KR20150116537A - Method for user authentication in virtual private cloud system and apparatus for providing virtual private cloud service - Google Patents

Abstract

The present invention relates to a method for authenticating a user in a virtual private cloud system, which comprises the following steps: a user terminal transmits an access request for a virtual cloud system; an organization authentication server requests login information including an email account to the user terminal based on the access request; the user terminal transfers the login information to the organization authentication server based on a request for the login information; and the organization authentication server issues an access permission based on the received login information to transfer the same to the user terminal. Accordingly, the present invention can prevent the inconvenience of managing an account by each virtual system in the virtual cloud system, and the inconvenience of inputting account information whenever accessing the virtual systems different from each other.

Description

TECHNICAL FIELD [0001] The present invention relates to a virtual private cloud service system,

The present invention relates to a user authentication method, and more particularly, to a user authentication method and a device for providing a virtual private cloud service in a virtual private cloud system.

With the recent advancement of IT technology, a smart work environment that can perform work anywhere, anytime within a limited physical space is being established. To accomplish this, IT resources for business or organization 's business are managed internally so that they can be used externally, or they are entrusted or leased to an external service provider to provide computing services. This is called cloud computing service. A specialized service targeting a specific organization or company is called a Virtual Private Cloud Service in preparation for a public cloud for an unspecified public in the cloud service.

 In order to securely provide such a virtual private cloud service, it is essential to authenticate the user who can access the resources of the specific institution and to manage the authority on whether the user can use the specific resource in the virtual private cloud service.

To this end, user accounts and passwords are created for each individual system within an organization or enterprise and are managed by individual systems. In this case, in order to access a plurality of systems, a user has to access each system and enter an account and a password, which makes it difficult and complicated for a user to manage multiple accounts and passwords. In addition, the inconvenience of having to connect several times to use individual systems and the number of virtual machines are increased, and the number of inputting is rapidly increased, resulting in a severe inconvenience.

Embodiments of the present invention provide a user authentication method that can access a plurality of systems in a virtual private cloud system.

Another embodiment of the present invention provides a virtual cloud service provision device that allows a user to access a plurality of systems in a virtual private cloud system.

A method for authenticating a user in a virtual private cloud system according to an embodiment of the present invention includes: transmitting a request for access to a virtual cloud system by a user terminal; determining, based on the access request, Requesting the user terminal for login information, transmitting the login information to the institution authentication server based on the login information request, and transmitting the login information to the institution authentication server based on the received login information, To the user terminal.

In one embodiment, the step of transmitting the access request to the virtual cloud system by the user terminal includes the steps of the access terminal transmitting the access request to the virtual cloud system to the institution system server, And transmitting the access request to the institutional authentication server.

In one embodiment, the step of the institution authentication server requesting the user terminal for the login information including the e-mail account based on the access request includes: the institution authentication server transmitting the login screen to the institution system server; And transmitting the login screen received by the institution system server to the user terminal.

In one embodiment, the step of transferring the login information to the institution authentication server based on the login information request may include receiving login information in response to the login information request, And transmitting the encrypted login information to the institutional system, wherein the institutional system server can receive the encrypted login information and deliver the encrypted login information to the institutional authentication server.

In one embodiment, the login information may include a user ' s email account and password.

In one embodiment, the institution authentication server issues an access certificate to the user terminal based on the received login information, and the institution authentication server authenticates the user of the user terminal based on the login information Retrieving the authority of the user, generating the access certificate based on the user authentication and user authority search result, encrypting the access certificate, and transmitting the encrypted access certificate to the institution system server And the institutional system server may receive the encrypted access certificate and forward it to the user terminal.

In one embodiment, the access right may include expiration information that the user terminal may access to the virtual cloud system.

In one embodiment, the method may further include accessing the virtual cloud system based on the access point received by the user terminal after the institution authentication server issues an access certificate to the user terminal have.

An apparatus for providing a virtual private cloud service according to another embodiment of the present invention includes an institutional system server and an institutional authentication server. The institutional system server is an institutional system server for operating a plurality of virtual servers in an organization, and receives an access request for at least one of the plurality of virtual servers from a user terminal. The institutional authentication server receives the access request from the institutional system server, generates an access certificate enabling access to the plurality of virtual servers, and transmits the access certificate to the user terminal.

In one embodiment, the institution authentication server includes: (i) requesting the user terminal for login information based on the access request; (ii) requesting the user of the user terminal based on the login information received from the user terminal Authenticate the user, retrieve the user's authority, and (iii) generate the access certificate based on the user authentication and user rights search results.

