KR20230012851A - Apparatus and method for enhancing network access security - Google Patents

Abstract

Disclosed are a device and a method for enhancing network access security by individually enhancing security of an authenticating step and a service accessing step when accessing the intranet in an enterprise through a mobile communicating network such as 5G or the like in a remote place with a portable terminal having a mobile communicating function such as 5G or the like. According to an embodiment, a communicating terminal which is connected to a second terminal and relays access of the mobile communicating network of the second terminal comprises: a first communicating unit; a second communicating unit; a third communicating unit; and a controlling unit. The first communicating unit independently accesses a terminal managing slice, a user authenticating slice, and a service slice provided in the mobile communication network. The second communicating unit communicates with the second terminal. The third communicating unit communicates with a third terminal which is carried by a user of the second terminal. The controlling unit performs terminal authentication of the second terminal and the communicating terminal through terminal managing slice; performs authentication of the user through the user authenticating slice; provides a service for the second terminal through the service slice; and terminates access for the service for the second terminal when occupancy authentication fails through the third terminal.

Description

Apparatus and method for enhancing network access security

The present invention relates to an apparatus and method for enhancing network access security, and more particularly, to an apparatus and method for enhancing network access security by reinforcing security in each of an authentication step and a service access step.

As telecommuting becomes active and communication technology develops, a network access control system for allowing corporate employees to remotely access an intranet within the company is being developed. In the network access control system, only communication terminals that satisfy access conditions are permitted to access the intranet (or private network) built in the company. Recently, as 5G networks are being built, a company-specific network is built on the 5G network using network slice technology, and a service is provided that allows corporate employees to connect to the 5G corporate-specific network from a remote location and access the intranet within the company. .

In order to access such a 5G corporate dedicated network, a user terminal must have a 5G communication function. Since a business user terminal is a terminal without a 5G communication function, such as a personal PC or laptop, it is equipped with a communication function capable of accessing the 5G network. A method of using a separate portable terminal connected to a user terminal is being promoted. However, when a portable terminal equipped with such a 5G communication function is stolen/lost, there is a risk that a malicious acquirer accesses a company-specific network and leaks important data of the company. Therefore, in accessing a 5G corporate dedicated network using a portable terminal equipped with a 5G communication function, it is necessary to strengthen security.

The present invention has been proposed to solve the above-mentioned problems, using a portable terminal equipped with a mobile communication function such as 5G, to access an intranet within a company through a mobile communication network such as 5G from a remote location, an authentication step and a service access step An object of the present invention is to provide a device and method for strengthening network access security by strengthening each security.

According to an embodiment, a communication terminal that is connected to a secondary terminal and relays an access of the secondary terminal to a mobile communication network independently of a terminal management slice, a user authentication slice, and a service slice provided by the mobile communication network. A first communication unit to connect; a second communication unit communicating with the secondary terminal; a third communication unit communicating with a tertiary terminal carried by a user of the secondary terminal; and performing terminal authentication of the secondary terminal and the communication terminal through the terminal management slice, performing authentication of the user through the user authentication slice, and providing a service to the secondary terminal through the service slice. and a control unit for terminating the service connection to the secondary terminal when the occupancy authentication fails through the tertiary terminal.

The control unit performs occupancy authentication through the tertiary terminal at predetermined time intervals, based on the signal strength and response time of a response message received from the tertiary terminal with respect to the message transmitted to the tertiary terminal. You can adjust the time interval.

The controller may increase the time interval when it is determined to be in a safe state based on the signal strength and the response time, and decrease the time interval when it is determined to be in an unsafe state.

The control unit sets the sum of the value corresponding to the signal strength and the value corresponding to the response time as a decision value, determines a safe state when the determined value is greater than or equal to a reference value, and determines an unsafe state when the determined value is smaller than the reference value. can be judged by

The control unit may increase the time interval in the form of a positive exponential function in a safe state and decrease the time interval in the form of a negative exponential function in an unsafe state.

The control unit may set a time interval to a time interval of a previous communication cycle in a communication period in which the determined value is greater than or equal to the reference value.

The present invention separates channels for terminal authentication, user authentication, and service access, that is, slices, to enhance security for network access. The user authentication slice for user authentication can be accessed only when the terminal authentication is successful, and the service slice can be accessed only when the user authentication is successful, thereby enhancing security.

