KR20130140483A - System for unified authorization and subscriber terminal - Google Patents

Abstract

Integrated authentication system and subscriber terminal according to an embodiment of the present invention are disclosed. Here, an integrated authentication system includes: a subscriber resource management unit for receiving an integrated authentication request from a subscriber terminal, confirming service subscription information based on subscriber identification information included in the integrated authentication request and confirming a plurality of services which a corresponding subscriber subscribes; an authentication management unit for obtaining each service right for using the plurality of services; and an integrated authentication issue unit for generating an integrated authentication key having the each service right and transmitting to the subscriber terminal. [Reference numerals] (100) Subscriber terminal;(103) Integrated authentication management unit;(200) Integrated authentication system;(300) Terminal/service authentication system;(301) HDS-TV server;(303) HDS-SoIP server;(307) 3G authentication server;(400) ID authentication system;(AA) Olleh EBook;(BB) WiFi footage;(CC) Life jockey;(DD) Olleh market;(EE) Music;(FF) Time coordination;(GG) Customer service center

Description

Integrated authentication system and subscriber terminal {SYSTEM FOR UNIFIED AUTHORIZATION AND SUBSCRIBER TERMINAL}

The present invention relates to an integrated authentication system and a subscriber terminal.

Service authentication schemes for Android-based services and terminals are very diverse. Each application installed in the terminal individually accesses the authentication system for user authentication, receives an authentication result value, and provides a service of the corresponding application. That is, in the same terminal, an ID and a password should be input for each application.

For example, an application using a show ID must enter a show ID, and an application using a cook ID must enter a cook ID.

In addition, the smartphone requires 010 number authentication. PAD and smart home pads require ID authentication. SoIP, smart home pads, TVs, and keyboards require HDS certification.

In addition, LifeJackie on HomePad has to be both Cook ID certified and HDS certified. As authentication becomes more complex, application development becomes more difficult.

In addition, as different authentication schemes are applied to terminals and services, cost and complaints are increasing.

In addition, when the authentication system is modified or changed, it is necessary to modify the authentication interworking of all services. That is, when SSO (Single Sign on) authentication is changed to SDP (Service Delivery Platform) authentication, all services or applications that have been linked with SSO must be modified to apply the SDP interworking standard.

The technical problem to be achieved by the present invention is to verify the subscriber information when the terminal receives one type of authentication, after the authentication of all the services subscribed to the subscriber, integrated authentication for providing the terminal with the authentication authority that can be used in all services It is to provide a system and a subscriber terminal.

According to an aspect of the present invention, the integrated authentication system receives an integrated authentication request from a subscriber terminal, and checks a plurality of services subscribed to by a corresponding subscriber by checking service subscription information based on subscriber identification information included in the integrated authentication request. Subscriber resource management unit; An authentication manager for acquiring each service right for using the plurality of services; And an integrated authentication key issuing unit for generating an integrated authentication key including the respective service rights and transmitting the generated authentication key to the subscriber station.

At this time, the terminal information retained by the subscriber for each subscriber, the ID and password for each service subscribed to by the subscriber, the telephone number of the telephone terminal held by the subscriber and a plurality of service subscription information subscribed to by the subscriber Include more databases,

The subscriber resource management unit,

Search the database using the subscriber identification information, extract the terminal information, the ID and password, the telephone number of the telephone terminal, and the plurality of service subscription information, and transmit the extracted information to the authentication manager;

The authentication management unit,

After accessing an authentication system for using each service identified using the plurality of service subscription information, authentication is performed using the terminal information, the ID and password, and the telephone number of the telephone terminal, and then the respective service authority. Can be obtained.

In addition, each service right may be an automatic login cookie for each service, and the integrated authentication key may be an integrated authentication cookie including the respective automatic login cookie.

