KR101160903B1 - Blacklist extracting system and method thereof - Google Patents

Abstract

A network identifier classification system and method are disclosed. The network identifier classification system is a network identification module for identifying a network identifier used by the terminal for connection with the network system when the terminal is connected to a predetermined network system through a wired or wireless network, and confirmed by the network identification module. A first positioning module for checking a first position corresponding to the network identifier, and a second position for identifying a second position of a political party member corresponding to a member identifier accessing the network system using the network identifier. And a control module for determining whether to store at least one of the network identifier or the member identifier in the blacklist DB according to whether the first position and the second position correspond to each other.

Description

Network identifier classification system and its method {Blacklist extracting system and method

The present invention relates to a network identifier classification system and a method thereof, and more particularly, to a network identifier (for example, a network identifier that enables online communication such as an IP (Internet Protocol) address) or a member identifier (for example, a member ID, etc.). The present invention relates to a system and a method for extracting a network identifier or a member identifier used for (or suspected to be) an illegal network connection (e.g., hacking or theft of personal information).

The present invention also relates to a system and a method for extracting a trusted network identifier and a member identifier using the network identifier.

The present invention also relates to a system and method for controlling access to a network system using the network identifier according to the reliability of the network identifier.

Due to the development of the network, many people access various network systems (eg, service servers, etc.) and use various services or functions. As such, according to the diversification and activation of services or functions through the network, services or functions that have a close and significant influence on people's lives are provided through the network. As the network world becomes active, hackers hack into personal information and hacked personal information is being distributed illegally. Therefore, the importance of network security is increasing.

Existing network security method is mainly used when a service requester accessing a network system knows certain information (for example, login information or personal information, password or one time password, public certificate, etc.). It is considered a user and provides a service.

The security method using the login authentication information has the advantage that the authentication process is simple and the time required for authentication is very short and easy to implement, while it is easily exposed to hacking and easily exploited. OTP generator or public certificate is more secure than the login authentication information, but there is inconvenience that a legitimate user should perform additional actions. In some cases, even OTP generators and public certificates are hacked.

In order to solve these problems, various new security methods have been studied. The new security scheme is based on the fact that a service that performs authentication based on the current facts, regardless of whether it knows specific information, ie authentication information, such as comparing the location of the terminal requesting the service with the location of the party user. May exist. Of course, in addition to such location-based authentication, there may be various authentication methods for solving the problem of authentication information.

However, a new authentication method other than the existing authentication method using the existing authentication information has a problem that it may take a relatively long time to authenticate. Moreover, a service server having a large number of users often needs to process many authentication requests at the same time, so that even if the complexity of the authentication procedure is slightly increased, a problem may occur in that it cannot process many authentication requests in a timely manner.

For example, when performing a location-based authentication procedure for a service request requesting login, a relatively long authentication time may be required as compared to the authentication process using existing authentication information. In this case, a user may feel inconvenient. Can be. In addition, even for the server providing the service, if the user terminal holds the authentication resource for a long time, the system is overloaded and the efficiency decreases.

Therefore, when a user who wants to access a network system through a predetermined terminal requests a specific service or function to the network system such as a login request, it is necessary to infer to some extent whether the access attempter is a legitimate user or an illegal user. This can be very useful in that it can be simplified.

For example, in order to access a network system, a terminal (e.g., a computer, laptop, smart phone, tablet PC, etc.) that can be connected to the network generally and a network identifier (e.g., an IP address, etc.) for the terminal to communicate with and identify the network system ) Is required. Therefore, if it is possible to know in advance whether it is a network identifier that may be used for an illegal connection for each network identifier, it is possible to exhibit excellent adaptability and flexibility, such as applying an authentication procedure that is selectively differentiated according to the degree of possibility of fraudulent connection of the network identifier. Will be. For example, the authentication procedure can be simplified for the case where it is assumed to be accessed by a legitimate user or a party member, and the authentication procedure can be strengthened for the network accessor who is determined to be connected by an illegal user or a suspect.

In addition, when there is a member identifier (eg, a member ID) determined to have been used for unauthorized access, it is possible to selectively apply an enhanced authentication procedure when performing a predetermined service request using the member identifier. do.

In addition, when a legitimate user specifies a network accessor and / or a contact location to access a network system, access to the network system through a network contactor and / or a contact location different from the specified network contactor and / or contact location may be blocked. Will be.

SUMMARY OF THE INVENTION The present invention has been made in an effort to provide a system and method for extracting and managing network identifiers and / or member identifiers that may be used for fraudulent access.

In addition, the present invention provides a system and a method for selecting a network identifier and / or a member identifier that can be used for a fraudulent connection on a location basis.

In addition, the present invention provides a system and method for selectively authenticating security by classifying and classifying a network identifier and / or a member identifier used in a fraudulent connection into a blacklist or a gray zone according to predetermined criteria.

In addition, network identifiers and / or member identifiers used for fraudulent access can also be released from the blacklist or the blacklist's grade can be alleviated based on a predetermined criterion to systematically assign various risk levels for each network identifier or member identifier. It is to provide a system and a method which can be devised.

In addition, the present invention provides a system and method for selecting a member identifier used for fraudulent access to notify a legitimate member corresponding to the member identifier of a fraudulent access and recommending the modification of the member identifier.

In addition, when a legitimate user specifies a network accessor and / or a contact location to access a network system, access to the network system through a network contactor and / or a contact location different from the specified network contactor and / or contact location may be blocked. It is to provide a system and a method thereof. That is, a white-list (a concept used as opposed to a black list in the present invention) or a white zone (a concept used as opposed to a black zone or a gray zone in the present invention) is set to a specific white list. The present invention provides a system and method for allowing access to a network system only for network accessor and / or member identifiers.

In the network identifier classification system according to an embodiment of the present invention for solving the above technical problem, when a terminal is connected to a predetermined network system through a wired or wireless network, the network identifier is used to identify a network identifier used for connection with the network system. A network identification module for confirming, a first location identification module for identifying a first location corresponding to the network identifier identified by the network identification module, and a member identifier for accessing the network system using the network identifier A second positioning module for identifying a second position of a political party member, and whether to store at least one of the network identifier or the member identifier in the blacklist DB according to whether the first position and the second position correspond to each other; Includes a control module to determine whether or not The.

When the control module determines that the first position and the second position do not correspond to each other, the control module receives a feedback signal as to whether the connection to the network system through the terminal is a party connection from the system corresponding to the party member. The at least one of the network identifier or the member identifier may be stored in the blacklist DB based on the received feedback signal.

The control module sends the feedback signal from the system corresponding to the political party member whether the political party member accesses the network system using the terminal or whether the political party member has allowed others to access the network system. Can be received.

The network identifier classification system identifies the first location from a location information DB for each network identifier storing location information for each network identifier, and the location information DB for each network identifier is determined by a predetermined terminal with a predetermined network identifier and a predetermined member identifier. When the party is connected to a predetermined network system using the, the location information for each network identifier may be stored based on the location of the mobile phone of the party member corresponding to the member identifier.

The control module further stores information on the number of times at least one of the network identifier or the member identifier is used as a negative access in the blacklist DB, wherein at least one of the network identifier or the member identifier is used as a negative access. The blacklist rating of at least one of the network identifier and the member identifier may be determined according to the number of times.

The control module deletes the network identifier or the member identifier from the blacklist DB according to the elapsed time since the network identifier or the member identifier used in the party access or the illegal access is stored in the blacklist DB. It may be characterized by lowering the blacklist rating.

The control module may transmit information on at least one of a network identifier or a member identifier stored in the blacklist DB to the external system in response to a blacklist request from an external system.

The control module may extract a network identifier or a member identifier of a predetermined blacklist level or more among the network identifier or the member identifier stored in the blacklist DB according to the external system and transmit the extracted network identifier or member identifier to the external system.

The control module determines whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other, and the party member corresponding to the member identifier is assigned to the network. The network identifier and the member identifier may be stored in the white list DB when the number of times of party access using the identifier is more than a preset number.

The control module may allow the specific service request only when the specific service is requested using the network identifier and the member identifier included in the white list DB for the specific service provided by the network system. You can do

The control module may further determine whether a position of a party member corresponding to the member identifier corresponds to a position corresponding to the network identifier, and allow the specific service request if the determination result corresponds.

