present invention is to provide a method of using the same when providing a service by reliably confirming the identity of the user who requested the service in the UPnP device.

In order to achieve the above object, a UPnP network system providing a user authentication service according to an embodiment of the present invention includes a first action of issuing a user certificate containing information about a user; A second action of verifying an issued user certificate; And an authentication server for providing a user authentication server service including a third action of destroying the issued certificate. And a fourth action of transferring a user certificate issued by the first action for an authenticated connection; A fifth action of maintaining an authenticated connection; And an authentication device for providing a user authentication device service comprising a sixth action for terminating an authenticated connection, wherein the control point (CP) calls the first action to obtain a user certificate from the authentication server. Issuing, calling the third action to destroy the issued user certificate, calling the fourth action to authenticate the connection with the authentication device, and call the fifth action at predetermined intervals to authenticate with the authentication device Maintain a connected connection, and terminate the authenticated connection with the authentication device by invoking the sixth action, wherein the authentication device responds to the fourth action from the CP and sends the user certificate delivered from the CP. 2 The connection to the CP is authenticated when verified and validated by the authentication server through a call of the action. When passing a connection identifier indicating that the connection to the CP, and that is the fifth action not invoked within the predetermined interval characterized in that the breaking of the authenticated connection.

In addition, a method for providing a user authentication service in a UPnP network according to another embodiment of the present invention, the CP is issued a user certificate from the authentication server through the call of the first action; The CP communicating the user certificate to an authentication device via a call of a fourth action; Verifying, by the authentication device, the user certificate from the authentication server through a call of a second action; The authentication device, when the user certificate is verified to be valid, passing a connection identifier to the CP indicating that the connection with the CP is an authenticated connection; The CP calling a fifth action on the authentication device at predetermined intervals to maintain an authenticated connection with the authentication device; The CP calling a sixth action on the authentication device to terminate the authenticated connection with the authentication device; And discarding, by the CP, a user certificate issued by calling a third action to the authentication server, wherein the authentication device is authenticated when the fifth action is not called within the predetermined interval. It is characterized by disconnecting.

The user certificate includes a user identifier, a user name, a date of birth, a gender, a group identifier, an IP address, a signature, and is expressed in xml form.

The first action uses a user identifier and a password as input variables, and the user certificate as an output variable, and the third action uses a user identifier and a password as input variables.

The fourth action is an input variable for the predetermined interval specifying the time limit of the user certificate and authentication, and the connection identifier is an output variable, and the fifth action is an input variable for the fifth identifier. Denotes the connection identifier as an input variable and the user identifier as an output variable.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the present invention, first, a user authentication server (UAS) (hereinafter referred to as UAS) service which guarantees the identity of a user is proposed, and actions and state variables (actions) necessary for the service to operate are proposed. State Variables).

Next, we propose a user authentication device (UAD) service (hereinafter referred to as UAD) service for exchanging and utilizing user's identity information in UPnP device, and selects actions and state variables necessary for this service to operate. define.

Finally, we present a process for providing UPnP user authentication using these two services.

In a typical UPnP scenario, the CP invokes an action on the UPnP device, and the UPnP device informs the CP of the result in a manner that responds to the action. At this time, the UPnP device provides a service unconditionally for a request from the CP when the CP has access authority on the network.

The present invention proposes a method of identifying a user's identity on a UPnP network and using this information for other UPnP services. For this purpose, the following two types of UPnP services are defined.

First, let's take a look at UAS (User Authentication Server) service. The service type is as follows.

urn: schemas-upnp-org: service: UserAuthenticationServer: 1

1 defines a state variable of a UAS.

A_ARG_TYPE_UserID is a variable representing an ID for identifying a user, and is used as an argument of the RequestAuthentication () action.

A_ARG_TYPE_Password is a variable that represents the user's password and is used as an argument of the RequestAuthentication () action. It authenticates the user's identity to the authentication server.

A_ARG_TYPE_UserCertificate is a variable that represents a certificate that contains information about a user. Represented in xml form, the xml schema (Schema) is defined in FIG. Elements of xml include UserID, UserName, Birthday, Sex, GroupID, IPAddress, Signature, and so on.

