KR20070109040A - System and method for secure web service using double enforcement of user authentication - Google Patents

Abstract

A system and a method for securing a web service by using double enforcement of user authentication are provided to use safe and more effective web services by doing key exchange and user authentication at once without any special transmission policy. A system for securing web service using double enforcement of user authentication included a client, a security management web service server(200) and a web service server(300). The client offers user authentication information to the security management web service server after the first encryption of the user authentication information with a public key and the second encryption of the first encrypted user authentication information with a random matching key. The security management web service server offers the public key to the client. The security management web service server authenticates users by the second decryption with a private key after the first decryption of the encrypted user authentication information offered from the client with the random matching key offered from the client. The web service server encrypts a web service message exchanged with the client with the random matching key offered from the security management web service server when users request a web service.

Description

SYSTEM AND METHOD FOR SECURE WEB SERVICE USING DOUBLE ENFORCEMENT OF USER AUTHENTICATION}

1 is a schematic diagram of a typical web service specification.

2 is a general program access diagram of a web service.

3 is a diagram illustrating an encryption method using a general hybrid encryption technique.

4 is a block diagram of a security management web service system for dual reinforcement of user authentication according to the present invention;

5 is a general operational flow diagram of the present invention.

6 is a detailed flowchart of an encryption process of user authentication information of the present invention.

7 is a schematic diagram of a process of encrypting user authentication information of the present invention.

8 is a detailed flowchart of the user authentication process of the present invention.

9 is a schematic diagram of a random symmetric key exchange of the present invention.

10 is a schematic diagram of a user authentication process of the present invention.

11 is a detailed flowchart illustrating a key delivery and service initiation process according to a web service request of a user of the present invention.

12 illustrates an example SOAP message encryption delivery.

<Description of the symbols for the main parts of the drawings>

100: client 110: random symmetric key

120: user authentication information 130: primary encrypted user authentication information

140: secondary encrypted user authentication information

      200: security management web service server 210: public key

220: private key

230: Database on the Security Administration Web Service Server

300: web service server

The present invention relates to a web service system and method, and in particular, by separately placing a security management web service apart from a normal web service, to enhance the duplication of user authentication and message security and to reduce the load by distributing it with the actual web service. The present invention relates to a security management web service system and method for double reinforcement of user authentication to enable a secure and more efficient web service.

Recently, XML-based web services have emerged as the foundation of next-generation e-business that solves the problem of integrated services within or between companies. In the past, systems have used a stand-alone approach in which mainframe servers centrally process all information. Until recently, server-client approaches have become mainstream. Most of these past systems use a closed network and adopt a very fixed architecture that does not have the flexibility of the system itself, so that various data can be viewed through a web browser or processed or analyzed by importing data from another system. I could not.

According to the Gartner Group, only 20% of the world's critical business systems are networked, and the remaining 80% use server-client closed systems.

In recent years, as the company's IT investment has expanded, many systems have been introduced in the enterprise, and many of them are scattered, and many efforts have been made to integrate these distributed systems. Web services are emerging as an alternative to efficiently integrating these scattered individual applications.

The definition of web service suggests various definitions according to suppliers and related organizations, and the general definitions including these definitions are as follows.

Web services are standardized software technologies that combine existing computer system programs between a single business or a number of business entities over an open network using the Internet, and are activities that enable all businesses to use these standard technologies. Web services can be accessed through various devices such as PCs, PDAs, and mobile phones, and can be used in conjunction with various application programs such as order management software and credit information services. Web services are very flexible by defining the definitions of the data standards they exchange with each other, rather than specifying and configuring complete definitions like other software. On the Internet, web services serve as a link to bridge communication gaps between disparate operating systems and heterogeneous programming languages.

The characteristics of web services are as follows.

First is the flexibility of the system structure. In the past, the mainframe or traditional server-client approach was a closed, tightly coupled, fixed system, but Web services provide flexible integration of heterogeneous data standards through a loosely coupled software architecture. .

Second is the ease of use. The web service is provided with services that users do not feel after installing the software, and can access various web services regardless of time and place through wired / wireless terminals that can connect to the Internet. .

Third, it provides an integrated environment of existing systems. You can get integration services between your own internal or external heterogeneous applications, and the integration between the new business partners and the system is automatic. In particular, Web services will provide various benefits to companies by integrating and operating existing systems rather than building new ones.

Fourth, it is cost effective. Web services automate the integration of software in distributed systems, reducing IT development and operational costs for each enterprise, and providing interconnected tasks much faster, more flexible, and more efficient than ever before. Will improve your efficiency.

The basic standards that make up the architecture of Web services in the W3C's web service standard protocols are Hypertext Transfer Protocol (HTTP), eXtensible Markup Language (XML), Simple Object Access Protocol (SOAP), and Web Service Description Language (WSDL). And Universal Discovery Description and Integration (UDDI).