The network identifier classification system for solving the technical problem is a network identification module for identifying a network identifier that the terminal uses for access to the network system, when the terminal is connected to a predetermined network system through a wired or wireless network, A first positioning module for identifying a first position corresponding to the network identifier identified by the network identification module, and a second position of a political party member corresponding to the member identifier accessing the network system using the network identifier; A second positioning module for checking, and a control module for determining whether to store at least one of the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other. It includes, the control module The group first position and the second position is more than a preset number of times if that correspond to each other, storing the network identifier and the member identifier in the white list DB.

The network identifier classification system for solving the technical problem is a network identification module for identifying a network identifier that the terminal uses for access to the network system, when the terminal is connected to a predetermined network system through a wired or wireless network, A first positioning module for identifying a first position corresponding to the network identifier identified by the network identification module, and a second position of a political party member corresponding to the member identifier accessing the network system using the network identifier; A second positioning module for checking, and a control module for determining whether the network identifier and the member identifier are included in a pre-registered white list, and whether the first position and the second position correspond to each other. It may include.

The white list includes the network identifier and the member identifier corresponding to the network identifier that the political party has made a network identifier registration request to the network system or the network identifier classification system, or the network system or the network identifier classification system. And the member identifier corresponding to the network identifier assigned to a specific user by the network identifier.

The control module registers a plurality of network identifiers used by the specific terminal in the white list when the party member requests a network identifier registration request for a specific terminal existing at a specific location, and the plurality of networks used by the specific terminal. When the political party member normally connects to the network system at the specific location to register an identifier on the white list, the plurality of network identifiers used for the connection may be registered on the white list.

The network identifier classification method for solving the technical problem is, when the network identifier classification system is connected to a predetermined network system via a wired or wireless network, the network identifier classification system to identify the network identifier used for access to the network system, Identifying a first location corresponding to the network identifier, identifying, by the network identifier classification system, a second location of a political party member corresponding to a predetermined member identifier connecting to the network system using the network identifier; And determining, by the network identifier classification system, whether to store at least one of the network identifier or the member identifier in the blacklist DB according to whether the first position and the second position correspond to each other.

The determining of whether to store at least one of the network identifier or the member identifier in the blacklist DB may include: when the network identifier classification system determines that the first position and the second position do not correspond to each other, the party member. Receiving a feedback signal as to whether the connection to the network system using the terminal is a party connection from the system corresponding to and storing the network identifier or the member identifier in the blacklist DB based on the received feedback signal. It may include the step.

The step of identifying the first position corresponding to the network identifier includes the step of the network identifier classification system identifying the first position corresponding to the network identifier from a location information DB for each network identifier, and for each network identifier. The location information DB is located by network identifier based on the location of the mobile phone of the party member corresponding to the member identifier when the predetermined terminal is connected to the predetermined network system using the predetermined network identifier and the predetermined member identifier. It may be characterized by storing the information.

The network identifier classification method may further include storing, by the network identifier classification system, information on the number of times the network identifier or the member identifier is used as a fraudulent connection in the blacklist DB, and the network identifier or the member identifier as a fraudulent connection. The method may further include determining a blacklist grade of the network identifier according to the number of times of use.

The network identifier network identifier classification method includes the network identifier or the network identifier according to the elapsed time since the network identifier or the member identifier used in the blacklist DB is used for a party access or a fraudulent connection. The method may further include deleting a member identifier from the blacklist DB or lowering the blacklist level.

The network identifier classification method may further include transmitting, by the network identifier classification system, information of a network identifier or a member identifier stored in the blacklist DB to the external system in response to a blacklist request from an external system. .

Transmitting the information of the network identifier stored in the blacklist DB to the external system, the network identifier classification system according to the external system, the network of a certain blacklist level or more of the network identifier or member identifier stored in the blacklist DB according to the external system Extracting an identifier or a member identifier may be transmitted to the external system.

The network identifier classification method may further include determining whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other. And determining whether to store the network identifier and the member identifier in the white list DB according to whether or not the second position corresponds to each other. The party member corresponding to the member identifier may be accessed by using a network identifier. The method may include determining whether the number is greater than or equal to a preset number.

The network identifier classification method for solving the technical problem is, when the network identifier classification system is connected to a predetermined network system via a wired or wireless network, the network identifier classification system to identify the network identifier used for access to the network system, Identifying a first location corresponding to the network identifier, identifying, by the network identifier classification system, a second location of a political party member corresponding to a predetermined member identifier connecting to the network system using the network identifier; And determining, by the network identifier classification system, whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other.

In the network identifier classification method for solving the technical problem, when a predetermined terminal is connected to a predetermined network system through a wired / wireless network, the network identifier classification system identifies a network identifier used by the terminal for connection with the network system. Determining a first location for identifying a first location corresponding to the identified network identifier; identifying a second location of a political party member corresponding to a member identifier accessing the network system using the network identifier And determining whether the network identifier and the member identifier are included in a pre-registered white list, and determining whether the first position and the second position correspond to each other.

According to the present invention, the risk that can be used for fraudulent access by network identifier and / or member identifier can be known in advance. Therefore, in a system providing a user with a predetermined service, a specific network identifier and / or a member with a high probability of fraudulent connection For the terminal using the identifier, it is possible to apply a stronger security procedure or block the use of the service at all.

In addition, by selectively performing an additional authentication procedure only for a terminal using a network identifier and / or a member identifier with a high possibility of fraudulent access, and performing a relatively simple authentication procedure for a trusted network identifier and / or a member identifier. There is an effect that can significantly reduce the load on the entire network system.

In addition, there is an effect that the authentication process can be performed or prepared for the authentication process much faster than the authentication process is performed after the actual login or specific service is requested because the network identifier can be used to know the illegal access or use. .

In addition, when a legitimate user specifies a network accessor and / or a contact location to access a network system, access to the network system through a network contactor and / or a contact location different from the specified network contactor and / or contact location may be blocked. Is effective. In other words, by setting a kind of white list or white zone, only a specific network accessor and / or member identifier can be allowed to access the network system, so that it can be selectively applied to users or network systems that require enhanced security. There is.

In addition, even if access is made through the same network identifier, if a fraudulent user attempts to make a fraudulent connection using the stolen authentication information, the technical idea of the present invention provides a case of a network identifier utilized by a fraudulent user. Since it may be stored in the network identifier blacklist DB, even if the fraudulent user has stolen authentication information, at least the same network identifier may be used to block the unauthorized access in advance.

In addition, it can maintain and manage information on the member identifier that was once used for fraudulent access, so that if a fraudulent user wants to make fraudulent access using another network identifier, it can block it or perform a stronger authentication procedure. It works.

Also, the network identifier of a terminal exposed to the public, such as a terminal installed in a public place or a PC room, which is frequently used for hacking or theft, can check the degree of risk of fraudulent access in advance, and cope with it accordingly. There is.

In addition, by selecting a member identifier used for fraudulent access and notifying a legitimate member corresponding to the member identifier of the attempted fraudulent access, and recommending the modification of the member identifier, the legitimate member realizes and prepares for the theft of personal information theft. There is an effect that can minimize the damage caused by information theft.

In addition, in determining the risk of fraudulent connection of a network identifier or a member identifier by location information, the error range that is previously identified is small, rather than simply using location information having a large error range provided by an Internet service provider (ISP) company or the like. By precisely mapping the location information of the mobile phone to the location information of the network identifier, it is possible to more accurately determine whether the network identifier or the member identifier is illegally accessed.

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.
1 shows a schematic configuration for implementing a network identifier classification method according to an embodiment of the present invention.
2 shows a schematic configuration of a network identifier classification system according to an embodiment of the present invention.
3 is a schematic flowchart illustrating a network identifier classification method according to an embodiment of the present invention.
4 illustrates an example in which a network identifier is stored in a blacklist DB by a network identifier classification system according to an embodiment of the present invention.
5 illustrates an example in which a member identifier is stored in a blacklist DB by a network identifier classification system according to an embodiment of the present invention.

In order to fully understand the present invention, the operational advantages of the present invention, and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents described in the accompanying drawings.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component.

Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 shows a schematic configuration for implementing a network identifier classification method according to an embodiment of the present invention.