In the present invention, when a primary terminal connected to a user's secondary terminal and communicating with a mobile communication network periodically communicates with a user's tertiary terminal, the signal strength of the tertiary terminal becomes weak or the response time of the tertiary terminal becomes long. , or when there is no response from the tertiary terminal, by blocking network access, security can be further strengthened in the case of loss or theft of the primary terminal.

1 is a diagram showing the configuration of a network access control system according to an embodiment of the present invention.
FIG. 2 is a diagram showing the configuration of a primary terminal of FIG. 1 .
3 is a diagram illustrating a communication time interval between a primary terminal and a tertiary terminal according to an embodiment of the present invention.
FIG. 4 is a graph showing a positive exponential function of increasing time intervals in the safe state of FIG. 3 .
FIG. 5 is a graph showing a negative exponential function decreasing the time interval in the unstable state of FIG. 3 .
6 is a flowchart illustrating a method of accessing a VDI server in the system of FIG. 1;

The above-described objects, features and advantages will become more apparent through the following detailed description in conjunction with the accompanying drawings, and accordingly, those skilled in the art to which the present invention belongs can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing the configuration of a network access control system according to an embodiment of the present invention. Referring to FIG. 1, the network access control system according to this embodiment includes a primary terminal 110, a secondary terminal 120, a tertiary terminal 130, a terminal management server 140, and a user authentication server 150. ), a Virtual Desktop Infrastructure (VDI) server 160 and a Software Defined Networking (SDN) system 170. In this embodiment, as a company intranet system, a VDI system will be described as an example.

VDI, also called virtual desktop service, is a virtualization technology that runs a virtual desktop instance of a virtual machine through a hypervisor on a host server and streams the screen of the virtual machine to the client program when a user remotely accesses the virtual machine through a client program. to be. That is, all work is performed on a virtual desktop instance of a virtual machine, and the screen of the virtual machine is streamed to the user terminal, rather than being performed on a local user terminal. However, the present invention is not applied only to such a VDI environment, but may also be applied to an environment in which a private network within a company is accessed through a company-specific telecommunications network (ie, a company-only slice).

The terminal management server 140, the user authentication server 150, the VDI server 160, and the SDN system 170 shown in FIG. 1 may be components constituting a mobile communication network, or end devices connected to the mobile communication network. It could be. The mobile communication network of this embodiment takes a 5G mobile communication network as an example. The 5G mobile communication network includes a next generation nodeB (gNB), a user plane function (UPF), an access and mobility management function (AMF), a session management function (SMF), and a policy control function (PCF), and uses network slice technology. support The network slice technology bundles network resources and network functions into one independent slice according to individual services. The network slice technology is based on Network Function Virtualization (NFV) and Software Defined Network (SDN) technologies, and as shown in FIG. 1, the SDN system 170 in this embodiment A terminal management slice 141, a user authentication slice 151, and a VDI slice 161 are provided.

The primary terminal 110 is connected to the secondary terminal 120 and relays the connection of the secondary terminal 120 to the VDI server 160 . The primary terminal 110 is a portable device including a communication module capable of accessing a 5G mobile communication network, and may be connected to the secondary terminal 120 by wire through a USB port or through short-range communication such as Wi-Fi. , In this embodiment, it is connected through a USB port. The primary terminal 110 performs terminal authentication of itself and the secondary terminal 120 through the terminal management slice 141, and after terminal authentication is completed, the secondary terminal 120 through the user authentication slice 151. User authentication is performed, and after user authentication is completed, the VDI server 160 is accessed through the VDI slice 161.

Preferably, the primary terminal 110 may include an operating system (OS) such as Windows and a client program for accessing the VDI server 160 inside, like a stick-type PC. For example, when the secondary terminal 120 is a terminal on which an operating system is not installed, such as a TV, the primary terminal 110 may run the operating system and execute the client program, or the secondary terminal 120 may run the operating system. In the case of a terminal including an operating system such as a laptop computer or a personal PC, the client program may be loaded into the memory of the secondary terminal 120 and executed. However, it is not limited thereto, and the client program may be installed and operated in the secondary terminal 120 .

