KR101545897B1 - A server access control system by periodic authentification of the smart card - Google Patents

Abstract

The present invention can prevent illegal file access or process termination based on the privilege information obtained through periodic smart card authentication and periodically perform smart card authentication, which automatically terminates important processes generated by the user after completion of the job An interface unit for generating and activating a login process, receiving an instruction after login, and creating an application process; An authentication processing unit, which is executed in an application layer of the operating system, performs authentication of the user using the authentication information stored in the smart card, and generates authentication right information of the user; An authentication status checking unit, which is executed in an application layer of the operating system and periodically checks whether authentication information of the smart card is valid; An authentication authority managing unit configured in the secure kernel of the operating system and receiving and storing the authentication right information of the user from the authentication processing unit; A session management unit configured in the security kernel of the operating system and setting the authentication right information of the application process when the application process is generated; And an access control unit configured in the security kernel of the operating system, and when the application process requests system resources of the operating system, the access control unit determines whether to permit the application resource by referring to the authentication right information of the application process.
With the above system, it is possible to solve a vulnerability that may occur when unauthorized use of the authority once granted at the time of login authentication is confirmed by periodically requesting re-authentication for the process of performing important work and confirming the task execution right.

Description

[0001] The present invention relates to a server access control system for periodically authenticating a smart card,

The present invention can prevent illegal file access or process termination based on the privilege information obtained through periodic smart card authentication and periodically perform smart card authentication, which automatically terminates important processes generated by the user after completion of the job Server access control system.

In particular, when the user process accesses a server system resource such as a file or a process, the security kernel verifies the privilege attribute of the process, blocks use of the system resource when valid authentication and authorization are not granted, And automatically terminates expired processes, and a server access control system through periodic smart card authentication.

In general, the operating system of the server system permits access only to authorized users and access control functions to prevent unauthorized access to system resources such as file reading, writing, execution, and process termination.

According to the related art, the access control function provided by the operating system of the server system is performed based on the user ID after password authentication. That is, when the user logs in to the server system, the same access authority is given to the system resources regardless of which authentication means is used to log in. Therefore, it can be a serious problem if passwords of users who can access important resources are leaked.

To solve these problems, a security kernel based access control system (security operating system) is installed and operated in order to enhance the security of the server system. The access control system provides a second authentication function such as a certificate of a public key infrastructure and an OTP (One-Time Password) to strengthen the login authentication procedure and grant access authority.

However, in the access control method of the security operating system, when the user is granted the privilege once through the authentication process when logging into the server system, the user has the same level of privilege until the process created by the user is terminated. Therefore, once a high level of authority is granted to access important resources of the server system through the secondary authentication, unlimited rights can be granted until the end of the process.

In particular, even if the user has finished the work and logs out of the server system, the process created by the user can operate without unintentionally terminating. Therefore, since important processes with high privileges may be unnecessarily present, there arises a problem that security of the server system is degraded.

Korean Patent No. 10-0386852 (2003.06.09. Announcement) Korean Patent No. 10-0386853 (published on Jun. 9, 2003)

An object of the present invention is to solve the above-mentioned problems, and it is an object of the present invention to prevent unauthorized file access or process termination action based on privilege information obtained through periodic smart card authentication, A system for periodically authenticating a server, and a system for terminating processes automatically.

In particular, it is an object of the present invention to provide a method and system for controlling a security kernel, when a user process accesses a server system resource such as a file or a process, checks the authority attribute of the process, And a server access control system through periodic smart card authentication that automatically terminates processes whose authentication has expired.

In order to achieve the above object, the present invention provides a system installed and executed on an operating system of an operating system server, wherein the operating system server is connected to a user terminal through which a smart card is inserted and from the user terminal to a user account of the operating system server The present invention relates to a server access control system through periodic smart card authentication, which provides a system user of the operating system with access to a connected user, and more particularly, to a server access control system which generates and activates a login process, receives an instruction after login, part; An authentication processing unit, which is executed in an application layer of the operating system, performs authentication of the user using the authentication information stored in the smart card, and generates authentication right information of the user; An authentication status checking unit, which is executed in an application layer of the operating system and periodically checks whether authentication information of the smart card is valid; An authentication authority managing unit configured in the secure kernel of the operating system and receiving and storing the authentication right information of the user from the authentication processing unit; A session management unit configured in the security kernel of the operating system and setting the authentication right information of the application process when the application process is generated; And an access control unit configured in the security kernel of the operating system, and when the application process requests system resources of the operating system, the access control unit refers to the authentication right information of the application process and determines whether the application resource is allowed or not.

