KR102792578B1 - Secure protocol-based unified host access management method and devices therefof - Google Patents

Abstract

The present invention relates to an integrated host access management method and device. Since the present invention allows a client to receive at least one of host information and credential information from a server and access a host, the client can access the host using a security protocol from various devices anytime and anywhere, and since the server integrates and stores the host information and credential information, fragmented information can be efficiently managed in one place, and the host access system can be managed by access link or host group unit. In addition, the present invention verifies pre-registered host information or credential information at a predetermined cycle, and thus ensures the client's safe host access and prevents security risks such as data forgery or credential information leakage in advance.

Description

SECURE PROTOCOL-BASED UNIFIED HOST ACCESS MANAGEMENT METHOD AND DEVICES THEREFOF

The present invention relates to an integrated host access management method and device.

In general, in order for a client (developer) to access a host, host information (connection information) regarding which host to access and credentials that can prove access rights are required. Since such host information and credentials are essential for host access, they must be strictly managed to ensure a safe and secure environment.

However, in the software development process, there are situations where the developer works from home, or there are situations where the host connection is needed unexpectedly, such as emergency service distribution or hotfixes. Many developers are sharing host information and credentials through email, collaboration tools, or even messengers. However, in this sharing process, data is frequently lost or data is leaked due to files stored on local computers.

Meanwhile, as DevOps, a methodology that integrates software development and operation, spreads in the development industry, the need to manage host information and credentials more flexibly is rapidly increasing. However, convenience and security are in conflict with each other, so an integrated host access management service that can satisfy both is urgently needed.

Republic of Korea Patent Publication No. 10-2008-0060010 "User terminal-based integrated authentication system and method thereof"

We propose a method and device that can comprehensively manage host information and credentials while simultaneously maintaining the convenience of accessing the host from various devices anytime and anywhere and the security to prevent data leakage and data falsification.

The integrated host access management method based on a security protocol according to the present invention is a method performed by a server that transmits and receives data with a client attempting to access a host using a security protocol, the method comprising: when receiving a query request event from a client, a step of querying host information or credential information requested by the client from pre-registered host information or credential information; and a step of transmitting at least one of the searched host information and credential information to the client.

The present invention allows a client to access a host by receiving at least one of host information and credential information from a server, thereby enabling access to the host using a security protocol from various devices anytime and anywhere, and efficiently managing fragmented information in one place by integrating and storing host information and credential information on the server, and managing the host access system by access link or host group unit.

In addition, the present invention verifies pre-registered host information or credential information at predetermined intervals, thereby ensuring safe host access by clients and preventing security risks such as data falsification or credential information leakage in advance.

Even if an effect is not directly described herein, it should be understood that any effect anticipated or expected by the description of the invention is described in the effects of the invention.

FIG. 1 is a diagram showing a network configuration including a server on which a host connection management method according to an embodiment of the present invention is performed.
FIG. 2 is a drawing showing the order in which a client logs in to a server on which a host connection management method according to an embodiment of the present invention is performed.
FIG. 3 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention transmits and receives data.
FIG. 4 is a diagram showing a network configuration including a server on which a host connection management method according to an embodiment of the present invention is performed.
FIG. 5 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention receives a query request.
FIG. 6 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention searches for a host group.
FIG. 7 is a diagram showing the order in which a server, in which a host connection management method according to an embodiment of the present invention is performed, creates a connection link.
FIG. 8 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention transmits and receives data with a blockchain network.
FIG. 9 is a drawing showing the configuration of a device in which a host connection management method according to an embodiment of the present invention is performed.

The present invention is not limited to the embodiments described in the description of the invention and can be implemented in various ways. The terms used in the description of the invention are for the purpose of describing the embodiments and are not intended to limit the present invention. The term "include" in the description of the invention is intended to specify that a configuration exists in which the described features are combined. Therefore, it should be understood that it does not exclude the possibility of the existence or addition of one or more other features or configurations combining them. In the following, a detailed description of the disclosed configuration or function that is obvious to those skilled in the art to which the present invention belongs is omitted.