UserID is the user ID used to identify the user, UserName is the user name of the ID, Birthday is the date of birth and can be used for the purpose of providing age-limited services, Sex is the gender, and GroupID is the user Represents the group to which IP belongs, and IPAddress represents the IP address of the CP for which the user has requested a certificate.

3 shows an example of a user certificate written according to a schema format including the above elements.

In addition, A_ARG_TYPE_Result is a variable associated with Result Argument which is a response to the VerifyCertificate () action. There are two possible values: VERIFIED and NOT_VERIFIED.

4 defines the actions of the UAS. The service's actions consist of three types: RequestCertificate (), VerifyCertificate (), and DestroyCertificate (). All of these are required.

RequestCertificate () requests a user certificate from UAS. Figure 5 shows the Arguments of this action, which includes a user ID that is a user ID requesting user authentication, and a password that is a password that can prove that the user. By invoking this action, the CP receives a user certificate from the UAS, which is a UserCertificate.

VerifyCertificate () is an action that verifies a user certificate. 6 shows the Arguments of this action, which consists of a UserCertificate representing the user certificate to be verified and a Result that returns the result of the verification.

DestroyCertificate () is an action that requests the destruction of a certificate issued by UAS. This action is a necessary function to prevent a third party user from randomly reusing a certificate that the user has duly issued. Fig. 7 summarizes the Arguments of this action, which requires UserID, UserID, and Password, to check if the person has the authority to request the certificate destruction.

Next, let's take a look at DAD (User Authentication Device) service. The service type is as follows.

urn: schemas-upnp-org: service: UserAuthenticationDevice: 1

8 defines the state variables of the UAD.

A_ARG_TYPE_UserCertificate is a variable representing a certificate that contains information about a user. It is used as an Argument of a SendUserCertificate () action. Follow the xml schema of FIG. 2 defined in UAS.

A_ARG_TYPE_Timeout is a variable that indicates the time when the user certificate is valid. It is used in the Argument of the SendUserCertificate () action. The CP must call the KeepAuthentication () action before the timeout occurs to ensure that the authentication connection remains valid.

A_ARG_TYPE_AuthenticatedConnectionID is a value returned as a result of the SendUserCertificate () action and is a variable representing an authentication connection ID automatically generated by the UAD. This variable uniquely identifies the connection between the authenticated user and the UAD.

9 defines the actions of the UAD. The service's actions consist of three parts, SendUserCertificate (), InvalidateAuthentication (), and KeepAuthentication (), all of which are required.

The SendUserCertificate () action is responsible for passing the user certificate to the UAD. Figure 10 summarizes the Arguments of this action, with a UserCertificate representing the user certificate and a timeout specifying the timeout of the certificate. Invoking this action, the CP receives an ID that uniquely identifies the user authentication connection from the UAD, which is the AuthenticatedConnectionID.

The InvalidateAuthentication () action functions to terminate the connection based on the user authentication information connected between the CP and the UAD. FIG. 11 summarizes the Argument of this action, in which there is an AuthenticatedConnectionID representing the currently connected authenticated connection ID.

The KeepAuthentication () action provides the ability to maintain an authenticated connection between the CP and the UAD. To prevent the authentication connection from being held indefinitely, the CP indicates that the authentication connection is still valid by invoking the KeepAuthentication () action within a shorter timeout of the SendUserCertificate () action. If there is no call to the KeepAuthentication () action within the specified time, the UAD considers the connection as no longer valid and closes the connection. FIG. 12 shows Arguments of this action, which consists of an AuthenticatedConnectionID, which represents an authentication connection ID to be kept valid, and a UserID, which is associated with the connection that is passed as a return value from the UAD.

Figure 13 shows the interaction between each component for user authentication.

First, the user calls the RequestCertificate () action on the UAS to obtain his own certificate containing the signature of the authentication server (S10, S11). The obtained certificate is transmitted to the UAD through the SendUserCertificate () action (S12). The UAD receiving the user certificate checks the status of the certificate by calling the VerifyCertificate () action on the UAS to determine the validity of the certificate (S13, S14). Return to (S15). The CP periodically calls the KeepAuthetication () action before the timeout occurs to maintain the authentication connection (S20, S21, S22, S23).