In addition, the present invention provides a server access control system through periodic smart card authentication, wherein the authentication authority information includes at least one of an access to a file on the operating system, an access type of the file, And a range of the process.

According to another aspect of the present invention, there is provided a server access control system through periodic smart card authentication, wherein the authentication authority management unit stores authentication authority information of users in an authentication authority table and manages the authentication authority information, And stores it in a table for management.

According to another aspect of the present invention, there is provided a server access control system for periodically authenticating a smart card, wherein the session management unit, when the application process is generated, authenticates the application process in the scope of the authentication authority in the authentication right information of the user to which the application process belongs And sets the authority information.

In the server access control system through periodic smart card authentication, the session management unit inherits the authentication right information from the parent process when the application process is created, and sets the authentication right information as the authentication right information of the application process .

According to another aspect of the present invention, there is provided a server access control system using periodic smart card authentication, wherein the authentication processing unit transmits authentication information of the smart card to an authentication server to allow the authentication server to perform user authentication, From the authentication server.

According to another aspect of the present invention, there is provided a server access control system through periodic smart card authentication, wherein the authentication status checking unit periodically transmits validity of the checked authentication information to the authentication authority management unit, Updates the authentication authority information, invalidates the authentication authority information of a user who has not been updated for a predetermined period of time, transmits authentication authority information of the invalidated user to the session management unit, And the management unit terminates the processes based on the authentication right information of the revoked user.

According to another aspect of the present invention, there is provided a server access control system through periodic smart card authentication, wherein the session management unit terminates an invalidated process received from the authentication right management unit, and terminates all the lower processes of the invalidated process .

As described above, according to the server access control system through the periodic smart card authentication according to the present invention, it is possible to periodically re-authenticate a process for performing important operations, It is possible to solve the vulnerability that may occur when the authority is used infinitely.

According to the server access control system through the periodic smart card authentication according to the present invention, the server system can be safely protected by automatically terminating all important processes created by the user at the time the user completes using the server system Is obtained.

1 is a block diagram of an overall system configuration for implementing a server access control system through periodic smart card authentication according to the present invention;
2 is a block diagram of a configuration of a server access control system through periodic smart card authentication according to an embodiment of the present invention.
3 is a flowchart illustrating a user authentication or re-authentication processing method according to an embodiment of the present invention;
4 is a flowchart illustrating a method of periodically checking a user authentication state according to an embodiment of the present invention.
5 is a flowchart illustrating a method of periodically checking a user authentication state according to an embodiment of the present invention.
FIG. 6 is a flowchart illustrating a method of managing an authentication right when a process is created according to an embodiment of the present invention. FIG.
FIG. 7 is a flowchart illustrating a method for managing an authorization authority control for a request operation of an application process according to an embodiment of the present invention; FIG.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In the description of the present invention, the same parts are denoted by the same reference numerals, and repetitive description thereof will be omitted.

First, a configuration of an overall system for performing a server access control system through periodic smart card authentication according to the present invention will be described with reference to FIG.

1, the overall system for implementing the present invention includes a user terminal 10, a smart card 11 inserted in the user terminal 10, a client 12 installed in the user terminal 10, A server 30, and an authentication server 30.

The user terminal 10 is a conventional computer terminal having a computing function such as a personal computer (PC), a tablet PC, a smart phone, and the like. The user terminal 10 is provided with an apparatus or an interface capable of inserting the smart card 11 to access the content of the smart card 11 to read or write data. The user terminal 10 is also provided with a client 12 connected to the operating system server 30 and capable of using the functions of the operating system server 30.

The smart card 11 may include a conventional integrated circuit (IC) chip to store data in the IC chip. In particular, the authentication information of the user is stored in the IC chip of the smart card 11. For example, authentication information in the form of a user's authorized certificate, an ID and a password, and a unique authentication code are stored.