A security protocol-based integrated host access management method according to an embodiment of the present invention (hereinafter referred to as the “host access management method”) relates to a method for providing a service for integrated management of secure access between a client and a host as an integrated SSH (Secure Shell) platform.

FIG. 1 is a diagram showing a network configuration including a server on which a host connection management method according to an embodiment of the present invention is performed. The host connection management method according to an embodiment of the present invention is a method performed in a server (100) that transmits and receives data with a client (200) attempting to connect to a host (300) using a security protocol. Here, the security protocol includes SSH, but may include various security protocols in addition to SSH. The server (100) transmits and receives data with the client (200) to perform the connection management method for the host (300). Here, the server (100), the client (200), and the host (300) are all computing devices that are capable of processing data by performing input, calculation, and output. Referring to FIG. 1, the client (200) requests data from the server (100) in order to connect to the host (300) using a security protocol, and connects to the host (300) using the data received from the server (100). At this time, data transmission and reception between the server (100) and the client (200) can be encrypted using the SSL (Secure Sockets Layer) and AES (Advanced Encryption Standard) 256 algorithms.

FIG. 2 is a diagram showing a sequence in which a client logs in to a server on which a host connection management method according to an embodiment of the present invention is performed. According to an embodiment, the server (100) transmits and receives data with a logged-in client (200) to perform the host connection management method. Referring to FIG. 2, the client (200) requests the server (100) to log in. When a login request event is received, the server (100) performs verification using ID (user_id) and password (password) data. According to an embodiment, the OAuth (Open Authorization) 2 algorithm can be used during verification. At this time, Client ID, Client Secret, Grant Type, and Hash verification can be used in OAuth 2. When verification is completed, the server (100) transmits user information to the client (200), and login is completed.

FIG. 3 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention transmits and receives data. The host connection management method according to an embodiment of the present invention includes a step (S100) of searching for host information or credential information requested by a client (200) from pre-registered host information or credential information when receiving a query request event from a client (200), and a step (S200) of transmitting at least one of the searched host information and credential information to the client (200). Each step is performed by the server (100), and the subject may be omitted in the description of each step.

Referring to FIG. 3, the step (S100) of searching for host information or credential information is performed when a search request event is received from the client (200). The search request event is an event in which the client (200) requests data from the server (100) in order to connect to the host (300). When the search request event is received, the server (100) searches for the host information or credential information requested by the client (200) from the pre-registered host information or credential information. Here, the host information is network information for the client (200) to connect to the host (300), and includes a host name, a host address, and a connection port. In addition, the credential information is information related to credentials for the client (200) to connect to the host (300), and is encryption information including at least one of a public key for an encryption algorithm, a private key, a public key certificate issued by a public certification authority, and a password. Host information and credential information may include various items for host access in addition to the items shown.

In the step of transmitting to the client (S200), at least one of the searched host information and credential information is transmitted to the client (200). The host information and the credential information are essential information for the client (200) to connect to the host (300). According to an embodiment, the host information and the credential information may be matched with each other. In addition, even if only one of the host information or the credential information is specified, the remaining information may be specified. If the client (200) already has one of the host information and the credential information, the server (100) may transmit only the host information or the credential information that is not present in the client (200). Therefore, the server (100) may transmit one of the host information and the credential information, or both.

The client (200) receives at least one of host information and credential information from the server (100) and requests a connection to the host (300) using a security protocol. The host (300) authenticates the credentials transmitted by the client (200) and then transmits and receives data. Therefore, the client (200) can safely connect to the host (300) and transmit and receive data. The host information and credential information required during the host (300) connection process of the client (200) are all stored in the server (100). Therefore, the client (200) is not dependent on a device and can connect to the host (300) anytime and anywhere using the data of the server (100). That is, in the present invention, the device dependency of the client for connecting to the host (300) is resolved through the server (100).

