KR20220056569A - Apparatus and method for controlling network access - Google Patents

Abstract

According to an embodiment, a communication terminal that communicates with a management server, a trusted server, and a user terminal to control access of the user terminal comprises: a plurality of different first communication interfaces for communicating with the user terminal; a second communication interface for communicating with the management server and the trusted server; a policy receiving unit for receiving an authentication policy for a communication terminal and an access policy for a communication terminal from the management server; a connection management unit for activating one of the first communication interfaces as the communication interface for authentication based on the authentication policy for a communication terminal and activating another one of the first communication interfaces as a data communication interface based on the access policy for a communication terminal; and a path control unit for forming an authentication channel with the trusted server through the second communication interface based on the authentication policy for a communication terminal and forming a data channel with the trusted server through the second communication interface based on the access policy for a communication terminal. Accordingly, it is possible to overcome the security limitations of operating only one existing data channel.

Description

Apparatus and method for controlling network access

The present invention relates to an apparatus and method for controlling network access, and more particularly, to an apparatus and method for controlling network access by separately operating an authentication channel and a data channel.

As telecommuting becomes active and communication technology develops, a network access control system is being developed for corporate employees to access an intranet inside a company from a remote location. In the network access control system, only communication terminals satisfying the access permission conditions are permitted to access the intranet (or private network) established in the enterprise.

Recently, as the 5G network has been built, a service is provided that allows a company-only network to be built on a 5G network using network slice technology, and a service that allows corporate employees to connect to the corporate intranet by accessing the 5G corporate-only network from a remote location. .

In such a network access control system, a technology for authenticating whether a connecting user is an authorized user should be introduced. There are several methods for authenticating a user. There are a method of using an address (MAC address, etc.) of a physical interface of a communication device used by a user, a method of using ID/PW, a method of allowing access only through a fixed communication path, and the like.

In the method using the physical interface address, when a USB (Universal Series Bus) port is used as a data channel using the RNDIS (Remote Network Driver Interface Specification) interface, a physical address such as a MAC address for the USB interface is temporarily created. Since the physical address of the USB interface changes every time it is connected, it is not suitable for use as an authentication method.

The method of using ID/PW is a representative method of using data for authentication that a person remembers, and there is a problem that ID/PW may be leaked through spying. Because it has to be set in a complicated way, there is a possibility that the security will be weak due to the limitation of management.

The method of authenticating a user by allowing access only through a fixed communication path has problems such as spying on each other's traffic between communication devices connected through a fixed communication path. There is a possibility of leakage.

The present invention has been proposed to solve the above problems, and in order to strengthen security in accessing an intranet within a company through a communication network such as 5G from a remote location, an authentication channel and a data channel are separated and operated for a user terminal located at a remote location Accordingly, an object of the present invention is to provide an apparatus and method for controlling network access.

According to an embodiment, a communication terminal communicating with a management server, a trust server, and a user terminal to control access of the user terminal includes: a plurality of different first communication interfaces for communicating with the user terminal; a second communication interface for communicating with the management server and the trust server; a policy receiver for receiving an authentication policy for a communication terminal and an access policy for a communication terminal from the management server; Activate one of the plurality of first communication interfaces as a communication interface for authentication based on the authentication policy for the communication terminal, and communicate the other one of the plurality of first communication interfaces for data based on the access policy for the communication terminal. a connection management unit activating as an interface; and establishing an authentication channel with the trusted server through the second communication interface based on the authentication policy for the communication terminal, and establishing a data channel with the trusted server through the second communication interface based on the access policy for the communication terminal. It includes a path control unit to form.

The path control unit may transmit an authentication request received from the user terminal through the authentication communication interface to the management server via the trust server through the authentication channel.

The policy receiving unit receives the access policy for the communication terminal from the management server as an authentication success response of the user terminal through the authentication channel, and the path control unit, as an authentication success response of the user terminal, through the authentication channel The access policy for the user terminal received from the management server may be transmitted to the user terminal through the communication interface for authentication.

The access policy for the user terminal includes data for additional authentication and communication interface information for data, and the path control unit is an access request including the data for additional authentication received from the user terminal through the communication interface for data may be transmitted to the trusted server through the data channel.

The path control unit may form multiple secure channels as the data channel with the trusted server based on user authority level information included in the access policy for the communication terminal.

The connection manager may reject or permit the access request based on the number of access allowed terminals included in the access policy for the communication terminal.

According to an embodiment, a method for a communication terminal communicating with a management server, a trust server, and a user terminal to control access of the user terminal includes: receiving an authentication policy for a communication terminal from the management server; activating one of the plurality of first communication interfaces as a communication interface for authentication based on the authentication policy for the communication terminal; forming an authentication channel with the trusted server based on the authentication policy for the communication terminal; receiving an access policy for a communication terminal from the management server; activating the other one of the plurality of first communication interfaces as a communication interface for data based on the access policy for the communication terminal; and establishing a data channel with the trusted server based on the access policy for the communication terminal.

In the method, before receiving the access policy for the communication terminal, the authentication request received from the user terminal through the communication interface for authentication is transmitted to the management server via the trust server through the authentication channel. It may include further steps.

