KR20180062782A - Security authenticate system and method for cloud services users - Google Patents

Abstract

Disclosed are a security authentication method and a security authentication system for a cloud service user. The security authentication method for a cloud service user comprises the steps of: when a user logs in to an integrated authentication portal server, generating, by the integrated authentication portal server, a multi-encrypted combination character string by using log-in information of the user, a one-time internal key, and a public key; transmitting, by the integrated authentication portal server, the encrypted combination character string to a target portal device among a plurality of cloud service portal devices; decrypting, by the target portal device, the encrypted combination character string; checking, by the integrated authentication portal server and the target portal device, authentication of the user by using the decrypted combination character string and the one-time internal key; and providing, by the target portal device, a main screen to the user when authentication of the user is successful. According to the present invention, it is possible to improve the convenience of users and to reduce the cost of constructing a system necessary for security.

Description

[0001] The present invention relates to a security authentication method and a security authentication system for a cloud service user,

The present invention relates to a security authentication method and a security authentication system for a cloud service user, and more particularly, to a security authentication method for a cloud service user that manages connection and use of each system through a single authentication in a cloud service environment And a security authentication system.

As the IT environment shifts to the cloud center, demand for existing IT services is gradually declining. On the other hand, demand for cloud service brokerage (CSB), cloud service provider (CSP), and cloud service consumer (CSC) is growing.

CSP is a cloud service provider that registers and sells cloud services, CSC is a cloud service user who requests and uses cloud services, and CSB is a service that integrates and intervenes in cloud services by matching solutions and requirements between multiple CSPs and CSCs. It is a business that provides services.

Therefore, various problems such as various regulatory compliance management and security risk management that occur due to introduction of various cloud services including CSB, CSC and CSP should be solved.

In particular, in order to solve the security problem, in the past, when a cloud service user uses different systems (that is, different cloud services), a single sign-on (SSO) The system of the cloud service linked by the login authentication only is used.

SSO is an integrated authentication method that allows users to connect to multiple systems with a single ID and a single password. However, in order to use SSO, an expensive commercial solution must be purchased. Also, when a weak encryption method is used in connection with each cloud service system, unnecessary information is exposed to packets during packet analysis, which causes security problems.

The existing cloud service system includes a plurality of CSPs, a plurality of CSCs, and a plurality of CSBs as described above. However, the plurality of CSPs, the CSCs, and the CSBs process authentication according to different authentication methods, A separate module for authentication processing is required. As the authentication processing method is different for both CSP, CSC and CSB, users who use the cloud service feel uncomfortable or hassle in the login authentication process. CSP, CSC and CSB developers can establish an authentication procedure system according to the development environment. Or purchase modules at great cost.

Korean Patent Laid-Open No. 10-2015-0053513 (published on May 18, 2015)

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems occurring in the prior art, and it is an object of the present invention to provide a security authentication method for a cloud service user that can easily process authentication without processing SSO solution in a system providing each cloud service, Method and security authentication system.

It is another object of the present invention to provide a method and a system for providing a security service to a cloud service user with a simple security function by integrating the authentication procedure required when a user accesses a CSP, And a security authentication system.

It is another object of the present invention to provide a security authentication method and a security authentication system for a cloud service user that can solve a vulnerable security problem of a system by using a disposable key even when a packet is exposed during authentication .

According to an aspect of the present invention, there is provided a security authentication method for a cloud service user, comprising: (A) when a user logs in to an integrated authentication portal server, Generating a plurality of encrypted combination strings using login information, a disposable internal key, and a public key; (B) the integrated authentication portal server transmitting the encrypted combination string to a target portal apparatus among a plurality of cloud service portal apparatuses; (C) decrypting the encrypted combination string by the target portal apparatus; (D) checking the user's authentication using the combination string decrypted by the integrated authentication portal server and the target portal device and the disposable internal key; And (E) when the authentication of the user is successful, the target portal device provides the main screen to the user.