FIG. 4 is a diagram showing a network configuration including a server on which a host connection management method according to an embodiment of the present invention is performed. Referring to FIG. 4, in the host connection management method according to an embodiment of the present invention, a client (200) connects to a host (300) using a security protocol. However, in the present invention, the host connection process and result can be implemented through an interface (Web or Application) provided by the server (100). For example, the client (200) connects to the server (100) through a Web browser or an application. Then, the client (200) receives at least one of host information and credential information from the server (100) and directly connects to the host (300). At this time, the host connection process and the connection result can be implemented through an application, a web application, or a hybrid application UI. That is, in reality, the client (200) connects to the host (300), but the host (300) connection process and the result are implemented through data provided by the server (100). Therefore, the user can easily and safely connect to the host (300) through the interface provided by the server (100) without a complicated host connection process.

FIG. 5 is a diagram showing the order in which a server performing a host connection management method according to an embodiment of the present invention receives a query request. The server (100) stores various host information and credential information for connecting to a host. Referring to FIG. 5, the step (S100) of querying host information or credential information searches for host information or credential information using a keyword or list requested by a client (200). At this time, the server (100) searches for information using a keyword or list included in a query request event. During the query process, the server (100) searches for information searched for by a specific keyword or searches for information stored in a specific list. Here, the list may be a pre-stored list such as a favorite. According to an embodiment, the step (S100) of querying host information or credential information may search for one or more of host information and credential information.

FIG. 6 is a diagram showing the order in which a server performing a host access management method according to an embodiment of the present invention searches for a host group. Referring to FIG. 6, in the step (S100) of searching for host information or credential information, when a host group request event is received, a host group accessible by user information received from a client (200) is searched. The host group request event is an event in which the client (200) requests a host group from the server (100). Since the server (100) stores multiple host information, a host group including multiple host information can be set for more efficient host management. The server (100) searches for a host group according to a host group request from the client (200). Then, the searched host group can be transmitted to the client (200) to provide a group management function.

According to an embodiment, accessible user information can be added to a host group. That is, permissions can be set and managed for each host group. By adding user information (e.g., user_id) to a specific host group, a host group accessible to a specific user can be set. Conversely, by deleting user information from a specific host group, a host group inaccessible to a specific user can be set. In addition, according to an embodiment, a host group can be created or deleted according to a request from a client (200). In the present invention, a host access system can be efficiently managed through such host group and group-specific permission settings.

FIG. 7 is a diagram showing a configuration in which a server, on which a host connection management method according to an embodiment of the present invention is performed, generates a connection link. The host connection management method according to an embodiment of the present invention includes a step (S300) of generating a connection link for connecting to a specific host and a password assigned to the connection link when a connection link creation event is received. The connection link creation event is an event in which a client (200) requests the server (100) to create a link that can connect to a specific host (300). Referring to FIG. 7, according to the embodiment, when requesting connection link creation, the client (200) transmits an ID (host_id) and a password (password) that can specify a host to the server (100). The server (100) uses the ID to specify a host that the client (200) wants to connect to with a connection link from pre-registered host information. The server (100) uses the specified host information to create a connection link that can connect to the host. At this time, the server (100) can assign an authentication password to the connection link. According to an embodiment, the authentication password may be set to a password transmitted by the client (200) when requesting creation of a connection link.

In the client transmission step (S100), one or more of the host information and the credential information can be transmitted to the client (200) connected to the connection link. The server (100) stores the connection link and the host information and the credential information matched to the connection link. Therefore, through the matching of the server (100), the client (200) can connect to a specific host (300) with only the connection link. At this time, if an authentication password is assigned, the host cannot be connected with only the connection link, and connection can be permitted only when authenticated with the authentication password. That is, the server (100) connects to the connection link and transmits one or more of the host information and the credential information to the client (200) authenticated with the authentication password.