Referring to FIG. 1, a network identifier classification system 100 may be provided to implement a network identifier classification method according to an exemplary embodiment of the present invention. The network identifier classification system 100 may be implemented by being included in a predetermined network system 400 or implemented as a separate physical device from the network system 400 through wired / wireless communication with the network system 400. The technical spirit of the present invention may be implemented.

The network system 400 may be a server (computer system) that provides a predetermined service (eg, login, payment, transfer, game, etc.) through a wired or wireless communication network. The network system 400 may provide data processing for providing various communication services online such as, for example, a web server, an authentication server, a game server, a messenger server, a mail server, an Internet site, a financial institution, a government institution, or an internal network of a company. It may be a device. Depending on the implementation example, it may be a predetermined authentication server that performs an authentication procedure for the data processing apparatus.

When the predetermined terminal 200 is connected to the network system 400 and performs a predetermined service request, the network system 400 defines a service (eg, login, payment, transfer) defined to be provided by the network system 400 to the terminal 200. , Mail, provision of information, etc.).

In addition, when the terminal 200 performs a predetermined service request, the network system 400 may provide predetermined member information for determining whether a user who uses the terminal 200 is a predetermined legitimate user, that is, a party member. It may be storing. For example, the network system 400 may include predetermined member identification information such as a member's name or social security number, login information such as an ID, a password, and / or identification information of the member's mobile phone (eg, a phone number of the mobile phone, MAC, serial number (SN), etc.) may be stored.

The network system 400 may identify a party member corresponding to the terminal 200 connected to the network system 400. The party member corresponding to the terminal 200 refers to a specific function such as accessing the network system 400 or a predetermined request (eg, a login request, inquiry or playback of main content, payment or transfer) after accessing the network system 400. / Request a service) may mean a legitimate user of the terminal 200. That is, when the political party member makes a predetermined request to the network system 400 through the terminal 200, the network system 400 may provide a service corresponding to the request for the request. It can mean a legitimate user. For example, when the terminal 200 accesses the network system 400 and requests a login, the owner (user) of the account corresponding to the member identifier (eg, ID) used in the login request is assigned to the terminal ( 200) can be a legitimate user. That is, when the terminal 200 performs a specific request, it may refer to a political party member that matches the member identifier confirmed by the network system 400.

Although the network system 400 is illustrated as one network system 400 for convenience of description in FIG. 1, the network identifier classification system 100 is connected to a plurality of network systems 400 so that the technical concept of the present invention. You can also implement For example, the network identifier classification system 100 may extract a network identifier that may be used for fraudulent access by applying the technical spirit of the present invention as described below to a service request of a plurality of terminals connected to a plurality of web servers. Can be. Of course, when the member identifier is extracted, the member identifier used for illegal access may be separately extracted and managed for each corresponding network system.

According to an embodiment, the network identifier classification system 100 extracts only a network identifier that may be used for fraudulent access, and extracts a member identifier that may be used for fraudulent access by the network system 400 receiving data of a related network identifier. It can also be managed.

According to an exemplary embodiment, the network identifier classification system 100 may extract a network identifier and / or a member identifier that can be used only for party access, or may be registered and managed from an external system or a party user's system.

Hereinafter, a method of classifying a network identifier based on location information of a terminal 200 and a mobile phone 300 of a political party member, which are core technical ideas of the present invention, will be described.

The network identifier classification system 100 may check a network identifier of the terminal 200 that makes a service request. In addition, the position of the terminal 200 and the position of the member corresponding to the identity verification request or the service request, that is, the position of the political party member can be confirmed. The location of the political party member can be determined using the location of the mobile phone 300 of the political party member. The location of the terminal 200 may be determined through a location where a network identifier used by the terminal 200 is used. According to an exemplary embodiment, the network identifier classification system 100 may be a separate system instead of an internal system of the network system 400. In this case, the network identifier classification system 100 may determine a network identifier and / or the terminal 200. Alternatively, the terminal 200 receives the identification information of the mobile phone 300 of the political party member corresponding to the member identifier that has requested the identity authentication from the network system 400 to determine the location of the terminal 200 and the location of the political party member. Of course you can.

In general, a political party member may assume that he or she owns his mobile phone 300. Then, when the party access, ie, the legitimate member accesses the network system 400 using the terminal 200, the position of the terminal 200 and the position of the party member are the same or within a predetermined range. As such, when the location of the terminal 200, that is, the location corresponding to the network identifier and the location of the political party member exist within the same or preset range, the two locations may be defined to correspond to each other.

If the position corresponding to the network identifier and the position of the party member do not correspond to each other, it may be considered that there is a possibility of fraudulent access.

In the present specification, the fraudulent access may refer to a case where a service request permitted to only a political party member is performed by accessing the network system 400 by a person who is not a political party member. For example, when a fraudulent user who steals authentication information (eg, login information) of a specific member makes a login request or performs a predetermined service (eg, payment, transfer, use or consumption of specific content, etc.) after login, The terminal used by the fraudulent user may be defined as a fraudulent connection to the network system 400.

Accordingly, the network identifier classification system 100 extracts and stores a network identifier or a member identifier (eg, ID, password, etc.) used for such a fraudulent connection, thereby allowing the network identifier to be used for a fraudulent connection in the future. And member identifiers can be identified in advance, and adaptive authentication can be performed accordingly.

For example, when a network identifier used for fraudulent access is maintained and managed, an additional authentication procedure may be additionally performed or a service request may be rejected when a fraudulent user performs fraudulent access using the same network identifier.

In addition, when a member identifier used for fraudulent access is maintained and managed, even when a fraudulent connection is performed by using a different network identifier, a separate authentication procedure is additionally performed for a service request performed using the member identifier. You can even refuse a service request at all.

In addition, when a member identifier used for fraudulent access is maintained and managed, the party member may be advised to modify the member identifier while informing the political party member that the member identifier is being misused.

Meanwhile, when the terminal 200 accesses the network system 400 and performs a predetermined service request, the network identifier classification system 100 may determine a location corresponding to the network identifier of the terminal 200 and the user's location. As long as the locations do not correspond to each other, the network identifier and / or the member identifier used for the service request may be stored in the blacklist DB. In this case, however, the managed network identifier and / or user identifier may be increased, but the convenience of the user may be lowered.

In some cases, even if the location corresponding to the network identifier of the terminal 200 and the location of the party member do not correspond to each other, the network identifier classification system 100 may not determine that the access is fraudulent. For example, when a party member accesses the network system 400 without owning his mobile phone 300, the location comparison results in two locations (that is, a location corresponding to the network identifier and the location of the mobile phone of the party member). Even if the positions do not correspond to each other, it is necessary to view the normal connection. In addition, there may be a case where another person accesses the network system 400 using the member identifier of the political party member with the permission of the political party user. Even in this case, even though the two positions do not correspond to each other, it is necessary to view the normal connection.

Therefore, even if the two locations do not correspond to each other, a technical idea may not be determined as a false connection. To this end, the network identifier classification system 100 may receive a predetermined feedback signal from a system corresponding to the party member. The system corresponding to the political party member may be the mobile phone 300 or may be a data processing device separate from the mobile phone 300. In any case, the party member need only be a data processing device capable of transmitting the feedback signal to the network identifier classification system 100. For example, the network system 400 notifies the network system 400 that a predetermined service request has been made in the name of the political party member by registered email or a messenger of the political party member, and whether the service request is a fraudulent connection. May receive a feedback signal for. Of course, when receiving the feedback signal from the mobile phone 300, the network identifier classification system 100 transmits a message including a call back URL (call back URL) so as to easily select whether or not a fraudulent connection, A predetermined signal may be transmitted so that a predetermined UI that can easily select whether the illegal access is displayed on the mobile phone 300.

Meanwhile, the network identifier classification system 100 may receive predetermined location information from a predetermined location determination system 500 to determine a location corresponding to the network identifier used by the terminal 200. The location determination system 500 may be implemented as a system for allocating a network identifier, such as an ISP system, or a predetermined system for receiving location information from such a system. However, the location information that can be grasped from the ISP system has a large error range, and the location information is not accurate in a large private network such as a VPN (Virtual Private Network).