Specifically, the smart card 11 stores unique identifier information. For example, it can store membership, user name, smart card password, etc., but it can be used as an identifier. The user inputs the user ID and password at the time of login, and the authentication module automatically extracts the smart card identifier and the like to generate the authentication request information. That is, the authentication process is performed by checking whether there is an additional smart card in addition to the ID / password at the time of login. After the successful login, the presence of the smart card is periodically checked to continuously check the user's work status.

The client 12 has a connection function for connecting to the operating system server 30, an authentication function for performing user authentication, a smart card reader function for reading the contents of the smart card 11, and the like. The user performs operations such as user authentication, server connection, and the like through the client 12. Hereinafter, the user performs a certain task by performing work through the client 12, or connecting to the server through the client 12 to perform an operation.

The client 12 uses the connection protocol to connect to the server of the operating system using a connection protocol such as remote connection (telent), secure shell (ssh), file transfer (ftp, sftp), remote desktop connection (RDF, (30) and uses the corresponding service. The connection function performs the same function as the dummy terminal using the operating system function of the operating system server 30.

Particularly, the client 12 is a program system installed in the user terminal 10, and connects to the operating system server 30 to perform user authentication. When the authentication for connecting to the operating system server 30 is completed, And accesses the operating system server 30.

Next, the operating system server 30 is a server based on a general-purpose operating system such as Unix and Windows, and provides a service that allows a user to use a user account (or a system account) by giving a user account (or a system account). The services provided include remote access (telent), secure shell (ssh), file transfer (ftp, sftp), remote desktop access (RDF, Windows) To this end, the service is provided through a protocol corresponding to each service.

Also, the user can access the operating system server 30 through the user account and use the operating system of the operating system server 30. In particular, the operating system server 30 provides a multi-user environment in which an individual operating system can be used for each user even when a plurality of users access at the same time.

At this time, the operating system server 30 authenticates the user with a password, an authentication code, a certificate (public certificate, etc.) for the user account. In particular, the operating system server 30 authenticates using the authentication information stored in the smart card 11. Each user's user account is granted a privilege divided into a plurality of levels, and the user of the user account accesses the system resources of the operating system server 30 within the privileges granted according to the privilege or authentication level given to the account of the user Can be used. A system resource is a file or a process. Specifically, it includes authority to access the file, execute or terminate the process, and the like.

Next, the authentication server 50 is a normal server for providing an authentication service for the client 12, and manages the authentication information for the user and performs a service for authenticating the user.

In the authentication server 50, information for user authentication is stored in advance. Preferably, the authentication server 50 stores information on an IP address of the operating system server, a user ID, a smart card identifier, a terminal IP address accessible to the operating system server, and the like in an authentication policy DB. That is, the authentication server 50 has a user ID, a smart card, and terminal device information that can be used when connecting to a specific server.

When the user logs in, the authentication server 50 requests authentication. At this time, the operating system server 30 transmits the server IP address, the user ID, the smart card identifier, and the terminal IP address. The authentication server 50 checks the authentication policy DB using the received authentication request information, and returns a successful authentication if a matching policy exists, otherwise returns a failure.

Meanwhile, the client 12, the operating system server 30, and the authentication server 50 may be connected to each other via a network, and may be remotely connected or connected to each other. Or the operating system server 30 and the authentication server 50 may be directly connected or constructed within the same physical server.

Next, a configuration of a server access control system through periodic smart card authentication according to an embodiment of the present invention will be described in more detail with reference to FIG.

The server access control system according to an embodiment of the present invention may be implemented by the operating system server 30 described above. That is, a module installed in the operating system server 30 and executed in the operating system or a module executed in the operating system.

2, the server access control system includes an interface unit 31, an authentication processing unit 32, an authentication state checking unit 33, and a kernel layer of an operating system, An authentication authority management unit 34, a session management unit 35, and an access control unit 36, which are executed in the kernel.

The interface unit 31 provides the client 12 or the user's server connection interface and can be used for remote access (telent), secure shell (ssh), file transfer (ftp, sftp), remote desktop connection ) To provide a user interface.