The receiving of the access policy for the communication terminal includes receiving the access policy for the communication terminal as an authentication success response of the user terminal through the authentication channel, the method comprising: the authentication channel as an authentication success response of the user terminal The method may further include transmitting the access policy for the user terminal received from the management server through the communication interface for authentication to the user terminal.

The access policy for the user terminal includes data for additional authentication and communication interface information for data, and the method includes: an access request including the data for additional authentication received from the user terminal through the communication interface for data The method may further include transmitting to the trusted server through the data channel.

The forming of the data channel may include forming multiple secure channels as the data channel with the trusted server based on user authority level information included in the access policy for the communication terminal.

The method may further include rejecting or permitting the access request based on the number of access allowed terminals included in the access policy for the communication terminal.

According to an embodiment, a management device for controlling access of a user terminal accessing a trusted server via a communication terminal receives an authentication policy request from the communication terminal through a communication network, and communication for authentication to communicate with the user terminal a policy management unit configured to transmit, to the communication terminal, an authentication policy for a communication terminal including interface information and information on the trusted server that is a communication counterpart to form an authentication channel with the trusted server; and an authentication unit configured to authenticate the user terminal according to an authentication request received from the user terminal through the authentication communication interface and the authentication channel, wherein the policy management unit is for data to be communicated with the user terminal as an authentication success response An access policy for a communication terminal including information on a communication interface and information on the trusted server as a communication counterpart to form a data channel with the trusted server may be transmitted to the communication terminal through the authentication channel.

The policy management unit may include, as the authentication success response, an access policy for a user terminal including information of a communication interface for data to communicate with the communication terminal and data for additional authentication generated for temporary use as the authentication channel and the authentication It can be transmitted to the user terminal through the communication interface.

The policy management unit may transmit the server access policy including the information of the communication terminal and the additional authentication data to the trusted server.

The policy management unit may transmit the information about the user authority level of the user terminal including the access policy for the server and the access policy for the communication terminal.

The policy manager may include an encryption method and an encryption key in the access policy for the server, the access policy for the communication terminal, and the access policy for the user terminal, respectively, and transmit it.

The present invention operates only one data channel by using a low-speed communication interface such as Bluetooth or a Wi-Fi communication interface that cannot use a data channel due to internal security regulations as a channel dedicated to device authentication by separating the authentication channel and the data channel. It can overcome the security limitations when doing

According to the present invention, after device authentication and/or user authentication through an authentication channel, additional authentication data that the user does not know is generated and transmitted to the access device, and when the access device accesses the data channel, additional authentication is performed with additional authentication data to provide authentication information Security can be strengthened by blocking the possibility of leakage of

The present invention can enhance network access security by dynamically controlling the number of access devices that can access the network, and can also enhance security by dynamically configuring multiple secure channels according to user authority levels.

1 is a diagram showing the configuration of a network access control system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating the configuration of a primary terminal and a secondary terminal of FIG. 1 .
3 is a diagram illustrating the configuration of a management server and a trust server of FIG. 1 .
4 to 6 are diagrams for explaining a data channel between a secondary terminal and a trusted server according to an embodiment of the present invention.
7 is a flowchart illustrating a method of authenticating a secondary terminal in the network access control system of FIG. 1 .
8 is a flowchart illustrating a method of accessing a corporate intranet of a secondary terminal in the network access control system of FIG. 1 .

The above-described objects, features, and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, whereby those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in the description of the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing the configuration of a network access control system according to an embodiment of the present invention. Referring to FIG. 1 , the network access control system according to the present embodiment includes a primary terminal 110 , a secondary terminal 120 , a management server 130 , a trust server 140 , and a communication network 150 connecting them. and, the corporate intranet 160 . In the present embodiment with reference to FIG. 1 , the access control system controls access of the secondary terminal 220 to the corporate intranet 160 . In this embodiment, although the corporate intranet 160 is described as an access destination of the secondary terminal 220, the present invention is not limited thereto and may be another server or another end terminal as an access destination.

The primary terminal 110 serves to transmit user traffic received from the secondary terminal 120 to an external network, more specifically, the management server 130 or the trust server 140 . To this end, the primary terminal 110 serves as an access point to become an access host of the secondary terminal 120, and also routes user traffic by creating a path to an external network.

The primary terminal 110 includes a mobile router, a fixed router, or the like, and can communicate with the management server 130 and the trust server 140 through the communication network 150 , and is controlled by the management server 130 . It is not particularly limited as long as it can be a communication terminal.

The primary terminal 110 creates an authentication channel with the trust server 140 for the secondary terminal 120 to access the management server 130 and perform authentication according to a policy received from the management server 130 . In addition, the secondary terminal 120 connects to the corporate intranet 150 via the trust server 140 and creates a data channel for transmitting and receiving data with the trust server 140 .

The primary terminal 110 includes a plurality of communication interfaces. The plurality of communication interfaces include a plurality of different communication interfaces for communicating with the secondary terminal 120 and a communication interface for communicating with the communication network 150 . A communication interface for communicating with the secondary terminal 120 includes, for example, Wi-Fi, Wired Ethernet, Bluetooth, USB, and the like. The communication interface for communicating with the communication network 150 includes, for example, a 5G modem or an LTE modem.

The primary terminal 110 activates, respectively, a communication interface for authentication and a communication interface for data among a plurality of communication interfaces with respect to the secondary terminal 120 according to a policy received from the management server 130 . The communication interface for authentication is used for the secondary terminal 120 to access the authentication channel, and the communication interface for data is used for accessing the data channel.

