KR20100097474A - A method for detecting prohibited terminals when using proxy server - Google Patents

Abstract

PURPOSE: A detection method of access using relay system(proxy) is provided to detect whether terminal devices use a proxy server(relay system), thereby secluding indirect access through a relay system in not applied network. CONSTITUTION: According to an initial access of a user, a provider confirms user information from pre-stored information. The provider confirms proper password(401). If received password is confirmed by proper authentication method of the provider, packing data is encrypted by using the password(402). When a user requests a service at the beginning, the provider determines whether to use relay system by comparison with network identification information of a user device(403).

Description

A method for detecting prohibited terminals when using proxy server}

The present invention detects the access of an unauthorized network or an unauthorized device using an intermediary system (proxy server) in a service (Internet, etc.) using a network (communication network), or even if the network is an authorized network. The invention is primarily a method for detecting that a computer) simultaneously accesses a service using a single intermediary system. In a financial service or content providing system using a network, an intermediary system is configured in a network within an authorized range, and an unauthorized network or unauthorized device detects an access to a financial service or a content providing system using an intermediary system. It is also possible to detect that several authorized devices go through a single intermediary system in order to impersonate the same. The intermediary system herein refers to a proxy server or a cache server.

In the present invention, there is no prior art and background that belong to the construction or method for the overall detection. However, the whole invention is achieved by mixing various detailed techniques already developed and disclosed. Detailed description of the whole invention is as follows.

1. User authentication technology using a public certificate.

2. Encryption technology and user authentication technology using One Time Password.

3. Public and symmetric key cryptography.

4. General packet communication technology (Internet Protocol) in network communication.

The present invention relates to a method for detecting access to a financial service and a content providing service using an intermediary system in an unauthorized range network or an unauthorized device when there is an intermediary system (proxy) in an authorized range network. It is about. In other words, there is currently no method for detecting when accessing a service through an authorized intermediary system from an unauthorized network. Therefore, in financial services or content providing services, intentional security breaches through authorized intermediary services cannot be prevented. Thus, in order to prevent access itself from unauthorized devices, it is necessary to detect the technology.

1. Authenticating Users with a Public Certificate

2. Generation of data encryption keys using one time password

3. Encryption of transmitted data using key generated in 2

4. Encryption of Transmission Data Using Symmetric and Public Keys

By combining the methods of each step well, a new protocol is created.

Using the method of the present invention,

It is possible to detect whether the terminal devices use a proxy server (mediation system). Thus, the effect is

1. Indirect access through intermediary systems in unauthorized networks (eg in China, the United States, or elsewhere) may be blocked (for financial systems or game servers).

2. In authorized networks (eg, domestic PC rooms), several users (both authorized and non-authorized) can be blocked from accessing simultaneously through a single intermediary (eg game room).

The provision of services or content on the network, such as financial services or online games,

Since all of this is done anonymously online, real users and the devices they use must be authenticated and secure communication must be ensured. Especially in the provision of services or content such as financial services, online games, etc., clear authentication of users and prevention of malicious access (access control, confidentiality, integrity) should be defined. There is no way to determine whether to use it. That is, the current security system recognizes that the system is legitimate when an illegal user accesses a service from an external unauthorized network through an intermediary system by stealing the information of a legitimate user. Of course, if a service is accessed directly from an unauthorized network, the system can refuse the service. Therefore, in case of financial services, an infringement incident may occur because it is impossible to detect access by using an intermediary system in an authorized network path from a blocked user device or a user's network. In addition, for paid online game services, if the payment target is limited to a user's specific network address (IP address), a number of unauthorized users may access through the network address of the intermediary system, so that services such as financial services, online games, or In providing content, abnormal access, such as authorized users and authorized devices, using an intermediary system (proxy) must be detected and blocked.

In order to establish a method for detecting an intermediary system proposed in the present invention, the following methods should be provided.

