KR20080052980A - Enum system and user authentication method - Google Patents

Abstract

A telephone number mapping system and a user authentication method applied to the same are provided to improve convenience of a user by using services provided from all service provider connected to a DNS server without an additional authentication process by a single authentication process of a user terminal which is performed through the DNS server of the telephone number mapping system. A user authentication method applied to a telephone number mapping system includes the steps of: if an address request of a service provider is inputted from a user terminal, determining whether an authentication for a corresponding user is needed(1); if the user authentication is needed based on the determination result, requesting a user authentication through the user terminal(2); determining whether a user authentication information inputted in response to the request is available, and if the authentication is available, generating and storing the authentication information of the corresponding user; and if an address for the service provider is requested from the user terminal having the authentication information, providing a corresponding information, and transmitting an acknowledgement information for an user authentication acknowledgement which is requested from the corresponding service provider(3).

Description

ENNMW system and user authentication method applied thereto {ENUM system and user authentication method}

1 is a schematic view showing an ENUM system according to an embodiment of the present invention;

FIG. 2 is a diagram illustrating an embodiment conceptually illustrating a user authentication method applied to FIG. 1; FIG.

3 is a flowchart illustrating an embodiment of a user authentication method applied to an ENUM system of the present invention.

The present invention relates to an ENUM (telephone number mapping) system and a user authentication method applied thereto, and more particularly, to an improved ENUM system and user authentication method applied thereto to improve user convenience and overall system security. It is about.

TElephone Number Mapping (hereinafter referred to as "ENUM") is a standard of the Internet Engineering Task Force (IETF), which is a communication protocol that converts existing telephone numbers into Internet addressing. In other words, it is proposed to map the general public network "E.164" numbering system which can integrate Internet application service into one identification system and guarantee commonality as attributes that connect with resources related to telephone number. Provide a single number that consolidates many numbers and addresses into one, such as your home phone, work phone, fax, mobile phone, or email.

In other words, ENUM is a way for a representative phone number to access other resources, such as e-mail, Internet phone, Internet fax, etc., and the sender needs to know the recipient's address, that is, the ENUM number. Easy access to multiple services or devices.

However, in such a conventional ENUM system, a user must use a new authentication every time in order to use a service provided by another service provider after using a service provided by one service provider.

And this not only acts as a hassle for the user to use the system, but also causes various security vulnerabilities.

The present invention has been proposed to solve the above problems, and an object thereof is to provide an improved ENUM system and a user authentication method applied thereto to improve user convenience and overall system security.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

In order to achieve the above object, the present invention provides a single authentication for the user terminal in the ENUM system in which a plurality of user terminals and a plurality of service providers (SPs) are interconnected through a DNS server. Through the process, the authenticated user terminal is characterized in that to enable the use of services provided from the plurality of service providers.

In this case, the single authentication for the user terminal performed by the DNS server may be SAML authentication, in which case, the DNS server is a dedicated Inter-Site Transfer Service (ITS) component for performing the SAML authentication. ) May be provided.

On the other hand, the present invention, in the authentication method applied to the ENUM system, if the address request of the service provider is input from the user terminal, determining whether the authentication of the user; Requesting user authentication through the user terminal when authentication of the user is required as a result of the determination; Determining whether the user authentication information input in response to the request is valid, and generating and storing authentication information about the corresponding user when the authentication is valid; And providing the corresponding information when there is a service provider address request from the user terminal in which the authentication information is stored, and transmitting confirmation information about the user authentication confirmation request from the corresponding service provider.

The authentication between the user and the service provider may be SAML authentication using authentication elements including assertions, protocols, bindings, and profiles.

At this time, the step of determining whether the user needs to authenticate, characterized in that by determining whether to store the authentication information of the user, if there is stored authentication information for the user does not request the user's authentication.

Meanwhile, the user authentication method of the present invention may further include providing a list of all service providers in a link form to a terminal of the user when generation and storage of authentication information for a user whose authentication is valid is completed. In this case, the service provider address request from the user terminal in which the authentication information is stored may be performed by selecting a service provider list provided in the link form.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a schematic diagram illustrating an ENUM system according to an exemplary embodiment of the present invention, and FIG. 2 conceptually illustrates a user authentication method applied thereto.

First, FIG. 1 illustrates an ENUM system equipped with a single authentication system between a terminal user and a service provider (SP) using the ENUM DNS 120. Referring to this, a terminal such as a PDA or a PC ( 110, in order to use the service, the user may first access the ENUM DNS 120 from the terminal 110 used by the user.

