KR19990038044A - How to Manage Security Information for Distributed Object System Resources - Google Patents

Abstract

The present invention relates to a security information management method required to solve the threat of illegal intruders in a distributed object environment combining the advantages of distributed processing and object-oriented processing, and does not store security information on managed resources in one system. How to manage security information for distributed system resources that can reduce the bottlenecks and improve the reliability of managing security information in one place by distributing the system that manages the security information by maintaining hierarchical security information It is about.

Description

How to Manage Security Information for Distributed Object System Resources

The present invention provides a distributed object system resource for solving the exposure or change of important information, the invasion of personal privacy, and the threat of illegal intruders by spreading information sharing in a distributed object environment combining the advantages of distributed processing and object-oriented processing. It relates to a security information management method.

In general, a distributed object system refers to a system that provides an environment in which multiple computers share resources distributed through a computer communication network using the advantages of inheritance, diversification, and reuse. Security information management technology is a technology for managing security information to provide security for resources in such a distributed object environment. This distributed security information management function provides security for resources in the distributed object system, and supports the security quickly by pursuing an efficient method.

As a typical example of a distributed object system, an information retrieval system requires a protection technology such as access control for commercial transactions, and a management technology thereof is required. In other words, the client, the client, authenticates the identity of the server, and only secures confidentiality and integrity of data such as credit card numbers that are passed between the client and the server.

In order to guarantee the security of the resources of the distributed object system, information integrity and security information management functions for authenticating the requester are required. For this purpose, a secure distributed object system must be managed in a reliable way to manage access control and control information for customer authentication information and stored resource information. Conventional security information management for this purpose is concentrated in one system and managed in the form of customers and servers.

Although the conventional security information management method has many advantages in maintaining safety, it is difficult to apply the management method to large-scale security information in a distributed object system environment, and the reliability of the security information management method is deteriorated. There is a problem that affects the performance of many.

Therefore, in the present invention, the security information of the managed resource is not stored in one system, but the security information of the hierarchical structure is maintained and distributed to manage the system for managing the security information in several places, thereby managing the security information in one place. The purpose of the present invention is to provide a security information management method for distributed object system resources that can prevent bottlenecks and improve reliability of security information for managed resources.

The present invention for achieving the above object is to obtain the location information of the security information management server after connecting with the location providing server for the security information of the management object to manage the security information of the distributed object system resources, and the security Comprising a step of preparing the request data for the security information management, including the location information of the information management server to the security information management server, and performing the security information management for the security information management request It features.

The present invention is a method of constructing a security information database according to attributes of security information in a distributed object system environment, and distributing and managing each security information database in multiple systems.

1 is a block diagram of a distributed object system to which the present invention is applied.

2 is a block diagram of system hardware to which distributed security information management software according to the present invention is applied.

3 is a configuration diagram of a security information management request system to which security information management software according to the present invention is applied;

4 is a process flow diagram of a process requiring security information management in accordance with the present invention.

5 is a flowchart illustrating a server providing a security information management server location according to an exemplary embodiment of the present invention.

6 is a flowchart illustrating execution of a security information management server according to an exemplary embodiment of the present invention.

7 is a block diagram of a data structure having security information location information according to an embodiment of the present invention.

<Explanation of symbols for main parts of the drawings>

100 and 110: communication network

101 to 105, 111 to 115: terminal or system

106: Gateway

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

1 is a block diagram of a distributed object system to which the present invention is applied.

In the distributed object system, a plurality of terminals or systems 101 to 105 and 111 to 115 are connected through one or more communication networks 100 and 110, and a gateway 106 exists between the communication networks 100 and 110. To transfer information between the communication networks 100 and 110. In particular, the security information management software suitable for the scale of the distributed object system connected through the communication networks 100 and 110 is installed in the system to manage the entire distributed object system environment.

2 is a block diagram of system hardware to which distributed security information management software according to the present invention is applied.

The relationship between the computer hardware system 200 when operating the security information management software 211, the communication network 230, the operating system and the communication network protocol 212 which is an operating system and a lower layer network protocol (TCP / IP) Can be. When the security information management software 211 is driven, the security information management software 211 is mounted in the main memory 210 of the computer to operate through the operating system and the communication network protocol 212 already installed in the main memory 210. do. The security information management request and response are processed through the communication network 230. In addition, the hard disk 220 is used as a place for storing management information held by the security information management software 211.

3 is a block diagram of a security information management request system to which security information management software according to the present invention is applied.

