KR20120011154A - System and method for managing voip service authentication password - Google Patents

Abstract

PURPOSE: A VOIP certification password management system and a method thereof are provided to facilitate synchronization of certification passwords between a call server and a user terminal by periodically changing certification password. CONSTITUTION: A call server(120) checks certification passwords classified into user terminals using the call process and control function related to a user terminal. The call server offers VOIP. The certification password management server creates certification password required for user terminal VOIP authentication. The certification password management server transmits the created certification password to the call server or the user terminal. The certification password management server changes the certification password saved in the call server or the user terminal into the created certification password.

Description

VIP service authentication password management system and its method {SYSTEM AND METHOD FOR MANAGING VOIP SERVICE AUTHENTICATION PASSWORD}

The present invention relates to a VIP service authentication password management system and a method thereof, and in particular, VIOIP by periodically or if necessary changing the authentication password required to use a Voice over Internet Protocol (VoIP) service. The present invention relates to a VIP service authentication password management system and method that can cope with security vulnerabilities and prevent illegal service use through authentication password theft.

Voice over Internet Protocol (VoIP), or Voice over Internet Protocol (VoIP), differs from public telephones in the Public Switched Telephony Network (PSTN). Says technology.

In other words, VIP is a communication service technology that enables voice calls to be made in general telephone networks by converting voice data into Internet protocol data packets. The introduction of VIP is accelerating the adoption trend due to the increase of high speed internet service and the demand of companies to reduce the call cost. VIP is able to be used simultaneously by multiple people through the cable and has excellent scalability. VIP has the advantage of being cheaper than the general public telephone network.

1 is a block diagram of a general VIP network.

As shown in FIG. 1, the VIP network includes a user terminal 110 and a call server 120. Here, the VIP network further includes a gateway 130 and a general telephone 140.

The basic structure of the VIP network is composed of a call server 120 that performs call processing and control functions and a user terminal 110 for an interface between the user.

In addition, the gateway 130 exchanges voice media or signal information between the Internet and heterogeneous networks (eg, PSTN, non-IP network, etc.). That is, the gateway 130 is connected to the user terminal 110 through the Internet, and is connected to the general telephone 140 through a public switched telephone network (PSTN).

On the other hand, the general VoIP (VoIP) network shown in Figure 1 has been developed in the form of combining a variety of information, such as data, images using the Internet as well as voice.

However, since VoIP uses the general internet network as it is, it is exposed to various security vulnerabilities that can occur in the internet network, and poses various potential risks. Here, the internet network is a packet switched network. A packet is a piece of data divided into small pieces, and is a piece of data used to transmit data.

In a packet-switched network on the Internet, as in public switched telephone networks (PSTNs), there is no monopoly circuit configuration. Packet-switched networks on the Internet support multiple simultaneous access of a single line.

In particular, among the potential risks, authentication passwords can be stolen by attackers. In the conventional VIP network, the network connection location or IP address of the user terminal 110 of the user may be changed. Accordingly, an authentication password (eg, an authentication password, etc.) used when the user accesses a phone number or a service through the user terminal 110 is used to identify the VIP user.

If it is assumed that the attacker acquires the authentication password of the user registered in the call server 120, the attacker can use the authentication password of the user to perform illegal actions such as using a free VoIP service. It becomes possible. Therefore, the conventional VIP service has a problem in that illegal service usage increases due to illegal theft of authentication passwords by malicious users.

The present invention was devised to solve the above problems, and by periodically or as necessary changing the authentication password required to use Voice over Internet Protocol (VoIP) service, it is possible to cope with VIO security vulnerability and authentication An object of the present invention is to provide a VIP service authentication password management system and a method thereof, which can prevent illegal service use through password theft.

To this end, the system according to the first aspect of the present invention, in the VIP service authentication password management system, by using the call processing and control functions associated with the user terminal to verify the authentication password for each user terminal VIO IP service Call server for providing a; And newly generating an authentication password necessary for VIP service authentication for each user terminal, and transmitting the generated authentication password to the call server or the user terminal to generate the authentication password stored in the call server or the user terminal. Characterized in that it comprises an authentication password management server for changing to an authentication password.

