TWI707572B - Intelligent network mobile terminal certification management system - Google Patents

Abstract

The present invention provides an intelligent network mobile terminal certification management system. The system includes a mobile terminal certification management device and a mobile terminal. The mobile terminal certification management device may perform a legality certification for the user and the mobile terminal. For domains have different security specifications, the mobile terminal certification management device may perform management through groups and provide the manager with a convenient management mechanism to improve network information security.

Description

Intelligent network mobile terminal authentication control system

The present invention relates to an intelligent network mobile terminal authentication management and control system, which is used to perform identity verification, group management and use authority management and control for mobile terminals in the network to ensure the information security of the overall network.

With the development and popularization of various technologies on mobile networks, more and more users connect to the Internet through mobile terminals to inquire about data or browse audio-visual services. If the content of the browsed data is public, the information is not sensitive and confidential. Users can access freely, without authentication and authority control. But if today’s usage scenario is a company’s internal network or an IoT network that collects smart data, it becomes very important to ensure user identity and isolate access rights.

For identity authentication and control, generally RADIUS can be combined with LDAP technology to achieve, but if you want to have higher security requirements for mobile devices, the existing authentication technology is difficult to achieve.

To achieve the above objective, the present invention provides an intelligent network mobile terminal authentication management system.

The intelligent network mobile terminal authentication management control system of the present invention includes a mobile terminal authentication management control device and a mobile terminal. The mobile terminal authentication management control device is communicatively connected to the mobile terminal and provides services to the mobile terminal. The mobile terminal authentication management control device includes: a user Data storage module, device data storage module, identity authentication module, first device authentication module, smart group module, information security policy control module, service authority control module, user group module, and message Push broadcast module. The user data storage module stores user-related data of at least one user who can use the service. The device data storage module stores device-related data of at least one device that can use the service. The identity authentication module confirms the identity when the user of the mobile terminal logs in to the mobile terminal authentication control device. The first device authentication module performs legal confirmation when the mobile terminal is registered. The smart group module is included in the mobile terminal to the group according to the type of the mobile terminal or the type of service. The information security policy control module controls information security policies of different attributes. The information security policy control module applies at least one information security policy to the group, and the information security policy control module checks the mobile terminal for compliance with the information security policy . The service authority control module activates or withdraws the authority of the mobile terminal to use the service. The service authority control module checks whether the mobile terminal has the authority to use the service based on legal confirmation and compliance with the information security policy. The user group module divides mobile terminals into user groups according to the user's department unit or job attribute. The message push module provides an input interface for managers to input push messages.

In an embodiment of the present invention, the above-mentioned user-related data includes using User account number, email address, mobile phone number, application date, period of use, and type of service applied for.

In an embodiment of the present invention, the aforementioned device-related data includes device type, device serial number, operating system name, registration time, and last login time.

In an embodiment of the present invention, the above-mentioned identity authentication module determines that the user is a legitimate user based on the result of the identity confirmation and the user-related data in the user data storage module.

In an embodiment of the present invention, the aforementioned mobile terminal includes a second device authentication module, wherein the second device authentication module sends a registration message to the mobile terminal authentication control device when the mobile terminal is registered, and the first device authentication module Based on the result of the legal confirmation and the device-related data in the device data storage module, the mobile terminal is determined to be a legal mobile terminal.

In an embodiment of the present invention, the above-mentioned smart group module incorporates the mobile terminal into the group based on the mobile terminal having the authority to use the service, and removes the mobile terminal from the group based on the cancellation of the authority of the mobile terminal.

In an embodiment of the present invention, the above-mentioned second device authentication module receives at least one security policy from the security policy management and control module, and transmits it based on the mobile terminal complying with at least one field security policy required by the security policy Report information to the information security policy control module, where the information security policy control module determines that the mobile terminal has passed the information security policy compliance check based on the report information.

In an embodiment of the present invention, the above-mentioned service authority management control module is based on The mobile terminal complies with the field security regulations to open the authority to use the mobile terminal service.

