KR20100053123A - Method and system for providing integrated authentication for legacy systems - Google Patents

Abstract

The present invention relates to an integrated authentication method and an integrated authentication system for a legacy system.

The present invention stores user information for each user in a user database, and when receiving a user ID and password from a terminal, checks the corresponding user information to process integrated authentication for the user ID, encrypts the confirmed user information, and stores cookie information. When the legacy system login request using the user ID is generated and stored, the cookie information is decrypted in advance and the legacy system login is integrated.

According to the present invention, by integrally processing the login procedure such as authentication for the user to access the legacy system, it is possible to smoothly and integrally operate a plurality of legacy systems, each of which is different in the system construction time, use, and system construction methods. Rather, it has the effect of improving vulnerable system security for legacy systems.

Description

Integrated Authentication Method and Legacy Systems for Legacy Systems

The present invention relates to an integrated authentication method and an integrated authentication system for a legacy system. More specifically, the present invention relates to an integrated authentication method and an integrated authentication system for a legacy system that collectively handles login procedures such as authentication for a user who wants to access a legacy system having different system construction timings, uses, and system construction methods. .

These days, companies such as finance and distribution have recognized the Legacy System, which contains the core logic of their business, as their core asset. As such, reengineering of such legacy systems is actively progressed in that development costs can be reduced by maximizing the use of legacy systems that contain a large amount of corporate resources and core business logic. . In addition, efforts are being made to integrate several legacy systems built for multiple use into a single system.

However, since these legacy systems are different from each other in terms of system construction time, usage, and system construction methods, they are difficult to integrate and operate in a single system. In addition, although such a legacy system can handle system authentication through a simple method such as a cookie, there is a problem that it is always exposed to security related problems.

In order to solve the above-mentioned problems, an object of the present invention is to integrate a login procedure such as authentication for a user who wants to access a legacy system in an integrated authentication server, thereby providing a plurality of systems having different timings, uses, and system building methods. It's about making legacy systems run smoothly and integrated.

Another object of the present invention is to block direct access of a user who wants to access a legacy system, and to handle the login procedure such as authentication of a user to a legacy system in an integrated authentication server, thereby providing a weak system security for legacy systems. To improve.

Another object of the present invention is to facilitate the integrated operation of the legacy system and improve system security by configuring the entire system including the legacy system in a hierarchical architecture in integrated operation and authentication of the legacy system. have.

The present invention to achieve the above object, the user database for storing user information per user; Upon receiving the user ID and password from the terminal, check the corresponding user information to process the integrated authentication for the user ID, encrypt the confirmed user information to generate and store cookie information, and use the legacy system using the user ID. An integrated authentication server configured to receive the response by including the stored cookie information in the legacy system login request when the login request is received, and to process the legacy system login for the user ID based on the received response; When the legacy system login request including the cookie information is received from the integrated authentication server, a decryption request for the cookie information is transmitted to receive decrypted cookie information, and the response is integrated based on the decrypted cookie information. Legacy system for sending to the authentication server; And an authentication verification server that receives the decryption request from the legacy system, decrypts the cookie information, and transmits the decrypted cookie information to the legacy system. .

In addition, the present invention, the user information storage step of storing the user information for each user in a user database; A cookie information generation step of confirming corresponding user information when receiving a user ID and password from a terminal, processing integrated authentication for the user ID, encrypting the identified user information, and generating and storing cookie information; And a legacy system login processing step of decrypting the stored cookie information and processing a legacy system login based on the decrypted cookie information when a legacy system login request using the user ID is received. It provides an integrated authentication method.

As described above, according to the present invention, the integrated authentication server handles a login procedure such as authentication of a user who wants to access a legacy system in an integrated authentication server, thereby providing a plurality of legacy systems having different system construction times, uses, and system building methods. It is effective to operate smoothly and integratedly.

In addition, according to the present invention, by blocking the direct access of the user who wants to access the legacy system, and integrated processing of the login procedure such as the user authentication of the legacy system in the integrated authentication server, weak system security for the legacy system It is effective to improve.