The primary terminal 110 forms a secure tunnel by using a tunneling technique in forming an authentication channel and a data channel with the trust server 140 . As for the authentication channel, one security tunnel common to all secondary terminals 120 is formed. As for the data channel, multiple secure tunnels may be formed according to the authority level of the user of the secondary terminal 120 . The secure tunnel according to the permission level includes, for example, a secure tunnel for an organization, a secure tunnel for a terminal, or a combination of the two. The organizational security tunnel is a path commonly used by a specific organization or group within an enterprise. The secure tunnel for terminals is a secure tunnel for each terminal, and is a path dedicated to one secondary terminal 120 , and the path and encryption are separated for each secondary terminal 120 . In the combined security tunnel, a security tunnel for each terminal is formed within the organization security tunnel.

The primary terminal 110 may perform encrypted communication with the secondary terminal 120 according to the policy received from the management server 130 , and may also perform encrypted communication with the trust server 140 . In this case, the encryption key for encryption communication between the primary terminal 110 and the secondary terminal 120 and the encryption key for encryption communication between the primary terminal 110 and the trust server 140 may be different from each other.

The secondary terminal 120 is a user terminal that enables communication with a portable terminal such as a smart phone or tablet PC, a notebook computer, a personal computer, etc. and generates user traffic, and is a communication between employees in the company connected to the company intranet 160 . it is a terminal The secondary terminal 120 includes a plurality of communication interfaces. The plurality of communication interfaces include, for example, Wi-Fi, Wired Ethernet, Bluetooth, USB, and the like.

The secondary terminal 120 accesses the communication interface for authentication activated in the primary terminal 110 and requests authentication through an authentication channel between the primary terminal 110 and the management server 130 , and the management server 130 . ) to receive the policy as an authentication result. The policy received to the secondary terminal 120 includes a profile for data. The profile for data includes communication interface information for data, data for additional authentication, encryption information, and the like.

Here, the data for additional authentication is data used for additional authentication performed when accessing through the data channel separately from authentication through the authentication channel. The additional authentication data is information randomly and temporarily generated by the management server 130 without the user of the secondary terminal 120, and includes ID/PW or an authentication token made of random characters. The encryption information includes an encryption method and an encryption key used in communication between the secondary terminal 120 and the primary terminal 110 .

The secondary terminal 120 activates a communication interface corresponding to the data communication interface information included in the data profile for data, and connects to the primary terminal 110 through the data communication interface. For example, when the secondary terminal 120 activates Wi-Fi during authentication and connects to the primary terminal 110 , when the communication interface for data received from the management server 130 is Bluetooth In order to access the data channel, Bluetooth is activated to connect to the primary terminal 110 .

The management server 130 manages the authentication and access policy of the access control system according to the present invention. The management server 130 transmits the policy for the authentication channel to the primary terminal 110 and the trust server 140, and when authentication of the secondary terminal 120 is completed through the authentication channel, the primary terminal 110 ), transmits the policy for the data channel to the secondary terminal 120 and the trust server 140 . Hereinafter, the policy for the authentication channel is referred to as an authentication policy, and the policy for the data channel is referred to as an access policy.

The authentication policy for the terminal transmitted to the primary terminal 110 includes communication interface information for authentication, information of the trusted server 140 that forms an authentication channel, authentication method information, and encryption information. The server authentication policy transmitted to the trust server 140 includes information of the primary terminal 110 as a counterpart, authentication method information, encryption information, and the like.

The access policy for the primary terminal transmitted to the primary terminal 110 is communication interface information for data, information of the secondary terminal 120 allowed access, the number of allowed secondary terminals 120, authentication method information, encryption information, and user authority level information of the secondary terminal 120 . The access policy for the secondary terminal transmitted to the secondary terminal 120 includes a profile for data, and the profile for data includes communication interface information for data, data for additional authentication, encryption information, and the like. The server access policy transmitted to the trust server 140 includes information of the primary terminal 110 as a counterpart, data for additional authentication of the secondary terminal 120, the authority level of the secondary terminal 120, authentication method information, encryption information, and the like.

The trust server 140 controls the connection of the secondary terminal 120 to the corporate intranet 160 . The trusted server 140 allows access to the corporate intranet 160 only for the authorized secondary terminal 120 . The trust server 140 establishes an authentication channel and a data channel with the primary terminal 110 according to a policy received from the management server 130 . The trusted server 140 establishes an authentication channel and a data channel using a tunneling technique. The authentication channel is used only for authenticating the secondary terminal 120 , and the data channel is a separate secure channel distinct from the authentication channel, and is used for the secondary terminal 120 to access the corporate intranet 160 . .

In forming the data channel, the trusted server 140 may configure multiple secure channels for each user according to the user's authority level with reference to the policy. In addition, the trust server 140 may perform encrypted communication with the primary terminal 110 according to encryption information included in the policy, that is, an encryption method and an encryption key. A plurality of trusted servers 140 may exist physically or logically.

FIG. 2 is a diagram illustrating the configuration of a primary terminal and a secondary terminal of FIG. 1 . Referring to FIG. 2 , the primary terminal 110 includes a policy receiver 111 , a connection manager 112 , a path controller 113 , a plurality of communication interfaces 114 , and a logical interface 115 . The secondary terminal 120 includes a policy receiving unit 121 , an access control unit 122 , and a plurality of interfaces 123 .