In addition, the authentication management unit,

Interconnected with the terminal and / or service authentication system, ID authentication system and network access authentication system through an external network or an internal network,

A first authentication module connected to the terminal and / or service authentication system to perform device authentication using the terminal information; A second authentication module accessing the terminal and / or service authentication system to perform storage over IP (SOIP) call type authentication using the terminal information and the telephone number; A third authentication module which accesses the terminal and / or service authentication system and performs SOIP non-call authentication using the terminal information; A fourth authentication module which accesses the terminal and / or service authentication system and performs TV non-call authentication using the terminal information; A fifth authentication module configured to access the ID authentication system and perform authentication using the ID and password; A sixth authentication module which accesses the ID authentication system and performs third party subscriber authentication using the ID and password; And a seventh authentication module for accessing the network access authentication system and performing IP authentication using the terminal information.

In addition, the authentication management unit,

When the authentication method is changed, a plurality of service-specific authentication methods related to the changed authentication method may be modified.

In addition, the subscriber identification information included in the integrated authentication request,

It may include a terminal unique number or a terminal IP address.

In addition, the subscriber identification information included in the integrated authentication request,

It may include the ID and password entered by the user.

In addition, the subscriber identification information included in the integrated authentication request,

It may include the telephone number of the subscriber station.

In addition, the integrated authentication key management unit for storing the integrated authentication key issued by the integrated authentication key issuing unit; And an integrated authentication key verification unit for receiving an integrated authentication key verification request from the subscriber terminal, verifying the validity of the verification request for the integrated authentication key in association with the integrated authentication key manager, and returning a verification result. .

In addition, the integrated authentication key issuing unit,

If the integrated authentication key verification unit fails to validate, after re-requesting the authentication authority by re-authenticating the authentication manager, the integrated authentication key may be regenerated and transmitted to the subscriber station.

According to another aspect of the present invention, the subscriber station is a subscriber station capable of transmitting and receiving data by accessing a network, comprising: an execution unit executing one or more applications requiring service authentication; And an integrated authentication key manager configured to manage an integrated authentication key including service rights of each of the one or more applications, and deliver the integrated authentication key to the execution unit according to a request of the execution unit.

The execution unit may include:

Selecting a service authority required for service authentication of the executed application from each of the service authority included in the integrated authentication key, a service server, wherein the service server is a server for controlling authentication and services for using the executed application. You can connect directly to

At this time, the integrated authentication key management unit,

When the integrated authentication key is not stored in advance, the integrated authentication request including the subscriber identification information may be performed by the integrated authentication system. Acquire each service right and generate the integrated authentication key to receive the integrated authentication key.

In addition, the integrated authentication key management unit,

When an authentication failure using the integrated authentication key is received from the execution unit, the integrated authentication key verification request including the authentication failure may be transmitted to the integrated authentication system.

In addition, the integrated authentication key management unit,

When the valid response is received from the integrated authentication system, the valid response is transmitted to the execution unit,

The execution unit may include:

Authentication using the integrated authentication key can be performed again.

In addition, the integrated authentication key management unit,

Receive a newly generated integrated authentication key with an invalid response from the integrated authentication system and delivers it to the execution unit,

The execution unit may include:

Authentication may be performed again using the newly generated integrated authentication key.

In addition, the integrated authentication key management unit,

Subscriber identification information according to the type of subscriber station and the type of authentication of the executed application may be included in the integrated authentication request.

In addition, the integrated authentication key management unit,

One or more of a terminal unique number or a terminal IP address, a telephone number of the subscriber station, and an ID and password input by requesting a user may be included in the integrated authentication request.

According to an embodiment of the present invention, when requesting authentication by receiving one ID from the same terminal, after completing authentication of all services used by the customer based on the ID, issuing an integrated authentication key usable in all services With only one authentication, you can use the service regardless of the authentication type.

In addition, all services are available with a single login, increasing user convenience.

In addition, it is easy to develop a service that must work with a plurality of authentication systems.

In addition, since the authentication value is shared within the same terminal, it provides SSO (Single Sign On) between applications.

In addition, since the component for managing the integrated authentication key substitutes for the authentication function, there is an effect of reducing the certification development period and cost of the application.