Then, the ENUM DNS 120 provides a form for querying the DNS through the telephone number to the user terminal 110. For this, when the user inputs a destination telephone number to the terminal 110, the user's authentication for the user is performed. Receive a user query.

In this case, as an ID for user authentication, when a user uses a mobile phone as the terminal 110, his or her mobile phone number, a personal phone number or a personal phone number when the user uses a PDA or a laptop or a PC, may be replaced. The issued separate ID may be used. However, the present invention is not necessarily limited thereto.

The following functional matters are required for each component shown in the configuration diagram of FIG. 1.

First, the mobile communication user terminal of the user terminal 110 should be capable of receiving wireless data service, and all terminals, such as a personal digital assistant (PDA) or personal computer (PC), including the mobile communication user terminal, are browsers. Should be provided.

The ENUM DNS 120 should basically store URL information mapped with the telephone number lists of the plurality of SPs 130. In addition, it must have the ability to perform authentication, which is a function of an identity provider (IDP).

The SP 130 should have a function of confirming that the requested user certificate is valid based on the certificate received from the ENUM DNS 120.

An overview of the process of authenticating a user in an ENUM system according to an embodiment of the present invention using the functions required for each of the above components will be described.

First, the user terminal 110 queries the ENUM DNS 120 using a destination telephone number of the SP1 133.

Then, the ENUM DNS 120 requests the user terminal 110 for authentication, and the user inputs an ID (such as his / her phone number) and a password through the terminal 110.

Next, the ENUM DNS 120 authenticates the user based on the received information and transmits the corresponding certificate to the SP1 133, and the SP1 133 determines whether the user certificate requested for authentication is valid based on the received certificate. Check it.

If the user is found to be a validly authenticated user, the SP1 133 passes the completed browser to the user terminal 110.

Thereafter, when the user terminal 110 wants to use the service provided from the SP2 136, authentication is performed in the following order.

First, the user terminal 110 requests access to the ENUM DNS 120 using the destination telephone number of the SP2 136. The SP2 136 requests user information from the ENUM DNS 120.

When the authentication request is transmitted from the SP2 136, the ENUM DNS 120 checks whether the authentication request of the user is the first by checking the certificate based on the session value. Next, as in the embodiment of the present invention, if the user has previously logged in to the SP1 133, the ENUM DNS 120 will notify the SP2 136 that it is a valid authenticator without a separate authentication request.

If the user is the first authentication requester, it is natural that the authentication procedure in the SP1 133 is performed.

When a valid authentication response is received from the ENUM DNS 120, the SP2 136 passes the browser on which the authentication is completed to the user's terminal 110 so that the user can use the corresponding service.

Therefore, it may be desirable to apply the SAML authentication method as the authentication method applied to the ENUM system of the present invention as described above.

SAML is an authentication method that uses elements such as Assertion, Protocol, Bindings, and Profiles.

An Assertion is a package containing certain information generated by a SAML Certificate Authority, which provides one or more statements for a particular subject.

The protocol defines the request / response to get the Assertion.

Binding defines in detail how to map the SAML protocol to standard transport and message protocols.

Profiles technically describe the flow of assertions and protocols used for specific purposes.

FIG. 2 is a diagram schematically illustrating a user authentication method applied to an ENUM system of the present invention. In a system SP requiring authentication information using a SAML artifact, a specific subject (user terminal) is illustrated in FIG. Conceptually, a method of receiving an Assertion containing authentication information is received.

Referring to FIG. 2, the single authentication process of the relying party 130 applied to the ENUM system of the present invention is performed as follows.

The user terminal 110 has an asserting party, that is, a session authenticated in the ENUM DNS 120, and wants to access specific contents in the relying party 130. In this case, it is assumed that the artifact is a base-64 encoded string.

The relying party 130 needs to determine the identity and entitlement of the user, so that the local site sends the SAML request containing the artifact to the asserting party 120 so that the local site can send the user. A request for confirmation of how the user is authenticating, and the assertions of the request for confirmation are received in a SAML response.

Then, the relying party 130 may determine whether to authenticate or authorize the corresponding user based on the assertions received as described above.

FIG. 3 is a flowchart illustrating a user authentication method applied to an ENUM system of the present invention, and illustrates a message flow in a scenario of querying using a destination phone number in a browser of a user terminal.

Here, ENUM DNS includes a component called Inter-Site Transfer Service (ITS). The component provides functionality for SAML related processing such as artifacts and redirect generation. The process is as follows.

