KR20080060010A - User terminal based integrated authentication system and method - Google Patents

Abstract

The present invention relates to a user terminal-based integrated authentication system and method thereof, comprising: a first process of performing user authentication at the request of a user terminal and then connecting an authentication session between the user terminal and the authentication server according to the result; A second process of transmitting a session management policy and a list of access permission systems among the management facilities from the authentication server, and selecting one of the list of access permission systems from the user terminal and transmitting the selected list to the authentication server; A third process of transmitting a task permission command list for the selected work target system among the allowed systems to the user terminal, a fourth process of logging in the work target system selected by the user terminal and inputting the work permission command; The user in the user terminal access rights to the selected target system If there is a determination, there is a need to install an agent for access authentication, authorization authentication, and task history management in the operating facility and proxy server, including a fifth process of executing a command to the selected target system and receiving the result. Without this, a technique of installing an agent only in a user terminal to process integrated authentication is disclosed.

Description

Integrated terminal based authentication system and method thereof

1 is a block diagram of a user terminal-based integrated authentication system according to an embodiment of the present invention.

2 is a flow chart showing an authentication method of a user terminal based integrated authentication system according to an embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: user terminal 200: VPN

300: authentication server 400: management server

500: log server 600: router

700: Target System 800: Internet Network

The present invention relates to a user terminal-based integrated authentication system and method thereof, and more particularly, to the agent only in the user terminal without installing an agent for access authentication, authorization authentication, and work history management in the operating facility and proxy server. It is a technology to install and handle integrated authentication.

In general, the conventional authentication system installs an agent in a user PC (user terminal) and an operation facility (server) to manage access authentication, authorization authentication, and work history, and the proxy between the user PC (user terminal) and the operation facility. By using a server, a proxy server was used to perform connection authentication, authorization authentication, and job history management.

The first method of installing agents for both user PCs (user terminals) and operating facilities (servers) is that there are various types of operating facilities, and it is difficult and expensive to install agents in the operating facilities due to the influence of OS and applications. there was. In addition, the method of installing the agent in the operation facility requires continuous agent update and reinstallation for each operation facility when the function is advanced, and may require a reboot of the operation facility. ), There is a problem that expensive initial investment cost is required to install the agent in both () and the operation facility (server).

Although the second method of installing the agent on the proxy server solves the problems of the first method such as cost because it is not necessary to install the agent on the operation facility, the following problems remain.

First, since the proxy server must perform connection authentication, authorization authentication, job log, and session management for all sessions of the user, a problem occurs in which all sessions in use at the time of proxy server failure are simultaneously disconnected.

In addition, since the proxy server plays an intermediate role, the session speed degradation such as Telnet and FTP occurs when a large number of sessions are formed at the same time, causing user inconvenience.

Therefore, the present invention for solving the above-described problem is to install the agent only in the user terminal to handle the integrated authentication, without the need to install the agent for access authentication, authorization authentication, and job history management in the operating facility and proxy server There is a purpose.

In addition, the present invention has an object to increase the convenience of the user by periodically changing the ID and password of the operation facility automatically.

In the user terminal-based integrated authentication method according to an embodiment of the present invention for achieving the above object, after performing the user authentication at the request of the user terminal, the authentication session is connected between the user terminal and the authentication server according to the result. And a second process of transmitting a session management policy and a list of access permission systems from the authentication server to the user terminal from the authentication server, and selecting one of the list of access permission systems from the user terminal. In step 3, transmitting a work permit command list of the work target system selected from the access permission system to the user terminal, and logging in the work target system selected by the user terminal and inputting the work permit command. In step 4, the user selects the selected work target system in the user terminal. If in which it is determined whether the access rights to be characterized in that it comprises a fifth step of receiving the result to executing a command to the selected target system operation.

In addition, the user terminal-based integrated authentication system according to an embodiment of the present invention, the user terminal including an agent for connection authentication, authorization authentication, and operation history management, and when the authentication session with the user terminal is connected, the An authentication server for transmitting a session management policy and a list of access permission systems to a user terminal and transmitting a list of work permission commands for the selected system when one of the target systems is selected from the list of access permission systems; and user authentication of the user terminal. It comprises a virtual private network that forwards the request to the authentication server and determines whether to connect to the VPN according to the result.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a block diagram of a Total Access Control System (TACS) according to an embodiment of the present invention.