In addition, it is possible to reduce costs due to the need for no authentication module development when developing new services.

1 is a configuration diagram of an authentication network using an integrated authentication key according to an embodiment of the present invention.
2 is a diagram schematically illustrating an authentication process using an integrated authentication key according to an embodiment of the present invention.
3 is a block diagram showing the configuration of a user terminal according to an embodiment of the present invention.
4 is a block diagram showing the configuration of an integrated authentication system according to an embodiment of the present invention.
5 is a flowchart illustrating an integrated authentication method according to an embodiment of the present invention.
6 is a flowchart illustrating an integrated authentication method according to another embodiment of the present invention.
7 is a flowchart illustrating an integrated authentication method according to another embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

In this specification, a terminal includes a mobile station (MS), a mobile terminal (MT), a subscriber station (SS), a portable subscriber station (PSS), a user equipment , An access terminal (UE), an access terminal (AT), and the like, and may include all or some functions of a terminal, a mobile terminal, a subscriber station, a mobile subscriber station, a user equipment,

In this specification, a base station (BS) includes an access point (AP), a radio access station (RAS), a node B, an evolved NodeB (eNodeB) A base station (BTS), a mobile multihop relay (MMR) -BS, or the like, and may perform all or a part of functions of an access point, a radio access station, a Node B, an eNodeB, a base transceiver station, .

Hereinafter, an integrated authentication system and a subscriber station according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an authentication network using an integrated authentication key according to an embodiment of the present invention.

Referring to FIG. 1, the subscriber station 100 includes one or more applications 101 and an integrated authentication key manager 103 using different authentication schemes.

In this case, the one or more applications 101 obtain a service right by using the integrated authentication key provided by the integrated authentication key manager 103.

The integrated authentication key manager 103 operates in conjunction with the integrated authentication system 200 and receives an integrated authentication key from the integrated authentication system 200. The integrated authentication key issued according to the request of the one or more applications 101 is transmitted to the one or more applications 101.

In addition, the integrated authentication system 200 is connected to a plurality of different authentication systems (300, 400) to obtain a service right through each authentication process to generate an integrated authentication key.

In this case, the plurality of different authentication systems 300 and 400 include a terminal / service authentication system 300 and an ID authentication system 400.

The terminal / service authentication system 300 performs authentication using terminal information and ID. The terminal / service authentication system 300 includes a home digital service (HDS) -TV server 301, a service over IP (HDS-SoIP) server 303, a home subscriber server (HSS) 305, and a 3G authentication server ( 307).

Here, the HDS-TV server 301 and the HDS-SoIP server 303 collects terminal information of the subscriber terminal 100 and performs authentication. The terminal information is, for example, an STB cookie and a media access control (MAC). It may include an address, a personal identification number (PIN) number, a terminal model name, and a smart card authentication number.

In addition, the HSS 305 registers a PUID (Private ID) and a PRID (Private ID) in advance, and when a user registers in a network, the HSS 305 performs user authentication in comparison with information posted from the terminal.

In addition, the 3G authentication server 307 checks the mobile phone number and IP information transmitted by the subscriber terminal 100 to authenticate whether or not the user is a legitimate user.

The ID authentication system 400 is an ID-based authentication system and may include a plurality of ID authentication servers for each ID type.

2 is a diagram schematically illustrating an authentication process using an integrated authentication key according to an embodiment of the present invention.

Referring to FIG. 2, the subscriber station 100 includes a first user terminal 110, a second user terminal 130, and a third user terminal 150.

In this case, the first user terminal 110 may include an integrated authentication key manager 103, and receive the integrated authentication key by transmitting a terminal unique number and an IP address to the integrated authentication system 200. The first user terminal 110 may be a mobile phone terminal such as a smart phone.

Here, the terminal unique number may include a Mobile Station International ISDN Number (MSSI), an International Mobile Subscriber Identity (IMSI), and an International Mobile Equipment Identity (IMEI).