Therefore, in order to solve this problem, the location determination system 500 according to another embodiment of the present invention may be a system for mapping location information for each network identifier based on the location of the user. This technical idea has been disclosed in Korean patent application (Application No. 10-2011-0081595, "Network Identifier Location Determination System and Method thereof", filed "Applicant") filed by the present applicant. The technical idea disclosed in the previous application and the description thereof are included as a reference of the present invention and may be treated as described herein.

When the position determination system 500 maps the location information for each network identifier based on the position of the party member as disclosed in the previous application, that is, when the party member legitimately accesses the network system, the mobile phone of the party member The location information of the network identifier can be mapped based on the location value of the network identifier. In this case, the location information of the network identifier is much smaller than the location information received from the ISP system, and in the case of the network identifier used in a private network, etc. Even has the effect of grasping accurate location information. Therefore, as the error range of the location information is reduced, even if it is a fraudulent connection, it is possible to reduce the case in which it is incorrectly determined that the location corresponding to the network identifier and the location of political party members are equivalent, and a private network such as a large corporation or an apartment complex. If you are using Dynamic Host Configuration Protocol (DHCP), you can still determine exactly whether the two locations correspond. For example, according to the previous application, when using a private network or DHCP, a plurality of possible location information may be mapped to the same network identifier (for example, an IP address), and any one of the plurality of location information may be the location of the party member. If corresponding to the network identifier classification system 100 may determine that the position corresponding to the network identifier and the position of the party member corresponds.

As a result, a method of determining a location corresponding to a conventional network identifier is simply a method of allocating a network identifier (ISP) to a network identifier, a rule, or a network operator's information. According to this, the position of the network identifier is determined by using other parameters (that is, the position of a party member), so that an accurate position can be identified. In particular, the conventional method has to grasp the location of each network identifier as information having a large error of about the same unit, according to the technical idea of the present invention, the degree of error of the position information of the party member is the error of the location of each network identifier It is determined that the effect. In general, when the party member's location information is identified as the location of the party member's mobile phone 300, the party member's location information includes a GPS value or a value received from the mobile communication company system 600. Since the range is from several meters to hundreds of meters, the error range of the location of each network identifier is significantly reduced compared to the conventional method.

In addition, when the position determination system 500 is implemented as disclosed in the previous application, the position determination system 500 may be included in the network identifier classification system 100 and installed. That is, the network identifier classification system 100 maps the location information for each network identifier and stores the location information in the location information DB for each network identifier, and at the same time, there is a network identifier having a risk of fraudulent access due to the technical idea of the present invention. And / or store a blacklist containing member identifiers.

On the other hand, the network identifier classification system 100 may receive its location value from the mobile phone 300 to determine the location of the political party, that is, the location of the mobile phone (300). In this case, a predetermined application or software code capable of communicating with the network identifier classification system 100 may be preinstalled in the mobile phone 300.

Alternatively, a location value of the mobile phone 300 may be received from a predetermined mobile telecommunication company system 600 that provides a wireless communication service to the mobile phone 300. In addition, the network identifier classification system 100 may determine the location of the mobile phone 300 in various ways.

For example, the network identifier classification system 100 may determine the location of the political party member without using the location of the mobile phone 300. For example, when there are all kinds of service systems (eg, LBS system or mobile communication company system, IPTV network, etc.) that know the party member's location, the party member's location information may be received from the service system. It may be. In addition, when a party member performs tagging through short-range RF communication or a party member directly inputs his or her information or a location to a device installed at a predetermined location, a service system for providing the service is provided. It may also receive location information of political party members. In this manner, the network identifier classification system 100 may check information on the position of a political party member corresponding to the terminal 200 currently connected.

As such, when the network identifier and / or member identifier which is at risk of being used for fraudulent access by the network identifier classification system 100 is extracted and stored, the network identifier classification system 100 is assigned to the stored network identifier and / or member identifier. Information may be provided to a predetermined external system 700. The external system 700 may be the same system as the network system 400 but may be a separate system. That is, the network system 400 used to extract the blacklist and the predetermined web system for performing the authentication process using the extracted blacklist, that is, the external system 700, must be used according to an embodiment of the present invention. It does not have to be the same. For example, the network identifier classification system 100 extracts a blacklist using a first web server and a second web server (ie, the network system 400), and extracts the extracted blacklist from a third web server (ie, The external system 700). Of course, when the network system 400 and the external system 700 are different systems, the blacklist provided to the external system 700 may be information on a network identifier that is at risk of fraudulent access. If the network system 400 and the external system 700 are the same system, information about a member identifier that may be a risk of fraudulent access to the external system 700 may also be provided.

Meanwhile, the network identifier classification system 100 may rate the network identifier and / or the member identifier with the risk of fraudulent access. For example, a network identifier and / or a member identifier once determined to be fraudulent may have a low risk rating, and may be increased if it is repeatedly determined to be fraudulent access. For example, when it is determined that the two locations do not correspond to each other by location comparison, the network identifier classification system 100 receives a feedback signal from the mobile phone 300 of a political party member or the like and receives a signal of a fraudulent connection. The connection of 200 may be determined to be a negative connection. In some embodiments, even when a party member accesses or requests a service, a party member may not transmit the feedback signal. In this case, the network identifier classification system 100 may deny the access or service request. It can also be determined. That is, when there is no feedback signal, since there is a probability of a negative connection, it may be safe to determine that the negative connection is once. Therefore, in such a case, it may not be desirable to uniformly include the corresponding network identifier and / or member identifier in the black list, even if it is counted once or several times. Thus, the blacklist rating according to the number of fraudulent connections can be a more effective way. Of course, according to another exemplary embodiment, when the feedback signal is not received, the network identifier classification system 100 may not count the number of fraudulent accesses.

Alternatively, it may be determined that the network identifier and / or member identifier used in the case where it is determined to be a fraudulent connection over a large number of times is a higher risk network identifier and / or member identifier than in the other cases. Thus, while extracting and managing the blacklist for the network identifier and / or member identifier in this way, it is possible to rate each risk.

In addition, a network identifier and / or a member identifier determined as a blacklist (i.e., a network identifier and / or a member identifier stored in the blacklist DB) are also deleted from the blacklist when they are used for normal connection for a predetermined period or more times. The risk level may be lowered. Therefore, even if the blacklist is extracted once, it can no longer be used for illegal access or if it is considered safe, so that the blacklist can be enlarged indefinitely so that the purpose and effect of extracting the blacklist will not fade. You can do this.

In general, a network identifier used by a fraudulent visitor, such as a hacker, to steal a member's personal information and try to gain unauthorized access to a political party's member, but a specific network identifier may be repeatedly used when a fraudulent visitor tries to access in the same region. If the visitor attempts to make a fraudulent connection in a space used by the public, such as a public institution or a PC room, the network identifier is preferably managed by a network identifier that can be used by political parties. That is, a kind of gray zone occurs. As such, it may not be desirable to statically manage the network identifier corresponding to the gray zone in the blacklist DB, and thus, ranking according to the number of fraudulent accesses may be required.

Meanwhile, according to another exemplary embodiment, the network identifier classification system 100 may extract, maintain, and / or manage a predetermined white list. The white list may mean information about a trusted network identifier and a member identifier. For example, the network identifier classification system 100 may extract a network identifier and a member identifier used for party access. Of course, when the number of party access is more than a certain number of times, the network identifier and the member identifier may be included in the white list. Therefore, the network identifier included in the white list and the member identifier corresponding to the network identifier may be information about a network identifier mainly used by a political party member. As such, when the white list is extracted, the predetermined network system 400 may allow the specific service only when the specific service is requested using the network identifier and the member identifier included in the white list for the specific service. The specific service may be a service classified as an important security service (eg, payment, transfer, system management, and personal information) with high security. Of course, the specific service may be any service provided by the network system 400. For example, the login request may be allowed only for the request using the network identifier and the member identifier included in the white list. In this case, the network system 400 may collect the white list for a certain period of time, and if enough white lists are collected, the network system 400 may be configured to allow the request only for the requests included in the white list.

2 shows a schematic configuration of a network identifier classification system according to an embodiment of the present invention.