The policy receiving unit 111, the connection management unit 112, and the path control unit 113 of the primary terminal 110 may be implemented as a program, stored in a memory, and executed by one or more processors, or as a combination of hardware and software. can be implemented and executed.

The policy receiving unit 111 connects to the management server 130 through the communication network 150 using a communication interface such as a 5G or LTE modem when the primary terminal 110 is booted, and is necessary as the management server 130 . Requests and receives the authentication policy for the primary terminal. Here, the authentication policy for the primary terminal includes information on a communication interface for authentication to communicate with the secondary terminal 120 , information on the trusted server 140 as a communication counterpart, encryption information, and authentication method information.

The connection manager 112 activates a communication interface for authentication to communicate with the secondary terminal 120 based on the received communication interface information for authentication included in the received authentication policy for the primary terminal. As shown in Figure 2, the primary terminal 110, as a plurality of communication interfaces 114, including Wi-Fi, Wired Ethernet, Bluetooth (Bluetooth), USB, etc., Activate one of these as a communication interface for authentication for authentication.

The path control unit 113 generates a logical interface 115 to communicate with the trusted server 140 by using the information of the trusted server 140 included in the received authentication policy for the primary terminal and forms an authentication channel. . That is, the path control unit 113 creates the logical interface 115 in a communication interface such as a 5G modem or an LTE modem.

The path control unit 113 establishes a path between the authentication communication interface communicating with the secondary terminal 120 activated by the connection management unit 112 and the logical interface 115 , that is, routing. The path control unit 113 uses a tunneling technique in forming the authentication channel.

The path control unit 113 transmits the authentication request received from the secondary terminal 120 through the communication interface for authentication to the management server 130 via the trust server 140 through the authentication channel.

When the authentication of the secondary terminal 120 is completed, the path control unit 113 transmits the access policy for the secondary terminal received from the management server 130 through the authentication channel as an authentication success response through the authentication communication interface. It is transmitted to the secondary terminal 120 .

When the authentication of the secondary terminal 120 is completed, the policy receiving unit 111 receives the access policy for the primary terminal from the management server 130 as an authentication success response and stores it in the internal storage unit. The access policy for the primary terminal includes information on a communication interface for data to communicate with the secondary terminal 120 , information on the trusted server 140 that is a communication partner, encryption information, authentication method information, access permitted ID, access permission It includes the number of terminals and user authority level information of the secondary terminal 120 .

The connection manager 112 activates a data communication interface to communicate with the secondary terminal 120 based on the information on the data communication interface included in the access policy for the primary terminal. For example, when the connection of the corporate intranet 160 allows only wired communication due to internal security regulations, the connection manager 112 activates the Wi-Fi interface as a communication interface for authentication and activates the USB interface as a communication interface for data can do. Alternatively, the connection manager 112 may activate the public Wi-Fi interface as a communication interface for authentication and activate the hidden Wi-Fi interface as a communication interface for data. Alternatively, the connection manager 112 may activate the Bluetooth interface as a communication interface for authentication and activate the hidden Wi-Fi interface as a communication interface for data.

The connection management unit 112, when the secondary terminal 120 accesses the data channel to access the data channel, based on the allowed ID included in the access policy for the primary terminal, the number of access allowed terminals, the secondary It is possible to permit or deny access to the terminal 120 . Here, the access allowed ID is identification information randomly generated by the management server 130 and assigned to the secondary terminal 120 , and the connection management unit 11 compares it with the ID received from the secondary terminal 120 . .

When the data channel access of the secondary terminal 120 is released, the connection manager 112 may delete a pre-stored access policy for the primary terminal. Accordingly, it is possible to dynamically adjust the number of secondary terminals 120 accessing the corporate intranet 160 under the control of the management server 130 .

The path control unit 113 creates a logical interface 115 to communicate with the trusted server 140 by using the information of the trusted server 140 included in the access policy for the primary terminal and forms a data channel. The path control unit 113 sets a path between the data communication interface activated by the connection management unit 112 and the logical interface 115 , that is, a routing. The path control unit 113 uses a tunneling technique to form the data channel.

In forming the data channel, the path control unit 113 may form multiple secure channels with the trust server 140 based on user authority level information included in the access policy for the primary terminal. The secure tunnel according to the permission level includes, for example, a secure tunnel for an organization, a secure tunnel for a terminal, or a combination of the two.

The path control unit 113 transmits an access request received from the secondary terminal 120 through the data communication interface to the trusted server 140 through the data channel.

The secondary terminal 120, the policy receiving unit 121, and the access control unit 122 may be implemented as a program, stored in a memory, and executed by one or more processors, or may be implemented and executed by a combination of hardware and software. .

The policy receiving unit 121 receives the access policy for the secondary terminal for accessing the corporate intranet 160 from the management server 130 . The access policy for the secondary terminal is received from the management server 130 through the authentication channel and the communication interface for authentication as an authentication success response after authentication of the secondary terminal 120 is completed by the access control unit 122 .