The secondary terminal 120 is a user terminal having a display device such as a laptop computer, a personal PC, or a TV, and an input device such as a mouse and keyboard. The secondary terminal 120 is connected to the primary terminal 110 through a USB port or short-range communication and accesses the VDI server 160 through the primary terminal 110 . As described above, authentication of the secondary terminal 120 is performed by the primary terminal 110 through the terminal management slice 141 . Authentication of the user of the secondary terminal 120 is performed by the primary terminal 110 through the user authentication slice 151 as described above. User authentication includes ID/password authentication and other authentication for identity verification. The user may input authentication information through an authentication information input window displayed by the client program.

The tertiary terminal 130, as a communication terminal for authentication of occupancy, is connected to the primary terminal 110 through short-range communication such as Bluetooth, so that the secondary terminal 120 can communicate through the primary terminal 110. While connecting to the VDI server 160 and providing the VDI service, it responds to the request of the primary terminal 110 at predetermined time intervals. The tertiary terminal 130 may be a portable device carried by the user of the secondary terminal 120, such as a smart phone. The primary terminal 110 stores terminal information about the tertiary terminal 130 in advance, requests terminal information from the tertiary terminal 130 at predetermined time intervals, receives a response message, and receives a response message. When the terminal information included in the received response message does not match the previously stored terminal information, or when there is no response from the tertiary terminal 130, the connection with the VDI server 160 is terminated. That is, the primary terminal 110 performs occupancy authentication using the tertiary terminal 130 . Even a legitimate user cannot use the VDI service when using the secondary terminal 120 without having the tertiary terminal 130 .

The primary terminal 110 may adjust a time interval for communication with the tertiary terminal 130 based on the signal strength and response time of the response message received from the tertiary terminal 130 . The primary terminal 110 increases the time interval when it is determined to be in a safe state based on the signal strength and response time of the response message, and decreases the time interval when it is determined to be in an unsafe state. Preferably, the primary terminal 110 increases or decreases the time interval according to an exponential function when increasing or decreasing the time interval. At this time, the primary terminal 110 uses an exponential function for adjusting the time interval in the safe state and an exponential function for adjusting the time interval in the unsafe state. This will be described in more detail below with reference to the drawings.

The terminal management server 140 performs terminal authentication through the terminal management slice 141 . Terminal authentication is to check whether a predetermined terminal is used. Terminal authentication is performed using unique information (eg, MAC address, serial number) of the terminal as authentication information. The terminal management server 140 checks whether the unique information of the primary terminal 110 and the unique information of the secondary terminal 120 match pre-registered information, and also determines whether the primary terminal 110 and the secondary terminal ( 120) is a pre-registered mapping relationship. That is, even if the primary terminal 110 is a terminal registered in advance, authentication fails when using the secondary terminal 120 that is not in a designated mapping relationship.

The user authentication server 150 performs user authentication through the user authentication slice 151 . Here, user authentication is authentication that is different from terminal authentication, and is to confirm whether a user is a legitimate user. User authentication is performed using unique information known only to the user as authentication information. Here, the unique information includes, for example, an ID/password or unique personal identification information. User authentication is performed after terminal authentication for the primary terminal 110 and the secondary terminal 120 is successful. Preferably, the user authentication server 150 receives the information of the primary terminal 110 from the SDN system 170 when the terminal authentication is successful, and requests user information from the primary terminal 110 based on this, so that the user's Unique information, that is, authentication information is received and authenticated.

The VDI server 160 runs virtual desktop instances by driving as many virtual machines as the number of users using virtualization technology, and transmits an execution screen of the virtual desktop to a client program in real time. In this embodiment, the VDI server 160 transmits an execution screen of a virtual desktop to a client program executed on the primary terminal 110 or the secondary terminal 120 in real time. The VDI server 160 communicates with the client program through the VDI slice 161. Access through the VDI slice 161 is allowed after the above-described terminal authentication and user authentication are completed. Preferably, the VDI server 160 receives information on the primary terminal 110 from the SDN system 170 when user authentication is successful, and transmits a VDI access permission message to the primary terminal 110 based on this information.

The SDN system 170 implements a network slice of a 5G mobile communication network based on Network Function Virtualization (NFV) and Software Defined Network (SDN) technologies. In this embodiment, the SDN system 170 generates a terminal management slice 141, a user authentication slice 151, and a VDI slice 161. The SDN system 170 communicates with the terminal management server 140, the user authentication server 150, and the VDI server 160. When the terminal authentication is successful, the SDN system 170 receives a user authentication slice use request including information of the primary terminal 110 from the terminal management server 140, and accordingly sends the primary terminal to the user authentication server 150. Information of the terminal 110 is transmitted. In addition, the SDN system 170 receives a VDI slice use request including information of the primary terminal 110 from the user authentication server 150 when user authentication is successful, and accordingly, the primary terminal to the VDI server 160. Transmit the information of (110).