Wherein the step (A) comprises: (A1) logging in the integrated authentication portal server using the user ID and password; (A2) encrypting a temporary string in which the integrated authentication portal server combines the password and the disposable internal key with the disposable internal key; And (A3) encrypting the combination string obtained by combining the encrypted temporary string and the ID with the public key.

The step (C) may include: (C1) the target portal device decrypting the encrypted combination string using the public key to check the decrypted combination string; And (C2) parsing the deciphered combination string to extract the ID and the encrypted temporary string.

Wherein the step (D) comprises: (D1) requesting the disposable internal key by calling the REST API URI with the extracted ID by the target portal apparatus; (D2) the integrated authentication portal server verifying the ID described in the RESP API URI received from the step (D1), and inquiring the disposable internal key with the confirmed ID; (D3) providing the retrieved disposable internal key to the target portal apparatus; (D4) requesting the user authentication check by calling the REST API URI provided by the integrated portal server with the provided disposable internal key and the received encrypted combination string; (D5) checking the authentication of the user using the encrypted combination string and the disposable internal key received by the integrated authentication portal server.

The step (D5) further comprises: (D51) decrypting the encrypted combination string received by the integrated authentication portal server using the received disposable internal key; (D52) parsing the decrypted temporary string to extract a password; And (D53) checking whether the extracted password is a password corresponding to the ID received from the target portal apparatus, and checking the authentication of the user.

The step (B) includes the steps of: (B1) determining, by the integrated authentication portal server, a target portal device to be connected by the user among the plurality of cloud service portal devices stored in the database; And (B2) transmitting the encrypted combination string to the identified target portal apparatus by the integrated authentication portal server.

Wherein the plurality of cloud service portal devices comprises: a cloud service provider portal device for providing a cloud service; A cloud service user portal apparatus using the cloud service; And a cloud service brokerage portal device providing cloud service brokering service.

According to another embodiment of the present invention, there is provided a security system for a cloud service user, comprising: a plurality of cloud service portal apparatuses responsible for at least one of providing, using and brokering a cloud service; And generating a plurality of encrypted combination strings by using the login information, the disposable internal key, and the public key of the user so that the user accesses a desired one of the plurality of cloud service portal devices through one login, And an integrated authentication portal server for transmitting the encrypted combination string to the target portal apparatus and verifying the authentication of the user using the acquired user ID, the disposable internal key, and the public key by decrypting the encrypted combination string in the target portal apparatus do.

Wherein the integrated authentication portal server comprises: an internal key encrypting unit for encrypting a temporary string, which is a combination of the password and the disposable internal key, with the disposable internal key when the user logs in the integrated authentication portal server using an ID and a password; And a public key encryption unit for encrypting the combination string obtained by combining the encrypted temporary string and the ID with the public key.

The target portal apparatus includes a public key decryption unit decrypting the encrypted combination string using the public key and verifying the decrypted combination string; And a combined string parser for parsing the decoded combination string to extract the ID and the encrypted temporary string.

Wherein the target portal device requests the disposable internal key by calling the REST API URI with the extracted ID, and when receiving the disposable internal key, transmits the REST API URI to the provided disposable internal key, Wherein the integrated authentication portal server inquires of the disposable internal key with an ID written in the RESP API URI received from the target portal apparatus, And an authentication check unit for providing the target portal apparatus with the combination string and the disposable internal key described in the received REST API URI to check the authentication of the user.

The authentication check unit may include a public key decryption unit decrypting the encrypted combination string received from the target portal apparatus using the public key; A parser for parsing the decrypted combination string to extract an ID and an encrypted temporary string; And an internal key decryption unit for decrypting the extracted temporary string using the received disposable internal key.

According to the present invention, not only a cloud service provider providing each cloud service but also a cloud service user and a cloud service broker system can easily process user authentication without applying SSO solution, thereby improving user convenience, .

Further, according to the present invention, by integrating different authentication procedure methods required when a user accesses a CSP, a CSC, or a CSB without a separate authentication processing module, the user convenience can be improved without burdening a large cost, Can also provide security-enhanced cloud services.