The access policy for the secondary terminal includes a profile for data. The profile for data includes communication interface information for data, data for additional authentication, encryption information, authentication method information, and the like. Here, the data for additional authentication is data used in authentication performed when accessing through the data channel, separately from authentication through the authentication channel. The additional authentication data is information randomly and temporarily generated by the management server 130 without the user of the secondary terminal 120, and includes ID/PW or an authentication token made of random characters. The encryption information includes an encryption method and an encryption key used in communication between the secondary terminal 120 and the primary terminal 110 .

The access control unit 122 activates a communication interface for authentication among the plurality of communication interfaces 123 according to preset information, accesses the primary terminal 110 through the activated communication interface for authentication, and the primary terminal ( 110) and the trust server 140 through the established authentication channel to request authentication to the management server (130). In this case, the authentication request may include device authentication and user authentication. Unique identification information (eg, terminal MAC address) of the secondary terminal 120 may be transmitted for device authentication, and ID/PW input from the user may be transmitted for user authentication. The ID/PW transmitted here is not the ID/PW included in the additional authentication data randomly and temporarily generated by the management server 130 transmitted through the data channel, but an ID fixedly assigned to the user that the user remembers. /PW.

When the authentication of the secondary terminal 120 is completed through the authentication channel, the access control unit 122 communicates corresponding to the communication interface information for data included in the access policy for the secondary terminal received from the policy receiving unit 121 . Activating the interface, accessing the primary terminal 110 through the activated data communication interface, and via the trust server 140 through the data channel formed between the primary terminal 110 and the trust server 140 Connect to the intranet 160 .

The access control unit 122, when accessing the primary terminal 110, performs encrypted communication with the primary terminal 110 according to the encryption information included in the access policy for the secondary terminal, and also for the secondary terminal Authentication is performed with the trusted server 140 through a data channel according to the authentication method information included in the access policy. In this case, the access control unit 122 performs authentication with the trust server 140 using additional authentication data included in the access policy for the secondary terminal. As described above, the additional authentication data is information randomly and temporarily generated in the management server 130 without the user of the secondary terminal 120, ID/PW, or an authentication token composed of random characters. etc.

According to the embodiment with reference to FIGS. 1 and 2 , the primary terminal 110 and the secondary terminal 120 include a communication interface for authentication used when the secondary terminal 120 is authenticated, and the secondary terminal 120 . After completion of the authentication, different communication interfaces are activated as communication interfaces for data for access to the corporate intranet 160, and the primary terminal 110 is formed by separating the trust server 140 and the authentication channel and data channel. . In addition, the secondary terminal 120 receives additional authentication data that the user is not aware of from the management server 130 after the completion of the basic authentication, and accesses the trust server 140 to perform additional authentication. In this way, security can be strengthened by separating the authentication channel and the data channel and performing authentication with additional authentication data temporarily allocated when accessing through the data channel.

3 is a diagram illustrating the configuration of a management server and a trust server of FIG. 1 . Referring to FIG. 3 , the management server 130 includes a policy management unit 131 and an authentication unit 132 . The trusted server 140 includes a policy receiving unit 141 , a path control unit 142 , and a logical interface 143 .

The policy management unit 131 and the authentication unit 132 of the management server 130 may be implemented as a program, stored in a memory, and executed by one or more processors, or may be implemented and executed by a combination of hardware and software.

The policy management unit 131 stores and manages an authentication policy for authentication of the secondary terminal 120 and an access policy for accessing the corporate intranet 160 of the secondary terminal 120 . The policy management unit 131 transmits the authentication policy for the primary terminal to the primary terminal 110 according to the request of the primary terminal 110 when the primary terminal 110 is booted.

Here, the authentication policy for the primary terminal is a policy for authentication of the secondary terminal 120 , and includes information on an interface for authentication to communicate with the secondary terminal 120 , information on the trusted server 140 as a communication partner, and encryption information, and authentication method information.

The policy management unit 131 transmits the authentication policy for the primary terminal to the primary terminal 110 while simultaneously transmitting the authentication policy for the server for forming an authentication channel to the trust server 140 . The server authentication policy includes information of the primary terminal 110 , encryption information, and authentication method information.

When the authentication for the secondary terminal 120 is successfully completed, the policy management unit 131 transmits an access policy to the primary terminal 110 , the secondary terminal 120 , and the trust server 140 as an authentication response. .

The access policy for the primary terminal transmitted to the primary terminal 110 includes information on a communication interface for data to communicate with the secondary terminal 120 , information on the trusted server 140 as a communication partner, encryption information, and an authentication method. information, access permitted ID, the number of access permitted terminals, and user authority level information of the secondary terminal 120 .

The access policy for the secondary terminal transmitted to the secondary terminal 120 includes a profile for data. The profile for data includes communication interface information for data, data for additional authentication, encryption information, authentication method information, and the like. The policy management unit 131 randomly and temporarily generates an ID/PW or an authentication token made of random characters as data for additional authentication.

The server access policy transmitted to the trust server 140 includes information of the primary terminal 110 , encryption information, authentication method information, data for additional authentication, and user authority level information of the secondary terminal 120 .

When the secondary terminal 120 accesses through the authentication channel, the authentication unit 132 performs authentication to check whether the secondary terminal 120 is a legitimate device and/or a legitimate user's device. Preferably, the authentication unit 132 may perform authentication with reference to a storage unit that stores unique identification information of the permitted device and the ID/PW of the permitted user. The authenticator 132 may perform 802.1X EAP authentication, and may generate an encryption key included in an access policy by using an individual session key generated through 802.1X EAP authentication.