FIG. 2 is a diagram showing the configuration of a primary terminal of FIG. 1 . Referring to FIG. 2 , the primary terminal 110 includes a first communication unit 111 , a second communication unit 112 , a third communication unit 113 , a storage unit 114 and a control unit 115 .

The first communication unit 111 includes a modem for mobile communication and communicates with a mobile communication network. In this embodiment, the first communication unit 111 may include a modem for 5G mobile communication. The first communication unit 111 communicates with the terminal management server 140 through the terminal management slice 141 of the 5G mobile communication network for terminal authentication, and the user authentication server ( 150) and communicates with the VDI server 160 through the VDI slice 161 for VDI service.

The second communication unit 112 communicates with the secondary terminal 120 . The second communication unit 112 includes a USB communication module or short range communication module, and communicates with the secondary terminal 120 through the USB communication module or short range communication module. In this embodiment, the second communication unit 112 communicates by being connected to the USB port of the secondary terminal 120 through a USB communication module.

The third communication unit 113 communicates with the tertiary terminal 130 . The third communication unit 113 includes a short-range communication module and communicates with the tertiary terminal 130 through the short-range communication module. The third communication unit 113, when the second communication unit 112 communicates with the secondary terminal 120 through the short-range communication module, uses a short-range communication of a communication protocol different from that of the short-range communication module. Communicate with (130). For example, when the second communication unit 112 performs Wi-Fi communication, the third communication unit 113 performs Bluetooth communication.

The storage unit 114 stores programs for operation of the primary terminal 110 , various data, and terminal information of the tertiary terminal 130 . Preferably, the storage unit 114 may store a client program for VDI connection and may also store an operating system such as Windows. The storage unit 114 may include high-speed random access memory, and may also include one or more magnetic disk storage devices, non-volatile memories such as flash memory devices, or other non-volatile semiconductor memory devices. Programs stored in the storage unit 114 may be executed by the control unit 115 or may be loaded into the operating system of the secondary terminal 120 and executed.

The controller 115 controls the overall operation of the primary terminal 110 . The controller 115 may include, for example, at least one central processing unit (CPU). When connected to the secondary terminal 120 through the second communication unit 112, the control unit 115 sends a terminal use request to the terminal management server 140 through the first communication unit 111 and the terminal management slice 141. and transmits the unique information of the primary terminal 110 in response to the authentication information request of the terminal management server 140 .

In addition, the control unit 115, when the terminal authentication of the primary terminal 110 succeeds, the secondary terminal 120 from the terminal management server 140 through the first communication unit 111 and the terminal management slice 141 The authentication information request is received and in response to the request, the unique information of the secondary terminal 120 obtained from the secondary terminal 120 is transmitted to the terminal management server 140 .

In addition, the control unit 115, when the authentication of the primary terminal 110 and the secondary terminal 120 succeeds, the user authentication server 150 through the user authentication slice 151 and the first communication unit 111 Receive authentication information request. In response to this, the control unit 115 transmits the user authentication information obtained from the secondary terminal 120 through the second communication unit 112 through the first communication unit 111 and the user authentication slice 151 to the user authentication server ( 150). Preferably, the control unit 115 may display an input window for user authentication information through a client program and receive user authentication information from a user through the input window.

Also, if the user authentication is successful, the control unit 115 receives a VDI access permission message from the VDI server 160 through the VDI slice 161 and the first communication unit 111 from the VDI server 160 . The control unit 115 transmits a VDI access permission message to the client program loaded in the secondary terminal 120 or the primary terminal 110, and the user receives the VDI server 160 through the VDI slice 161 through the client program. ) can be accessed.

The control unit 115 performs occupancy authentication using the tertiary terminal 130 after access to the VDI server 160 is permitted. That is, the control unit 115 requests terminal information from the tertiary terminal 130 through the third communication unit 113 at predetermined time intervals, receives a response message, and stores the terminal information included in the received response message. It is checked whether it matches the terminal information stored in advance in 114, and if it does not match, or if there is no response from the tertiary terminal 130 for a predetermined time, it is determined that the occupancy authentication has failed, and the VDI server 160 close the connection

The controller 115 may adjust a time interval for communication with the tertiary terminal 130 based on the signal strength and response time of the response message received from the tertiary terminal 130 . Based on the signal strength and response time of the response message, the primary terminal 110 increases the time interval when it is determined to be in a safe state from when it is in an unsafe state, and increases the time interval when it is determined to be in an unsafe state from when it is in a safe state. , and communicates with the tertiary terminal 130.