When disconnecting the authentication, the CP invalidates the certificate held by the UAD by calling the InvalidateAuthentication () action on the UAD (S30). In addition, in order to prevent the third party from reusing the certificate issued from the UAS from the same CP, DestroyCertificate () action is called to the UAS to destroy the issued certificate (S31).

As described above, preferred embodiments of the present invention have been disclosed for the purpose of illustration, and those skilled in the art can improve, change, and further various embodiments within the technical spirit and the technical scope of the present invention disclosed in the appended claims. Replacement or addition may be possible.

As described above, in the present invention, the user's identity can be confirmed in the UPnP network, and accordingly, there is an effect of providing a differentiated service for each user.

Claims (14)

A first action of issuing a user certificate containing information about the user; A second action of verifying an issued user certificate; And an authentication server for providing a user authentication server service including a third action of destroying the issued certificate. And A fourth action delivering a user certificate issued by the first action for an authenticated connection; A fifth action of maintaining an authenticated connection; And an authentication device for providing a user authentication device service consisting of a sixth action of terminating the authenticated connection, Herein, the control point CP receives the user certificate from the authentication server by calling the first action, discards the issued user certificate by calling the third action, and invokes the authentication by calling the fourth action. Establish an authenticated connection with the device, call the fifth action at a predetermined interval to maintain an authenticated connection with the authentication device, terminate the authenticated connection with the authentication device by calling the sixth action, In response to the fourth action from the CP, the authentication device is authenticated from the authentication server through a call of the second action by the user certificate transmitted from the CP and verified that the connection with the CP is verified. UPnP network system for providing a user authentication service, characterized in that for transmitting a connection identifier indicating that the connection to the CP, and if the fifth action is not called within the predetermined interval. The method of claim 1, The user certificate includes at least one or more of a user identifier, a user name, date of birth, gender, group identifier, IP address, signature, UPnP network system providing a user authentication service, characterized in that expressed in xml form. The method of claim 1, The first action is a UPnP network system for providing a user authentication service, characterized in that the user identifier and password as an input variable, the user certificate as an output variable. The method of claim 1, The third action is a UPnP network system for providing a user authentication service, characterized in that the user identifier and password as input variables. The method of claim 1, The fourth action is a UPnP network system for providing a user authentication service, characterized in that the predetermined interval specifying the time limit of the user certificate and authentication as the input variable, the connection identifier as an output variable. The method of claim 1, The fifth action is a UPnP network system for providing a user authentication service, characterized in that the connection identifier as an input variable. The method of claim 1, The sixth action is UPnP network system for providing a user authentication service, characterized in that the connection identifier as an input variable and the user identifier as an output variable. The CP issuing a user certificate from the authentication server through a call of the first action; The CP communicating the user certificate to an authentication device via a call of a fourth action; Verifying, by the authentication device, the user certificate from the authentication server through a call of a second action; The authentication device, when the user certificate is verified to be valid, passing a connection identifier to the CP indicating that the connection with the CP is an authenticated connection; The CP calling a fifth action on the authentication device at predetermined intervals to maintain an authenticated connection with the authentication device; The CP calling a sixth action on the authentication device to terminate the authenticated connection with the authentication device; And And the CP discarding the issued user certificate by calling a third action to the authentication server. Wherein the authentication device disconnects the authenticated connection if the fifth action is not called within the predetermined interval. The method of claim 8, The user certificate may include at least one or more of a user identifier, a user name, a date of birth, a gender, a group identifier, an IP address, and a signature, and the user certificate may be expressed in xml. The method of claim 8, The first action is a method for providing a user authentication service in a UPnP network, characterized in that the user identifier and password as an input variable, the user certificate as an output variable. The method of claim 8, The third action is a method for providing a user authentication service in a UPnP network, characterized in that the user identifier and password as input variables. The method of claim 8, The fourth action is a method for providing a user authentication service in a UPnP network, characterized in that the predetermined interval specifying the user certificate and the time limit of authentication is used as the input variable and the connection identifier is an output variable. The method of claim 8, The fifth action is a method for providing a user authentication service in a UPnP network, characterized in that the connection identifier as an input variable. The method of claim 8, The sixth action provides a user authentication service in a UPnP network, wherein the connection identifier is used as an input variable and the user identifier is an output variable.

Images