In addition, the second user terminal 130 may also include an integrated authentication key management unit 103 and may transmit an ID, password, and ID type to the integrated authentication system 200 to receive the integrated authentication key. The second user terminal 130 may be a tablet device, for example, a pad (PAD), a smart home pad, or the like.

In addition, the third user terminal 150 may also include an integrated authentication key management unit 103 and transmit a phone number to the integrated authentication system 200 to receive the integrated authentication key. The second user terminal 150 may be a SoIP terminal, a smart home pad, or the like.

Here, the information transmitted by the first user terminal 110, the second user terminal 130, and the third user terminal 150 differently, that is, the terminal unique number, IP address, ID and password, telephone number is a subscriber Identification information. The integrated authentication system 200 uses the subscriber identification information to grasp all the services subscribed to by the subscriber. The terminal / service authentication system 300 and the ID authentication system 400 interwork with each other to obtain respective service rights through authentication of each service subscribed to by the subscriber to generate an integrated authentication key.

3 is a block diagram showing the configuration of a user terminal according to an embodiment of the present invention.

Referring to FIG. 3, the subscriber station 100 includes n applications 101, an execution unit 105, and an integrated authentication key manager 107.

That is, the subscriber station 100 may download and install n applications 101 from an application server (for example, an app store) (not shown). In this case, the n applications 101 implement a corresponding service after service authentication in association with a service server (not shown). In addition, different authentication methods may be used, and two or more authentication methods may be combined.

Here, the service server (not shown) is a server that controls authentication and services for using the executed application.

The integrated authentication key manager 103 receives and manages an integrated authentication key including the respective service rights for the n applications 101 from the integrated authentication system 200. Then, the integrated authentication key is delivered at the request of the execution unit 105.

The integrated authentication key manager 103 transmits an integrated authentication request including subscriber identification information according to the type of the subscriber station 100 and the authentication type of the executed application to the integrated authentication system 200 to receive an integrated authentication key.

In this case, the subscriber identification information may include at least one of a terminal unique number or a terminal IP address, a telephone number of the subscriber terminal 100, and an ID and password received by the user.

The execution unit 105 executes one application 101 of the n applications 101, and at this time, the integrated authentication key manager 107 requests and receives the integrated authentication key. The service authority required for service authentication of the executed application is selected from each service authority included in the integrated authentication key and directly connected to the corresponding service server (not shown) without any other authentication procedure.

4 is a block diagram showing the configuration of an integrated authentication system according to an embodiment of the present invention.

4, the integrated authentication system 200 includes an interface unit 210, a subscriber resource management unit 220, a database 230, an authentication management unit 240, an integrated authentication key issuing unit 250, and an integrated authentication key management unit. 260 and the integrated authentication key verification unit 270.

The interface unit 210 is connected to the integrated authentication key management unit 103 of the subscriber station 100 to transmit and receive data. That is, it receives the integrated authentication request and transmits the integrated authentication key. In addition, it receives a verification request of the integrated authentication key and transmits the verification result.

The subscriber resource manager 220 searches the database 230 based on the subscriber identification information included in the integrated authentication request received from the subscriber station 100 to confirm service subscription information. And check the plurality of services subscribed to the subscriber.

The database 230 includes a subscriber device DB 231, a subscriber ID DB 232, a subscriber telephone number DB 233, and a subscription service authority DB 234.

Here, the subscriber device DB 231 stores the terminal information held by the subscriber for each subscriber. At this time, the terminal information includes a terminal unique number.

The subscriber ID DB 232 stores IDs and passwords for services subscribed to by subscribers.

The subscriber telephone number DB 233 stores the telephone number for each subscriber by the telephone terminal held by the subscriber.

The subscription service authority DB 234 interworks with the subscriber device DB 231, the subscriber ID DB 232, and the subscriber telephone number DB 233, and provides a plurality of service subscription information subscribed to by a subscriber for each subscriber and for each service. Save service permissions.