In one embodiment, the login information may include an email account and password of the user.

In one embodiment, the access certificate may include user authentication information and authorization information that can access at least two virtual servers in the institutional system server.

In one embodiment, the access right may include expiration information that the user terminal may access to the virtual cloud system.

According to this technology, it is possible to provide an integrated authentication and authorization method based on a user's in-house email address in providing a virtual private cloud service as an environment for a smart work that is rapidly increasing in demand in recent years. This makes it possible to avoid the burden of managing individual accounts in the internal network system of the enterprise network and to free the risk of identity theft by individual systems. Users can easily use their in-house services without having to enter additional accounts / passwords with one click, and it is easy to manage IDs because they have only one in-house e-mail account without managing multiple IDs and passwords. .

1 is a diagram illustrating a situation where user terminals are provided with a virtual private cloud service.
2 is a diagram illustrating a situation where a user terminal accesses a plurality of virtual systems in a virtual private cloud service providing apparatus in the example of FIG.
3 is a diagram illustrating a situation where user terminals access a virtual private cloud service providing apparatus and receive a service according to an embodiment of the present invention.
4 is a diagram illustrating a situation where a user terminal accesses a plurality of virtual systems based on an access certificate issued from an institutional authentication server in the embodiment of FIG. 3;
5 is a flowchart illustrating a method for authenticating a user in a virtual private cloud system according to an embodiment of the present invention.
6 is a flowchart illustrating a method for authenticating a user in a virtual private cloud system according to an exemplary embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in the drawings, the same components are denoted by the same reference symbols as possible. Further, the detailed description of well-known functions and constructions that may obscure the gist of the present invention will be omitted. In the present invention, a virtual private cloud system is used to refer to an aggregate of organized hardware elements and software elements that provide a virtual private cloud service to a user. In addition, the virtual private cloud service providing apparatus is a device for providing a virtual private cloud service to a user, and the virtual private cloud system and the virtual private cloud service providing apparatus may be understood to have the same meaning, and at least a virtual private cloud service may be a virtual private cloud service May also be understood as including a providing device.

1 is a diagram illustrating a situation where user terminals are provided with a virtual private cloud service.

Referring to FIG. 1, a situation is shown in which user terminals 101 and 102 access the institution system server 103 via the Internet 104. The institutional system server 103 provides a cloud service to specific persons belonging to the institution, not a server for an unspecified public person. In FIG. 1, the institutional system server 103 is shown as one for the sake of convenience, but a plurality of servers may be provided according to the size of the service. In addition, the institutional system server 103 provides cloud services to the user terminals 101, 102 via the Internet 104. The cloud service may be a service associated with the institution to which the institutional system server 103 belongs. In addition, the institution system server 103 can operate a plurality of virtual machines according to the type and nature of the service. Each virtual machine can operate a private system server as a virtual system, and access and authority ranges of the user terminals 101 and 102 may be different for each private system server.

The user terminals 101 and 102 may be terminals that access the institution system server 103 via the Internet 104. Although the user terminals 101 and 102 are shown as a wireless terminal in FIG. 1, a wired terminal may also be connected to the institution system server 103 via the Internet 104.

2 is a diagram illustrating a situation where a user terminal accesses a plurality of virtual systems in a virtual private cloud service providing apparatus in the example of FIG.

2, there is shown a situation in which the user terminal 101 accesses the virtual systems 103a, 103b, and 103c operated by the institutional system server 103. As shown in FIG. In the existing virtual private cloud service providing apparatus, when the user terminal 101 accesses the respective virtual systems 103a, 103b, and 103c, authentication information is transmitted to the virtual systems 103a, 103b, and 103c Access authority. In this case, the authentication information for accessing each of the virtual systems 103a, 103b, and 103c, for example, the account name and the password may be different. Therefore, there is an inconvenience that the user terminal 101 has to manage multiple accounts and passwords in order to access the respective virtual systems 103a, 103b, and 103c. Also, there is an inconvenience that the authentication information must be input every time when a plurality of virtual systems 103a, 103b, and 103c are connected.

3 is a diagram illustrating a situation where user terminals access a virtual private cloud service providing apparatus and receive a service according to an embodiment of the present invention.