In addition, according to the present invention, by registering a plurality of IDs for each user and designating different cloud services for each ID, it is possible to solve the trouble that the user tries to join the membership several times. In addition, even after the user joins the subscription, the desired cloud service can be designated while registering the new ID after logging in with the previously registered ID, thereby enhancing user convenience.

Also, according to the present invention, even if a packet is exposed during user authentication, a security problem can be solved by encrypting and decrypting using a one-time key.

FIG. 1 illustrates a security authentication system for a cloud service user according to an embodiment of the present invention; FIG.
2 is a block diagram of an integrated authentication portal server and a target portal device of the security authentication system,
3 is a diagram for explaining an encrypted combination string structure and a decoded combination string structure,
4 is a flowchart illustrating a security authentication method for a cloud service user according to an embodiment of the present invention,
5 and 6 are flowcharts for explaining the security authentication method described with reference to FIG. 4 in more detail.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings.

It is to be understood that when an element, apparatus, or system is referred to as comprising a program or a component made up of software, the component, apparatus, or system is in communication with the computer (e.g., CPU, etc.) or other program or software (e.g., drivers needed to drive an operating system or hardware, etc.). It is also to be understood that unless the context requires otherwise, the components may be implemented in software, hardware, or any form of software and hardware.

In this specification, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware.

Hereinafter, the present invention will be described in detail with reference to the drawings. In some instances, it should be noted that portions of the invention that are not commonly known in the description of the invention and are not significantly related to the invention do not describe confusing reasons for explaining the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Each of the configurations of the security authentication system for the cloud service user shown in FIGS. 1 and 2 indicates that it can be functionally and logically separated, and each configuration can be divided into separate physical devices or written in separate codes The average expert in the field of the present invention can easily reasonably deduce that the term " a "

In addition, the present invention provides a program stored in a computer-readable recording medium executed on a computer for controlling the security authentication system to implement a security authentication method for a security authentication system for a cloud service user, The system may be installed in a predetermined data processing apparatus to implement the technical idea of the present invention.

1 is a diagram illustrating a security authentication system for a cloud service user according to an embodiment of the present invention.

The security authentication system shown in Fig. 1 is for integrated authentication of a cloud service user in a cloud computing environment. A cloud service user uses services provided by at least one of a plurality of CSPs, CSCs, and CSBs.

Referring to FIG. 1, a security authentication system for a CSB user according to an embodiment of the present invention includes a plurality of cloud service portal devices 10, 20, and 30 and an integrated authentication portal server 100.

The cloud service portal devices 10, 20 and 30 include a CSP portal device 10, a CSC portal device 20 and a CSB portal device 30. [ The CSP portal device 10 is a device for providing CSP service, the CSC portal device 20 is a device for providing CSC service, and the CSB portal device 30 is a device for providing CSB service.

The integrated authentication portal server 100 integrally manages a user for using at least one of the cloud service portal apparatuses 10, 20, and 30. To this end, the user registers an ID and a password PW in the integrated authentication portal server 100 and designates one of the CSP, CSC, and CSB to be used by the user. When the user designates the CSP, the integrated authentication portal server 100 determines the CSP portal device 10 as the target portal device and adds the information of the CSP portal device 10 (for example, web path, Identification information, etc.) are mapped and stored.

In addition, the user can set a plurality of IDs in the integrated authentication portal server 100 when joining members, and specify different services for each ID. For example, the user can set three IDs ID1, ID2, and ID3, and designate CSP, CSC, and CSB for ID1, ID2, and ID3, respectively. Accordingly, when there are a plurality of cloud services that the user wants to use, the user can register multiple IDs with only one member registration and designate a desired cloud service portal as a simple procedure for each ID.

Thereafter, when the user logs in the integrated authentication portal server 100, the integrated authentication portal server 100 confirms the target portal apparatus mapped to the user's ID. Then, the integrated authentication portal server 100 performs a user authentication check procedure with the CSP portal device 10 so as to automatically login and connect to the CSP portal device 10, which is the confirmed target portal device, without receiving further information from the user do.

The integrated authentication portal server 100 generates an encrypted combination string necessary for the user authentication procedure using the user's ID, password, disposable internal key, and public key.