Accordingly, the subscriber resource management unit 220 uses the subscriber identification information included in the integrated authentication request, using the subscriber device DB 231, the subscriber ID DB 232, the subscriber telephone number DB 233, and the subscription service authority DB 234. Search for and extract the terminal information, ID and password, phone number and a plurality of service subscription information and transmits to the authentication management unit 240.

The authentication manager 240 acquires each service right for using the plurality of services checked by the subscriber resource manager 220. That is, the system accesses authentication systems 300 and 400 for using each service identified using the plurality of service subscription information received from the subscriber resource management unit 220. The terminal information, ID and After authentication is performed using a password and a telephone number, each service authority is obtained.

The authentication manager 240 may include an ID authentication module 241, a third party subscriber authentication module 242, a terminal authentication module 243, an IP authentication module 244, a SOIP call type authentication module 245, and a SOIP non-call type authentication module. 246 and the TV non-call authentication module 247.

The ID authentication module 241 accesses the ID authentication system 400 to perform authentication using a subscriber's ID and password, and then obtains a service right for each service.

The third party subscriber authentication module 242 accesses the ID authentication system 400 to perform third party subscriber authentication using the subscriber's ID and password, and then obtains a service right for each service.

The terminal authentication module 243 accesses the terminal and / or the service authentication system 300 to perform device authentication using the terminal information of the subscriber, and then acquires a service right for each service.

The IP authentication module 244 accesses the terminal and / or the service authentication system 300 to perform IP authentication using the subscriber's terminal information, and then obtains a service right for each service.

The SOIP telephony authentication module 245 accesses the terminal and / or the service authentication system 300 to perform SOIP telephony authentication using the terminal information and the phone number of the subscriber, and then acquires the service right for each service.

The SOIP non-call authentication module 246 accesses the terminal and / or the service authentication system 300 to perform SOIP non-call authentication using the terminal information of the subscriber, and then acquires a service right for each service.

The TV non-call authentication module 247 accesses the terminal and / or service authentication system 300 to perform TV non-call authentication using the terminal information, and then acquires a service right for each service.

Each of the authentication modules 241, 242, 243, 244, 245, 246, and 247 performs a plurality of service-specific authentication schemes related to the changed authentication scheme when the authentication scheme is changed.

The integrated authentication key issuing unit 250 generates an integrated authentication key including each service right acquired by the authentication manager 240 and transmits the generated authentication key to the subscriber station 100.

Here, each service right may be an automatic login cookie for each service. The integrated authentication key may be an integrated authentication cookie including each automatic login cookie.

Cookies are small files (less than 4kB) that contain information that mediates websites and netizens' computers. Automatic login cookies are authentication facts that allow for automatic login without authentication of ID and password.

The integrated authentication key manager 260 stores the integrated authentication key issued by the integrated authentication key issuing unit 250 for each subscriber.

The integrated authentication key verification unit 270 receives the integrated authentication key verification request from the subscriber terminal 100 and verifies the validity of the integrated authentication key. In other words, the validity may be determined by comparing the identity of the integrated authentication key received from the integrated authentication key manager 260 and the integrated authentication key managed by the integrated authentication key manager 260. The verification result is returned to the subscriber station 100.

At this time, if the verification result is unsuccessful, request a new integrated authentication key issuance to the integrated authentication key issuing unit 250 to be delivered to the subscriber terminal (100).

Based on the configuration described so far, the integrated authentication process will be described. In this case, the same reference numerals are used to describe the same elements as those of FIGS. 1 to 4.

5 is a flowchart illustrating an integrated authentication method according to an embodiment of the present invention.

Referring to FIG. 5, the execution unit 105 of the user terminal 100 executes a specific application requested by the user (S101).

Next, the execution unit 105 requests the integrated authentication key from the integrated authentication key management unit 103 of the user terminal 100 (S103).

Next, the integrated authentication key management unit 103 determines whether the integrated authentication key is stored (S105).

At this time, if the integrated authentication key is not stored, the integrated authentication key management unit 103 transmits a response indicating that the integrated authentication key is not stored to the execution unit 105 (S107).