In an embodiment of the present invention, the aforementioned message push module pushes push messages to devices in the user group.

In an embodiment of the present invention, the aforementioned mobile terminal includes a message browsing module, wherein the message browsing module receives push messages from the message push module and displays the push messages for users of the mobile terminal to read.

The purpose of the present invention is to provide a mobile terminal authentication and control system in scenarios with high security requirements, to ensure the safety of mobile terminals in the scene network environment, and to reduce the chances of mobile terminals becoming springboards or zombie devices, and even Infecting other devices on the network leads to collective poisoning, while ensuring the identity of mobile terminal users to avoid data theft or monitoring by interested parties on the network.

1: Intelligent network mobile terminal authentication control system

10: Mobile terminal authentication control device

100: User data storage module

101: Device data storage module

102: Identity Authentication Module

103: First device authentication module

104: Smart Group Module

105: Information Security Policy Management and Control Module

106: Service authority control module

107: User Group Module

108: Message push module

11: mobile terminal

110: Message browsing module

113: Second device authentication module

S101, S102, S103, S104, S105, S106, S107, S108, S109: steps

Please refer to the detailed description of the present invention and its accompanying drawings to further understand the technical content of the present invention and its objectives and effects; the relevant drawings are: Figure 1 shows a smart network mobile terminal authentication management system according to an embodiment of the present invention Schematic diagram.

Fig. 2 shows a flowchart of a method for authentication and control of a smart network mobile terminal according to an embodiment of the present invention.

Figure 1 illustrates the authentication management of an intelligent network mobile terminal according to an embodiment of the present invention Schematic diagram of the control system 1. The intelligent network mobile terminal authentication management control system 1 mainly uses the mobile terminal authentication management control device 10 to authenticate and manage the mobile terminal 11. The mobile terminal authentication management device 10 can also provide one or more services for the mobile terminal 11.

The mobile terminal authentication control device 10 has a processing unit (such as a processor but not limited to this), a communication unit coupled to the processing unit (such as a transceiver supporting various communication protocols such as mobile network, Bluetooth or WiFi), and a coupling The storage unit connected to the processing unit (such as removable random access memory, flash memory, or hard disk, but not limited to, etc.) and other necessary components for running the mobile terminal authentication control device 10. The mobile terminal authentication control device 10 can be connected to the mobile terminal 11 through a communication unit. The storage unit of the mobile terminal authentication management device 10 can store data including a user data storage module 100, a device data storage module 101, an identity authentication module 102, a first device authentication module 103, a smart group module 104, and information security The policy management and control module 105, the service authority management and control module 106, the user group module 107, and the message push module 108 are multiple modules. The processing unit of the mobile terminal authentication management device 10 can access and execute these modules. The functions of the above-mentioned modules will be described later.

The mobile terminal 11 is, for example, a notebook computer, a personal digital assistant (PDA), a tablet computer, or a telephone device. The mobile terminal 11 has a processing unit (such as a processor but not limited to this), a communication unit coupled to the processing unit (such as a transceiver that supports various communication protocols such as mobile network, Bluetooth or WiFi), and is coupled to the processing unit The storage unit of the unit (for example, but not limited to removable random access memory, flash memory or hard disk, etc.) and other necessary components for running the mobile terminal 11. The storage unit of the mobile terminal 11 can store multiple modules including the second device authentication module 113 and the message browsing module 110. The processing unit of the mobile terminal 11 can access and execute these modules. The functions of the above-mentioned modules will be described later.

The user data storage module 100 is used to store user related information of users who have been reviewed by the administrator and can use the services provided by the mobile terminal authentication management device 10 (or an external server managed by the mobile terminal authentication management device 10) data. User-related information may include information such as user account, email address, mobile phone number, service application date, service use period, and/or application service type, but is not limited to this. The device data storage module 101 is used to store devices (for example: mobile terminal 11) that have been reviewed by the administrator and can use the services provided by the mobile terminal authentication management device 10 (or an external server managed by the mobile terminal authentication management device 10) ) Device related information. Device-related data may include device type, device serial number, operating system name, registration time and/or last login time, but is not limited to this.