1. Known and secure authentication methods (such as certified certificates) in user authentication

2. In communication, sufficient encryption algorithm and sufficiently secure encryption key (work

As a password)

3. Sufficiently secure compression method (various software packing techniques)

service, contents  User authentication of the provider (subject detecting unauthorized access) and detection of unauthorized access

In general, it is not possible to search for an intermediary system in the current network service. The current service system is shown in FIG. 1 illustrates a service using a current network. The actual accessing network (unauthorized) identification information (101 in FIG. 1) is changed by the intermediary system to its own information (authorized network, 102 in FIG. 1). The service provider that receives the authorized network identification information (eg, IP address) changed by the intermediate system targets the normal system to provide the normal service (103 in FIG. 1). The intermediary system transmits the information received from the service to the unauthorized user as it is (104 of FIG. 1), and the service provider recognizes the authorized relay system as the service target. This structure is a structure that can guarantee a continuous connection in the future communication.

Details of the invention and the order of the contents are as follows.

1. Service, data request to the provider of the user (FIG. 3, 301)-The user first sends a general request to the intermediary system, which transmits the information to the provider. In this case, the provider cannot determine the use of the intermediary system, but can check the network identification information of the actual network device that requested the information (network information of the intermediary system or network identification information of the user device in case of direct access).

Req (Req_Net_ID, Req_data, Req_time): Req (Request), Req_Net_ID (Network Identification Information), Req_data (Detailed Information about the Request), Req_time (Time of User Device or Intermediate System)

2. The provider requests the user a secure password that has been distributed in advance before providing the data (FIG. 3, 302). The provider requests a specific cryptographic key value for secure data communication and user authentication. The encryption key is then distributed in a sufficiently secure manner in advance.

Req (Req_data): Req (Request), Req_data (Detailed information about the request, user identification information, key request for pre-allocated user authentication)

3. The user provides a secure password upon request (one-time password) (FIG. 3, 303)-The user sends a cryptographic key at the provider's request.

E _pk (User_auth_key, User_ID): E _pk (public key encryption), User_auth_key (key for user authentication requested by the provider), User_ID (user identification information)

4. Mutual authentication with information communicated in 3 (Fig. 3, 302, 303)-The provider checks if the user is a suitable user by comparing the key transmitted by the user with the information of the user previously possessed by the provider.

D _pk (User_auth_key, User_ID): D _pk (decrypted by user's private key), User_auth_key (key for user authentication), User_ID (user identification information)

5. Using the password used in 3 as the public key, the provider packs the initial data for encryption and then uses it for encryption (Figure 4, 402). Encrypts the session key (provided by the provider) to be used and software (Active X or similar software) that conveys the network identification of the user's actual device. The software is then packed in any manner (various different packing methods depending on the provider's time information).

P _i (Data, Session_Key): P _i (packing of method i randomly chosen by the provider), Data (software to send the network identification information of the user device to the provider), Session_Key (session key to encrypt the network identification information of the user device)

6. Secure initial data transmission (FIG. 3, 304)-Use the encryption key used in steps 3, 4, and 5 or generate a one-time password to transmit encrypted data.

E _{User _ auth _ key} (P _i (Data, Session_Key)): E _{User _ auth _ key} (user authentication key identified in step 4), P _i (packing of the i method chosen by the provider), Data (user device Software that will send its network identification to the provider), Session_Key (session key to encrypt the network identification of the user's device)

7. Decompress the initial data received by the user's device using the key (or one-time key) entered in Figure 3 (FIG. 5, 501, 502, 503). If it is decrypted.

_{D User _ auth _ key (P} i (Data, Session_Key)): D User _ auth _ key ( the user authentication key found in step 4), P _i (arbitrarily the provider packing of the selected i method), Data (user equipment Software that will send its network identification to the provider), Session_Key (session key to encrypt the network identification of the user's device)

8. Decompression initial data is installed as soon as it is released (Fig. 5, 502)-Decrypted data (packed software) is installed immediately.

9. Encryption of network identification information for the user device upon installation of 9. (Encryption uses a one-time password (FIGS. 5 and 504) arbitrarily configured by a provider, included in the packed software) (FIGS. 3 and 305) ( 5, 505)-At the same time of installation, the network identification information of the currently installed user equipment is checked.