Next, the execution unit 105 transmits an integrated authentication request including subscriber identification information according to the type of the executed application to the integrated authentication key manager 103 (S109).

For example, when the executed application requires authentication using an ID, the execution unit 105 outputs a screen requesting input of an ID and password, and sends an integrated authentication request including the received ID and password to the integrated authentication key management unit. Forward to 103.

Alternatively, when the executed application IP authentication is required, the integrated authentication request including the IP address assigned to the subscriber station 100 is transmitted to the integrated authentication key manager 103.

Next, the integrated authentication key management unit 103 transmits an integrated authentication request including subscriber identification information to the integrated authentication system 200 (S111).

Next, the authentication manager 240 of the integrated authentication system 200 acquires all the service rights subscribed to by the subscriber corresponding to the subscriber identification information in association with the authentication systems 300 and 400 (S113).

Next, the integrated authentication key issuing unit 250 of the integrated authentication system 200 generates an integrated authentication key based on each service authority obtained in step S113 (S115).

Next, the integrated authentication key issuing unit 250 of the integrated authentication system 200 transmits the integrated authentication key generated in step S115 to the integrated authentication key management unit 103 (S117). At this time, the transmitted integrated authentication key is stored in the integrated authentication key manager 103.

Next, the integrated authentication key management unit 103 transmits the integrated authentication key stored in step S105 or the integrated authentication key received in step S117 to the execution unit 105 (S119).

Then, the execution unit 105 extracts the service authority required for authentication of the application executed in the integrated authentication key received in step S119 (S121). Then, the service is directly connected to the service server (not shown) of the corresponding application by using the extracted service right and provided with the service (S123).

FIG. 6 is a flowchart illustrating an integrated authentication method according to another embodiment of the present invention, which is a flowchart showing details of steps S113 to S117 of FIG. 5.

Referring to FIG. 6, the subscriber management unit 220 of the integrated authentication system 200 receives an integrated authentication request from the subscriber terminal 100 (S201).

Next, the subscriber management unit 220 of the integrated authentication system 200 extracts subscriber identification information from the integrated authentication request received in step S201 (S203).

Next, based on the subscriber identification information extracted in step S203 by the subscriber management unit 220 of the integrated authentication system 200, the subscriber device DB 231, the subscriber ID DB 232, the subscriber telephone number DB 233, and the subscription service authority DB The terminal 234 searches for subscriber terminal information, ID and password, telephone number, and a plurality of service subscription information (S205).

Next, the terminal authentication module 243 accesses the terminal / service authentication system 300 and performs device authentication using the terminal information of the subscriber extracted in step S205 (S207) to obtain a service right (S209).

Next, the SOIP telephony authentication module 245 accesses the terminal / service authentication system 300 to perform SOIP telephony authentication using the subscriber's terminal information and phone number extracted in step S205 (S211) to obtain a service right. (S213).

Next, the SOIP non-call authentication module 246 accesses the terminal / service authentication system 300 and performs SOIP non-call authentication using the subscriber terminal information extracted in step S205 (S215) to obtain a service right (S217). ).

Next, the TV non-call authentication module 247 accesses the terminal / service authentication system 300 and performs TV non-call authentication using the terminal information of the subscriber extracted in step S205 (S219) to obtain a service right (S221). ).

Next, the IP authentication module 244 accesses the terminal / service authentication system 300 and performs IP authentication using the subscriber's IP, ID, and terminal information extracted in step S205 (S223) to obtain a service right (S225). ).

Next, the ID authentication module 241 accesses the ID authentication system 400 and performs ID authentication using the ID and password of the subscriber extracted in step S205 (S227) to obtain a service right (S229).

Next, the third party subscriber authentication module 242 accesses the ID authentication system 400 and performs third party subscriber authentication using the subscriber's ID and password extracted in step S205 (S231) to obtain a service right (S233).

Next, the integrated authentication key issuing unit 250 generates an integrated authentication key based on the service rights obtained in steps S209, S213, S217, S221, S225, S229, and S233, respectively (S235).