After the second device authentication module 113 is installed on the user's mobile terminal 11, the second device authentication module 113 will send a registration message to the first device authentication module 103 through the communication unit of the mobile terminal 11 for registration. During the registration process, the identity authentication module 102 will perform user identity verification. Specifically, after the user of the mobile terminal 11 logs in to the mobile terminal authentication management device 10 through the mobile terminal 11, the identity authentication module 102 will read the user-related data stored in the user data storage module 100 and confirm Whether the logged-in user matches the user-related data (for example, whether the user's identity is recorded in the legal user list in the user-related data). If they match, it means that the user is a legal user.

Then, the mobile terminal 11 that is being registered can be legally confirmed by the first device authentication module 103. Specifically, the first device authentication module 103 reads the device-related data stored in the device data storage module 101, and confirms whether the registered mobile terminal 11 matches the device-related data (for example, the device ID of the mobile terminal 11). Whether it is recorded on the list of legal mobile terminals in the device-related data). If they match, it means that the mobile terminal 11 is a legal mobile terminal.

The information security policy control module 105 is in charge of information security policies of different types or attributes. After confirming that the user and the mobile terminal 11 are used legally, the information security policy management control module 105 will perform an information security policy compliance check on the mobile terminal 11 through the second device authentication module 113 to confirm whether the mobile terminal 11 complies with the Information security standards required by the field. Specifically, the second device authentication module 113 may receive the information security policy from the information security policy management and control module 105, and detect whether the mobile terminal 11 meets the field security regulations required by the information security policy. If it matches, the second device authentication module 113 can send a report message to the information security policy control module 105. The information security policy management control module 105 can determine that the mobile terminal 11 has passed the information security policy compliance check based on the report information. In addition, the second device authentication module 113 will periodically check the compliance of the information security policy of the mobile terminal 11 to ensure that the mobile terminal 11 is in compliance at all times.

The service authority management control module 106 is used to activate or withdraw the authority of the mobile terminal 11 to use the service. The service authority management control module 106 can distinguish whether the mobile terminal 11 has the authority to use the service according to the aforementioned legal confirmation and/or the result of the information security policy service check. Specifically, if the mobile terminal 11 complies with the field security regulations, the service authority management and control module 106 will enable the mobile terminal 11 to use the service. The opposite of, If the mobile terminal 11 does not comply with the field security regulations, the service authority management control module 106 will disable the mobile terminal 11's authority to use the service.

After the service authority management control module 106 activates the service use authority of the mobile terminal 11, the smart group module 104 will include the mobile terminal 11 into its own smart group according to the type of the mobile terminal 11 or the type of service used. After the mobile terminal 11 enters the smart group to which it belongs, the mobile terminal 11 can receive several APP dispatches belonging to the smart group. Conversely, if the service authority management control module 106 disables or cancels the service use authority of the mobile terminal 11, the smart group module 104 will move the mobile terminal 11 out of the smart group to which it belongs, and at the same time, the mobile terminal 11 belongs to the smart group Several apps in the group will be deleted automatically.

The information security policy management and control module 105 can apply different information security policies to different smart groups. For example, the information security policy management and control module 105 can apply a specific information security policy to the smart group to which the mobile terminal 11 belongs. In this way, all devices in the smart group need to comply with the specific security policy.