On the other hand, the device according to the second aspect of the present invention, the authentication password management server, a password generation unit for periodically generating a new or new authentication password for each user terminal necessary for VIP service authentication; A password transmission unit for transmitting the generated authentication password to a call server or a user terminal to request an authentication password change, and receiving a response to the change request; And a password manager configured to manage the authentication password change history in the call server or the user terminal according to the response, and store the generated authentication password.

Preferably, the authentication password generation unit, characterized in that for generating a new authentication password by combining at least one of alphabetic case, lowercase letters, numbers and special characters.

Preferably, the password management unit, characterized in that for the request to change the authentication password of the call server and the user terminal by checking the response to the authentication password in the call server and the user terminal, characterized in that.

Preferably, the authentication password management unit, if the change from the user terminal to the requested authentication password, characterized in that to restore the authentication password of the call server to the previous authentication password.

Preferably, the password management unit stores the generated authentication password when the user terminal is not registered in the call server, and if the user terminal queries the authentication password before registering with the call server, the stored authentication. Characterized in that the transmission of the password.

On the other hand, the method according to the third aspect of the present invention, in the authentication password management method in the authentication password management system, authentication password generation step of generating the authentication password for each user terminal necessary for VIP service authentication or periodically; A server authentication password changing step of changing the authentication password at the call server by transmitting the generated authentication password to a call server; And a terminal authentication password changing step of changing the authentication password in the user terminal by transmitting the generated authentication password to the user terminal.

Preferably, the method further comprises a password synchronization step of synchronizing the authentication password in the call server and the user terminal by checking whether the authentication password is changed in the call server and the user terminal.

On the other hand, the method according to the fourth aspect of the present invention, in the authentication password management method in the authentication password management server, authentication password generation step of periodically or newly generated authentication password for each user terminal required for VIP service authentication ; A server password management step of requesting an authentication password change by transmitting the generated authentication password to a call server and managing a change of the authentication password in the call server; And a terminal password management step of transmitting the generated authentication password to the user terminal, requesting the authentication password change, and managing the details of the authentication password change in the user terminal.

Preferably, the method further comprises a password synchronization step of synchronizing the authentication password in the call server and the user terminal by checking a response to the authentication password change request.

Preferably, the authentication password generation step, characterized in that for generating a new authentication password by combining at least one of alphabetic case, lowercase letters, numbers and special characters.

Preferably, the authentication password synchronization step, if the change from the user terminal to the requested authentication password, characterized in that to restore the authentication password of the call server to the previous authentication password.

Preferably, in the terminal password management step, if the user terminal is not registered in the call server, the generated authentication password is stored, and if the user terminal queries the authentication password before registering with the call server, Characterized in that the transmission of the stored authentication password.

The present invention, by periodically or if necessary changing the authentication password required to use the Voice over Internet Protocol (VoIP) service, it can cope with VIP security vulnerability and prevent illegal use of the service through the authentication password theft It can work.

That is, the present invention, by changing the authentication password stored in the call server and the user terminal periodically or automatically, if necessary, in order to respond to the illegal use of the service through the use of authentication password theft used to access the VoIP service, There is an effect that can easily synchronize the authentication password of the server and the user terminal.

In addition, the present invention makes it difficult for an attacker to use illegal services through authentication password theft, and even if the authentication password is illegally obtained by the attacker, there is an effect of easily preventing continuous illegal use by changing the authentication password.

1 is a configuration diagram of a general VIO IP network,
2 is a configuration diagram of an embodiment of a VIP service authentication password management system according to the present invention;
3 is a flowchart illustrating an authentication password management method according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The configuration of the present invention and the operation and effect thereof will be clearly understood through the following detailed description. Prior to the detailed description of the present invention, the same components will be denoted by the same reference numerals even if they are displayed on different drawings, and the detailed description will be omitted when it is determined that the well-known configuration may obscure the gist of the present invention. do.

2 is a configuration diagram of an embodiment of a VIP service authentication password management system according to the present invention.

As shown in FIG. 2, the authentication password management system 200 includes a call server 210 and an authentication password management server 220. Here, the authentication password management server 220 includes a password generator 221, a password transmitter 222, and a password manager 223.