First, the user terminal requests a destination address from the ENUM DNS (1). The ENUM DNS then checks for access, verifies that the user does not have a current session, and determines whether authentication is required (2).

In the case where the authentication is required to be authenticated by the authentication decision process (2), the user provides a certificate (e.g., an ID and password such as a phone number) to the ENUM DNS (3). If so, a session is created for that user in ENUM DNS (4). In this case, an appropriate welcome message of a portal application may be output.

Next, the user enters a command by selecting a menu of a screen output on the terminal or the like, which means that the user wants to access a resource or an application at a destination web site.

This user input generates an HTTP request to the ITS in ENUM DNS. The request includes the URL of the resource at the destination site (5).

ITS generates assertions and artifacts for that user. The artifact contains a source ID of the SAML responder that responds to the SAML request and a reference to the assertion (AssertionHandle).

The ITS sends an HTTP redirect message to the browser that includes the URL, TARGET URL and artifact of the Artifact Receiver service at the destination site. The browser receiving the redirect message generates an HTTP Get message, where <artifact> is the base64 encoded value.

The message is sent to the server hosting the TARGET URL (6).

The artifact receiver of the destination site that receives the HTTP message extracts the source ID. In this case, the mapping of the source ID and the remote SAML asserting party may be possible by a trust relationship established in advance.

In this way, the Artifact Receiver learns that it needs to communicate with the SAML Asserting Party corresponding to the extracted source ID, that is, the SAML responder. The artifact receiver of the destination site sends a SAML request including the artifacts provided by the ITS of the ENUM DNS to the SAML Asserting Party, or SAML responder, of the ENUM DNS (7).

The SAML Asserting Party of the ENUM DNS, that is, the SAML Responder, transmits a SAML response message including the assertion generated in step (6) (8). Typically, from that point on receiving a valid assertion, a session is created for that user's destination site.

An artifact receiver at the destination site sends a redirect message to the browser that includes a cookie confirming the created session. The browser processes the redirect message and issues an HTTP Get message for the target resource of the destination site (9).

Here, the GET message includes a cookie sent by an Artifact Receiver. The destination site checks whether the user has the correct access right to the destination site and whether the initial page resource is authorized to use the resource before granting access to the resource.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

According to the present invention as described above, by a single authentication process of the user terminal performed through the DNS server of the ENUM system, the user terminal passing the authentication is all SP (service provider) connected to the DNS server without additional authentication procedure By using the services provided from these, there is an effect that can greatly improve the user's ease of use ENUM service.

In addition, the present invention does not need to receive a separate authentication each time it is connected to each SP, there is an effect such as to improve the overall security level of the system.

Claims (8)

In the authentication method applied to the ENUM system, When an address request of a service provider is input from a user terminal, determining whether authentication of the corresponding user is required; As a result of the determination, requesting user authentication through the user terminal when user authentication is required; Determining whether the user authentication information input in response to the request is valid, and generating and storing authentication information about the corresponding user when the authentication is valid; And If there is a service provider address request from the user terminal in which the authentication information is stored, providing the corresponding information, and transmitting confirmation information on the user authentication confirmation request from the corresponding service provider. User authentication method of the ENUM system comprising a. The method of claim 1, Authentication between the user and the service provider is a user of the ENUM system, characterized in that it is a SAML authentication using authentication elements including Assertions, Protocols, Bindings, and Profiles. Authentication method. The method of claim 2, Determining whether the user needs to authenticate the user, The user authentication method of the ENUM system, characterized in that by determining whether to store the authentication information of the user, if there is stored authentication information for the user does not request authentication of the user. The method according to any one of claims 1 to 3, When the generation and storage of authentication information for the user whose authentication is valid is completed, providing a list of all service providers in a link form to the terminal of the user. User authentication method of the ENUM system, characterized in that it further comprises. The method of claim 4, wherein The service provider address request from the user terminal in which the authentication information is stored is performed by selecting a service provider list provided in the form of a link. In the ENUM (telephone number mapping) system in which a plurality of user terminals and a plurality of service providers (SPs) are interconnected through a DNS server, The DNS server enables the authenticated user terminal to use services provided by the plurality of service providers through a single authentication process for the user terminal. The method of claim 6, ENUM system, characterized in that the single authentication for the user terminal performed by the DNS server is SAML authentication. The method of claim 7, wherein The DNS server comprises a dedicated Inter-Site Transfer Service (ITS) component for performing the SAML authentication.

Images