Referring to FIG. 2, the network identifier classification system 100 according to an exemplary embodiment of the present invention may include a control module 110, a network identification module 120, a first positioning module 130, and a second positioning module ( 140). The network identifier classification system 100 may further include a blacklist DB 150. According to the implementation example, the location information DB 160 for each network identifier may be further included. The location information DB 160 for each network identifier may be included in the network identifier classification system 100 as shown in FIG. 2, and separate from the network identifier classification system 100 as shown in FIG. 1. It may also be implemented as a system (eg, position determination system 500).

The network identifier classification system 100 may include hardware resources and / or software necessary for implementing the technical idea of the present invention, and may necessarily mean one physical component or one device. It is not. That is, the network identifier classification system 100 may mean a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, the network identifier classification system 100 may be installed in devices spaced apart from each other. It may be implemented as a set of logical configurations for implementing the technical idea of the present invention. In addition, the network identifier classification system 100 may refer to a set of components separately implemented for each function or role for implementing the technical idea of the present invention.

In addition, the term "module" in the present specification may mean a functional and structural combination of hardware for performing the technical idea of the present invention and software for driving the hardware. For example, the module may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware. Can be easily deduced to the average expert in the field of the present invention.

The control module 110 may include other components (for example, the network identification module 120, the first positioning module 130, the second positioning module 140, and the black list) to implement the technical idea of the present invention. Resources and / or functions of the DB 150, the location information DB 160 for each network identifier, and the like.

The network identification module 120 may check a network identifier used by the terminal 200 connected to the network system 400. Confirming the network identifier includes not only the network identification module 120 directly identifying the network identifier used by the terminal, but also receiving information about the identified network identifier from the network system 400. Can be used in the sense. For example, the network identification module 120 may receive information about a network identifier used by the terminal 200 from the network system 400. When the network identifier classification system 100 is included and implemented in the network system 400, the network identification module 120 may directly recognize the network identifier. When the terminal 200 is connected, the network system 400 may check a network identifier (eg, an IP address, etc.) used by the terminal 200. This is because, of course, the network system 400 checks the network identifier of the terminal 200 in order to establish a session for the terminal 200 to access the network system 400. . Of course, the method of confirming the network identifier may vary according to the type of network. According to an exemplary embodiment, predetermined means for confirming the network identifier of the terminal 200 may be installed in the network identifier classification system 100 and / or the network system 400.

The network identifier may vary depending on the type of network. For example, when the network is a wired or wireless Internet, the network identifier may be an Internet Protocol (IP) address. The network identifier of any network is preferably a unique value assigned for each network node existing on the network.

The first positioning module 130 may identify a first position corresponding to the network identifier. To this end, the first positioning module 130 may receive information on the first position corresponding to the network identifier from a predetermined position determination system 500. The location determination system 500 may be implemented as an ISP system for allocating a network identifier used by the terminal 200 or a system that receives information about the first location from the ISP system. According to another embodiment of the present invention, the location determination system 500 stores predetermined network-specific location information mapped to the location of the network identifier based on the location of the mobile phone of the party user as disclosed in the previous application. It may be a system. The location determination system 500 may include location information DB 160 for each network identifier. When the position determination system 500 is included in the network identifier classification system 100, the first positioning module 130 may include the location information DB for each network identifier included in the network identifier classification system 100. The first position can be confirmed from 160. When the position determination system 500 is implemented as a separate device from the network identifier classification system 100, the first position determination module 130 is included in the position determination system 500 through a wired or wireless network. The first location may be identified from the location information DB 160 for each network identifier.

The location determination system 500 may use the network system 400 to construct the location information DB 160 for each network identifier, but may use a web server or the like separate from the network system 400. .

For example, the location determination system 500 determines a network identifier of a second terminal (not shown) that accesses the first web server using a first web server, and locates a party member corresponding to the mall second terminal, That is, when the second terminal accesses the network system 400, a party user corresponding to a member identifier such as ID, P / W, etc., provided to confirm that the party is a party member, or the second terminal is restricted to a specific user. The location of the specific user may be mapped to the location of the network identifier of the second terminal. Since the technical idea is disclosed in detail in the previous application, the detailed description thereof will be omitted.

Then, the network identifier classification system 100 may use the network identifiers of the users connected to the first web server and the position information of the political party members at that time to build the position information DB 160 for each network identifier. . The location information DB 160 for each network identifier established through the first web server is not necessarily used only in the first web server.

That is, the location information DB 160 for each network identifier may be constructed based on the network identifier used in any one or a plurality of network systems and the location information of the political party members at that time, and the location information for each network identifier actually constructed. The DB 160 may be used for the network system used when constructing the location information DB 160 for each network identifier, or may be used for other network systems.

On the other hand, the second positioning module 140 may check the information on the location of the member corresponding to the terminal 200 is connected to the network system 400 using the network identifier. The member corresponding to the terminal 200 may be the specific user scheduled when the terminal 200 is scheduled to be used only by a specific user. Alternatively, when the terminal 200 performs a request for identifying a member of the network system 400 by logging in, using contents, or financial transaction, it means a political party member who has a legitimate authority to make the request. can do.

The second positioning module 140 may receive information on the second location from the mobile communication company system 600 to determine the second location of the political party member corresponding to the terminal 200. According to an embodiment, information about the second location may be received from a predetermined LBS system (not shown). The second location may be the location of the mobile phone 300 of the party member. Of course, the location of the user may be determined without using the mobile phone 300. In this regard, it has been described above.

According to an implementation example, the second positioning module 140 may receive information on the location of the mobile phone 300 from the mobile phone 300 of the political party member. For example, as described above, the mobile phone 300 may be provided with a predetermined means (eg, a GPS module) capable of determining its own location. Then, the mobile phone 300 is located at the position determined by the means. Information may be transmitted to the second positioning module 140.

Then, the control module 110 may determine whether the identified first position and the second position correspond to each other. As a result of the determination, when the first position and the second position correspond, the control module 110 may determine that the connection of the terminal 200 and / or the predetermined request is a normal connection.

However, when the first position and the second position do not correspond to each other, the control module 110 may determine a network identifier and / or a member identifier (eg, a login ID, etc.) used by the terminal 200. You can judge that there is a risk.

If the first position and the second position do not correspond to each other, the control module 110 may immediately store the network identifier and / or member identifier in the blacklist DB 150. However, even in the normal connection as described above, there may be a case where the first position and the second position do not correspond to each other.

Therefore, when the first position and the second position do not correspond, the control module 110 confirms whether the illegal access is made to a system corresponding to a predetermined political party member (for example, a message, an e-mail, or a push). Information, etc.). To this end, the control module 110 may transmit the confirmation information to the mobile phone 300, or may transmit the confirmation information to a path (eg, an email account) separate from the mobile phone 300. . In any case, the confirmation information may be transmitted to the party member corresponding to the terminal 200 to confirm.

Such confirmation information may include information that may indicate that the network system 400 has been connected and / or requested at the first location. The party member receiving the confirmation information sends his / her member to a signal or other person who knows that he / she has access to the network system 400 using the terminal 200 but does not possess his mobile phone 300. When the connection using the identifier is allowed, a predetermined signal, that is, a feedback signal, may be transmitted to the control module 110 to know that the connection is not a fraudulent connection. Alternatively, a feedback signal indicating that the connection through the user terminal 200 is a negative connection may be transmitted to the control module 110.

Then, the control module 110 may store the network identifier used for the terminal 200 to access the network system 400 in the blacklist DB 150 when the feedback signal indicating that a negative connection is received. have. According to an embodiment, the control module 110 may also store information on the member identifier (eg, login ID) used by the terminal 200 in the blacklist DB 150.

Then, the control module 110 may transmit information about the blacklist (ie, network identifier and / or member identifier) stored in the blacklist DB 150 to a predetermined external system 700. The external system 700 may be the network system 400 or may be a separate system.

The external system 700 may receive the blacklist and perform a differentiated authentication procedure using the received blacklist. According to an embodiment, a predetermined request using a network identifier and / or a member identifier included in the blacklist may be rejected.

On the other hand, as described above, the control module 110 may further store information on the number of times the network identifier and / or member identifier used in the blacklist DB 150 is used for unauthorized access. This may be because the more times the fraudulent connection is used, the more likely it is to be used for fraudulent access. In addition, the control module 110 may determine a blacklist grade of the network identifier and / or the member identifier stored in the blacklist DB 150 based on the information on the number of times.

One such example is shown in FIGS. 4 and 5.