In the integrated authentication system of the present invention, a user terminal 100, a virtual private network (VPN; hereinafter referred to as a VPN) 200, an authentication server 300, a management server 400, a log server 500 , A router (ROUTER) 600, and a target system 700.

The user terminal 100 can implement Telnet, FTP, and SSH services, and can automatically log in to the target system 700 (operational facility) without an additional authentication procedure, and the IP of the target system 700. Download list and each ID / Password. In addition, the user terminal 100 downloads a list of self-employment allowance command for the operation facility, periodically transmits a heart beat (Heart Beat) to inform that the client is running for session management, session management policy for client operation Download and perform user log transfer functions (access authentication, authorization authentication, and job log). Here, the user terminal 100 is preferably an operator terminal for performing integrated management and management of the work target system 700. In addition, the user terminal 100 may be connected through the authentication server 300, the management server 400, and the log server 500 and the Internet network 800, which is an operation facility.

VPN (200) performs a function (NAT) to make the access IP of a variety of users into one representative IP, in the present invention, if the authentication is successful by performing the user authentication in the authentication server 300 and the user terminal 100 and Form VPN tunneling.

The authentication server 300 stores session management policy information, access permission system list (operational facility information such as operation facility IP list, ID and password), user information, work permit command list information, and performs user authentication. In order to perform authentication on the work target system 700, the user terminal 100 transmits session management policy information, a list of access allowable systems, a list of work permit commands, and the like.

The management server 400 performs a client policy setting function, user access control policy setting function by user, organization, user and operation ID and password management function, and session monitoring and statistics management function. In particular, the management server 400 of the present invention automatically changes the ID and password of the target system 700 to provide a single sign-on (SSO) service and transmits to the target system 700.

The log server 500 collects, stores, and manages user access authentication, authorization authentication, and work logs.

The router 600 is connected between the VPN 200 and the connection target facility 700 and each server 300 to 500 to route signals.

The target system 700 includes facilities with access rights, facilities without access rights, and the like.

Hereinafter, an integrated authentication method according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

First, the management server 400 performs a user registration (S101), and transmits the resulting user information to the authentication server 300 to store (S102). At this time, the authentication server 300 preferably stores the connection target facility information, operator information, access list information, authorization list information, RBAC (Role Base Access Control) information and the like in advance.

The user terminal 100 on the user side receives an ID and a password from the user and transmits the ID and password to the virtual private network 200 (S103 and S104).

Accordingly, the VPN 200 requests user authentication by transferring an ID and a password to the authentication server 300 (S105).

Thereafter, the authentication server 300 compares the received ID and password with the ID and password registered in the internal DB, performs user authentication (S106), and notifies the VPN 200 of the user authentication result (S106). S107).

Accordingly, the VPN 200 determines whether the authentication is successful based on the received authentication result (S108). If the authentication fails, the VPN 200 notifies the user terminal 100 of the connection failure (S109). 100) and establish a session between the VPN (200) (S110).

Thereafter, a new session is automatically configured by a direct authentication session request between the user terminal 100 and the authentication server 300 (S111, S112). At this time, the authentication session request between the user terminal 100 and the authentication server 300 is transmitted through the Internet network (800).

Subsequently, the authentication server 300 transmits the session management policy to the user terminal 100 through the Internet network 800 (S113). In this case, the session management policy indicates that the user terminal 100 transmits log information to the log server 500 every few seconds or minutes, how to load balance, timer related information, and that the client of the user terminal 100 is running. It includes information such as a period for transmitting a heartbeat signal to inform.

Thereafter, the authentication server 300 transmits to the user terminal 100 a list of access permission systems among the work target system 700 (S113). In this case, the authentication server 300 transmits the IP list of the plurality of target systems and the IDs and passwords of the target systems 700.

When the request and list transmission and reception between the authentication server 300 and the user terminal 100 of the process S111 ~ S116 transmits and receives through encryption . Encryption communication between the authentication server 300 and the user terminal 100 uses SSL (Secure Socket Layer), the operation principle is as follows. The user terminal 100 extracts the public key from the certificate of the authentication server received from the authentication server 300 and encrypts and transmits an arbitrary string for generating a session key with the public key of the authentication server 300, and then sends the authentication server 300. ) Share an arbitrary string by decrypting the encrypted string using the private key, and encrypts the message by creating a session key through the shared string.