The security information management request system 310 is divided into a security information management location process 311 and a security information management request process 312, and the security information management location process 311 contacts the security information management location providing server 321. After obtaining the location information on the security information of the management target and handing it to the security information management request process 312, the security information management request process 312 creates a management request with the location information to create the security information management server. Contact with. The security information management server 341 processes the request transmitted from the security information management request system 310 and delivers the processed result back to the security information management request system 310. The exchange between the secure information management location process 311 and the secure information management location providing server 321 and the exchange between the secure information management request process 312 and the secure information management server 341 are a transmission control protocol and an intercommunication network protocol. (TCP / IP: Transmission Control Protocol and Internet Protocol).

4 is a process flow diagram of a process for requesting security information management in accordance with the present invention.

Location information is requested in order to contact a server for managing security information (401). Thereafter, it is determined whether a valid security information management server address has been obtained (402), and if it fails, the location information request process 401 is performed again. If the location information request process is successful, the following process is performed.

Obtaining the location of the server that manages the security information can require the management of the security information. Based on the security information type and value and the security information type header, a request for management is constructed (403) and forwarded to the security information management server (404).

Thereafter, waiting for the arrival of the response message requested by the security information management request process (405), if the response message does not arrive at the security information management request process (406), the location information request process 401 is performed again, and the security information management is performed. When a response message arrives at the request process (406), the event generated in the log file is stored (407), and the administrator is notified of the security information management processing result (408). Repeat 401).

5 is a flowchart illustrating a server providing a security information management server location according to an exemplary embodiment of the present invention.

A communication port for communicating with a location process of the security information management server is allocated (501). The location providing server for the security information management server waits (502) for generation of a message requesting location information. Determining whether a request message from the security information management request process has been received (503), if not, reassigns a communication port for communication with the location process of the security information management server (501), and accepts the request. To store (504). The location of the server managing the security information in the request is retrieved from the database to obtain an Internet address (505). Determining whether the search is successful (506), if the search fails, reallocates a communication port for communication with the location process of the security information management server (501), and if successful, location information to the security information management location process requesting the location information. After the signal with the (507) and reassigns the communication port for communication with the location process of the security information management server (501).

6 is a flowchart illustrating a security information management server according to an exemplary embodiment of the present invention.

Execution of the server managing the security information first allocates one TCP / IP socket port (SECsd) through a function called SEClisten () to communicate with the security information management request process (601), and sends a message to the port. Analyze (602). If the header indicating the message type is analyzed (602), and if the header is a PO of security policy information, one TCP / IP socket port (POsd) is allocated using the POlisten () function to manage security policy information (604). It processes the requested management operation (605), and sends a signal with the processing result to the security information management request process through the POsd (606). If the header is a USR indicating security information for the resource (607), one TCP / IP socket port (USRsd) is allocated using the USRlisten () function to manage the security information for the resource (608), and the requested management It processes the operation (609), and sends a signal with the processing result to the security information management request process via the POsd (610).

7 is a configuration diagram of a data structure having security information location information according to an embodiment of the present invention.

The data structure includes a security information type header 701, a security information attribute name 702, and a security information attribute value 703.

As described above, according to the present invention, the security information is managed at one place by maintaining a security system in a hierarchical structure and distributing the system for managing the security information in various places without storing the security information of the managed resource in one system. It can prevent bottlenecks that occur when managing and has an excellent effect to improve the reliability of security information on the managed resource.

Claims (4)

Obtaining location information of the security information management server after connecting with a location providing server for security information of a management object to manage security information of a distributed object system resource; Creating a request document for managing security information, including location information of the security information management server, and transmitting it to the security information management server; And managing security information with respect to the security information management request. The method of claim 1, further comprising: allocating a communication port for communication with a location process of the security information management server; Determining whether a request message has been received after selecting a port through which the message to the security information management server is transmitted; If it is determined that the message has not been received, the server relocates the communication port for communication with the location process of the security information management server, receives and stores the received request, and stores the security information in the request. Determining whether the search is successful by allocating an Internet address by searching the database; If retrieval of the search result fails, reallocates a communication port for communication with the location process of the security information management server, and if successful, sends a signal with the location information to the security information management location process requesting the location information and manages the security information And reallocating a communication port for communication with a location process of the server. 2. The method of claim 1, wherein the data structure of the request for managing security information includes a security information type header, a security information attribute name, and a security information attribute value. The method of claim 1, wherein the method for performing security information management on the security information management request allocates one TCP / IP socket port (SECsd) through a function SEClisten () for communication with the security information management request process. Receiving steps, Analyzing a message sent to the port and analyzing a header indicating a message type; If the header of the analysis result is security policy information, a TCP / IP socket port (POsd) is allocated by using a function POlisten () to manage security policy information, and a requested management operation is processed, and the security policy information ( Sending a signal with the processing result to the security information management request process via POsd), If the header indicates security information about the resource, the header is allocated a TCP / IP socket port (USRsd) using a function (USRlisten ()) to manage security information about the resource, and processes the requested management operation. And transmitting a signal along with the processing result to the security information management request process through the security policy information (POsd).