The disposable internal key is a disposable authentication key generated by the integrated authentication portal server 100 for authenticating the user. The public key is a key shared by the cloud service portal devices 10, 20, and 30 and the integrated authentication portal server 100. That is, the public key is a key promised beforehand between the integrated authentication portal server 100 and the plurality of cloud service portal apparatuses 10, 20, 30, and is not transmitted on a packet basis, (10, 20, 30, 100). In addition, the integrated authentication portal server 100 finally performs encryption in an AES 128-bit method, which is a standard encryption method, so as not to be exposed by the outside, and transmits the encryption in a parameter (i.e., a factor).

The target portal apparatus 10 and the integrated authentication portal server 100 decrypt the encrypted combination string using the public key, the REST API, and the disposable internal key, and in this process, the target portal apparatus 10 performs the authentication procedure Is authenticated through the integrated authentication portal server (100).

2 is a block diagram of the integrated authentication portal server 100 and the target portal apparatus 10 of the security authentication system.

2, the integrated authentication portal server 100 includes an authentication processing unit 110, an internal key encryption unit 120, a public key encryption unit 130, an authentication check unit 140, and a DB 150, .

When the user inputs the ID and the password to the integrated authentication portal server 100, the authentication processing unit 110 searches for the ID and the password stored in the DB 150 and processes the login authentication of the user. Once authenticated, the authentication processing unit 110 confirms the target portal device stored in the DB 150, which is mapped to the ID of the user. Hereinafter, the CSP portal apparatus will be described as an example of the target portal apparatus 10 designated by the user in the ID that is previously logged in.

3 is a diagram for explaining an encrypted combination string structure and a decoded combination string structure.

Referring to FIG. 3 (a), a process of generating a combination string will be described. The internal key encryption unit 120 generates a disposable internal key, and generates a temporary string in which the password of the user and the disposable internal key are combined (①). The temporary string has the form of 'password :: disposable internal key', and '::' is the delimiter. Then, the internal key encryption unit 120 encrypts the temporary string with the disposable internal key (2).

The public key encryption unit 130 generates a combination string in which the temporary string encrypted by the internal key encryption unit 120 and the ID of the user are combined (3). The generated combination string has the form of 'ID :: Encrypted Temporary String'. Then, the public key encryption unit 130 encrypts the combination string using the public key (4).

The integrated authentication portal server 100 transmits the encrypted combination string to the target portal device 10, receives at least two REST API URI calls from the target portal device 10, .

The authentication check unit 140 inquires the disposable internal key with the ID described in the RESP API URI first received from the target portal apparatus 10 and provides the disposable internal key to the target portal apparatus 10, The user's authentication is checked using the encrypted combination string and the disposable internal key.

The authentication check unit 140 includes an internal key checking unit 142, a public key decrypting unit 144, a parser 146, and an internal key decrypting unit 148.

When the first REST API URI call is received from the target portal apparatus 10, the internal key checking unit 142 checks whether the ID contained in the REST API URI and the ID included in the encrypted combination string transmitted to the target portal apparatus 10 are the same . In the same case, the internal key verifying unit 142 inquires of the disposable internal key used in the combination string encryption and provides it to the target portal apparatus 10. The internal key verifying unit 142 inquires of the DB 150 about the disposable internal key used in generating the encrypted combined character string using the ID described in the REST API URI.

If the ID described in the REST API URI is different from the ID contained in the encrypted combination string, the internal key checking unit 142 does not inquire the disposable internal key, but sends a warning message indicating that the user authentication is inadequate to the target portal apparatus 10).

Referring to FIG. 3 (b), when the second REST API URI call is received, the public key decryption unit 144 decrypts the encrypted combination string described in the REST API URI using the public key ().

The parser 146 parses the combination string decrypted with the public key to extract the ID and the encrypted temporary string (12).

The internal key decryption unit 148 decrypts the extracted encrypted temporary character string using the disposable internal key received from the REST API URI call (13).

The parser 146 parses the decrypted temporary string to extract the password and the disposable internal key (14).