E _{Session _ Key} (Real_Net_ID): E _{Session _ Key} (encrypted with the session key generated and transmitted by the provider in step 5), Real_Net_ID (network identification information of the user device)

10. Send the data of 9 to the provider in an encrypted communication using a secure password configured in the same way as used in step 3 (FIG. 3, 302, 303, 304, 305)-the user device using the session key received from the provider in step 5. The actual network identification information of is encrypted and automatically sent to the provider.

_{E User _ auth _ key (E} Session _ Key (Real_Net_ID)): E User _ auth _ key (5 encryption level user authentication key or a one-time encryption newly created key of) the provider is created in E _{Session _Key} (5 steps Encrypted with the sent session key), Real_Net_ID (network identification of the user's device)

11. The provider decrypts the information received in step 10 and compares it with the network identification information used for the initial access of the user collected in step 1 (FIG. 4, 403). Compare network identification information accessed by.

_{D User _ auth _ key (D} Session _ Key (Real_Net_ID)): D User _ auth _ key (5 decoding step user authentication key or a one-time encryption newly created key of), D _{Session _ Key} (decrypt the session key), Real_Net_ID (Network identification of your device)

12. If they are the same, check whether they are within the authorized range and decide whether to accept them (FIGS. 4, 403),

That is, check by comparing Req_Net_ID of step 1 and Real_Net_ID of step 11.

13. If it is not the same, check whether the network identification information of the user equipment collected in step 9 is within the authorized range and determine whether to accept it (FIG. 4, 403)-compare and analyze the network identification information of steps 1 and 11 to mediate Determine the presence of a system.

Blocking malicious user attacks

Malicious users can try to attack in two ways:

1. Derivation and modification of the initial data transmitted in the user equipment

2. Derivation and change of network identification data of user equipment to be transmitted

In case of 1, the user can derive the data from inside the system with the intention of malicious software or data. However, the method of the present patent provides a short time interval that is useful for attack by installing the packed software (data). It is impossible to derive. In addition, in the case of 2, since the software (data) is executed by the user at the same time as the user is received, encrypted and transmitted at the same time, it is impossible at the current system level to attempt a known system hooking method. In addition, when the data is collected or derived using a high-speed computing system, it is difficult to modulate the transmission information because the provider's packing method is changed over time.

Representative too. Representative diagram is to explain the contents to be achieved in the present invention, when the user's device (personal computer or mobile device) is accessed by using a mediation system without direct access to a service, a content provider how to detect this It is a design of the structure.

FIG. 1. As a description of an intermediary system in a current network, it is not possible to determine whether an intermediary system is used when communicating with an authorized network or a user device as an intermediary system for unauthorized access. In this case, an unauthorized user or a user device transmits a user's request to an intermediary system within an authorized range. (101) At this time, the intermediary system uses its own network identification information rather than the actual user's network identification information. (102) When the user's request is received, the provider recognizes the intermediary system as an authorized network or user device and sends a legitimate response (103). It is possible to communicate 104 to the user, the user device. Therefore, in the current network structure, there is no way to identify and detect intermediate systems.

In the same manner as the insecure current network situation described above, an unauthorized user and a user device transmit a request of a user to an intermediary system (201). In this case, the provider collects network identification information for the initial access 202. (Network identification information of the intermediary system) In this case, in order to secure communication, in the present invention, the provider and the user have the same password. The data is pre-allocated and the packed data is encrypted and transmitted to the intermediary system so that unauthorized users cannot see it using the corresponding password (such as one-time passwords). The content of 204 is transmitted as is to the unauthorized user as it is encrypted. In this case, even if the unauthorized user is authenticated but the network is an unauthorized region, the transmitted data 205 may be decrypted. The decrypted packing data is installed (or executed) at the same time, and the packing method is changed within a sufficiently safe range of the provider. In other words, the contents packed in real time cannot be confirmed. The packing data is installed (or executed) and the network identification information of the unauthorized network is encrypted using a temporary encryption key issued by the provider included in the packing data and transmitted to the provider. (206, 207) The transmitted network identification information 206 ) And the network identification information 202 of the intermediate system collected in the initial connection to determine the presence of the intermediate system.