The present invention enables a client (200) to access a specific host (300) simply by accessing a connection link address without a separate login procedure. In addition, the client (200) that can access a specific host (300) can be restricted by an authentication password assigned to the connection link. Accordingly, without having to share host information or credential information, the client (200) can access a specific host (300) simply by sharing a connection link generated by a server (100).

FIG. 8 is a diagram showing the order in which a server performing a host access management method according to an embodiment of the present invention transmits and receives data with a blockchain network. The host access management method according to an embodiment of the present invention includes a step (S400) of requesting storage of host information or credential information in a blockchain network when creating, modifying, or deleting host information or credential information. Here, the blockchain network is a distributed network formed by a blockchain. Since the detailed algorithms and data structures of the blockchain and the blockchain network are known to those skilled in the art, a detailed description thereof will be omitted.

Referring to FIG. 8, when the server (100) creates, modifies, or deletes host information or credential information, it transmits the host information or credential information to the blockchain network and requests storage. Then, the blockchain network stores the host information or credential information. Accordingly, the host information or credential information is created, modified, or deleted in both the server (100) and the blockchain network. According to an embodiment, the blockchain network may store a hash value of the host information or credential information.

A host access management method according to an embodiment of the present invention includes a step (S500) of updating pre-registered host information or credential information and host information or credential information stored in a blockchain network at a predetermined cycle. The server (100) updates the host information or credential information at a predetermined cycle and also updates the host information or credential information stored in the blockchain. Here, the predetermined cycle can be set in various ways. The server (100) can change existing data by periodically updating the host information or credential information and also storing it in the blockchain network. Therefore, even if there is tampering or leakage of existing data, the security risk can be minimized through periodic updates. According to an embodiment, the blockchain network can update the hash value of the host information or credential information.

A host access management method according to an embodiment of the present invention includes a step (S600) of detecting data forgery by comparing pre-registered host information or credential information with host information or credential information stored in a blockchain network. The server (100) compares the pre-stored host information or credential information with the host information or credential information stored in the blockchain network. If forgery occurs in the host information or credential information stored in the server (100), the host information or credential information stored in the blockchain network and its value become different. In the present invention, by querying and comparing the host information or credential information stored in the server (100) with the host information or credential information stored in the blockchain network, it is possible to check whether data has been forged. At this time, hash values of the host information or credential information can be compared with each other for faster detection. If some data is changed, the hash values become different. Therefore, it is possible to check whether data has been forged or not with fewer resources by comparing only hash values without having to compare the entire data.

Meanwhile, according to an embodiment, when a client (200) requests a login to a server (100), the server (100) searches for credential information stored in a blockchain network while performing an authentication step. That is, credential information is stored in advance in the blockchain network, and in the login step, the credential information received by the server (100) is compared with the credential information stored in the blockchain network. Through this credential comparison, it is possible to check whether data has been falsified or altered, and more secure login can be implemented.

In the step (S600) of detecting data forgery, a request to block access is sent to the client (200) that is connecting to the host (300) using the host information or credential information for which data forgery has been detected. If data forgery is detected, a greater security risk may occur if the host (300) is connected using the host information or credential information for which forgery has occurred or if the connection is maintained for a long time. Therefore, the server (100) requests blocking of the client (200) access when data forgery is detected. In an embodiment where the host (300) access of the client (200) is implemented as a web UI of the server (100), the host access or data transmission/reception of the client (200) can be blocked on the web UI and the access blocking can be requested to the client (200). According to an embodiment, the server (100) may label clients (200) and hosts (300) related to host information or credential information for which data falsification has been detected, and then classify them to request access blocking. Alternatively, when data falsification is detected, the server (100) may request access blocking for all clients (200).