In addition, according to the present invention, in the integrated operation and authentication of the legacy system by configuring the entire system including the legacy system in a hierarchical architecture, the effect of facilitating the integrated operation of the legacy system and improve the system security have.

The present invention provides the difficulty of integrating legacy system logins that may occur in the operation of legacy systems that differ from each other in terms of system construction time, usage, and system construction method, and the user directly accesses the legacy system. In order to solve the weaknesses of system security that may occur, we propose a new hierarchical system architecture that can operate legacy systems in an integrated manner, and under such a hierarchical system architecture, authentication of users who want to access the legacy system, etc. It provides an integrated authentication method and a system (hereinafter referred to as "integrated authentication system") for a legacy system that can not only handle the login procedure of the system but also enhance the system security. Of course, the present invention can be applied even when there is only one legacy system, and the login procedure can be performed while enhancing the security of the legacy system.

Hereinafter, some embodiments of the present invention will be described in detail through exemplary drawings. In adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are assigned to the same components as much as possible even though they are shown in different drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

In addition, in describing the component of this invention, terms, such as 1st, 2nd, A, B, (a), (b), can be used. These terms are only for distinguishing the components from other components, and the nature, order or order of the components are not limited by the terms. If a component is described as being "connected", "coupled" or "connected" to another component, that component may be directly connected to or connected to that other component, but there may be another configuration between each component. It is to be understood that the elements may be "connected", "coupled" or "connected".

1 is a diagram schematically illustrating an integrated authentication system 100 for a legacy system 122 according to an embodiment of the present invention. In FIG. 1, for convenience of description, only one legacy system 122 is present. However, depending on the system implementation, a plurality of legacy systems 122 may exist.

Referring to FIG. 1, an integrated authentication system 100 for a legacy system 122 according to an embodiment of the present invention may include a user database (DB) 132 storing user information for each user; The user information is encrypted for the user ID, cookie information is generated, integrated authentication processing is performed, and a login request is made to the legacy system 122 according to the decrypted cookie information obtained through the decryption request for the cookie information previously generated and stored. An integrated authentication server 121 for integrally processing login, such as authentication for a user ID, a legacy system 122 for transmitting a decryption request for cookie information and decrypted cookie information; And an authentication confirmation server 131 for decrypting and providing the encrypted cookie information.

When the integrated authentication server 121 receives the user ID and password from the terminal 111, the corresponding user information is checked in the user database 132 to process integrated authentication for the user ID, and the determined user information is determined. By using the encryption algorithm of encryption to generate and store the cookie (Cookie) information, after receiving a legacy system login request using a user ID for a specific legacy system 122, the previously stored cookie information is stored in the legacy system login The request is included in the request, transmitted to the legacy system 122 to receive a response, and the legacy system login for the user ID is processed based on the received response.

When the legacy system 122 receives the legacy system login request including the cookie information from the integrated authentication server 121, the legacy system 122 transmits a decryption request for the cookie information to the authentication verification server 131 to transmit the decrypted cookie information. And transmits a response to the legacy system login request to the integrated authentication server 121 based on the decrypted cookie information.

The aforementioned authentication confirmation server 131 receives a decryption request for cookie information from the legacy system 122 to decrypt the cookie information, and transmits the decrypted cookie information to the legacy system 122.

The above-mentioned predetermined encryption algorithm is used to generate the cookie information, which is an encrypted string by encrypting the user information for the corresponding user ID. Such encryption algorithm includes symmetric cryptography (Symmetric Cryptograph, Also known as 'secret encryption'); And an asymmetric key encryption (Symmetric Cryptograph, also known as 'public key encryption') algorithm with which the encryption key and the decryption key are different.

As an example of an encryption algorithm using a key of a predetermined bit length, the Data Encryption Standard (DES), the Triple Data Encryption Standard (3DES), the International Data Encryption Algorithm (IDEA), the Fast Data Encryption Algorithm (FEAL), SEED, AES ( Advanced Encryption Standard), RSA (Ron Rivest, Adi Shamir, Leonard Adleman). Without being limited thereto, the encryption algorithm should be interpreted as including all algorithms or techniques related to encryption such as a hash function, a message authentication code (MAC) algorithm, a signature, and the like.