The authentication processing unit 110 checks whether the authentication of the user is normally performed by using the password extracted by the parsing and the disposable internal key. That is, the authentication processing unit 110 confirms from the DB 150 whether the extracted password is the password corresponding to the ID described in the first REST API URI. If the extracted password is a password corresponding to the ID described in the REST API URI, the integrated authentication portal server 100 and the target portal apparatus 10 ) Is performed by a normal procedure.

DB 150 stores the user ID, password, information of the target portal device designated by the user, and disposable internal key used in generating the encrypted combination string.

The target portal apparatus 10 includes a target public key decryption unit 12, a combination string parser 14, and an authentication request unit 16.

The target public key decryption unit 12 decrypts the encrypted combination string received from the integrated authentication portal server 100 using the public key, and confirms the decrypted combination string.

The combination string parser 14 parses the decoded combination string to extract the ID and the encrypted temporary string.

The authentication request unit 16 calls the REST API URI provided from the integrated authentication portal server 100 with the extracted ID to request the transmission of the disposable internal key, and when receiving the disposable internal key, the second REST API URI It calls the supplied disposable internal key and the encrypted combination string to request the user's authentication check.

Hereinafter, a security authentication method for a security authentication system for a cloud service user will be described.

4 is a flowchart illustrating a security authentication method for a cloud service user according to an embodiment of the present invention.

The security authentication method shown in FIG. 4 is performed by the target portal apparatus 10 and the integrated authentication portal server 100, which are one of the plurality of cloud service portal apparatuses 10, 20, and 30 described in FIG. Therefore, the target portal apparatus and the integrated authentication portal server shown in FIG. 4 to FIG. 5 may be the same apparatus as the target portal apparatus 10 and the integrated authentication portal server 100, respectively.

Referring to FIG. 4, the integrated authentication portal server performs login authentication using an ID and a password input from a user, and if authenticated, identifies which target portal user the user is in (S210). In step S210, the integrated authentication portal server confirms the target portal device designated by the user from the DB.

When the target portal device is confirmed, the integrated authentication portal server generates a multiple encrypted combination string using the login information (i.e., ID and password) of the user, the disposable internal key, and the public key (S220).

The integrated authentication portal server transmits the encrypted combination string to the target portal device, and calls the authentication dummy page (S230). The authentication dummy page is for calling the main portal site provided by the target portal apparatus and is a page linked to show to the user while the integrated authentication portal server and the target portal apparatus automatically perform the user authentication procedure. In step S230, the integrated authentication portal server transmits the encrypted combination string as a parameter.

The target portal device opens the authentication dummy page according to the call of the authentication dummy page (S240).

The target portal device checks whether the encrypted combination string received is a character string transmitted in a normal process, that is, whether the authentication procedure of the user logged into the integrated authentication portal server is normal (S250 to S260) through the integrated authentication portal server.

More specifically, the target portal apparatus decrypts the encrypted combination string received through step S230 with the public key (S250).

When the combination string is decrypted with the public key, the target portal device and the integrated authentication portal server check the user's authentication using the REST API call, the encrypted combination string, and the disposable internal key used in the encryption (S260). Steps S220, S250 and S260 will be described later in detail with reference to FIGS. 5 and 6. FIG.

The integrated authentication portal server 100 transmits the success or failure of the user authentication check to the target portal apparatus 10 (S270).

If the authentication of the user is successful, that is, if it is checked that the user authentication is performed in the normal procedure as a result of the authentication check, the target portal device provides the portal main screen to the user and displays the portal main screen (S280).

5 and 6 are flowcharts for explaining the security authentication method described with reference to FIG. 4 in more detail.

5 and 6, the integrated authentication portal server performs authentication using the ID and password of the logged-in user, and confirms the target portal device designated by the user in step S210.

The step S220 illustrated in FIG. 4 includes the following steps S222 through S228.

In step S222, the integrated authentication portal server generates a temporary string by combining the string of the password and the disposable internal key input in step S210 with delimiters (: :). Thus, the temporary string has the form of a 'password :: disposable internal key'.