There are several specifications consisting of standard protocols used when creating web services, and FIG. 1 shows the existing web service specifications.

Currently, web sites are accessed by people through web browsers, but web services are accessed through computer programs, which expose some application logic or code. Web services are accessed through a program. The program can be any type of application shown in Figure 1, such as a web application, a window application. Applications can use your organization's internal web services, external web services from affiliates, or generic building block services. Web services may be used by other web services. 2 illustrates a general program access diagram of a web service.

On the other hand, the goal of Web Services Message Security (WS-Security) is to enable secure SOAP message exchange. It provides a variety of mechanisms that can be used to establish a range of security protocols, but it does not describe specific fixed security protocols. In other words, the focus of web service message security describes a single message security language that provides message security under the assumption of session establishment, security context, and policy agreement.

Message protection with regard to reliability and integrity is the subject of security. This message security model provides a means to protect a message by encrypting or signing the header, body, or a combination of headers and bodies of a SOAP message. The integrity of the message can be ensured by an XML Signature combined with a security token that guarantees tamper detection of the message, and the authenticity of the message can be guaranteed by XML Encryption combined with a security token to maintain the trust of the SOAP message. .

Encryption of a SOAP message is a specification for encrypting a body block, a header block, or any combination of infrastructures thereof, using a symmetric key shared by the sender and the receiver, or by transferring the symmetric key in an encrypted form.

The general steps for creating an encrypted SOAP message are as follows:

(1) Create a new SOAP envelope.

(2) Create a <wsse: Security> header.

(3) Locate the item to be encrypted.

(4) Encrypt the items and replace the encrypted data with <xenc: EncryptedData>.

(5) Create an <xenc: DataReference> element that references the generated <xenc: EncryptedData> element.

(6) Copy the rest of the unencrypted data.

The general steps for decrypting an encrypted SOAP message are as follows:

(1) Identify the decryption key owned by the recipient of the message, and identify the element of the message to be decrypted.

(2) Find <xenc: EncryptedData>.

(3) Decrypt each encrypted element in the SOAP envelope according to the XML Encryption rules.

In addition, public key-based cryptography solves the problem of key distribution well, but requires the use of large, expensive algebraic operations. In contrast, symmetric key cryptography is much more efficient. In general, public key-based cryptography is much more complicated and slower than symmetric key cryptography.

In hybrid encryption, instead of encrypting large data using public key technique, the receiver encrypts large data using symmetric cipher, and instead encrypts symmetric key using public key technique. Then send both data to the receiver. The advantage of this is that it reduces the computation time of the public key method and solves the key distribution problem. Receiving two encrypted items, the receiver first decrypts the symmetric key with its private key and then decrypts the large data using the symmetric key technique. 3 schematically illustrates encryption using a hybrid encryption technique.

In practice, many hybrid encryption techniques are used, for example, the digital envelope and the Secure Sockets Layer (SSL) protocol.

There are various technologies such as message security, security policy, privacy protection, and trust management that are existing security standard technologies for using secure web services. However, all of them are very difficult and complicated to implement. Commonly used web service security technologies include security tokens such as SAML (Security Assertion Markup Language) and Keberos embedded in web service messages to handle security tokens individually. In the case of using a conventional encryption technique such as string processing, the processing method is still complicated and there is a fear of deterioration of performance, such as using another additional technology.

In terms of user authentication, hybrid cryptography can also be problematic. Even if the user authentication information is encrypted with a random symmetric key, if it is intercepted, there is a possibility of decrypting the user authentication information, which may cause a security problem.

The present invention has been made in view of this point, and an object of the present invention is to configure a security management web service for security separately from the actual web service to double user authentication, and to exchange random keys based thereon to use it among the actual web services. The present invention provides a security management web service system and method for double reinforcement of user authentication to enhance message security and to load balance web service servers that provide real services.

Security management web service system for dual reinforcement of user authentication according to the present invention for achieving the above object, the first encryption of the user authentication information with a public key, the second encryption of the first encrypted user authentication information with a random symmetric key Client to provide to the security management web service server; A security management web service server providing the public key to a client, first decrypting encrypted user authentication information provided from the client based on a random symmetric key provided from the client, and secondly decrypting the private user with a private key. ; And a real web service server that receives a random symmetric key from the security management web service server and encrypts a web service message with the client when a user requests a web service.

The random symmetric key is randomly generated in the client when user authentication is required, and the private key is a private key of the security management web service server.

The security management web service server includes a database in which a user ID, which is user authentication information, and a random symmetric key corresponding thereto are stored in pairs, and the security management web service server overlaps the same time of the user ID and a random symmetric key pair. No. Based on the constraint of not using the same random symmetric key, the IP of the client that violates the constraint is blocked.