In addition, the message push module 108 may provide an input interface (for example, a keyboard) for the administrator to input push messages, so as to push the push messages to various devices in a specific user group. After the service authority management control module 106 opens the service use authority of the mobile terminal 11, the user group module 107 will assign the user to the department or work attribute (but not limited to this) to which the user of the mobile terminal 11 belongs. The mobile terminal 11 is included in the user group to which it belongs. When the mobile terminal 11 enters the user group to which it belongs, the mobile terminal 11 can read the push message pushed to the user group by the message push module 108 through the message browsing module 110. For example, the message browsing module 110 The push message can be displayed on the display of the mobile terminal 11 for the user to read. This push message will be sent separately for the user group. Users who do not belong to the user group cannot browse the messages pushed by the user group. This approach can improve the transmission security of confidential information. On the contrary, if the service authority management control module 106 withdraws the service use authority of the mobile terminal 11, the user group module 107 will remove the mobile terminal 11 from the user group to which it belongs, and when the mobile terminal 11 leaves the user group to which it belongs At this time, the mobile terminal 11 cannot read the push messages pushed to the user group by the message push module 108 through the message browsing module 110.

FIG. 2 shows a flow chart of an authentication control method for a smart network mobile terminal according to an embodiment of the present invention. The authentication control method for the smart network mobile terminal can be implemented by the smart network mobile terminal authentication management system 1 shown in FIG. 1.

Step S101: After the second device authentication module 113 is installed on the mobile terminal 11, the mobile terminal 11 will be required to register with the first device authentication module 103.

Step S102: The identity authentication module 102 performs user identity authentication on the user of the mobile terminal 11. The authentication method is to read user-related data stored in the user data storage module 100 and compare the user-related data And the identity of the user.

Step S103: The device authentication module 103 performs device authentication on the mobile terminal 11. The authentication method is to read the device-related data stored in the device data storage module 101 and compare the device-related data with the mobile terminal 11.

Step S104: The information security policy control module 105 passes the second device authentication module The group 113 conducts an information security policy compliance check on the mobile terminal 11 to confirm whether the mobile terminal 11 meets the information security regulations required by the field.

Step S105: After determining that the mobile terminal 11 complies with the field security regulations, the service authority management control module 106 will activate the use authority according to the services that the mobile terminal 11 can use. On the contrary, if the mobile terminal 11 does not comply with the field security regulations, the service authority management control module 106 will disable or revoke the authority of the mobile terminal 11 to use the service.

Step S106: After the service use authority of the mobile terminal 11 is activated, according to the type of the mobile terminal 11 or the type of service used, the smart group module 104 will include the mobile terminal 11 into the smart group to which it belongs. Conversely, if the service use authority of the mobile terminal 11 is withdrawn, the smart group module 104 will remove the mobile terminal 11 from the smart group to which it belongs.

Step S107: When the mobile terminal 11 enters the smart group to which it belongs, it will receive a number of APPs belonging to the smart group and corresponding to the requested service. On the contrary, if the mobile terminal 11 is removed from the smart group to which it belongs, several APPs belonging to the smart group on the mobile terminal 11 will be automatically deleted.

Step S108: After the service use permission of the mobile terminal 11 is activated, the user group module 107 will include the mobile terminal 11 into the user group to which the user of the mobile terminal 11 belongs. On the contrary, if the service use authority of the mobile terminal 11 is withdrawn, the user group module 107 will remove the mobile terminal 11 from the user group to which it belongs.

Step S109: After the mobile terminal 11 enters the user group to which it belongs, act The terminal 11 can browse the push messages generated by the message push module 108 through the message browsing module 110. On the contrary, if the mobile terminal 11 is removed from the user group to which it belongs, the mobile terminal 11 cannot browse the push messages generated by the message push module 108 through the message browsing module 110.

The intelligent network mobile terminal authentication management and control of the present invention can be used to perform identity and device authentication for mobile terminals in the network to ensure the legitimacy of the logged-in user and registered device. At the same time, the device can be checked at any time according to the security regulations of the field. Perform information security policy compliance checks to ensure that the device is maintained in a safe state and protect the overall network information security.

The above detailed description is a specific description of a feasible embodiment of the present invention, but this embodiment is not intended to limit the patent scope of the present invention. Any equivalent implementation or modification without departing from the technical spirit of the present invention shall be included in In the scope of the patent in this case.