Accordingly, the user terminal 100 views the IP list of the target systems, selects the desired target system 700, and transmits the result to the authentication server 300 (S115). The authentication server 300 selects the selected target object. The task permission command list for the system 700 is transmitted to the user terminal 100 (S116). In this case, the work permission command list means a command list that can be used for the corresponding work target system 700.

Thereafter, the user terminal 100 logs in to the selected work target system 700 using the received ID and password (S117) to enable access to the corresponding work target system 700, and then the user. Receive a command from (S118).

The user terminal 100 compares the list of work permission commands received from the authentication server 300 with the commands input by the user, and determines whether the user has the authority to perform the input command for the selected target system 700. (S119).

As a result of the determination of step S119, if there is an access right, the user terminal 100 requests execution of a command to the selected work target system 700 through the VPN 200 (S120), and the work target system 700 receives the command. After executing the result is transmitted to the user terminal 100 through the VPN (200). On the other hand, the user terminal 100 rejects the execution of the command if the user does not have access to the target system.

In this case, FIG. 2 discloses an example of determining whether a corresponding user has authority to the selected work target system 700, and may be given a command execution authority according to a user. For example, if the operator A grants all rights to the mail server (target system), and the operator B gives only the read only permission to the mail server, it is determined whether to execute the command separately. It is desirable to be able to.

Accordingly, the user terminal 100 transmits log information to the log server 500 through the Internet network (S122). In this case, the user terminal 100 transmits log information in real time or at a predetermined period according to the session management policy received in step S113, and the log information includes access authentication log information, log information denied command execution, and command execution. Include work history.

Thereafter, the authentication server 300 periodically determines whether or not an abnormal session of the user terminal 100 (S123), blocks the abnormal session (S124), and manages the statistical information related to such authentication server 400 By transmitting (S124), the management server 400 to store the authentication statistics information (S125).

On the other hand, the log server 500 transmits the log statistics information to the management server 400 (S126), so that the log management information is stored in the management server 400 (S127).

The storing of the authentication statistics information (S125) and the storing of the log statistics information (S127) disclose an example of storing the authentication statistics information first in FIG. 2, but may also store the log statistics information first.

Thereafter, the management server 400 changes the password of the target system 700 and transmits the password to the target system 700 (S128). Therefore, the ID and password of the target system (operational facility) is automatically changed periodically in the management server 400 to support Single Sign-On (SSO) service, thereby greatly improving user convenience. .

On the other hand, during the process of S101 ~ S128, in order to maintain the authentication session with the authentication server 300, the user terminal 100 periodically transmits the heart beat information (Heart Beat) information to the authentication server (300) Preferably, the user terminal 100 downloads and reflects a client operation management policy set by an administrator, such as a log transmission cycle and a load balancing method.

In addition, by applying the converted IP to the access control list (ACL) of the network device (router) by using the network address translation (NAT) function of the VPN 200, illegal access of an unauthorized user is fundamentally applied. Allow to be limited.

As described above, the present invention does not install a separate agent in the operation facility, and installs a client only in the user terminal so that various facilities can be accommodated at a low cost.

In addition, the present invention is an authentication system that operates in a push sequence (Push Sequence) method by adding the authorization authentication function in addition to the authentication authentication function of the general authentication server telnet (single) for a variety of heterogeneous systems with only one login (Single Sign On) process Allows you to implement systems that ensure the legitimate use of Telnet), FTP, and SSH services.

In addition, the user terminal 100 of the present invention blocks illegal access of unauthorized persons without permission, provides authority authentication and work log functions, and stores various details thereof in a database to provide various statistical analysis functions.

As described above, the present invention integrates heterogeneous equipment such as network equipment or server facilities and performs connection authentication, authorization control, and perfect logging to effectively block an operator's mistake or illegal access by unauthorized users. have.

  In addition, the present invention has the effect of providing the convenience, the auditing function through the tracking of accidents at the time of accident tracking, capacity expansion near infinity, etc. by automating the management of the ID and password for the operation facility.