Referring to FIG. 3, there is shown a situation where user terminals 301, 302 access the institution system server 303 via the Internet 305. The institutional system server 303 provides a cloud service to specific persons belonging to the organization, not a server for an unspecified public person. In FIG. 3, the institutional system server 303 is shown as one for the sake of convenience, but a plurality of servers may be provided according to the size of the service. In addition, the institutional system server 303 provides cloud services to the user terminals 301, 302 via the Internet 305. The cloud service may be a service associated with the institution to which the institutional system server 303 belongs. In addition, the institution system server 303 can operate a plurality of virtual machines according to the type and nature of the service. In addition, each virtual machine can operate a private system server, and access and authority ranges of the user terminals 301 and 302 may be different for each private system server.

The user terminals 301 and 302 may be terminals that access the institution system server 303 via the Internet 305. Although the user terminals 301 and 302 are shown as a wireless terminal in FIG. 3, a wired terminal may also be connected to the institution system server 303 through the Internet 305. [

The authority authentication server 304 can authenticate whether the user of the user terminal 301, 302 is a legitimate user registered with the organization. For this, an e-mail account and a password are received from the user terminals 301 and 302, and an access certificate can be issued. The access right is similar to the offline visit and may include authentication information and authorization information as to whether the user terminal 301, 302 is a user who can access the virtual systems of the institutional system server 303. [ When an access certificate is issued, the user terminal 301, 302 can access the virtual systems of the institution system server 303 with the issued access certificate. Therefore, it is possible to prevent the inconvenience of transmitting account information and encryption information for each virtual system when accessing a plurality of virtual systems.

An e-mail account of the user registered in the organization authenticates the user between the institutional system server and the authentication server. It also exchanges information registered in the authentication server with respect to whether the user is an employee, a customer, a visitor, Thereby granting an access right that corresponds to the authority. According to an embodiment, the accessibility may include expiration information that each of the user terminals 301, 302 may access to the virtual cloud system. The valid period may be defined as a period from a point of time when the access point is issued to a point after a certain period of time, and a period of access to the virtual cloud system may be changed based on the access point issued according to the valid period information. Once the validity period has expired, the process for issuing a new access certificate may be repeated.

 As described above, a protocol for authenticating a user and granting authority may be added for authentication through an institutional system server and an institutional authentication server according to the present invention. The protocol to be added is an e-mail account of the user registered in the organization, and authenticates the user between the institutional system server and the authentication server. It is registered in the authentication server as to whether the user is an employee, a customer or a visitor, To exchange information and to grant rights-based access rights.

The virtual private cloud service providing apparatus according to the present invention may include an institutional system server 303 and an institutional authentication server 304. In Figure 3, the institutional system server 303 and the institutional authentication server 304 are shown as independent devices, but the institutional system server 303 and the institutional authentication server 304 may be implemented within a single device .

The user terminals 301 and 302 may be some persons who can access the web or an app database of the employee or the customer or the institution of the relevant institution. The institutional system server 303 may refer to an institutional computing system, a database, a web server, an application server for smart terminals, and the like. The institution authentication server 305 is a system that performs a function of checking whether the user of the user terminal 301 is a user who can access the system of the institution and the access range. Or a groupware server.

4 is a diagram illustrating a situation where a user terminal accesses a plurality of virtual systems based on an access certificate issued from an institutional authentication server in the embodiment of FIG. 3;

Referring to FIG. 4, an institutional authentication server 304, a user terminal 301, and an institutional system server 303 are shown. The institution system server 303 can operate a plurality of virtual systems 303a, 303b, and 303c. The virtual systems 303a, 303b, and 303c may be individual systems in which the user terminal 301 actually accesses and wants to receive the cloud service.

The institutional authentication server 304 can issue an access certificate to the user terminal 301 and the user terminal 301 can access the virtual systems 303a, 303b, and 303c of the institutional system server 303 ). Unlike the existing virtual private cloud service providing apparatus shown in FIG. 2, in the virtual private cloud service providing apparatus according to the embodiment of the present invention shown in FIG. 3, the access right issued by the institutional authentication server 304 303b, and 303c of the institutional system server 303 individually so that it is necessary to repeatedly input the account information and the password information to the virtual systems 303a, 303b, and 303c And it is also possible to prevent the inconvenience of managing different account information and encryption information for each of the virtual systems 303a, 303b and 303c. The access rights may also include rights information for each virtual system 303a, 303b, 303c of the user terminal 301 so that individual rights for each virtual system 303a, 303b, 303c for one user Information management is easy.

5 is a flowchart illustrating a method for authenticating a user in a virtual private cloud system according to an embodiment of the present invention.