Preferably, the control unit 115 sets the sum of a value corresponding to the signal strength of the response message received from the tertiary terminal 130 and a value corresponding to the response time of the response message as a decision value, and the decision value is greater than or equal to a reference value. In this case, it is determined to be in a safe state, and if the determined value is smaller than the reference value, it is determined to be in an insecure state, and communication with the tertiary terminal 130 is performed at a longer time interval in the safe state than in the insecure state. For example, communication is performed at 3-second intervals when maintaining a safe state and at 1-second intervals when maintaining an insecure state.

The method for calculating the decision value is expressed as Equation 1 as follows. The closer the primary terminal 110 and the tertiary terminal 130 are, the higher the signal strength and the shorter the response time. It uses the losing principle.

(Equation 1)

Decision Value = f(x) + f(y)

In the above (Equation 1), when α _x is 1, β _x is 0, α _y is 1, and β _y is 0, the signal strength of the response signal is greater than the threshold (RSSI _threshold ) and the response signal response If the time is less than the threshold (Response Time _threshold ), the decision value is 2, and if the signal strength of the response signal is greater than the threshold (RSSI _threshold ) and the response time of the response signal is greater than the threshold (Response Time _threshold ), the decision value is 1, and if the signal strength of the response signal is less than the threshold value (RSSI _threshold ) and the response time of the response signal is greater than the threshold value (Response Time _threshold ), the decision value is 0.

In another embodiment, the control unit 115 determines a safe state when the signal strength and response time of the response message in the first communication cycle are equal to or greater than the reference value, and sets the time interval in subsequent communication cycles in which the determination value is equal to or greater than the reference value. It increases in the form of a positive exponential function and sets the time interval to the time interval of the previous communication cycle in a communication period in which the decision value is smaller than the reference value.

In addition, if the decision value according to the signal strength and response time of the response message in the first communication cycle is smaller than the reference value, the control unit 115 determines that the state is in an unstable state, and in subsequent communication cycles in which the decision value is smaller than the reference value, the time interval is negative. Decreases in the form of an exponential function of and sets the time interval to the time interval of the previous communication cycle in the communication period in which the decision value is greater than the reference value.

At this time, the control unit 115, when the time interval in the specific communication period in the safe state decreases to the time interval of the first communication cycle in the safe state, determines that the determined value is smaller than the reference value, determines that the state is in an unsafe state, and in the above-described insecure state Depending on the method, the time interval is varied, and conversely, if the time interval in a specific communication cycle in an unsafe state increases to the time interval of the first communication cycle in an unsafe state and the determined value is greater than or equal to the reference value, the safe state is determined and the above-described safe state The time interval is varied according to the method in

3 is a diagram illustrating a communication time interval between a primary terminal and a tertiary terminal according to an embodiment of the present invention, and FIG. 4 is a graph showing a positive exponential function increasing the time interval in a safe state of FIG. 3 . , FIG. 5 is a graph showing a negative exponential function decreasing the time interval in the unstable state of FIG. 3 .

As shown in FIG. 3, when the determined value according to the signal strength and response time of the response message of the tertiary terminal 130 in the first communication period between the primary terminal 110 and the tertiary terminal 130 is greater than or equal to the reference value. , the primary terminal 110 determines that it is in a safe state, and then increases the time interval in a communication period in which the determined value is greater than or equal to the reference value. At this time, as shown in FIG. 4 , the primary terminal 110 increases the time interval in the form of a positive exponential function. For example, in the safety state #1, which is the first communication period, the primary terminal 110 communicates with the tertiary terminal 130 after the initial setting time interval t ₁ , and at this time, if the determined value is equal to or greater than the reference value, the next time interval Set t ₂ as In the subsequent communication cycle, safety state #2, if the decision value is greater than or equal to the reference value, the time interval is increased according to _the positive exponential function. It communicates with the terminal 130.