Here, the call server 210 and the authentication password management server 220 may be connected to the user terminal 201 through the Internet. Here, the user terminal 201 is an Internet Protocol (IP) based terminal, and is connected to a VIO IP service (eg, an internet phone service, an image, a voice mail, a text data, a messenger, etc.) through a call server 210. Additional services, etc.) can be provided to the user.

Referring to the VIP network, the call server 210 performs a call processing and control function associated with the user terminal 201. The call server 120 and the user terminal 110 communicate by a predetermined protocol.

For example, a given protocol is H.323, an ITU-T standard protocol designed for real-time voice, data, and video transmission over a local area network (LAN) that does not guarantee quality of service (QoS). Media Gateway Control Protocol (MGCP), which defines the communication between Media Gateway (MG) and call control elements, or Session Initiation Protocol (SIP), an Internet Engineering Task Force (IETF) standard for providing multimedia services over the Internet. Etc.

Here, the call server 120 may be used under a different name according to each protocol. For example, the call server 120 is called a gatekeeper, a proxy server, a softswitch, or the like.

Authentication password management server 220 manages the change history of the authentication password for each terminal. Here, the change history of the authentication password refers to the change history of the authentication password for the user terminal 110 to access the VoIP service.

Looking at the authentication password management server 220 in detail, the password generation unit 221 generates a new authentication password for each user terminal necessary for VIO service authentication periodically or when necessary. In this case, the authentication password should be generated long enough by mixing alphabet letters, small letters, numbers, and special characters. Through this authentication password, messages sent and received between each component can be encrypted to increase security.

The password transmission unit 222 transmits the authentication password generated by the password generation unit 221 to the call server 210 or the user terminal 201 to request the authentication password change, and receives a response to the change request.

The password manager 223 manages the change of the authentication password in the call server 210 or the user terminal 201 according to the response of the call server 210 or the user terminal 201. The password manager 223 stores the authentication password generated by the password generator 221.

The call server 210 or the user terminal 201 changes the previous authentication password into a new authentication password transmitted from the password transmission unit 222.

Looking at the authentication password change process in detail, the password management unit 223 checks the response message of the call server 210 for the change request of the new authentication password to confirm whether the change is successful. According to whether the change is successful, the password management unit 223 re-requests the change of the authentication password when the call server 210 fails to change the new authentication password, and processes the password change after a certain number of times. On the other hand, if the change of the new authentication password is successful in the call server 210, the password management unit 223 stores the changed new authentication password in the database.

After the authentication password of the call server 210 is changed to a new authentication password, the password manager 223 confirms whether the user terminal 201 is registered with the call server 210.

As a result of the check, when the user terminal 201 is registered in the call server 210, the password manager 223 first connects to the user terminal 201 and changes the authentication password of the user terminal 201 to a new authentication password. In order to do so, the new authentication password is transmitted to the user terminal 201 through the password transmission unit 222. The user terminal 201 changes the old authentication password into a new authentication password. Through this, authentication password synchronization between the call server 210 and the user terminal 201 is maintained.

On the other hand, if the user terminal 201 is not registered as a result of the check, before the user terminal 201 registers with the call server 210, the user accesses the authentication password management server 220 and queries the changed authentication password. Then, the password manager 223 transmits the new authentication password stored in the database to the user terminal 201 through the password transmitter 222. The user terminal 201 changes the old authentication password into a new authentication password. Through this, authentication password synchronization between the call server 210 and the user terminal 201 is maintained.

Thereafter, the password manager 223 confirms to the user terminal 201 whether the user terminal 201 succeeds in changing the new authentication password.

As a result of the check, when the authentication password change in the user terminal 201 succeeds, the password manager 223 confirms that the authentication password between the call server 210 and the user terminal 201 is changed to a new authentication password, and confirms that. Save the result.

On the other hand, if the authentication password change in the user terminal 201 failed as a result of the check, the password management unit 223 considers that the authentication password change in the user terminal 201 is impossible. The password manager 223 restores the authentication password at the call server 210 from the new authentication password to the previous authentication password. This is to synchronize the authentication password between the call server 210 and the user terminal 201.

3 is a flowchart illustrating an authentication password management method according to an embodiment of the present invention.