4 illustrates an example in which a network identifier is stored in a blacklist DB by a network identifier classification system according to an embodiment of the present invention, and FIG. 5 illustrates a user identifier being black by a network identifier classification system according to an embodiment of the present invention. An example is stored in the list DB.

First, referring to FIG. 4, the blacklist DB 150 includes a network identifier (eg, identifier 1) used for a predetermined request (eg, login, payment, transfer, etc.) determined to be a fraudulent connection as shown in FIG. 4. , 2, 3, 4) can be stored. In addition, the access log for each network identifier, that is, information about the access log may be stored. The access log may include information about an access time. In addition, the blacklist DB 150 may store information on the number of illegal accesses for each network identifier. Then, the control module 110 may determine the blacklist grade of the network identifier based on the information on the number of fraudulent accesses. For example, a blacklist rating of one grade may be set for a network identifier (eg, identifier 1) in which only one fraudulent connection was performed. Two levels of blacklist rating may be established for network identifiers (eg, identifier 2) that have been used for more than three fraudulent connections. In addition, a blacklist grade of three grades may be set for a network identifier (eg, identifier 3) that has been used for more than 10 fraudulent accesses. By blacklisting the network identifier according to the number of fraudulent accesses, a connection or request to the external system 700 using a network identifier having a high blacklist grade may indicate a high probability of fraudulent access.

In addition, as described above, since the first position and the second position do not correspond to each other, a feedback signal is requested to the party member's terminal (eg, a party member's mobile phone), and no feedback signal is received from the party member's terminal. If not, the control module 110 may determine that the connection is a negative connection. In such a case, it may also be significant to assign a relatively low blacklist rating to the network identifier used for several fraudulent connections. Of course, for the sake of security, a high blacklist rating may be set for all network identifiers used for only one fraudulent connection, or uniformly treated as a blacklist regardless of the number of fraudulent connections.

In general, a network identifier having a large number of fraudulent accesses may be a case in which a user's authentication information is leaked and a specific fraudulent user repeatedly performs fraudulent access using his terminal. Alternatively, a network identifier used by a terminal placed in a public place or a PC room and used by many users may be repeatedly used for illegal access. In the case of a terminal arranged in a public place or a PC room, there is a risk of being used again for unauthorized access, so that an additional authentication procedure may be additionally performed in the external system 700.

For a network identifier for which a fraudulent user repeatedly attempts a fraudulent connection at a specific location, a separate authentication procedure or a request may be rejected. Whether the network identifier used for fraudulent access is a specified network identifier of a hacker or fraudulent accessor or a public network identifier that is also used by party members can be determined according to the frequency of party accesses used with fraudulent access. Even if the same network identifier is used for fraudulent access, the blacklist level may vary depending on the frequency of party access, and additional authentication procedures may be applied differently. In any case, there may be an effect that, by strengthening the authentication procedure by blacklisting the network identifier used for fraudulent access, at least the illegal user can always use a different network identifier.

On the other hand, when it is determined that the terminal 200 is connected to the network system 400 is an illegal connection, the control module 110 performs a predetermined request by the terminal 200 as shown in FIG. In addition, the member identifier (eg, login ID, etc.) used at the time may be extracted to a blacklist. According to an implementation example of the network system 400, when login is not required, identification information (eg, MAC address) of the terminal 200 may be used as the member identifier.

The member identifier may also be blacklisted according to the number of times used for fraudulent access. For a member identifier repeatedly used for fraudulent access, the external system 700 may request a political member to change authentication information. Of course, a separate authentication procedure may be required or a predetermined request may be rejected even for the member identifier used for the illegal access once.

When the blacklist for the member identifier is extracted as described above, even if an illegal user changes the network identifier used for the illegal access, security is provided by denying the service or performing a separate authentication procedure for the illegal access using the member identifier. There is an effect to increase the sex.

4 and 5 illustrate a case in which a network identifier and / or a member identifier are separately stored in the blacklist DB 150 for convenience of description, but a network identifier used for fraudulent access and a member identifier used at the same time are simultaneously used. It may be easily deduced by the average expert in the art of the present invention that the data may be stored in the blacklist DB 150.

On the other hand, the continuous blacklisting of network identifiers and / or member identifiers used for fraudulent access at least once may not be possible when the network identifiers and / or member identifiers are not used for fraudulent access in the future. 700 may generate a continuous load. In addition, when the amount of the managed blacklist is enormous, the purpose and effect of extracting and managing the blacklist separately may be slightly halved. In addition, if a hacker or a fraudster attempts to make a fraudulent connection in a public place or a PC room, it may not use the network identifier and / or the member identifier that has been used after a certain time.

Therefore, when it is determined that the network identifier and / or member identifier stored in the blacklist DB 150 are no longer used for unauthorized access, the control module 110 deletes the blacklist from the blacklist or sequentially blacklists the rating. It can also be lowered. For example, when a predetermined network identifier and / or a member identifier is included in the blacklist and used only for party access for a predetermined number of times consecutively or when no longer used for illegal access for a certain period, the control module 110 The network identifier and / or the member identifier may be deleted from the blacklist or the blacklist grade may be lowered. In the case of lowering the blacklist rating, it may be deleted from the blacklist when there is no further lowering rating.

On the other hand, when a blacklist grade is assigned to a blacklist managed by the network identifier classification system 100 as described above, the attribute of the external system 700 or the external system 700 requesting the blacklist is determined. ), You can provide a blacklist for each class at your request. For example, when the external system 700 is a financial institution or a public institution that preferably has high security, the network identifier classification system 100 may also transmit information on a low level blacklist to the external system 700. have. In the case of an external system 700 that does not have to have high security, the black list extraction system 100 may transmit only information on a blacklist having a predetermined level or more to the external system 700.

Then, the external system 700 can flexibly operate such as selectively performing or additionally performing an authentication procedure or denying a service according to the received blacklist information. According to the external system 700, whether or not to transmit a blacklist of which grade or more may be stored in the network identifier classification system 100 in advance.

Of course, the network identifier classification system 100 may transmit the blacklist to the external system 700 regardless of the grade, and the external system 700 may perform different authentication or security response to the blacklist according to a predetermined criterion. Of course it is.

3 is a schematic flowchart illustrating a network identifier classification method according to an embodiment of the present invention.

Referring to FIG. 3, according to a network identifier classification method according to an exemplary embodiment of the present disclosure, the network identifier classification system 100 may include a first network identifier corresponding to a network identifier of a terminal 200 connected to a predetermined network system 400. One location may be determined, and a second location corresponding to a specific member who is allowed to access a party member or a network system 400 corresponding to a member identifier used when the terminal 200 accesses may be identified ( S100).

Then, the network identifier classification system 100 may compare the first location with the second location and determine whether they correspond to each other (S110). When the two locations correspond to each other as a result of the determination, the network identifier classification system 100 may determine that the connection is a normal connection. However, if it is determined that the two locations do not correspond to each other, it may be determined that the connection is a fraudulent connection.

Meanwhile, if the two locations do not correspond to each other, the network identifier classification system 100 may store the network identifier and / or the member identifier used for the connection directly in the blacklist DB 150, but the two locations are mutually different. In order to determine whether the connection is normal even if it does not correspond, a predetermined feedback signal may be received from a party member system such as a mobile phone of the party member from the party member system (S120). Then, the network identifier classification system 100 may finally determine whether the connection is a fraudulent connection based on the received feedback signal, and if it is determined that the splice is a fraudulent connection, the network identifier and / or member identifier used for the connection. The may be stored in the blacklist DB 150 (S140).

Meanwhile, a predetermined blacklist grade may be determined for the network identifier and / or the member identifier stored in the blacklist DB 150 according to the number of times used for the illegal access, and accordingly, the predetermined blacklist grade may be determined to the predetermined external system 700 for each grade. As described above, information about the blacklist may be provided.

In addition, the network identifier and / or the member identifier included in the blacklist DB 150 may also be deleted from the blacklist or the blacklist grade may be lowered depending on the number of normal accesses or the period of no longer used for illegal access. As described above.