On the other hand, as shown in FIG. 3, the decision value according to the signal strength and response time of the response message of the tertiary terminal 130 in the first communication period between the primary terminal 110 and the tertiary terminal 130 is the reference value. If it is less than, the primary terminal 110 determines that it is in an unsafe state, and then decreases the time interval in a communication period in which the determined value is smaller than the reference value. At this time, as shown in FIG. 5 , the primary terminal 110 decreases the time interval in the form of a negative exponential function. For example, in the insecure state #1, which is the first communication period, the primary terminal 110 communicates with the tertiary terminal 130 after the initial setting time interval t ₁ , and at this time, if the determined value is smaller than the reference value, the next time Set t ₂ as the interval. In the subsequent communication cycle, unstable state # ₂ , if the decision value is smaller than the reference value, the time interval is reduced according to the negative exponential function. It communicates with the car terminal 130.

At this time, the primary terminal 110, when the time interval in the specific communication period in the safe state decreases to the time interval of the first communication cycle in the safe state, and the determined value becomes smaller than the reference value, determines that the state is in an unsafe state and unsafe state #1 Communicate with the tertiary terminal 130 at a time interval of , and then vary the time interval according to the method in the insecure state, and conversely, the time interval in the specific communication cycle in the insecure state is the time interval of the first communication cycle in the insecure state. When the determined value is equal to or greater than the reference value after increasing up to , it is determined as a safe state and communicates with the tertiary terminal 130 at the time interval of safe state #1, and then the time interval is varied according to the method in the safe state described above.

In one embodiment, when the primary terminal 110 provides the VDI service and terminates communication with the tertiary terminal 130 and then provides the VDI service again, the tertiary terminal 130 provides the previous VDI service. ) and the time interval in the last communication cycle can be set as the initial time interval.

In one embodiment, the primary terminal 110 may use an advertising message in the Bluetooth communication standard when requesting terminal information from the tertiary terminal 130 . In the Bluetooth communication standard, an advertising mode is to periodically transmit an advertising message without designating a specific device, but security may be relatively weak. Therefore, when the primary terminal 110 transmits an advertisement message to the tertiary terminal 130, information (ie, time interval) for the next communication period and the tertiary terminal ( 130) may transmit information about the order of advertisement messages to be responded to and channel information to be used by the tertiary terminal 130 among a plurality of channels. Preferably, the primary terminal 110 may perform a hash operation on a random value and then perform a modulo operation on a predetermined value to determine a value obtained in the order of advertising messages. Accordingly, when the next communication period arrives, the tertiary terminal 130 may prevent hacking due to use of an advertisement message by replying a response message to advertisement messages in a predetermined order among a plurality of advertisement messages.

6 is a flowchart illustrating a method of accessing a VDI server in the system of FIG. 1 . Referring to FIG. 6 , the user connects the primary terminal 110 to the secondary terminal 120 and loads a client program for VDI access. Then, in step S601, the primary terminal 110 transmits a terminal use request to the terminal management server 140 through the terminal management slice 141 of the mobile communication network.

In step S602, the terminal management server 140 transmits a request for primary terminal authentication information to the primary terminal 110 in response to the terminal use request. In step S603, the primary terminal 110 transmits the terminal authentication information to the terminal management server 140 through the terminal management slice 141. Here, the terminal authentication information includes terminal-specific information such as the MAC address of the primary terminal 110 .

The terminal management server 140 compares the authentication information of the pre-registered primary terminal 110 with the terminal authentication information received in step S603, and if they match, authenticates the secondary terminal to the primary terminal 110 in step S604. Send information requests. In step S605, the primary terminal 110 acquires terminal authentication information of the secondary terminal 120 and transmits it to the terminal management server 140 through the terminal management slice 141. Here, the terminal authentication information includes terminal-specific information such as the MAC address of the secondary terminal 120 .

The terminal management server 140 compares the authentication information of the pre-registered secondary terminal 110 with the terminal authentication information received in the step S605, and also determines whether the primary terminal 110 and the secondary terminal 120 have been previously registered. Check if the mapping relationship is registered. The terminal management server 140 determines that the authentication is successful when the terminal authentication information matches and has a mutual mapping relationship.

In step S606, the terminal management server 140 transmits a user authentication slice use request including information (eg, IP address) of the primary terminal 110 to the SDN system 170. In step S607, the SDN system 170 transmits the information of the primary terminal 110 to the user authentication server 150. Accordingly, in step S608, the user authentication server 150 transmits a user authentication information request to the primary terminal 110 through the user authentication slice 151 using the information of the primary terminal 110.