When the authentication password management server 220 receives a password change request, the authentication password is periodically or necessary to manage the change of the authentication password.

First, the authentication password management server 220 checks whether the authentication password of the user terminal 201 is changed periodically or when necessary (302). The authentication password management server 220 may check whether a predetermined time has elapsed after the authentication password of the user terminal 201 is changed. Alternatively, when receiving a request to change the authentication password from the user terminal 201, the authentication password management server 220 may determine whether the password change is necessary to determine whether the authentication password has been changed.

As a result of checking whether the change is made, the authentication password management server 220 generates a new authentication password for the user terminal 201 that does not change the authentication password for a predetermined time or the user terminal 201 that requires a password change (304). ). That is, the authentication password management server 220 may generate new authentication passwords for the corresponding user terminals 201 by selecting the user terminals 201 after a predetermined time since the authentication password is changed. Alternatively, if there is a user terminal 201 that needs to change the authentication password even if the authentication password change period is not present, the authentication password management server 220 may generate a new authentication password for the corresponding user terminal 201.

In this case, the authentication password should be generated long enough by mixing alphabet letters, small letters, numbers, and special characters. Through this authentication password, messages sent and received between each component are encrypted to increase security.

On the other hand, if the result of the check whether the change (302), the period does not pass or the password change is not necessary, the authentication password management server 220 performs again from the "302" process.

The authentication password management server 220 transmits the generated new authentication password to the call server 210 and sequentially requests the authentication password change for the corresponding user terminals 201 stored in the call server 210 (306). .

Thereafter, the authentication password management server 220 checks the response message of the call server 210 for each authentication password change request and checks whether the change is successful (308).

If the success or failure result 308, the change of the authentication password is successful, the authentication password management server 220 stores the changed authentication password in the database (310). On the other hand, when the change of the authentication password fails, the authentication password management server 220 ends the change process.

When the authentication password change stored in the call server 210 for each terminal is successful in the process of "302" to "310", the authentication password management server 220 indicates that the corresponding user terminal 201 is the call server 210. Check whether it is registered in step 312.

If the check result 312, the user terminal 201 is registered in the call server 210, the authentication password management server 220, in order to change the authentication password of the user terminal 201 to a new authentication password, the user first The new authentication password stored in the database is connected to the terminal 201 and transmitted to the user terminal 201 (314). The user terminal 201 changes the old authentication password into a new authentication password. Through this, authentication password synchronization between the call server 210 and the user terminal 201 is maintained.

On the other hand, if the user terminal 201 is not registered in the call server 210 as a result of the check, the user terminal 201 queries the authentication password management server 220 for the authentication password before registering in the call server 210. do. Accordingly, the authentication password management server 220 transmits the new authentication password stored in the database to the user terminal 201 (316). The user terminal 201 changes the old authentication password into a new authentication password. Through this, authentication password synchronization between the call server 210 and the user terminal 201 is maintained. As such, the user terminal 201 asks the authentication password management server 220 for the authentication password before registering the authentication password in the call server 210. Then, the authentication password management server 220 notifies the user terminal 201 of the changed authentication password. This is because the authentication password management server 220 synchronizes the authentication password between the call server 210 and the user terminal 201.

Thereafter, the authentication password management server 220 confirms whether the user terminal 201 succeeds in synchronizing the authentication password with the call server 210 by changing the authentication password (318). That is, the authentication password management server 220 checks the response message for the change of the authentication password from the user terminal 201 to confirm whether the change is successful.

The verification result 318, if successful, the authentication password management server 220 stores the verification result for the authentication password change history in the database and terminates the change procedure successfully (320).

On the other hand, if the verification result 318, the change of the authentication password in the user terminal 201 failed, the authentication password management server 220 considers that the change of the authentication password in the user terminal 201 is impossible. The authentication password management server 220 restores the authentication password of the call server 210, which has already been changed, to the previous authentication password (322). This is to synchronize the authentication password between the call server 210 and the user terminal 201.

Meanwhile, the present invention does not relate to a separate authentication system for authenticating a VoIP terminal upon authentication request using subscriber information (telephone number, etc.) and terminal information (MAC address, IP address, etc.) rented to the subscriber. It is about managing the authentication password (stored in the call server and the terminal respectively) used to access the VoIP service.