Among the above-described examples of encryption algorithms, cookie information which is a string in which user information is encrypted using an AES (Advanced Encryption Standard) encryption algorithm is as follows.

AES Encrypted cookie information:

733672A93AEBF1CE3A3685D197E9358662E6EBDB8EEE8028B5EAB1964768

FD1E1030BFD088E312A33023C39B0F91E72E11860EFA2BD668BDCE82B684

677A1E8D62BDB24B141020851224224DAA6B1CA0FEBB83B27CD67C3FB3A0

07363F763EA989133DC1B22F45E8EB4E88B2D6FA1F1FFE977DFE8E5E141C

When the above-described authentication verification server 131 receives the encrypted cookie information from the legacy system 122 or when decrypting the encrypted cookie information and providing the decrypted cookie information to the legacy system 122, the web service protocol (Web Service Protocol) is used.

For example, when the legacy system 122 transmits the encrypted cookie information illustrated above to the authentication verification server 131 using the web service protocol, the encrypted cookie information transmitted may be as follows.

Encrypted cookie information passed using the web service protocol:

http://200.15.1.3:90/interface/GetCustomerInfo.jsp?session_key=

733672A93AEBF1CE3A3685D197E9358662E6EBDB8EEE8028B5EAB1964768

FD1E1030BFD088E312A33023C39B0F91E72E11860EFA2BD668BDCE82B684

677A1E8D62BDB24B141020851224224DAA6B1CA0FEBB83B27CD67C3FB3A0

07363F763EA989133DC1B22F45E8EB4E88B2D6FA1F1FFE977DFE8E5E141C

In addition, the cookie information (i.e., decrypted user information) decrypted by the authentication verification server 131 or the user information before being encrypted may include, in addition to the user ID, an authentication time, an authentication expiration time, an ID group, a user name, a group name, and a group. One or more in a level or the like. Such decrypted cookie information (ie, decrypted user information) or user information before being encrypted may be as follows.

Decrypted cookie information (user information) or user information before being encrypted:

<? xml version = "1.0" encoding = " UTF -8 "?>

< LOGIN _ USER error _ code = "1" error _ desc = "Normal lookup">

      < exp _ tm > 20061108180344 </ exp _ tm >

      < EMP _ ID > administrator </ EMP _ ID >

       < GRP _ ID > 100 </ GRP _ ID >

       < EMP _ NM > ABCD </ EMP _ NM >

       < GRP _ NM > ABCD  Administrator </ GRP _ NM >

       < GRP _ LEVEL > 1 </ GRP _ LEVEL >

</ LOGIN _ USER >

The legacy system 122 transmits a response to the integrated authentication server 121 that may include authentication information based on the decrypted cookie information. In the above decrypted cookie information (user information) or the example of user information before being encrypted, ' exp _ tm ' is the authentication time, which means authentication expiry time, and ' EMP _ ID ' is the logged-in user ID, ' GRP _ ID ' means ID group, ' EMP _ NM ' means user name, ' GRP _ NM ' means group name, and ' GRP_LEVEL ' means group level.

Integrated authentication system 100 for the legacy system 122 according to an embodiment of the present invention, the terminal 111 is accessible quarantine Zone (Quarantine Zone) (110); An intra zone 120 including an integrated authentication server 121 and a legacy system 122; And a protected zone 130 including an authentication verification server 131 and a user database 132.

By operating the integrated authentication system 100 in this hierarchical architecture, the terminal 111 is prevented from being able to log in by accessing the legacy system 122 directly and the legacy system only through the integrated authentication server 121. By allowing access to 122, system security is enhanced. In addition, when there are a plurality of legacy systems 122, the terminal 111 accesses them to the integrated authentication server 121 in an integrated manner, thereby enhancing system security and facilitating integrated management. .

Accordingly, the legacy system 122 does not include an interface directly accessible from the terminal 111, but includes an interface with the integrated authentication server 121 accessible by the terminal 111.

As described above, in FIG. 1, for convenience of description, only one legacy system 122 is present, but a plurality of legacy systems 122 may exist according to a system implementation.