The integrated authentication portal server encrypts the created temporary string with the disposable internal key (S224).

The integrated authentication portal server generates a combination string by combining the ID of the user and the encrypted temporary string, maps the disposable internal key used in step S224 to the user ID, and stores it in the DB (S226).

Then, the integrated authentication portal server encrypts the generated combination string with the public key (S228). The combination string generated in step S226 has a form of 'ID :: encrypted temporary string'.

The integrated authentication portal server calls the dummy page for authentication of the target portal device while transmitting the encrypted combination string (S230). In step S230, the integrated authentication portal server calls the authentication dummy page in the form shown in Table 1 below.

Cloud service portal device Authentication dummy page call type Targeted portal device http://192.168.10.11/ Targeted portal device / dummy? authStr = Encryption combination string CSP portal device http://192.168.10.11/cspportal/dummy?authStr=34dsre! CSC portal device http://192.168.10.11/cscportal/dummy?authStr=#6df4l5%? CDB portal device http://192.168.10.11/csbportal/dummy?authStr=gfjkld93em

[Table 1] Referring to Table 1, a basic form used for calling an authentication dummy page is, for example, 'http://192.168.10.11/ target portal device / dummy? AuthStr = encryption combination string'. Of the basic types, the 'target portal device' describes the identification ID of the target portal device designated by the user, and the 'encrypted combination string' describes the user's ID, password, internal key, and encrypted combination string generated by the public key.

Therefore, if the target portal device specified by the user is the CSP portal device, the identification ID of the CSP portal device is' cspportal ', and the encrypted combination string is' 34dsre!', The integrated authentication portal server reads' http://192.168.10.11 / cspportal / dummy? authStr = 34dsre! 'to request a link to the portal dummy page for authentication to the CSP portal device. This is also applied to the CSC portal apparatus 20 and the CSB portal apparatus 30 in the same manner.

In response to the authentication dummy page call, the target portal device attempts to check whether the combination string received from the integrated authentication portal server is a correctly received string. At this time, the target portal device calls the two REST APIs to the integrated authentication portal server and finally checks the authentication with the received value. This authentication check procedure will be described in detail with reference to steps S250 and S260 of FIG.

The target portal device opens the dummy page for authentication according to the dummy page call for authentication from the integrated authentication portal server (S240).

The step S250 illustrated in FIG. 4 includes the following steps S252 and S254, and step S260 includes steps S261 through S268.

In step S252, the target portal device decrypts the encrypted combination string received in step S240 with the public key stored in the target portal device, and confirms the decoded combination string. By decryption, the target portal device can confirm the combination string combined with delimiter (: :).

The target portal apparatus parses the deciphered combination string in step S252 and extracts the ID and the encrypted temporary string (S254). That is, as a result of parsing in step S254, 'ID :: encrypted temporary string' is generated, and the target portal device acquires the ID of the user and the encrypted temporary string from this.

Then, the target portal apparatus calls the REST API URI to the integrated authentication portal server to request the disposable internal key used in the integrated authentication portal server (S261, S262).

In step S261 and step S262, the target portal apparatus calls the REST API URI provided by the integrated authentication portal server with the ID extracted in step S254 to request the transmission of the disposable internal key. The target portal device calls the REST API URI by GET method. Here, the REST API URI call type used for single-use internal key request is as follows.

Ex) <GET> http://192.168.10.2/mainportal/api/users/{id}/key

In the above form {id}, the ID of the user extracted in step S254 is described, and 'mainportal' means the integrated authentication portal server 100. Therefore, if the user's ID is extracted as 'nkia', the target portal device requests the transmission of the internal key using 'http://192.168.10.2/mainportal/api/users/nkia/key'.

The integrated authentication portal server confirms 'nkia', which is the ID of the user included in the REST API URI according to the call of the target portal device, and inquires the disposable internal key with the confirmed ID (S263). If the ID transmitted by the target portal device is an ID contained in the encrypted combination string in step S226, the disposable internal key is mapped to the ID identified in step S263. This is described in step S226.