In addition, the interface unit 31 provides an interface for providing a login interface to the user by creating and activating a login process, and accepting a user's command when login connection is completed.

In addition, the interface unit 31 executes an application program according to a user's instruction. At this time, an application process that actually executes the application program on the operating system is created.

The generated application process is authorized to the system resource in the same scope as the privilege granted to the user or within the scope of the privilege. Authentication and authorization of the application process is performed by the session management unit 35. [ As described above, the authority includes access authority to a file or authority to execute or terminate a process.

That is, the interface unit 31 creates a new process in the first interface process, and gives authentication and authorization. The process thus created can create another process. At this time, the created process and the created process are called parent and child processes, or parent and child processes.

The authentication processing unit 32 performs authentication for the user when the user logs in to the operating system server 30 or when re-authentication is required. In particular, the authentication processing unit 32 performs user authentication through the smart card.

Specifically, the authentication processing unit 32 receives the user authentication information from the client 12, transmits the received authentication information to the authentication server 50, and requests the user authentication. At this time, the user authentication information is user authentication information read from the smart card 11 inserted in the user terminal 10. [

The authentication processing unit 32 receives the authentication result from the authentication server 50 and transmits the authentication information and the corresponding authentication information to the authentication authority management unit 34 configured in the security kernel when the authentication is successful. An application process executed by the user calls a system call to the kernel layer in order to use server system resources (for example, file access or process termination). At this time, the authentication right management unit 34 installed in the security kernel of the kernel layer determines whether or not to execute the system call of the application process according to the previously determined right information.

Next, the authentication status checking unit 33 periodically checks the smart card information to update authentication and authorization status information of the secure kernel. The authentication status checking unit 33 periodically requests authentication information stored in the smart card 11 to the user terminal 10 or the client 12 according to a predetermined inspection period. Then, the authentication state checking unit 33 checks whether the authentication information received from the client 12 matches the existing authentication information. If the authentication information does not match, the authentication state checking unit 33 requests the authentication authority management unit 34 to invalidate the previously granted authentication.

Preferably, it has higher resource access rights depending on whether it has received smart card authentication or re-authentication. In addition, the information is used as an inspection target list when the authentication status checking unit 33 periodically checks the status of the smart card. For example, when an entry is created by the kdhong terminal using the smart card having the identifier 'A00001' at the IP address '192.168.100.10' and logged in to the operating system server, the authentication status checking unit 33 periodically checks the IP address '192.168.100.10' Request smart card information to the terminal and compare the smart card identifier with the existing information 'A00001'.

Next, the authentication authority management unit 34 is configured in the security kernel of the kernel layer, and manages authentication and authority state setting information for each user (or user account). The authentication and authority state setting information for each user or user account is stored and managed in the authentication authority table 41. [

The authentication authority setting information for the user or the user account includes whether or not the user is authenticated, and the scope of the user's authority. The scope of authority includes the scope of the accessible file (or scope of the directory), the type of access to the file (eg, read, write, etc.), and the scope of the process that can be terminated. Specifically, the authentication and authorization state setting information includes a process ID (login process), an authentication type (whether it is set in the login process or set by re-authentication), a smart card identifier, a user terminal address, do.

In addition, the authentication and authority state setting information is information generated for each login (or re-authentication) session. That is, the number of log-in or re-authenticated to the operating system server is generated, and when logging out, the corresponding item is deleted. In addition, the authentication and authorization state setting information is stored in the secure kernel so that it remains secure until the server system is shut down.

When the authentication and authority state (or the authentication authority setting information) is changed, the authentication authority management unit 34 transmits the changed setting information to the session management unit 35, and updates the authentication and authority information of each process according to the changed setting information Request to change.

Next, the session management unit 35 manages authentication and authority information for each process, and ends the process in which the authentication has expired. The session management unit 35 is also configured in the security kernel of the kernel layer.

When each process is created, the session management unit 35 refers to the authentication authority setting information for the user or the user account of the process from the authentication authority management unit 34, and sets the authentication authority (or authority scope) of the process to be generated do. The scope of the authentication authority of the process is set within the scope of the authorization authority set for the user account of the process. The authenticity and the authority range of the process are recorded in the process table 42.