The term "integration" as described herein prevents a user's direct access to one or more legacy systems 122 and allows the integrated authentication server 122 to access the user for such one or more legacy systems 122. 'In place' to manage the authentication or login process for the access of the user, and the user authentication or login process upon the user's access to the plurality of legacy systems 122 'collectively' processing in the integrated authentication server 122 It should be interpreted as including all aspects, such as.

In addition, although the integrated authentication server 121 and the authentication confirmation server 131 are illustrated as being different devices in FIG. 1, they may be implemented in one device depending on the implementation method.

2 is a flow diagram of an integrated authentication method for legacy system 122 in accordance with one embodiment of the present invention.

Referring to FIG. 2, the integrated authentication method for the legacy system 122 provided by the integrated authentication system 100 according to an embodiment of the present invention includes user information for storing user information for each user in the user database 132. A storage step (S200); Receiving the user ID and password from the terminal 111, confirming the corresponding user information to process integrated authentication for the user ID, and generating cookie information by encrypting the identified user information and storing the cookie information (S202); And a legacy system login processing step (S204) of decrypting the stored cookie information and processing the legacy system login based on the decrypted cookie information when the legacy system login request using the user ID is received.

3 exemplarily illustrates a step S202 of generating cookie information in the integrated authentication method for the legacy system 122 according to an embodiment of the present invention with reference to the integrated authentication system 100 shown in FIG. 1. to be.

Referring to FIG. 3, the cookie information generating step S202 may include receiving, by the integrated authentication server 121, a user ID and a password from the terminal 111 (S300); Confirming, by the integrated authentication server 121, corresponding user information in the user database (DB) 132 (S302); The integrated authentication server 121 generating and storing cookie information by encrypting user information identified in the user database (DB) 132 using a predetermined encryption algorithm (S304); And when the integrated authentication server 121 determines that the user is normally registered as a result of the checking in step S302, processing the integrated authentication for the user ID and transmitting the result (S306).

4 exemplarily illustrates a legacy system login processing step S204 of the integrated authentication method for the legacy system 122 according to an embodiment of the present invention with reference to the integrated authentication system 100 shown in FIG. 1. Drawing.

Referring to FIG. 4, in the legacy system login processing step (S204), the legacy system login request using the user ID by the integrated authentication server 121 to a specific legacy system 122 may be a terminal 111 (another terminal). Receiving from) (S400); In step S402, the integrated authentication server 121 includes the cookie information associated with the user ID previously stored in the legacy system login request and transmits the cookie information to the corresponding legacy system 122; Transmitting, by the corresponding legacy system 122, a decryption request for cookie information included in the received legacy system login request to the authentication confirmation server 131 (S404); The authentication confirmation server 131 decrypting the cookie information in response to the decryption request for the cookie information (S406); The authentication confirmation server 131 transmitting the decrypted cookie information to the legacy system 122 (S408); Transmitting a response to the legacy system login request to the integrated authentication server 121 based on the decrypted cookie information received by the legacy system 122 (S410); And (S412), by the integrated authentication server 121, processing the legacy system login for the user ID based on the response received from the legacy system 122.

In the legacy system login processing step S204 illustrated in FIG. 4, the encrypted cookie information is illustrated as being decrypted by the authentication verification server 131. However, this is only an example, and according to an implementation method, the integrated authentication server 121 or It may be decrypted by the legacy system 122. That is, the integrated authentication server 121 performs login processing on whether to authenticate the access to the legacy system 122 for one user ID, and decrypts the encrypted cookie information for the previously generated user ID. The position or order of execution of the decryption function, etc. may be modified or changed without departing from the essential features of the present invention of using decrypted cookie information.

As described above, according to the present invention, by integrally processing the login procedure, such as authentication for the user to access the legacy system 122 in the integrated authentication server 121, the system establishment time, use, system construction methods There is an effect that can be smoothly integrated operation of a plurality of different legacy system (122).

In addition, according to the present invention, by blocking the direct access of the user to access the legacy system 122, by integrally processing the login procedure, such as authentication of the user to the legacy system 122 in the integrated authentication server 121, There is an effect of improving the weak system security for the legacy system 122.