[Features and Effects]

The feature of the present invention is to ensure the legitimacy of users and mobile terminals through various aspects of identity, device authentication, and information security policy management and control technology. In addition, with the introduction of smart group technology, it can manage and control multiple fields on the same platform. Mobile terminals set different information security policies and deliver different APP services according to different fields, enhancing the control of mobile devices and overall network information security. In addition, with user group isolation technology, it can ensure that data is not leaked when pushing alert messages, and can instantly announce system messages to specific user groups.

1: Intelligent network mobile terminal authentication control system

10: Mobile terminal authentication control device

100: User data storage module

101: Device data storage module

102: Identity Authentication Module

103: First device authentication module

104: Smart Group Module

105: Information Security Policy Management and Control Module

106: Service authority control module

107: User Group Module

108: Message push module

11: mobile terminal

110: Message browsing module

113: Second device authentication module

Claims (8)

An intelligent network mobile terminal authentication management control system, comprising: a mobile terminal authentication management control device and a mobile terminal, wherein the mobile terminal authentication management control device is communicatively connected to the mobile terminal and provides services to the mobile terminal, wherein the mobile terminal authentication management control device includes : User data storage module, which stores user-related data of at least one user who can use the service; device data storage module, which stores device-related data of at least one device that can use the service; Identity authentication module, in The user of the mobile terminal performs identity verification when logging in to the mobile terminal authentication control device; the first device authentication module performs legal verification when the mobile terminal is registered; the smart group module depends on the type of the mobile terminal or the The type of service is included in the mobile terminal to the group, where the smart group module includes the mobile terminal in the group based on the mobile terminal having the permission to use the service, and the permission is cancelled based on the mobile terminal The mobile terminal is removed from the group; the information security policy control module controls information security policies of different attributes, wherein the information security policy control module applies at least one information security policy to the group, and the information security policy The policy control module checks the mobile terminal’s information security policy compliance; the service authority control module activates or withdraws the mobile terminal’s authority to use the service, where the service authority control module is based on the legal confirmation and the information security Policy compliance check whether the mobile terminal has the right to use the service; The user group module, which divides the mobile terminal into user groups according to the user’s department or work attribute; and the message push module, which provides an input interface for the administrator to input push messages; where the action The terminal includes a second device authentication module, wherein the second device authentication module sends a registration message to the mobile terminal authentication control device when the mobile terminal is registered, and the first device authentication module is based on the legal confirmation result and the The device-related data in the device data storage module matches to determine that the mobile terminal is a legal mobile terminal. For example, in the intelligent network mobile terminal authentication management system described in the first item of the scope of patent application, the user-related information includes user account, email address, mobile phone number, application date, use period, and application service type. For example, the intelligent network mobile terminal authentication management system described in the scope of patent application, wherein the device-related data includes device type, device serial number, operating system name, registration time, and last login time. For example, the intelligent network mobile terminal authentication management system described in item 1 of the scope of patent application, wherein the identity authentication module determines that the identity authentication module matches the user-related data in the user data storage module based on the identity verification result The user is a legal user. For example, the intelligent network mobile terminal authentication management system described in the first item of the scope of patent application, wherein the second device authentication module receives the at least one information security policy from the information security policy management and control module, and is based on the mobile terminal conforming to the At least one field information security standard required by an information security policy sends a report message to the information security policy control module, where The information security policy control module determines that the mobile terminal passes the information security policy compliance check based on the report message. For example, in the intelligent network mobile terminal authentication management system described in item 5 of the scope of patent application, the service authority management control module activates the authority for the mobile terminal to use the service based on the mobile terminal complies with the field security regulations. For example, the intelligent network mobile terminal authentication management system described in the first item of the scope of patent application, wherein the message push module pushes the push message to the devices in the user group. For example, the intelligent network mobile terminal authentication management system described in the first item of the scope of patent application, wherein the mobile terminal includes a message browsing module, wherein the message browsing module receives the push message from the message push module and displays the Push the message to the user of the mobile terminal to read.

Images