In addition, the present invention has an effect that can greatly improve the convenience of the user by periodically changing the ID and password of the operating facility.

In addition, the preferred embodiment of the present invention for the purpose of illustration, those skilled in the art will be able to various modifications, changes, replacements and additions through the spirit and scope of the appended claims, such modifications and changes are the following claims Should be seen as belonging to.

Claims (19)

Performing a user authentication at the request of a user terminal and then connecting an authentication session between the user terminal and the authentication server according to the result; A second process of transmitting a session management policy and a list of access permission systems among the operation facilities from the authentication server to the user terminal; A third step of transmitting, when the user terminal selects one of the access permission system list to the authentication server, a work permission command list for the selected work target system among the access permission systems to the user terminal; A fourth step of logging in to the selected work target system in the user terminal and inputting the work permission command; And And a fifth process of executing a command to the selected work target system and receiving a result when the user terminal determines whether the user has access to the selected work target system. Integrated authentication method. The method of claim 1, wherein the first process comprises: After the VPN tunneling between the user terminal and the VPN is formed, the user terminal-based integrated authentication method characterized in that for connecting the authentication session between the user terminal and the authentication server. The session management policy of claim 1, wherein Log information transmission cycle, timer-related information, the user terminal based integrated authentication method comprising the transmission period information of the heartbeat (HeartBeat) signal for notifying that the client of the user terminal is running. The method of claim 1, wherein the list of the access permission system of the second process, The user terminal-based integrated authentication method comprising an IP list of target systems, ID and password of each of the target systems. The method of claim 1, wherein the fifth process comprises: The user terminal-based integrated authentication method characterized in that for performing the authorization authentication using the work permission command in the user terminal. The method of claim 1, And a sixth process of transmitting and storing log information to the log server by the user terminal. The method of claim 6, wherein the sixth process, The user terminal-based integrated authentication method according to the session management policy, characterized in that for transmitting the log information in real time or at regular intervals. The method of claim 6 or 7, wherein the log information of the sixth process, User authentication based on the user terminal, characterized in that it comprises access authentication log information, log information denied execution of the command, and the operation history of the command. The method of claim 6, wherein the sixth process, The user terminal-based integrated authentication method characterized in that the log information is transmitted to the management server to store the statistics. The method of claim 6, A seventh step of determining, by the authentication server, an abnormal session of the user terminal; And And an eighth process of blocking the abnormal session and transmitting and storing authentication statistical information to a management server. The method of claim 1, User terminal-based integrated authentication method characterized in that the management server to automatically change the ID and password of the target system periodically to support Single-Sign-on (SSO) service. A user terminal including an agent for access authentication, authorization authentication, and work history management; When the authentication session with the user terminal is connected, the session management policy and the access permission system list are transmitted to the user terminal. When one task target system is selected from the access permission system list, the work permission command list for the selected system is sent. An authentication server for transmitting; And a virtual private network configured to transmit a user authentication request of the user terminal to the authentication server and determine whether to connect to a VPN according to the result. The method of claim 12, wherein the session management policy of the authentication server, Log information transmission cycle, timer related information, the transmission terminal information of the heartbeat (HeartBeat) signal for notifying that the client of the user terminal is running, characterized in that it comprises a user terminal based. The system of claim 13, wherein the list of the system allowing access to the authentication server is as follows. User terminal-based integrated authentication system comprising an IP list of the target systems, each of the ID and password of the target system. The method of claim 14, wherein the user terminal, And receiving the task permit command list from the authentication server, logging in by automatically inputting and logging in the ID and password of the selected task target system, and inputting the task permit command. The method of claim 15, wherein the user terminal, The user terminal-based integrated authentication system, characterized in that the user is authorized to access the selected work target system using the work permission command. The method of claim 16, wherein the user terminal, And requesting execution of a command for the selected work target system and receiving a result when the corresponding user has authorization. The method of claim 17, A log server that receives and manages log information including access authentication log information, log information denied command execution, and a job history on which the command is executed from the user terminal; And And a management server configured to receive, store, and manage log statistics information from the log server and authentication statistics information from the authentication server, and to register and manage user information. The method of claim 18, wherein the management server, Integrated terminal authentication system based on the user terminal, characterized in that for automatically changing the ID and password of the target system to deliver to the target system.

Images