In step S609, the primary terminal 110 receives user authentication information from the user and transmits it to the user authentication server 150 through the user authentication slice 151. Preferably, a user authentication information input window is displayed through a client program and user authentication information is received from a user through the input window. User authentication information includes, for example, information for uniquely identifying a user such as an ID/password.

The user authentication server 150 compares the received user authentication information with pre-registered user authentication information to authenticate the user. If user authentication is successful, in step S610, the user authentication server 150 transmits a VDI slice use request including information (eg, IP address) of the primary terminal 110 to the SDN system 170.

In step S611, the SDN system 170 transmits information on the primary terminal 110 to the VDI server 160. Accordingly, in step S612, the VDI server 160 transmits a VDI access permission message to the primary terminal 110 through the VDI slice 161 using the information of the primary terminal 110. The client program informs the user of the success of the VDI connection, and therefore, in step S613, the user connects to the VDI server 160 through the VDI slice 161 through the client program loaded in the secondary terminal 120 to perform the task. .

According to the above embodiment, a channel for terminal authentication, user authentication, and VDI access is separated to enhance network access, that is, security for VDI access. The user authentication slice 151 for user authentication can be accessed only when the terminal authentication is successful, and the VDI slice 161 can be accessed only when the user authentication is successful, thereby enhancing security.

In addition, when the primary terminal 110 periodically communicates with the user's tertiary terminal 130 and the signal strength of the tertiary terminal 130 becomes weak or the response time of the tertiary terminal 130 becomes long, or When the connection with the tertiary terminal 130 is disconnected, by blocking network access, security can be further strengthened in a situation where the primary terminal 110 is lost or stolen.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in separate embodiments in this specification may be implemented in combination in a single embodiment. Conversely, various features that are described in this specification in a single embodiment may be implemented in various embodiments individually or in combination as appropriate.

Although actions are described in a particular order in the drawings, it should not be understood that such actions are performed in the specific order as shown, or that the actions are performed in a series of sequential order, or that all described actions are performed to achieve a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily performed by a person skilled in the art to which the present invention belongs, it will not be described in detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention to those skilled in the art to which the present invention belongs, and thus the above-described embodiments and It is not limited by drawings.

110: primary terminal, 120: secondary terminal
130: 3rd terminal, 140: terminal management server
141: terminal management slice, 150: user authentication server
151: user authentication slice, 160: VDI server
161: VDI slice, 170: SDN system
111: first communication unit, 112: second communication unit
113: third communication unit, 114: storage unit
115: control unit

Claims (6)

In the communication terminal connected to the secondary terminal and relaying the connection of the secondary terminal to the mobile communication network,
a first communication unit independently accessing a terminal management slice, a user authentication slice, and a service slice provided by the mobile communication network;
a second communication unit communicating with the secondary terminal;
a third communication unit communicating with a tertiary terminal carried by a user of the secondary terminal; and
Performing terminal authentication of the secondary terminal and the communication terminal through the terminal management slice, performing authentication of the user through the user authentication slice, and providing a service for the secondary terminal through the service slice; , A communication terminal including a control unit for terminating the connection for service to the secondary terminal when occupancy authentication fails through the tertiary terminal. According to claim 1,
The control unit,
Performing occupancy authentication through the tertiary terminal at predetermined time intervals,
The communication terminal characterized in that the time interval is adjusted based on the signal strength and response time of the response message received from the tertiary terminal with respect to the message transmitted to the tertiary terminal. According to claim 2,
The control unit,
The communication terminal characterized in that the time interval is increased when it is determined to be in a safe state based on the signal strength and the response time, and the time interval is decreased when it is determined to be in an unsafe state. According to claim 3,
The control unit,
Using the sum of the value corresponding to the signal strength and the value corresponding to the response time as a decision value, determining a safe state when the decision value is greater than or equal to a reference value, and determining an unsafe state when the decision value is smaller than the reference value. A characterized communication terminal. According to claim 4,
The control unit,
increasing the time interval in the form of a positive exponential function in the safe state;
The communication terminal, characterized in that for reducing the time interval in the form of a negative exponential function in an insecure state. According to claim 5,
The control unit,
In a communication period in which the determined value is greater than or equal to the reference value, a time interval is set to a time interval of a previous communication period.

Images