Security management web service method for dual strengthening of user authentication to achieve the above object, the client first encrypts the user authentication information based on the public key provided from the security management web service server, the random symmetric key 1 Firstly encrypting the second encrypted user authentication information and providing second encrypted user authentication information to the security management web service server; After the exchange of the random symmetric key between the client and the security management web service server, the security management web service server first decrypts the encrypted user authentication information provided from the client based on the random symmetric key, and then the security management web service. A second step of authenticating the user by second decrypting with the private key of the server; And a third step of, after the user authentication, when the user requests a web service from a web service server, the web service server encrypts a web service message with a random symmetric key provided from the security management web service server and exchanges the message with a client. It is characterized by.

In the first process, the second encrypted user authentication information is provided to the security management web service server together with the user ID. In the second process, the random symmetric key is exchanged between the client and the security management web service server. The client encrypts the random symmetric key with the user ID with the public key of the security management web service server and provides the random symmetric key to the security management web service server.

The security management web service server decrypts the information encrypted with the public key provided from the client with its private key, and stores a user ID and a corresponding random symmetric key pair in a database.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following examples are merely to illustrate the present invention is not limited to the contents of the present invention.

4 is a road illustrating a security management web service system for dual reinforcement of user authentication according to the present invention and a process thereof, and the present invention is largely provided by a client 100, a security management web service server 200, and a web service server 300. It is composed of

The client 100 encrypts the user ID and password, which is the user authentication information 120, with the public key 210 distributed by the security management web service server 200, and encrypts the encrypted user authentication information 130 with the client 100. In order to encrypt once again with a random symmetric key 110 randomly generated in the) to provide the user authentication information 140 and user ID encrypted twice to the security management web service server 200.

The security management web service server 200 decrypts the dually encrypted user authentication information 140 provided from the client 100 based on a random symmetric key 110, and decrypts the decrypted data. The user is authenticated by decrypting with the private key 220 of 200.

The web service server 300 transmits from the security management web service server 200 when the client 100 requests a web service of the web service server 300 after user authentication by the security management web service server 200. The random symmetric key 110 receives the encrypted message between the client 100 and the web service server 300 so as to be exchanged.

The present invention configured as described above is shown in the overall flow chart of the present invention of Figure 5, by the authentication and distribution of the public key 210, the user authentication information 120 of the security management web service server 200 Encryption process of the authentication information 120 (S100), random symmetric key 110 exchange between the client 100 and the security management web service server 200, the user authentication process (S200) to undergo a user authentication, the user's web Key delivery and service start process according to the service request (S300).

First, the encryption process (S100) of the user authentication information 120, as shown in Figure 6, the security management web service server 200 is an authorized authentication to verify whether the service is a valid service, not the disguised service of the attacker Through the authority, the security management web service server 200 is sure that it is a security manager where the actual web service 300 will be used, and receives the public key 210 from the security management web service server 200 (S110). .

Thereafter, the client 100 receives user authentication information 120 including a user ID and a password from a user, and uses the public key 210 distributed by the security management web service server 200 to authenticate the user authentication information 120. Encrypt (S120).

The encrypted user authentication information 130 is encrypted once again using a random symmetric key 110 randomly generated in the client 100 (S130). After the first encryption by the public key 210, the user authentication information 140, which is secondly encrypted by the random symmetric key 110 is sent to the security management web service server 200 through the Internet with the user ID. It is lost (S140). The random symmetric key 110 is a symmetric key generated randomly by the client 100 when user authentication of the client 100 is required. 7 is a schematic diagram of an encryption process of user authentication information 120.

The user authentication process (S200) is as shown in FIG.

First, a random symmetric key 110 is exchanged between the client 100 and the security management web service server 200.

That is, the random symmetric key 110 randomly generated by the client 100 is encrypted with the public key 210 of the security management web service server 200 together with the user ID, so that the security management web service server 200 may be over the Internet. It is delivered to (S210).

The information transmitted to the security management web service server 200 in step S210 is decrypted using the private key 220 of the security management web service server 200, and the user ID is determined to determine the security management web service server. The user ID and the corresponding random symmetric key 110 are stored in pairs in the database 230 of 200. 9 is a schematic diagram thereof.

Constraints are user ID: random symmetric key (110) pair can not overlap at the same time, the same use of the same random symmetric key (110) is impossible, for this, user ID: random symmetric key (110) pair Leave a record. If the constraint is violated more than once, it blocks based on the received IP information. User ID: The random symmetric key 110 pair is used to decrypt the encrypted user authentication information 140 sent from the client 100.

Subsequently, if the key is correctly delivered, the encrypted user authentication information 140 sent from the client 100 is decrypted based on the random symmetric key 110 exchanged between the client 100 and the security management web service server 200. (S220).