The integrated authentication portal server transmits the disposable internal key confirmed in step S263 to the target portal apparatus (S264). In step S264, the integrated authentication portal server delivers the disposable internal key in the following form.

Example) Response

   {"auth": {"authKey": "d23fd1232sd"}}

In the above form, 'authKey' refers to the disposable internal key, and 'd23fd1232sd' refers to the disposable internal key actually used in step S224.

The target portal apparatus calls the REST API URI to the integrated authentication portal server to check whether the authentication procedure of the user is appropriate (S265, S266).

In steps S265 and S266, the target portal apparatus calls the REST API URI provided by the integrated authentication portal server in step S264 and the encrypted combination string received in step S230, thereby requesting the user's authentication check . The target portal device calls the REST API URI by GET method, and the REST API URI call method used for user authentication check is as follows.

Ex) <GET> http://192.168.10.2/mainportal/api/users/{id}/check

    Request

    {"auth": {"authKey": "d23fd1232sd", "authStr": "34dsre!"}}

In the above form {id}, the ID of the user extracted in step S254 is described, and 'check' has a meaning of requesting a user authentication check. When the user's ID is extracted as 'nkia', the target portal device requests the transmission of the internal key using 'http://192.168.10.2/mainportal/api/users/nkia/check'.

In the 'authKey' field of 'Request', the disposable internal key transmitted in step S264 is described, and the encrypted combination string received in step S230 is described in 'authStr'.

The integrated authentication portal server decrypts the received encrypted combination string using the disposable internal key, and then checks the authentication of the user (S267).

In step S267, the integrated authentication portal server decrypts the received encrypted combination string with the public key to confirm the combination string combined with the separator '::', parses the decrypted combination string, and stores the ID and the encrypted temporary string , That is, 'ID :: Encrypted Temporary String'. Then, the integrated authentication portal server 100 decrypts the extracted 'ID :: encrypted temporary string' with the received disposable internal key, parses it, and extracts the temporary string combined with 'password :: disposable internal key'.

The integrated authentication portal server verifies from the DB whether the extracted password is the password corresponding to the ID received from the target portal device, and if it is determined that the user authentication between the integrated authentication portal server and the target portal device is performed by a normal procedure do.

Accordingly, the integrated authentication portal server can check (authenticate) whether the user authentication is performed by a normal procedure by receiving the combination string (authStr) and the internal key (authKey) encrypted with the internal key and the public key again from the target portal apparatus.

The integrated authentication portal server transmits the success or failure of the user authentication check in step S267 to the target portal apparatus (S268). In step S268, the integrated authentication portal server transmits the authentication check success or failure as follows.

Response

{"auth": {"code": 0, "message": "non pw"}}

If '0' is written as 'code' in the above form, it means that the authentication is successful. If '1' is written, it means that the authentication has failed. Also, the reason for failure is described in 'message', and 'non pw' in the above example means that the password extracted by parsing does not match the password of the user.

If it is determined that the user authentication check is successful, the target portal device displays the main page of the portal (S270).

On the other hand, according to the embodiment of the present invention, for example, after the user accesses the portal provided by the CSP portal apparatus 10 as the target portal apparatus 10, the user must access the CSB portal A connection attempt and authentication procedure must be performed through the server 100 with a separate ID and password for connection to the device 20. [ That is, when the same user needs to use different portals, the user ID can be newly issued from the server 100 for each portal, and then accessed.

10, 20, 30: Cloud service portal devices 100: Integrated authentication portal server
12: Target public key decryption unit 14: Combination string parser
16: authentication request unit 110: authentication processing unit
120: Internal key encryption unit 130: Public key encryption unit
140: authentication check unit 150: DB

Claims (11)