Referring to FIG. 5, a method for authenticating a user in a virtual private cloud system according to an embodiment of the present invention includes: transmitting a request for access to a virtual cloud system by a user terminal (S101) (S103), the institutional authentication server requesting login information including an e-mail account to the user terminal (S102); transmitting the login information to the institutional authentication server based on the login information request (S103) A step S104 of generating an access certificate by the institution authentication server based on the received login information, and a step S105 of delivering the issued access certificate to the user terminal. The method of authenticating a user in a virtual private cloud system according to an embodiment of the present invention may further include a step (S106) of accessing a virtual private cloud system based on an access certificate issued by the user terminal.

In a step S101 in which the user terminal transmits an access request to the virtual cloud system, the user authentication process may be started with an access request of the user terminal. One example of an access request transmitted by a user terminal may be the case where an enterprise smart terminal has clicked on an application provided by an institution. At this time, the e-mail account may be an internal e-mail account of the organization, or an e-mail account of the external portal may be used if the organization does not operate an internal e-mail account. In any case, the e-mail account should be the only account that is not duplicated within the organization. In one embodiment, the step S101 of transmitting a request for access to the virtual cloud system by the user terminal comprises the steps of the user terminal sending an access request for the virtual cloud system to the institution system server, And transmitting the access request to the institution authentication server. Since the institutional system server may not have a user account separately, in this case, the institutional system server may receive the access request from the user terminal and may transmit the access request to the institutional authentication server. According to an embodiment, the institutional system server and the institutional authentication server may be implemented as a single device. In this case, the institutional authentication server may directly receive and process the access request from the user terminal.

6 is a flowchart illustrating a method for authenticating a user in a virtual private cloud system according to an exemplary embodiment of the present invention.

Referring to FIG. 6, a flow of information between a user terminal 601, an institutional system server 603, and an institutional authentication server 605 is shown. The flowchart shown in FIG. 6 shows an example of a user authentication method in a virtual private cloud system according to an embodiment of the present invention, and the embodiment of FIG. 6 can be changed within the scope of the technical idea of the present invention .

The user terminal 601 can make an access request to the institution system server using its own e-mail account (step S201). One example of an access request transmitted by a user terminal may be the case where an enterprise smart terminal has clicked on an application provided by an institution. At this time, the e-mail account may be an internal e-mail account of the organization, or an e-mail account of the external portal may be used if the organization does not operate an internal e-mail account. In any case, the e-mail account should be the only account that is not duplicated within the organization.

The corresponding institutional system server 603 receiving the service request with the only e-mail account within the organization may not have a separate user account. Thus, the institutional system server 603 can forward the request to the institutional authentication server 605 (step S202).

In response to the access request, the institution authentication server 605 transmits an authentication server login screen to the institution system server 603 to check whether the user is a valid user based on the user's e-mail account (step S203). The institution system server 603 transfers the received authentication server login screen to the user terminal 601 (step S204). The user can confirm the authentication server login information displayed on the screen of the user terminal 601 and input an e-mail account and a password. The user terminal 601 can encrypt the inputted e-mail account and password and transmit the encrypted e-mail account and password to the institution system server 603 (step S205). The institutional system server 603 can forward it to the institutional authentication server 605 (step S206).

The institution authentication server 605 determines whether the user of the user terminal 601 is a valid user based on the received e-mail account and password (step S207). If the user is a valid user, it checks the identity of the user and the range of the access right within the company, issues an access certificate corresponding thereto, encrypts it, and transmits the access certificate to the requested institution system server 603 (step S208). At this time, no access is granted unless it is a valid user. Here, the access certificate performs a similar function as the off-line visit certificate, and the user terminal 601 can include authentication information and authorization information that can access the virtual systems operated in the institutional system server 603 . The institution system server 605 can forward the received access certificate to the user terminal 601 (step S209).

In the subsequent steps, the user terminal 601 can access the virtual systems of the institutional system server 603 within the allowed range through the issued access point, and use the virtual private cloud service. That is, whether or not access to the virtual systems operated by the institution system server 603 is determined according to the allowable range of the access authentication, and access rights within the connected virtual system may also be changed. The virtual systems in the institution system server 603 may provide cloud services such as a computing system, a database, an application service, and a web service, respectively. Thus, individual read and write privileges may be granted to each of the cloud services in accordance with the allowed range of the access grant.

By the above operation procedure, it is possible for the private system servers in the virtual private cloud to manage and control the accounts consistently and integrally through the authentication server of the institution without separately managing the accounts.