The policy receiving unit 141 and the path control unit 142 of the trusted server 140 may be implemented as a program, stored in a memory, and executed by one or more processors, or may be implemented and executed by a combination of hardware and software.

The policy receiving unit 141 receives an authentication policy for a server for forming an authentication channel for the secondary terminal 120 and an access policy for a server for accessing the corporate intranet 160 of the secondary terminal 120 . The server authentication policy includes information of the primary terminal 110 , encryption information, and authentication method information.

The path control unit 142 forms an authentication channel by allocating a logical interface 143 for communication with the primary terminal 110 based on the authentication policy for the server, and receives the secondary terminal 120 through the authentication channel. ) transmits the authentication request to the management server 130 , and receives the authentication result from the management server 130 and transmits it to the secondary terminal 120 through the authentication channel. Here, the logical interface 143 is created in the physical communication interface.

When the authentication for the secondary terminal 120 is completed, the policy receiving unit 141 receives a server access policy from the management server 130 . The server access policy includes information of the primary terminal 110 , encryption information, authentication method information, data for additional authentication, and user's authority level information of the secondary terminal 120 .

The path control unit 142 allocates a logical interface 143 for communication with the primary terminal 110 and forms a data channel for the secondary terminal 120 based on the server access policy. The path controller 142 may form a multi-data channel that is a secure tunnel by using a tunneling technique according to the user's authority level. The secure tunnel according to the permission level includes, for example, a secure tunnel for an organization, a secure tunnel for a terminal, or a combination of the two. The organizational security tunnel is a path commonly used by a specific organization or group within an enterprise. The secure tunnel for terminals is a secure tunnel for each terminal, and is a path dedicated to one secondary terminal 120 , and the path and encryption are separated for each secondary terminal 120 . In the combined security tunnel, a security tunnel for each terminal is formed within the organization security tunnel.

4 to 6 are diagrams for explaining a data channel between a secondary terminal and a trusted server according to an embodiment of the present invention.

4 is an example in which the secure channel for the organization and the secure channel for the terminal are formed in multiple with respect to the secondary terminal 120 . The secondary terminal 120 forms a communication path 410 through the communication interface for data with the primary terminal 110 . The primary terminal 110 is a data channel for the secondary terminal 120, and as shown in FIG. 4, additionally forms a secure channel 420a for the secondary terminal in the secure tunnel 420 for the organization. This is a case in which the user of the secondary terminal 120 belongs to organization A of the company, and the user is a user of a specific rank or higher, such as an executive of the company, and an additional security channel is required. Organizational encryption and terminal encryption are combined and applied at the same time. Accordingly, the secondary terminal 120 accesses the corporate intranet 160 in a state in which security is enhanced more than that of other members of the organization A of the enterprise.

In FIG. 5 , only a secure channel 530 for an organization common to each of the secondary terminals 120a and 120b of two users is assigned as a data channel. Each of the secondary terminals 120a and 120b forms communication paths 510 and 520 through the primary terminal 110 and the data communication interface, respectively. As shown in FIG. 5 as a data channel for each of the secondary terminals 120a and 120b, the primary terminal 110 forms only one common secure tunnel 530 for an organization. Both users belong to organization B within the enterprise, and the organization is subject to the same path and encryption.

In FIG. 6 , secure channels 630 and 640 for respective terminals are allocated as data channels for each of the secondary terminals 120c and 120d of two users. Each of the secondary terminals 120c and 120d forms communication paths 610 and 620 through the primary terminal 110 and the data communication interface, respectively. The primary terminal 110 is a data channel for each of the secondary terminals 120c and 120d, and as shown in FIG. 6 , forms respective secure tunnels 630 and 640 for each secondary terminal. Therefore, even if the two users belong to organization C within the company, the path and encryption are applied separately for each terminal.

7 is a flowchart illustrating a method of authenticating a secondary terminal in the network access control system of FIG. 1 .

Referring to FIG. 7 , in step S701 , the primary terminal 110 boots according to a user's input. In step S702 , the primary terminal 110 accesses the management server 130 through the communication network 150 using a 5G or LTE modem, and requests the necessary authentication policy for the terminal from the management server 130 .

In step S703 , the management server 130 transmits the authentication policy for the terminal to the primary terminal 110 according to the request of the primary terminal 110 . Here, the authentication policy for the terminal includes information on a communication interface for authentication to communicate with the secondary terminal 120 , information on the trusted server 140 as a communication counterpart, encryption information, and authentication method information.

In step S704 , the management server 130 transmits the server authentication policy to the trust server 140 . Here, the server authentication policy includes information of the primary terminal 110 , encryption information, and authentication method information.

In step S705, the primary terminal 110 activates a communication interface for authentication to communicate with the secondary terminal 120 based on the authentication policy for the terminal received in the step S703. The primary terminal 110, as a plurality of communication interfaces 114, includes Wi-Fi, Wired Ethernet, Bluetooth, USB, etc., included in the authentication policy for the terminal. Activate the communication interface corresponding to the communication interface for authentication.