As described above, according to the network identifier classification system and the method thereof, the network identifier used for fraudulent access can be extracted and managed, so that the network identifier is used to access a predetermined external system 700. If there is a terminal, the external system 700 may recognize that the risk is high before the terminal performs a predetermined action for identifying the user such as a login request. Therefore, security measures such as selectively performing a separate authentication procedure or monitoring the behavior or request of the terminal can be established only for the terminal.

In addition, since the member identifier with a high risk of fraudulent access can be extracted and managed separately, the party member of the account being stolen can be notified and advised to change the member identifier to reduce the post-mortem damage caused by the theft of personal information. In addition, there is an effect that a selective security policy can be applied to a terminal accessing the external system 700 using the member identifier.

On the other hand, the control module 110 of the network identifier classification system 100 according to an embodiment of the present invention to extract a trusted network identifier and information about the member identifier used in the request using the network identifier to a white list It may be maintained and / or managed.

The white list can be constructed by extracting the network identifier used for party access and the member identifier at that time as opposed to blacklist extraction. In general, if the user is a normal user instead of a fraudulent user, he or she may repeatedly connect to a specific network system 400 in a company or home that he or she mainly uses. Therefore, when a white list is constructed according to the technical idea of the present invention, information about a network identifier mainly used for each member identifier may be stored and managed. Therefore, when the white list is constructed as such, the network identifier and the member identifier included in the white list may be determined to be information about the network identifier and the member identifier at that time, which are more or less reliable. Therefore, when a predetermined connection or request using the network identifier included in the white list and the member identifier corresponding to the network identifier is performed, a simpler authentication procedure may be selectively applied. According to an embodiment, the access or request may be allowed only for a predetermined connection or request using a network identifier included in the white list and a member identifier corresponding to the network identifier.

Even when the white list is constructed, the network identifier classification system 100 may extract the network identifier and the member identifier used for the connection as a white list only when a normal number of times of normal access is made.

In addition, the service forcing the use of the network identifier included in the white list and the member identifier corresponding to the network identifier may be a specific service in which security is emphasized in the network system 400. Of course, for all services (including login) provided by the network system 400, the service may be allowed (provided) only when the network identifier included in the white list and the member identifier corresponding to the network identifier are used. .

Meanwhile, when a predetermined service request using a white list is performed, it may mean a case where a service request is performed using a member identifier of the political party member at a location mainly used by a political party member. Service requests may not guarantee service requests by political party members. For example, even when a fraudulent user requests the service using the party member's ID and / or password using a computer mainly used by a party member at a location mainly used by a party member, the service request may be a white list. Because there is. Therefore, according to an embodiment of the present invention, even when a predetermined service request using a white list is performed, it may be further determined whether or not a party access is made. That is, it is possible to compare the position of the party member with the position of the network identifier used for the connection (eg, the computer position of the party member). Therefore, even when the network identifier mainly used by the political party member and the member identifier of the political party member are used, if the political party member is not located at the position corresponding to the network identifier (for example, the computer member of the political party member), it is determined that the access is illegal. Can be. In practice, if a party member is present at a location corresponding to a network identifier (e.g., a party member's computer location), it is extremely unlikely that a fraudulent connection will occur (i.e., a party member's computer access). In the case of allowing access (or request) only for the connection (or request), and additionally determining whether the connection is illegal at the time of the connection (or request), most unauthorized access by the illegal user can be filtered out. .

In addition, according to another embodiment of the present invention, as described above, the white list may be automatically established by the network identifier classification system 100, but a party member mainly uses a network identifier (eg, IP). Etc.) or by the network identifier classification system 100 or the network system 400, a specific user (e.g., an internal person such as a developer or an engineer) is assigned to use a specific network identifier, thereby establishing the white list. May be

For example, a given political party member may wish to use the network system 400 or a specific service provided by the network system 400 only at a location (eg, a company or a home) that is mainly used by the party. Then, the party member may output a network identifier registration request to the network identifier classification system 100 to the network system 400 or through the network system 400.

The party member may directly input a network identifier used by the party member and output the network identifier registration request to use only the input network identifier, but the network corresponding to the terminal currently connected to the network system 400 is used. The network identifier registration request for automatically registering an identifier may be output.

Then, when the party member normally connects to the network system 400, the network identifier classification system 100 may automatically register a member identifier of the party member and a network identifier currently being used on the white list. have. As such, the network identifier classification system 100 automatically recognizes the network identifier and includes it in the white list because the political party member may have difficulty in knowing or identifying the network identifier used by the political party member. Therefore, in this case, the network system 400 and / or the network identifier classification system 100 may intuitively recognize the political party member, such as 'subscribe to use the service only on the PC currently being used'. The network identifier registration request may be performed through a predetermined phrase and a UI.

On the other hand, even when a political party member accesses the network system 400 using the same terminal at the same location, the network identifier used by the terminal may be changed every time, such as DHCP. As such, even when a network identifier assigned to the terminal is dynamically allocated, the party member may use the terminal to use a specific service provided by the network system 400 or the network system 400. Do.

To this end, the network identifier classification system 100 may automatically register the corresponding network identifier when the party members access the network system 400 at the same location and the party members access normally. . In this case, when repeatedly accessing the network system 400 using the same terminal at the same location, all network identifiers used by the terminal may be automatically registered as a white list.

When a white list is registered as described above, when a predetermined service request is performed to the network system 400 using a network identifier included in the white list and a member identifier corresponding thereto, at least a terminal registered by a political party member is used. It may be determined that the person who knows the member identifier of the political party member has performed the service request. If it is determined once more whether or not the service request is normally connected, it is proved that the person who performed the service request exists at the same location as the party member, that is, the person who performed the service request is the party. This means that the probability of being a member is very high, so it has very good security.

Meanwhile, the network identifier classification system 100 and / or the network system 400 may allocate a specific user to use only a specific network identifier. In this case, the specific user may be a limited user such as the network identifier classification system 100 and / or an operator or company employee of the network system 400, and access to the system is limited to only a specific user and a specific network identifier. Can be. That is, the specific user may need to be allowed to the service only when a specific service request (eg, a request for performing specific functions that can be performed by an operator) is made using the specific network identifier. For example, the authority to access the system or information is required when external access such as national institution network, financial institution network or corporate internal network needs to be blocked, or if a high level of security is required for an individual's e-mail or personal information. It may be necessary to ensure that the service is provided only to those who have it.

In this case a fixed network identifier may be assigned to the specific user or a specific user may register a network identifier, such a fixed network identifier is assigned or registered and the network identifier and the member identifier of the specific user are When registered in the white list, a specific service can be used only through the network identifier. In this case, only a person who is limited to use a specific service by using a fixed network identifier may use the specific service by determining whether a normal connection is made using the location of the specific user. Of course, when the network identifier is dynamically allocated to the specific user, as described above, information about a plurality of network identifiers used by the specific terminal used by the specific user may be automatically collected and registered in the white list. .

As such, when a service is allowed only for a service request using a network identifier and a member identifier included in the white list using a predetermined white list, the service request can be limited to occur only at a predetermined location (or terminal). There is. Even in this case, the service requester may be an unauthorized user who knows the member identifier (ID, password, etc.). According to the technical idea of the present invention, the position corresponding to the network identifier is compared with the position of a party member corresponding to the member identifier. By checking whether the connection is normal or not, there is an effect that it can be guaranteed with a high probability of being a party member with the limitation of the place (or terminal).

The network identifier classification system 100 may determine whether a normal connection is made to a predetermined service request using the network identifier and the member identifier stored in the white list DB 170 as described above. That is, it is determined whether a predetermined service is requested to the network system 400 through a network identifier stored in the white list DB 170 and a corresponding member identifier, and the location corresponding to the location and the member identifier of the network identifier is also determined. It can be determined whether the positions correspond to each other. If both conditions are satisfied, the service request can be allowed. Allowing the service request not only determines whether the network identifier classification system 100 directly satisfies the two conditions and permits the service request, but also allows the network identifier classification system 100 to determine the network system ( Transmitting a predetermined signal indicating whether the two conditions are satisfied to the system providing the requested service, and determining that the network system 400 finally accepts the service request in response to the transmission. It may be defined to include.