That is, the present invention relates to a method of making it difficult to use illegal services through the theft of authentication information by periodically changing the authentication password periodically or when necessary, and a method of maintaining authentication information synchronization between the call server and the terminal when the authentication password is changed. .

The above description is merely illustrative of the present invention, and various modifications may be made by those skilled in the art without departing from the technical spirit of the present invention. Therefore, the embodiments disclosed in the specification of the present invention are not intended to limit the present invention. The scope of the present invention should be construed by the claims below, and all techniques within the scope equivalent thereto will be construed as being included in the scope of the present invention.

The present invention, by periodically or if necessary changing the authentication password required to use the Voice over Internet Protocol (VoIP) service, it can cope with VIP security vulnerability and prevent illegal use of the service through the authentication password theft It can work.

200: authentication password management system 210: call server
220: authentication password management server 201: user terminal
221: password generator 222: password transmitter
223: password management unit

Claims (13)

In the VIP service authentication password management system,
Call server for verifying the authentication password for each user terminal using the call processing and control functions associated with the user terminal to provide a VIP service; And
Generate a new authentication password for the VIP service authentication for each user terminal, and transmit the generated authentication password to the call server or the user terminal to transmit the generated authentication password stored in the call server or the user terminal. Password management server for changing to password
Authentication password management system comprising a. In the authentication password management server,
A password generation unit for periodically or newly generating new authentication passwords for user terminals necessary for VIP service authentication;
A password transmission unit for transmitting the generated authentication password to a call server or a user terminal to request an authentication password change, and receiving a response to the change request; And
Password management unit for managing the authentication password change history in the call server or the user terminal according to the response, and stores the generated authentication password
Authentication password management server comprising a. The method of claim 2,
The authentication password generator,
Authentication password management server for newly generating the authentication password by combining at least one of alphabetic case, number, and special characters. The method of claim 2,
The password management unit,
The authentication password management server for synchronizing the authentication password in the call server and the user terminal by checking the response of the call server and the user terminal with respect to the generated authentication password change request. The method of claim 2,
The authentication password management unit,
The authentication password management server for restoring the authentication password of the call server to the previous authentication password when the change from the user terminal to the requested authentication password fails. The method of claim 2,
The password management unit,
And storing the generated authentication password when the user terminal is not registered in the call server, and transmitting the stored authentication password when the user terminal queries the authentication password before registering with the call server. In the authentication password management method in the authentication password management system,
An authentication password generation step of periodically or as needed, generating an authentication password for each user terminal required for VIP service authentication;
A server authentication password changing step of changing the authentication password at the call server by transmitting the generated authentication password to a call server; And
A terminal authentication password changing step of changing the authentication password in the user terminal by transmitting the generated authentication password to the user terminal
Authentication password management method comprising a. The method of claim 7, wherein
Password synchronization step of synchronizing the authentication password in the call server and the user terminal by checking whether the authentication password is changed in the call server and the user terminal
Authentication password management method further comprising. In the authentication password management method in the authentication password management server,
An authentication password generation step of periodically or newly generating an authentication password for each user terminal necessary for VIP service authentication;
A server password management step of requesting an authentication password change by transmitting the generated authentication password to a call server and managing a change of the authentication password in the call server; And
A terminal password management step of transmitting the generated authentication password to the user terminal to request the authentication password change, and managing the details of the authentication password change in the user terminal.
Authentication password management method comprising a. The method of claim 9,
Password synchronization step of synchronizing the authentication password in the call server and the user terminal by checking the response to the authentication password change request
Authentication password management method further comprising. The method of claim 9,
The authentication password generation step,
Authentication password management method for newly generating the authentication password by combining at least one of alphabetic case, lowercase letters, numbers and special characters. The method of claim 10,
The authentication password synchronization step,
If the user terminal fails to change to the requested authentication password, the authentication password management method for restoring the authentication password of the call server to the previous authentication password. The method of claim 10,
The terminal password management step,
And storing the generated authentication password when the user terminal is not registered in the call server, and transmitting the stored authentication password when the user terminal queries the authentication password before registering with the call server.

Images