Next, the integrated authentication key management unit 260 matches and stores the integrated authentication key generated in step S235 for each subscriber (S237).

Next, the integrated authentication key issuing unit 250 transmits the integrated authentication key generated in step S235 to the subscriber station 100 (S239).

7 is a flowchart illustrating an integrated authentication method according to another embodiment of the present invention.

Referring to FIG. 7, when the execution unit 105 of the subscriber station 100 fails to authenticate using the integrated authentication key (S301), the execution unit 105 transmits an authentication failure to the integrated authentication key management unit 103 of the subscriber station 100. (S303).

Next, the integrated authentication key management unit 103 of the subscriber terminal 100 requests the integrated authentication key verification to the integrated authentication system 200 (S305).

Next, the integrated authentication key verification unit 270 of the integrated authentication system 200 verifies whether the requested integrated authentication key is valid (S307). That is, the requested integrated authentication key validates the integrated authentication key by determining whether the integrated authentication key managed by the integrated authentication key manager 260 of the integrated authentication system 200 is the same.

At this time, it is determined whether it is valid (S309), and if it is valid, the integrated authentication key verification response is transmitted to the integrated authentication key management unit 103 of the subscriber station 100 (S311).

Next, the integrated authentication key management unit 103 of the subscriber terminal 100 transmits the integrated authentication key verification response to the execution unit 105 of the subscriber terminal 100 (S313). Then, the execution unit 105 of the subscriber terminal 100 may re-authenticate using the integrated authentication key.

On the other hand, if it is determined that it is not valid in step S309, the authentication management unit 240 of the integrated authentication system 200 performs the authentication process again (S315) to re-acquire the service authority. At this time, only the authentication procedure in question may be performed to obtain a service right.

Next, the integrated authentication key issuing unit 250 of the integrated authentication system 200 may generate a new integrated authentication key or replace only a service right in question based on the service rights acquired in step S315 (S317).

Next, the integrated authentication key verification unit 270 of the integrated authentication system 200 is integrated authentication including the integrated authentication key newly created or modified in step S317 by the integrated authentication key issuing unit 250 of the integrated authentication system 200. The key verification response is transmitted to the integrated authentication key management unit 103 of the subscriber station 100 (S319).

Next, the integrated authentication key management unit 103 of the subscriber terminal 100 transmits the integrated authentication key verification response received in step S319 to the execution unit 105 of the subscriber terminal 100 (S321). Then, the execution unit 105 of the subscriber station 100 re-authenticates using the integrated authentication key.

The embodiments of the present invention described above are not implemented only by the apparatus and method, but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (17)