In step S706, the primary terminal 110 and the trust server 140 establish an authentication channel based on the authentication policies received in the steps S703 and S704, respectively. In this case, the primary terminal 110 and the trust server 140 set encryption based on encryption information included in the authentication policy. For example, they share encryption keys with each other. Preferably, the authentication channel may be a secure tunnel using a tunneling technique.

In step S707, the secondary terminal 120 activates the communication interface for authentication according to information preset therein. That is, the primary terminal 110 activates the same type of communication interface as the communication interface activated in step S705.

In step S708, the secondary terminal 120 connects to the primary terminal 110 through the activated communication interface for authentication, for example, Bluetooth, or Wi-Fi, and transmits an authentication request. In this case, the authentication request includes unique identification information (eg, MAC address) of the secondary terminal 120 and/or ID/PW input from the user.

In step S709, the primary terminal 110 transmits an authentication request to the management server 130 via the trust server 140 through the authentication channel formed in step S706. Accordingly, the management server 130 performs device authentication and/or user authentication using the unique identification information and/or ID/PW of the secondary terminal 120 included in the authentication request.

If authentication is successful, in step S710 , the management server 130 transmits the access policy for the secondary terminal to the secondary terminal 120 . The access policy for the secondary terminal includes a profile for data. The profile for data includes communication interface information for data, data for additional authentication, encryption information, authentication method information, and the like. Here, the data for additional authentication is data used in authentication performed when accessing through the data channel, separately from authentication through the authentication channel. The additional authentication data is information randomly and temporarily generated by the management server 130 without the user of the secondary terminal 120, and includes ID/PW or an authentication token made of random characters.

In step S711 , the management server 130 transmits the access policy for the primary terminal to the primary terminal 110 . The access policy for the primary terminal includes information on a communication interface for data to communicate with the secondary terminal 120 , information on the trusted server 140 that is a communication partner, encryption information, authentication method information, access permitted ID, access permission It includes the number of terminals, information about the authority level of the user of the secondary terminal 120, and the like.

In step S712 , the management server 130 transmits the server access policy to the trusted server 140 . The server access policy includes information of the primary terminal 110 , encryption information, authentication method information, data for additional authentication, and user's authority level information of the secondary terminal 120 .

In step S713, the primary terminal 110 and the trust server 140 form a data channel for the secondary terminal 120 according to the access policy received in steps S711 and S712, respectively. The primary terminal 110 and the trusted server 140 may form multiple data channels that are secure tunnels by using a tunneling technique according to the user's authority level.

FIG. 8 is a flowchart illustrating a method of accessing a corporate intranet by a secondary terminal in the network access control system of FIG. 1 , and a subsequent process of the embodiment described with reference to FIG. 7 is described.

Referring to FIG. 8 , in step S801 , the primary terminal 110 activates a communication interface corresponding to the communication interface information for data included in the access policy for the primary terminal received from the management server 130 in step S711 . do.

In step S802, the secondary terminal 120 activates a communication interface corresponding to the communication interface information for data included in the access policy for the secondary terminal received from the management server 130 in step S710. That is, the secondary terminal 120 activates a communication interface of the same type as the communication interface for data in which the primary terminal 110 is activated.

In step S803, the secondary terminal 120 transmits an access request including additional authentication data included in the access policy for the secondary terminal to the primary terminal 110 using the activated data communication interface. do.

In step S804, the primary terminal 110 compares the allowed ID included in the access policy for the primary terminal with the ID included in the additional authentication data received from the secondary terminal 120, and the allowed ID Check if it is connected to If the connection is of an allowed ID, in step S805, the primary terminal 110 checks whether the connection exceeds the number of allowed terminals included in the access policy for the primary terminal.

As a result of checking in step S804, if it is not an allowed ID connection, or if as a result of checking in step S805, the number of allowed terminals is exceeded, in step S806, the primary terminal 110, the secondary terminal 120 to send a connection rejection.

On the other hand, in the case of a connection with an allowed ID and a connection within the number of allowed terminals, in step S807, the primary terminal 110 connects to the trust server 140 through the data channel formed in step S713 described with reference to FIG. send the request In this case, the primary terminal 110 encrypts data according to the encryption information included in the access policy for the primary terminal and transmits it to the trust server 140 .

In step S808, the trust server 140 includes the data for additional authentication of the secondary terminal 120 included in the access request received from the primary terminal 110, and the management server ( 130), additional authentication is performed to check whether the data for additional authentication of the secondary terminal 120 included in the access policy for the server matches.

Upon successful additional authentication, in steps S809 and S810 , the trust server 140 transmits an access approval to the secondary terminal 120 via the primary terminal 110 through the data channel. And in step S811 , the secondary terminal 120 transmits and receives data by accessing the corporate intranet 160 through the data channel via the primary terminal 110 and the trust server 140 .

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features described herein in a single embodiment may be implemented in various embodiments individually, or may be implemented in appropriate combination.

Although acts are described in a particular order in the drawings, it should not be understood that the acts are performed in the particular order as shown, or that all of the described acts are performed in a continuous order, or to obtain a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable form in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.). Since this process can be easily performed by a person skilled in the art to which the present invention pertains, it will not be described in detail any longer.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible within the scope without departing from the technical spirit of the present invention. It is not limited by the drawings.