The host access management method according to an embodiment of the present invention includes a step (S700) of receiving an access control rule by executing a smart contract of a blockchain network when a client (200) logs in, and setting an authority so that the client (200) can access only specific host information, specific credential information, or specific access link according to the access control rule. The smart contract of the blockchain network is automatically executed when specific conditions are satisfied, and processes data according to the set rules. In the embodiment of the present invention, the smart contract is automatically executed when the client (200) logs in, and transmits an access control rule to the server (100). The access control rule is data stored by the blockchain network according to a request from the server (100). The server (100) receives the access control rule, and sets an authority so that the client (200) can access only specific host information, specific credential information, or specific access link according to the access control rule. The server (100) stores access authority information for each client in a database. At this time, the client (200) can be identified by the ID through the login of the server (100). If the access authority information matches the access control rule received from the blockchain network, the server (100) can set the authority of the client (200) according to the access control rule.

FIG. 9 is a diagram showing the configuration of a device in which a host connection management method according to an embodiment of the present invention is performed. Referring to FIG. 9, a security protocol-based integrated host connection management device (100') according to an embodiment of the present invention (hereinafter referred to as a 'host connection management device') includes a memory for storing commands and a processor for executing commands. Here, the commands include each step of the host connection management method according to an embodiment of the present invention. Alternatively, according to an embodiment, a function performed in each step may be converted into each configuration and implemented as a device including these configurations. Since each configuration overlaps with the description of the steps of the above-described diagnostic method, a detailed description thereof will be omitted.

The contents described in the description of the invention are merely examples, and the present invention can be implemented in various ways by those skilled in the art. Therefore, the protection scope of the present invention is not limited to the description and expression of the described embodiments.

100: Server
100': Host Access Management Device
200: Client
300: Host

Claims (11)

A method performed by a server that transmits and receives data to and from a client attempting to connect to the host using a security protocol:
When receiving a query request event from the client, a step of searching for host information or credential information requested by the client from pre-registered host information or credential information; and
A method for integrated host access management based on a security protocol, comprising the step of transmitting one or more of the searched host information and credential information to the client. In claim 1,
A security protocol-based integrated host access management method, characterized in that it comprises the step of generating an access link for accessing a specific host and an authentication password assigned to the access link when a access link creation event is received. In claim 2,
The steps to send to the above client are:
A security protocol-based integrated host access management method, characterized in that it transmits at least one of the host information and credential information to a client who accesses the above access link and is authenticated with the above authentication password. In claim 1,
The step of searching the above host information or the above credential information is,
A security protocol-based integrated host access management method characterized by searching for host information or credential information using a keyword or list requested by the client. In claim 4,
The step of searching the above host information or the above credential information is,
A security protocol-based integrated host access management method, characterized in that when a host group request event is received, an accessible host group is searched using user information received from the client. In claim 1,
A method for integrated host access management based on a security protocol, characterized by including a step of requesting storage of host information or credential information in a blockchain network when creating, modifying, or deleting host information or credential information. In claim 6,
A security protocol-based integrated host access management method, characterized by including a step of updating pre-registered host information or credential information and host information or credential information stored in the blockchain network at a predetermined cycle. In claim 6,
A security protocol-based integrated host access management method, characterized by including a step of detecting data forgery by comparing the pre-registered host information or credential information with the host information or credential information stored in the blockchain network. In claim 8,
The steps for detecting the above data falsification are:
A security protocol-based integrated host access management method characterized by sending a connection blocking request to a client accessing a host using host information or credential information in which data falsification is detected. In claim 6,
A method for integrated host access management based on a security protocol, characterized in that it includes a step of receiving an access control rule by executing a smart contract of the blockchain network when a client logs in, and setting an authority so that the client can access only specific host information, specific credential information, or specific access link according to the access control rule. Memory for loading instructions; and
comprising a processor for executing the above instructions;
The above command is,
A security protocol-based integrated host access management device, characterized in that the above processor performs the steps of any one of claims 1 to 10.

Images