First, a user requests a provider to provide a service through a user device, and the provider simultaneously collects information of the user device, which can be collected from network communication data. (301) The provider according to the user's information (identifies the user). Request a corresponding secure password (one-time password) using the available ID information, etc. (302) The user provides a secure password at the request of the provider. (303) A user whose password has been previously stored in the provider. If the authentication key value is appropriate according to the information, the encrypted keying data is provided to the user by using the key as a public key (304). The data is encrypted with a one-time password issued by the provider, which is included in the data, and transmitted to the provider. (305)

According to the user's initial access, the provider verifies the user information from the pre-stored information and confirms (obtains) a suitable password. (401) Also, if the password received by the user is requested by the provider's proper authentication method, The packing data is encrypted using the corresponding cipher as a public key (402). The packed data includes software including a mechanism for transmitting information of the user equipment, software to be installed as needed, and a one-time password arbitrarily issued by the provider. Included together. As the packed data is installed (executed) on the user equipment, the network identification information of the user equipment is collected, and the collected information is encrypted and provided to the provider by a one-time password included in the prepacking data. Using the provided data, the provider initially determines whether the intermediary system is in use or not by comparing the network identification information of the user device when the user requests to provide a service.

5. Upon requesting a secure password for the user authentication of the provider, the user generates a key using a secure method previously distributed (501). The generated password then decrypts the encrypted data of the provider's packed data (502). It is used as a key value when (), and data is executed (installed) after (503). (502)

Claims (10)

In order to identify the intermediary system, the network identification information checks the initial access and the subsequent access according to the authentication to determine whether the intermediary system is used or not. In other words, in the authentication phase of the user and in the step of communicating with the provider after the authentication of the user, a structure for checking whether the intermediary system is used or directly accessed by comparing network identification information and each of the following steps 1. The data and data transmission step for the provider to the user or the user's device for identification of the intermediary system after the user's secure authentication 2. Encrypt the key used by the provider as the public key in a number of ways to provide confidentiality and integrity of the data provided in 1. 3. Using the provider's various packing methods arbitrarily to provide confidentiality and integrity inside the user equipment of the data to be encrypted in 2 4. Sending network identification information of the user equipment to the provider at the same time when the packed data is released and installed in the user equipment 5. Public key encryption in the same manner as 2 to ensure the confidentiality and integrity of the information transmitted in 4. 6. A step in which a provider determines the presence of an intermediary system by comparing the network identification information of the user equipment at the time of user authentication (initial access) with the network identification information collected in step 4. Configuration Contents of Network Identification Information 1. Unique identification information (ID) of access user 2. Network address (IP address) of the connected user device 3. Unique address (Mac address) of network connected device of connected user equipment 4. Operating system information of the connected user device (Operating system specific information, registration information) 5. Unique information of the intermediate route (router) used when the connected user equipment is connected to the provider (router's IP address) The following points when network identification information is compared between initial connection and subsequent connection 1. When the network identification information is the same in the initial connection and the subsequent connection, the user and the user equipment within the authorized range are recognized as direct access. 2. When network identification information differs between initial access and subsequent access, it is recognized as access using an intermediary system. 3. If a user accesses the same network identification information at the same time, it is recognized as access using an intermediary system. 4. When the network information is different in the initial connection and the subsequent connection. If the IP address of the user device is one of a virtual private network (VPN) address or an IP address that is not assigned to the general user, among the network identification information of the subsequent connection, and intermediate. Confirming the use of a network sharing device if the final unique identification address of the route (router) is the same as the network identification information collected from the provider at initial connection Encrypting the data using the one-time cipher as a public key in the structure of claim 1 Real time packing by the provider to ensure confidentiality inside the device in the structure of claim 1 Varying packing methods based on time intervals to maintain the confidentiality of the packed data In the structure of claim 1, the packed data (software) collects various information at the same time as the installation. In the structure of claim 1, in the case of a financial service, the security software for the existing financial service includes a software for collecting network identification data and packing In the structure of claim 1, in the case of an online game service, a structure and a step of packing and including software for collecting network identification data into existing online game software and security software for online games The structure and step of including the encryption key in the packing data in the structure of claim 1 to use as an encryption key of the data subsequently transmitted

Images