(A) when the user logs in to the integrated authentication portal server, the integrated authentication portal server generates a multi-encrypted combination string using the login information, the disposable internal key, and the public key of the user;
(B) the integrated authentication portal server transmitting the encrypted combination string to a target portal apparatus among a plurality of cloud service portal apparatuses;
(C) decrypting the encrypted combination string by the target portal apparatus;
(D) checking the user's authentication using the combination string decrypted by the integrated authentication portal server and the target portal device and the disposable internal key; And
(E) if the authentication of the user is successful, the target portal device provides the main screen to the user. The method according to claim 1,
The step (A)
(A1) logging in the integrated authentication portal server using the user ID and password;
(A2) encrypting a temporary string in which the integrated authentication portal server combines the password and the disposable internal key with the disposable internal key; And
(A3) encrypting the combination string obtained by combining the encrypted temporary string and the ID with the public key. 3. The method of claim 2,
The step (C)
(C1) the target portal device decrypting the encrypted combination string using the public key to check the decrypted combination string; And
(C2) parsing the deciphered combination string to extract the ID and the encrypted temporary string. &Lt; RTI ID = 0.0 &gt; 31. &lt; / RTI &gt; The method of claim 3,
The step (D)
(D1) the target portal device calls the REST API URI with the extracted ID to request the disposable internal key;
(D2) the integrated authentication portal server verifying the ID described in the RESP API URI received from the step (D1), and inquiring the disposable internal key with the confirmed ID;
(D3) providing the retrieved disposable internal key to the target portal apparatus;
(D4) requesting the user authentication check by calling the REST API URI provided by the integrated portal server with the provided disposable internal key and the received encrypted combination string;
(D5) checking the authentication of the user using the encrypted combination string and the disposable internal key received by the integrated authentication portal server. 5. The method of claim 4,
The step (D5)
(D51) decrypting the received combination string with the received disposable internal key by the integrated authentication portal server;
(D52) parsing the decrypted temporary string to extract a password; And
(D53) checking whether the extracted password is a password corresponding to the ID received from the target portal apparatus, and checking the authentication of the user. The method according to claim 1,
The step (B)
(B1) the integrated authentication portal server determining the target portal device to be connected by the user among the plurality of cloud service portal devices stored in the database; And
(B2) transmitting the encrypted combination string to the identified target portal device by the integrated authentication portal server. A plurality of cloud service portal devices that are responsible for at least one of providing, using and brokering a cloud service; And
The user creates a multiple encrypted combination string using the login information, the disposable internal key, and the public key of the user so as to access a desired target portal device among the plurality of cloud service portal devices through one login, And an integrated authentication portal server for transmitting the encrypted combination string to the portal device and verifying the authentication of the user using the acquired user ID, the disposable internal key, and the public key by decrypting the encrypted combination string in the target portal device Security system for cloud service users. 8. The method of claim 7,
Wherein the integrated authentication portal server comprises:
An internal key encryption unit encrypting a temporary string combining the password and the disposable internal key with the disposable internal key when the user logs in the integrated authentication portal server using an ID and a password; And
And a public key encryption unit encrypting the combination string obtained by combining the encrypted temporary string and the ID with the public key. 9. The method of claim 8,
The target portal apparatus comprises:
A target public key decryption unit decrypting the encrypted combination string using the public key to identify the decrypted combination string; And
And a combinator string parser for parsing the deciphered combination string to extract the ID and the encrypted temporary string. &Lt; RTI ID = 0.0 &gt; [100] &lt; / RTI &gt; 10. The method of claim 9,
The target portal apparatus comprises:
The REST API URI is called with the extracted ID to request the disposable internal key, and when receiving the disposable internal key, the REST API URI is called with the provided disposable internal key and the received encrypted combination string, And an authentication request unit for requesting an authentication check of the user,
Wherein the integrated authentication portal server comprises:
Using the encrypted combination string and the disposable internal key described in the received REST API URI to inquire the disposable internal key with the ID described in the RESP API URI received from the target portal apparatus and providing the disposable internal key to the target portal apparatus, Further comprising: an authentication checking unit checking the authentication of the cloud service user. 11. The method of claim 10,
The authentication check unit,
A public key decryption unit for decrypting the encrypted combination string received from the target portal apparatus using the public key;
A parser for parsing the decrypted combination string to extract an ID and an encrypted temporary string; And
And an internal key decryption unit for decrypting the extracted temporary string using the received disposable internal key.

Images