At this point, it will be appreciated that the combinations of blocks and flowchart illustrations in the process flow diagrams may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, so that those instructions, which are executed through a processor of a computer or other programmable data processing apparatus, Thereby creating means for performing functions. These computer program instructions may be stored in a computer readable memory or in a computer capable of directing a computer or other programmable data processing apparatus to implement a function in a particular manner, It is also possible for instructions stored in memory to produce manufacturing items that contain instruction means for performing the functions described in the flowchart block (s). Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible for the instructions to perform the processing equipment to provide steps for executing the functions described in the flowchart block (s).

In addition, each block may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative implementations, the functions mentioned in the blocks may occur out of order. For example, two blocks shown in succession may actually be executed substantially concurrently, or the blocks may sometimes be performed in reverse order according to the corresponding function.

Herein, the term " part " used in the present embodiment means a hardware component such as software or an FPGA or an ASIC, and 'part' performs certain roles. However, 'part' is not meant to be limited to software or hardware. &Quot; to " may be configured to reside on an addressable storage medium and may be configured to play one or more processors. Thus, by way of example, 'parts' may refer to components such as software components, object-oriented software components, class components and task components, and processes, functions, , Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. The functions provided in the components and components may be further combined with a smaller number of components and components or further components and components. In addition, the components and components may be implemented to play back one or more CPUs in a device or a secure multimedia card.

The embodiments of the present invention disclosed in the present specification and drawings are merely illustrative examples of the present invention and are not intended to limit the scope of the present invention in order to facilitate understanding of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

101, 102: user terminal 103: institutional system server
104: Internet 103a, 103b, 103c: Virtual system
301, 302: user terminal 303: institutional system server
304: Institutional authentication server 305: Internet
303a, 303b, and 303c:

Claims (13)

Transmitting the access request to the virtual cloud system by the user terminal;
Requesting, by the institution authentication server, based on the access request, login information including an e-mail account to the user terminal;
Transmitting the login information to the institution authentication server based on the login information request; And
And issuing an access certificate to the institution authentication server based on the received login information and transmitting the access authorization to the user terminal.
The method of claim 1, wherein the transmitting the access request to the virtual cloud system comprises:
Transmitting the access request for the virtual cloud system to the institution system server by the user terminal; And
And transmitting the access request received by the institutional system server to an institutional authentication server.
The method according to claim 1,
The method of claim 3, wherein, based on the access request, the step of the institution authentication server requesting the user terminal for login information including an e-mail account comprises:
Transmitting the login screen to the institutional system server by the institutional authentication server; And
And transmitting the login screen received by the institutional system server to the user terminal in the virtual private cloud system.
2. The method of claim 1, wherein the step of delivering login information to the institutional authentication server based on the login information request comprises:
Receiving login information in response to the login information request;
Encrypting the input login information; And
And transmitting the encrypted login information to the institutional system,
Wherein the institutional system server receives the encrypted login information and delivers the encrypted login information to the institution authentication server.
The method according to claim 1,
Wherein the login information includes a user's email account and a password.
The method according to claim 1,
Wherein the institution authentication server issues an access certificate to the user terminal based on the received login information,
Authenticating the user of the user terminal based on the login information and searching for the authority of the user;
Generating the access right based on the user authentication and user rights search result;
Encrypting the access certificate; And
And forwarding the encrypted access to the institutional system server,
Wherein the institutional system server receives the encrypted access authentication certificate and transmits the encrypted access authentication certificate to the user terminal in the virtual private cloud system.
The method according to claim 1,
Wherein the access certificate includes expiration information that the user terminal can access the virtual cloud system.
2. The method of claim 1, wherein after the institution authentication server issues an access certificate to the user terminal,
Further comprising accessing the virtual cloud system based on the access point received by the user terminal.
An institutional system server for operating a plurality of virtual servers in an organization, the institutional system server receiving an access request for at least one of the plurality of virtual servers from a user terminal; And
And an institution authentication server for receiving the access request from the institutional system server and generating an access certificate for accessing the plurality of virtual servers and transmitting the generated access certificate to the user terminal.
The system according to claim 9,
(i) requesting the user terminal for login information based on the access request,
(ii) authenticating the user of the user terminal based on the login information received from the user terminal, searching the authority of the user,
(iii) generating the access right based on the user authentication and user authority search result.
11. The apparatus of claim 10, wherein the login information includes an email account and a password of the user.
10. The apparatus of claim 9, wherein the access authorization includes user authentication information and authorization information capable of accessing at least two virtual servers in the institutional system server.
10. The apparatus of claim 9, wherein the access grant includes expiration information that the user terminal is able to connect to the virtual cloud system.

Images