A subscriber resource management unit configured to receive an integrated authentication request from a subscriber station and check a plurality of services subscribed to by a corresponding subscriber by checking service subscription information based on subscriber identification information included in the integrated authentication request;
An authentication manager for acquiring each service right for using the plurality of services; And
Integrated authentication key issuing unit for generating an integrated authentication key including the respective service rights and transmitting to the subscriber terminal
Integrated authentication system comprising a. The method of claim 1,
A database that stores and stores terminal information owned by the subscriber for each subscriber, ID and password for each service subscribed to by the subscriber, telephone numbers of telephone terminals owned by the subscriber, and a plurality of service subscription information subscribed to by the subscriber. Including more,
The subscriber resource management unit,
Search the database using the subscriber identification information, extract the terminal information, the ID and password, the telephone number of the telephone terminal, and the plurality of service subscription information, and transmit the extracted information to the authentication manager;
The authentication management unit,
After accessing an authentication system for using each service identified using the plurality of service subscription information, authentication is performed using the terminal information, the ID and password, and the telephone number of the telephone terminal, and then the respective service authority. Integrated authentication system to obtain a. 3. The method of claim 2,
Each service right is an automatic login cookie for each service,
The integrated authentication key is an integrated authentication cookie including the respective automatic login cookies. 3. The method of claim 2,
The authentication management unit,
Interconnected with the terminal and / or service authentication system, ID authentication system and network access authentication system through an external network or an internal network,
A first authentication module connected to the terminal and / or service authentication system to perform device authentication using the terminal information;
A second authentication module accessing the terminal and / or service authentication system to perform storage over IP (SOIP) call type authentication using the terminal information and the telephone number;
A third authentication module which accesses the terminal and / or service authentication system and performs SOIP non-call authentication using the terminal information;
A fourth authentication module which accesses the terminal and / or service authentication system and performs TV non-call authentication using the terminal information;
A fifth authentication module configured to access the ID authentication system and perform authentication using the ID and password;
A sixth authentication module which accesses the ID authentication system and performs third party subscriber authentication using the ID and password; And
A seventh authentication module for accessing the network access authentication system and performing IP authentication using the terminal information
Integrated authentication system comprising a. 5. The method of claim 4,
The authentication management unit,
If the authentication method is changed, the integrated authentication system for modifying a plurality of service-specific authentication method associated with the changed authentication method. 3. The method of claim 2,
Subscriber identification information included in the integrated authentication request,
Integrated authentication system including a terminal unique number or terminal IP address. 3. The method of claim 2,
Subscriber identification information included in the integrated authentication request,
Integrated authentication system including an ID and password entered by the user. 3. The method of claim 2,
Subscriber identification information included in the integrated authentication request,
Integrated authentication system including the telephone number of the subscriber station. The method of claim 1,
An integrated authentication key manager for storing an integrated authentication key issued by the integrated authentication key issuing unit; And
An integrated authentication key verification unit that receives an integrated authentication key verification request from the subscriber terminal, verifies the validity of the verification request for the integration authentication key in association with the integrated authentication key manager, and returns a verification result.
Integrated authentication system further comprising. 10. The method of claim 9,
The integrated authentication key issuing unit,
If the integrated authentication key verification unit fails to validate, the integrated authentication system to re-authenticate the service authority by re-requesting the authentication to the authentication management unit, and to regenerate the integrated authentication key to transmit to the subscriber terminal. A subscriber station capable of transmitting and receiving data by accessing a network,
An execution unit executing one or more applications requiring service authentication; And
The integrated authentication key management unit for managing the integrated authentication key including the service rights of each of the one or more applications, and delivers the integrated authentication key to the execution unit in response to the request of the execution unit,
The execution unit may include:
Selecting a service authority required for service authentication of the executed application from each of the service authority included in the integrated authentication key, a service server, wherein the service server is a server for controlling authentication and services for using the executed application. Subscriber terminal directly connected to. 12. The method of claim 11,
The integrated authentication key management unit,
When the integrated authentication key is not stored in advance, the integrated authentication request including the subscriber identification information is determined by the integrated authentication system. The integrated authentication system checks the service subscription information based on the subscriber identification information, thereby providing a plurality of services subscribed to by the corresponding subscriber. And acquire the respective service rights and generate the integrated authentication key to receive the integrated authentication key. The method of claim 12,
The integrated authentication key management unit,
When the authentication failure is received using the integrated authentication key from the execution unit, the subscriber terminal for transmitting an integrated authentication key verification request including the authentication failure to the integrated authentication system. The method of claim 13,
The integrated authentication key management unit,
When the valid response is received from the integrated authentication system, the valid response is transmitted to the execution unit,
The execution unit may include:
Subscriber terminal for re-authentication using the integrated authentication key. The method of claim 13,
The integrated authentication key management unit,
Receive a newly generated integrated authentication key with an invalid response from the integrated authentication system and delivers it to the execution unit,
The execution unit may include:
Subscriber terminal for re-authentication using the newly generated integrated authentication key. The method of claim 12,
The integrated authentication key management unit,
And subscriber identity information according to the type of the subscriber station and the authentication type of the executed application in the integrated authentication request. 17. The method of claim 16,
The integrated authentication key management unit,
And at least one of a terminal unique number or terminal IP address, a telephone number of the subscriber terminal, and an ID and password inputted by a user.

Images