110: primary terminal
120: secondary terminal
130: management server
140 : trust server
150: communication network
160: Corporate Intranet
111, 121, 141: policy receiver
112: connection management unit
113, 142: path control unit
122: access control unit
114, 123: multiple communication interfaces
115, 143: logical interface
131: policy management department
132: authentication unit

Claims (17)

A communication terminal for controlling access of the user terminal by communicating with a management server, a trust server, and a user terminal,
a plurality of different first communication interfaces for communicating with the user terminal;
a second communication interface for communicating with the management server and the trust server;
a policy receiver for receiving an authentication policy for a communication terminal and an access policy for a communication terminal from the management server;
Activate one of the plurality of first communication interfaces as a communication interface for authentication based on the authentication policy for the communication terminal, and communicate the other one of the plurality of first communication interfaces for data based on the access policy for the communication terminal. a connection management unit activating as an interface; and
Establish an authentication channel with the trusted server through the second communication interface based on the authentication policy for the communication terminal, and establish a data channel with the trusted server through the second communication interface based on the access policy for the communication terminal A communication terminal comprising a path control unit. According to claim 1,
The path control unit,
and transmitting an authentication request received from the user terminal through the authentication communication interface to the management server via the trust server through the authentication channel. 3. The method of claim 2,
The policy receiving unit,
Receiving the access policy for the communication terminal from the management server as an authentication success response of the user terminal through the authentication channel,
The path control unit,
Communication terminal, characterized in that for transmitting the access policy for the user terminal received from the management server through the authentication channel as an authentication success response of the user terminal to the user terminal through the communication interface for authentication. 4. The method of claim 3,
The access policy for the user terminal is,
data for additional authentication and communication interface information for data;
The path control unit,
and transmitting an access request including the data for additional authentication received from the user terminal through the data communication interface to the trusted server through the data channel. 5. The method of claim 4,
The path control unit,
and forming multiple secure channels as the data channel with the trusted server based on user authority level information included in the access policy for the communication terminal. 5. The method of claim 4,
The connection management unit,
A communication terminal, characterized in that it rejects or permits the access request based on the number of access allowed terminals included in the access policy for the communication terminal. A method for a communication terminal communicating with a management server, a trust server and a user terminal to control access of the user terminal,
receiving an authentication policy for a communication terminal from the management server;
activating one of the plurality of first communication interfaces as a communication interface for authentication based on the authentication policy for the communication terminal;
forming an authentication channel with the trusted server based on the authentication policy for the communication terminal;
receiving an access policy for a communication terminal from the management server;
activating the other one of the plurality of first communication interfaces as a communication interface for data based on the access policy for the communication terminal; and
and establishing a data channel with the trusted server based on an access policy for the communication terminal. 8. The method of claim 7,
Prior to receiving the access policy for the communication terminal,
The method further comprising the step of transmitting an authentication request received from the user terminal through the communication interface for authentication to the management server via the trust server through the authentication channel. 9. The method of claim 8,
Receiving the access policy for the communication terminal comprises:
Receiving the access policy for the communication terminal as an authentication success response of the user terminal through the authentication channel,
The method is
The method further comprising the step of transmitting an access policy for a user terminal received from the management server through the authentication channel as an authentication success response of the user terminal to the user terminal through the communication interface for authentication. 10. The method of claim 9,
The access policy for the user terminal is,
data for additional authentication and communication interface information for data;
The method is
The method of claim 1, further comprising: transmitting an access request including the data for additional authentication received from the user terminal through the data communication interface to the trusted server through the data channel. 11. The method of claim 10,
Forming the data channel comprises:
and forming multiple secure channels as the data channels with the trusted server based on user authority level information included in the access policy for the communication terminal. 11. The method of claim 10,
The method further comprising the step of rejecting or permitting the access request based on the number of access allowed terminals included in the access policy for the communication terminal. A management device for controlling access of a user terminal accessing a trusted server via a communication terminal, comprising:
A communication terminal that receives an authentication policy request from the communication terminal through a communication network, and includes information on a communication interface for authentication to communicate with the user terminal and information on the trusted server as a communication partner to form an authentication channel with the trusted server a policy management unit for transmitting an authentication policy for use to the communication terminal; and
An authentication unit for authenticating the user terminal according to the authentication request received from the user terminal through the authentication communication interface and the authentication channel,
The policy management unit,
An access policy for a communication terminal including information of a communication interface for data to be communicated with the user terminal as an authentication success response and information of the trusted server that is a communication partner to form a data channel with the trusted server through the authentication channel A management device, characterized in that the transmission to the communication terminal. 14. The method of claim 13,
The policy management unit,
As the authentication success response, an access policy for a user terminal including information on a communication interface for data to communicate with the communication terminal and additional authentication data generated for temporary use is transmitted through the authentication channel and the authentication communication interface. Management device, characterized in that the transmission to the user terminal. 15. The method of claim 14,
The policy management unit,
The management device, characterized in that for transmitting the server access policy including the information of the communication terminal and the additional authentication data to the trusted server. 16. The method of claim 15,
The policy management unit,
Management device, characterized in that the information about the user authority level of the user terminal is transmitted by being included in the access policy for the server and the access policy for the communication terminal. 17. The method of claim 16,
The policy management unit,
An encryption method and an encryption key are included in the access policy for the server, the access policy for the communication terminal, and the access policy for the user terminal, respectively, and transmitted.

Images