In addition, according to the present invention, in the integrated operation and authentication of the plurality of legacy systems 122, the entire system including the legacy system 122, for example, including a quarantine zone, intra zone and protection zone, etc. By configuring a hierarchical architecture, there is an effect of facilitating integrated operation of the legacy system 122 and improving system security.

In the above description, all elements constituting the embodiments of the present invention are described as being combined or operating in combination, but the present invention is not necessarily limited to the embodiments. In other words, within the scope of the present invention, all of the components may be selectively operated in combination with one or more. In addition, although all of the components may be implemented in one independent hardware, each or all of the components may be selectively combined to perform some or all functions combined in one or a plurality of hardware. It may be implemented as a computer program having a. Codes and code segments constituting the computer program may be easily inferred by those skilled in the art. Such a computer program is stored in a computer readable storage medium, which is read and executed by a computer, thereby implementing embodiments of the present invention. The storage medium of the computer program may include a magnetic recording medium, an optical recording medium, a carrier wave medium, and the like.

In addition, the terms "comprise", "comprise" or "having" described above mean that the corresponding component may be included, unless otherwise stated, and thus excludes other components. It should be construed that it may further include other components instead. All terms, including technical and scientific terms, have the same meanings as commonly understood by one of ordinary skill in the art unless otherwise defined. Terms commonly used, such as terms defined in a dictionary, should be interpreted to coincide with the contextual meaning of the related art, and shall not be construed in an ideal or excessively formal sense unless explicitly defined in the present invention.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

1 is a view schematically showing an integrated authentication system for a legacy system according to an embodiment of the present invention;

2 is a flowchart illustrating an integrated authentication method for a legacy system according to an embodiment of the present invention;

3 is a diagram illustrating a cookie information generation step in the integrated authentication method for the legacy system according to an embodiment of the present invention,

4 is a diagram illustrating a legacy system login processing step in the integrated authentication method for the legacy system according to an embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: integrated authentication system

110: Quarantine Zone

111: terminal

120: intra zone

121: Integrated authentication server

122: legacy system

130: protection zone

131: Certificate Verification Server

132: user database

Claims (5)

In the integrated authentication system for legacy systems, A user database storing user information for each user; Upon receiving the user ID and password from the terminal, check the corresponding user information to process integrated authentication for the user ID, encrypt and confirm the identified user information, generate and store cookie information, and log in to the legacy system using the user ID. An integrated authentication server that receives the request by including the stored cookie information in the legacy system login request, receives a response, and processes a legacy system login for the user ID based on the received response; When the legacy system login request including the cookie information is received from the integrated authentication server, a decryption request for the cookie information is transmitted to receive decrypted cookie information, and the response is integrated based on the decrypted cookie information. Legacy system for sending to the authentication server; And An authentication verification server that receives the decryption request from the legacy system, decrypts the cookie information, and sends the decrypted cookie information to the legacy system. Integrated authentication system for the legacy system comprising a. The method of claim 1, The integrated authentication system, A quarantine zone accessible by the terminal; An intra zone including the integrated authentication server and the legacy system; And a protected zone including the authentication verification server and the user database. The method of claim 1, The user information and the decrypted cookie information, And at least one of an authentication time, an authentication expiration time, an ID group, a user name, a group name, and a group level, in addition to the user ID. The method of claim 1, The authentication verification server, Integrated authentication system for the legacy system, characterized in that for receiving the request for decryption of the cookie information from the legacy system, or transmit the decrypted cookie information to the legacy system using a web service protocol (Web Service Protocol). . In the integrated authentication method for the legacy system provided by the integrated authentication system, A user information storing step of storing user information for each user in a user database; A cookie information generation step of confirming corresponding user information when receiving a user ID and password from a terminal, processing integrated authentication for the user ID, encrypting the identified user information, and generating and storing cookie information; And Legacy system login processing step of decrypting the stored cookie information and processing a legacy system login based on the decrypted cookie information when a legacy system login request using the user ID is received. Integrated authentication method for a legacy system comprising a.

Images