Network identifier network identifier classification method according to an embodiment of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, optical data storage, and the like, and also in the form of carrier waves (e.g., transmission over the Internet). It also includes implementations. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (25)

A network identification module for identifying a network identifier used by the terminal for connection with the network system when the terminal is connected to a predetermined network system through a wired or wireless network;
A first positioning module for identifying a first position corresponding to the network identifier identified by the network identification module;
A second positioning module for identifying a second position of a political party member corresponding to a member identifier accessing the network system using the network identifier; And
And a control module for determining whether to store at least one of the network identifier or the member identifier in the blacklist DB according to whether the first position and the second position correspond to each other.
The method of claim 1, wherein the control module,
If it is determined that the first location and the second location do not correspond to each other, receiving a feedback signal as to whether the connection to the network system through the terminal from the system corresponding to the party member is a party connection, and receives the received feedback And storing at least one of the network identifier or the member identifier in the blacklist DB based on a signal.
The method of claim 2, wherein the control module,
A network identifier for receiving the feedback signal from a system corresponding to the political party member whether the political party member has accessed the network system using the terminal or whether the political party member has allowed others to access the network system; Classification system.
The method of claim 1, wherein the network identifier classification system,
Confirming the first location from a location information DB for each network identifier for storing location information for each network identifier,
The location information DB for each network identifier is
When a predetermined terminal accesses a predetermined network system by using a predetermined network identifier and a predetermined member identifier, the terminal stores the location information for each network identifier based on the position of the mobile phone of the party member corresponding to the member identifier. Network identifier classification system, characterized in that.
The method of claim 1, wherein the control module,
And storing information on the number of times at least one of the network identifier or the member identifier is used for a fraudulent connection in the blacklist DB, wherein the at least one of the network identifier or the member identifier is used for a fraudulent connection. And determine a blacklist grade of at least one of the network identifier or the member identifier.
The method of claim 5, wherein the control module,
The network identifier or the member identifier is deleted from the blacklist DB or blacklisted according to the elapsed time after the network identifier or the member identifier stored in the blacklist DB is used for the party access or the illegal access. Network identifier classification system, characterized in that lowering.
The method of claim 1, wherein the control module,
And in response to the blacklist request from an external system, transmitting information on at least one of a network identifier or a member identifier stored in the blacklist DB to the external system.
The method of claim 7, wherein the control module,
Network identifier classification system, characterized in that for extracting a network identifier or a member identifier of a certain blacklist level or more of the network identifier or member identifier stored in the blacklist DB according to the external system to transmit to the external system.
The method of claim 1, wherein the control module,
Determining whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other;
And storing the network identifier and the member identifier in the white list DB when the number of times a political party corresponding to the member identifier is partyly accessed using the network identifier is a preset number or more.
The method of claim 9, wherein the control module,
For a specific service provided by the network system,
And the specific service request is allowed only when the specific service is requested using the network identifier and the member identifier included in the white list DB.
The method of claim 10, wherein the control module,
And further determining whether the position of the political party member corresponding to the member identifier corresponds to the position corresponding to the network identifier, and allowing the specific service request if the determination result corresponds.
A network identification module for identifying a network identifier used by the terminal for connection with the network system when the terminal is connected to a predetermined network system through a wired or wireless network;
A first positioning module for identifying a first position corresponding to the network identifier identified by the network identification module;
A second positioning module for identifying a second position of a political party member corresponding to a member identifier accessing the network system using the network identifier; And
And a control module for determining whether to store at least one of the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other.
The control module includes:
And storing the network identifier and the member identifier in the white list DB when the first position and the second position correspond to each other more than a preset number of times.
A network identification module for identifying a network identifier used by the terminal for connection with the network system when the terminal is connected to a predetermined network system through a wired or wireless network;
A first positioning module for identifying a first position corresponding to the network identifier identified by the network identification module;
A second positioning module for identifying a second position of a political party member corresponding to a member identifier accessing the network system using the network identifier; And
And a control module for determining whether the network identifier and the member identifier are included in a pre-registered white list, and whether the first position and the second position correspond to each other.
The method of claim 13, wherein the white list,
The political party member includes the network identifier and the member identifier corresponding to the network identifier that has made a network identifier registration request to the network system or the network identifier classification system, or
And the network identifier assigned to a specific user by the network system or the network identifier classification system and the member identifier corresponding to the network identifier.
The method of claim 14, wherein the control module,
When the political party member makes a network identifier registration request for a specific terminal existing at a specific location, a plurality of network identifiers used by the specific terminal is registered in the white list,
When the political party member normally connects to the network system at the specific location to register the plurality of network identifiers used by the specific terminal to the white list, the plurality of network identifiers used for the connection are registered on the white list. Network identifier classification system, characterized in that.
When the network identifier classification system is connected to a predetermined network system through a wired or wireless network, the network identifier classification system checks a network identifier used by the terminal for connection with the network system, and identifies a first position corresponding to the network identifier. step;
Identifying, by the network identifier classification system, a second position of a political party member corresponding to a predetermined member identifier connecting to the network system using the network identifier; And
And determining, by the network identifier classification system, whether to store at least one of the network identifier or the member identifier in the blacklist DB according to whether the first position and the second position correspond to each other. Way.
The method of claim 16, wherein determining whether to store at least one of the network identifier or the member identifier in a blacklist DB includes:
If the network identifier classification system determines that the first position and the second position do not correspond to each other, a feedback signal indicating whether a connection from the system corresponding to the party member to the network system using the terminal is a party connection; Receiving; And
And storing, by the network identifier classification system, the network identifier or the member identifier in the blacklist DB based on the received feedback signal.
The method of claim 16, wherein the determining of the first location corresponding to the network identifier comprises:
Identifying, by the network identifier classification system, a first position corresponding to the network identifier from a location information DB for each network identifier;
The location information DB for each network identifier is
When a predetermined terminal accesses a predetermined network system by using a predetermined network identifier and a predetermined member identifier, the terminal stores the location information for each network identifier based on the position of the mobile phone of the party member corresponding to the member identifier. Network identifier classification method, characterized in that.
The method of claim 16, wherein the network identifier classification method comprises:
Storing, by the network identifier classification system, information on the number of times the network identifier or the member identifier is used as a fraudulent connection in the blacklist DB; And
And determining, by the network identifier classification system, a blacklist rating of the network identifier according to the number of times the network identifier or the member identifier is used for fraudulent access.
The method of claim 19, wherein the network identifier network identifier classification method comprises:
The network identifier or the member identifier is stored in the blacklist DB according to the elapsed time after the network identifier or the member identifier is used for the party access or the illegal access. Deleting or lowering the blacklist rating.
The method of claim 16, wherein the network identifier classification method comprises:
And in response to the blacklist request from an external system, transmitting, by the network identifier classification system, information of a network identifier or a member identifier stored in the blacklist DB to the external system.
The method of claim 21, wherein the transmitting of the information of the network identifier stored in the blacklist DB to the external system,
The network identifier classification system according to the external system, extracting a network identifier or a member identifier of a predetermined blacklist level or more among the network identifiers or member identifiers stored in the blacklist DB, and transmitting the extracted network identifiers to the external system Way.
The method of claim 16, wherein the network identifier classification method comprises:
Determining, by the network identifier classification system, whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other;
Determining whether to store the network identifier and the member identifier in a white list DB according to whether the first location and the second location correspond to each other,
And determining, by the network identifier classification system, whether the number of times a party member corresponding to the member identifier is partyly accessed using the network identifier is a preset number or more.
When the network identifier classification system is connected to a predetermined network system through a wired or wireless network, the network identifier classification system checks a network identifier used by the terminal for connection with the network system, and identifies a first position corresponding to the network identifier. step;
Identifying, by the network identifier classification system, a second position of a political party member corresponding to a predetermined member identifier connecting to the network system using the network identifier; And
And determining, by the network identifier classification system, whether to store the network identifier and the member identifier in a white list DB according to whether the first position and the second position correspond to each other. Identifying, by a network identifier classification system, a network identifier used by the terminal for connection with the network system when the predetermined terminal is connected to the predetermined network system via a wired or wireless network;
Confirming, by the network identifier classification system, a first position for identifying a first position corresponding to the identified network identifier;
Identifying, by the network identifier classification system, a second position of a political party member corresponding to a member identifier accessing the network system using the network identifier; And
And determining, by the network identifier classification system, whether the network identifier and the member identifier are included in a pre-registered white list, and whether the first position and the second position correspond to each other.

Images