 Based on the decrypted data, it is determined whether it is sent from the correct client 100. Since the decrypted data is encrypted with the public key 210 of the security management web service server 200, it is decrypted using its private key 220 (S230). The random symmetric key 110 determines whether the user is authenticated according to whether or not the user is the same (S240). 10 is a schematic diagram of the user authentication process.

Next, the key delivery and service start process (S300) according to the user's web service request will be described with reference to FIG. 11.

After authentication of the user by the security management web service server 200, if a service request is made to use a web service that an actual user wants to use, the security management web service server 200 is received in step S200. The random symmetric key 110 is passed to the web service server 300 (S310).

The message between the client 100 and the web service of the actual web service server 300 is exchanged by encrypting part or all of the message using the web service message security specification based on the given random symmetric key 110 (S320).

12 illustrates an example of encrypting a SOAP message using a triple-DES encryption scheme using a random symmetric key 110. The message additionally contains user information about the time stamp and the key.

As described above, the present invention modifies a hybrid encryption scheme using a combination of the public key 210 distributed by the security management web service server 200 and the random symmetric key 110 generated by the client 100 to perform web service user authentication. At the same time, a security management web that exchanges the random symmetric key 110 generated by the client 100 at the same time, and encrypts the service authorized to the user according to the hierarchy based on the exchanged key after authentication. The service model is presented.

As described above, although described with reference to a preferred embodiment of the present invention, those skilled in the art various modifications of the present invention without departing from the spirit and scope of the invention described in the claims below Or it may be modified.

As described above, the present invention distributes the load on the real web service by placing the security management web service separately from the web service providing the real service, and simultaneously exchanges a user without a separate key delivery policy. Programmatically, random symmetric keys are generated, regardless of user ID and password, which are encrypted and passed to the web service, allowing real user passwords to be more securely managed. In addition, the management of the service for the user can be handled separately from the actual service, which makes management easier. That is, the present invention doubles the user authentication, and by using the random symmetric key transmitted based on the message security by strengthening the distributed processing it is possible to use the secure and more efficient web services by reducing the load.

Claims (10)

A client for first encrypting user authentication information with a public key and secondly encrypting the first encrypted user authentication information with a random symmetric key to provide a security management web service server; A security management web service server providing the public key to a client, first decrypting encrypted user authentication information provided from the client based on a random symmetric key provided from the client, and secondly decrypting the private user with a private key. ; And A web service server receiving a random symmetric key from the security management web service server and encrypting a web service message with the client when a user requests a web service; Security management web service system for dual strengthening of user authentication, characterized in that consisting of. The method of claim 1, wherein the random symmetric key is Security management web service system for dual reinforcement of user authentication, characterized in that randomly generated in the client when user authentication is required. The method of claim 1, wherein the private key Security management web service system for dual reinforcement of user authentication, characterized in that the private key of the security management web service server. The method of claim 1, wherein the security management web service server And a database in which a user ID as user authentication information and a random symmetric key corresponding thereto are stored in pairs. The method of claim 4, wherein the security management web service server Based on the constraint that the user ID and the random symmetric key pair cannot be duplicated at the same time and the same random symmetric key cannot be used, the IP of the client that violates the constraint is blocked. Security Management Web Service System. The client first encrypts the user authentication information based on the public key provided from the security management web service server, and then secondly encrypts the first encrypted user authentication information using a random symmetric key to recall the second encrypted user authentication information. Providing a security management web service server; After the exchange of the random symmetric key between the client and the security management web service server, the security management web service server first decrypts the encrypted user authentication information provided from the client based on the random symmetric key, and then the security management web service. A second step of authenticating the user by second decrypting with the private key of the server; And After the user authentication, when the user requests a web service from the web service server, the web service server encrypts the web service message with a random symmetric key provided from the security management web service server and exchanges the message with the client; Security management web service method for dual reinforcement of user authentication comprising a. 7. The security management web service method of claim 6, wherein the first process is provided to the security management web service server together with the second encrypted user authentication information as a user ID. . The method of claim 6, wherein in the second process, a random symmetric key is exchanged between the client and the security management web service server. And the client encrypts the random symmetric key with a public key of the security management web service server together with a user ID to provide the security management web service server to the security management web service server. The method of claim 8, wherein the security management web service server decrypts the information encrypted with the public key provided from the client with its own private key, and stores a user ID and a corresponding random symmetric key pair in a database. Security management web service method for dual strength of user authentication. 10. The method of claim 9, wherein the security management web service server is based on a constraint that the user ID and the random symmetric key pair can not be duplicated at the same time, the same random symmetric key can not use the IP of the client that broke the constraint Security management web service method for dual strengthening of user authentication, characterized in that blocking.

Images