In addition, the session management unit 35 receives the updated data of the authentication authority setting information of the user from the authentication authority management unit 34, and re-sets the authentication authority range of the process belonging to the user account according to the updated setting information.

In addition, the session management unit 35 periodically checks whether or not each authentication of the entire process or the authority range is performed. If the user account is lost, the authentication (or reauthentication) fails, the privilege range of the user account is reduced, or the authentication or reauthentication failure of the user account is updated, the session management unit 35 updates the application process of the user Stop everything.

When the application process accesses system resources (files, processes, etc.), the access control unit 36 checks the authentication and authorization status of the process and determines whether to allow or deny access to system resources. The access control unit 36 is also configured in the security kernel of the kernel layer.

An application process calls a system call to the kernel layer to use system resources such as files or processes. At this time, the access control unit 36 obtains the setting right (or the authority range) of the application process requesting the system call, and confirms whether the system call is a system call within the corresponding authority range. The setting authority of the application process reads the data recorded in the process table 42.

The access control unit 36 checks whether the access (or the requesting system resource) of the requested file or process is within the authority of the corresponding process. If the system resource is outside the privilege of the corresponding process, the system call is not processed. On the other hand, if the access request of the system resource is within the authority of the process, the system call is processed.

Next, a user authentication or re-authentication processing method according to an embodiment of the present invention will be described with reference to FIG.

As shown in FIG. 3, when the client 12 requests the operating system server 30 to log in (S11) and requests re-authentication (S12), the authentication processing unit 32 is requested to authenticate or re-authenticate. The re-authentication request is invoked by the user or client 12 executing the re-authentication command if re-authentication is required.

When the second authentication by the smart card 11 is performed, the access right to the server resource is increased. When logging in, you can perform tasks with normal privileges without receiving smart card authentication. If you are working with normal privileges and need more privileges, use reauthentication to get smart card credentials. In addition, re-authentication can be used even when the smart card authentication is performed at the login, even if authentication is once again required in the important operation.

The authentication processing unit 32 collects information from the smart card 11 inserted in the user terminal 10 and generates authentication request information (S13). Then, the authentication processing unit 32 transmits the generated authentication request information to the authentication server 50, requests authentication (S14), and receives the authentication result (S15). The authentication request information includes an authentication request type (login authentication, reauthentication), a user account (or a user ID), a smart card identifier, a user terminal address, and a server system address.

Upon receiving the authentication failure from the authentication server 50, the authentication server 50 returns a failure result (S16). Upon receiving the success, the authentication and authority information for the user account (or user) is generated (S17). Then, the generated authentication right information is transmitted to the authentication right management unit 34 of the security kernel (S18). The authentication authority information is composed of a process ID, an authentication type (login authentication, re-authentication), a smart card identifier, and a user terminal address. At this time, the process ID is the login process that performed the login process or the parent process ID of the re-authentication command.

Next, a method for periodically checking the user authentication state according to an embodiment of the present invention will be described in more detail with reference to FIG.

As shown in FIG. 4, the authentication status checking unit 33 periodically collects smart card information (smart card identifier) at predetermined time intervals, and updates authentication and authorization information of the secure kernel.

First, the authentication status checking unit 33 requests the authentication right management unit 34 of the secure kernel (S21) and receives the list (S22). The inspection target list is targeted to the user who has been authenticated by the user and has generated the authentication authority information. Therefore, the list of objects to be checked is the same as the list of authentication authority information.

The authentication status checking unit 33 extracts information about the user terminal 10 recorded in the inspection target list at step S23 and requests the client 11 of the extracted user terminal 10 to insert the inserted smart card 11 (S24).

The authentication status checking unit 33 checks whether the collected smart card identifier information is the same as the existing information. If they are the same, the authentication status checking unit 33 transmits the authentication information to the authentication authority management unit 34 (S26) If they do not match, the authentication information is requested to be invalidated (S25).

That is, the unique identifier information stored in the smart card 11 is retrieved to check whether the smart card 11 is in a state or not, and whether the smart card 11 is a smart card used for login or re-authentication is checked. To this end, the authentication status checking unit 33 previously stores the authentication information of the smart card. That is, the authentication information of the smart card is stored at the time of login (re-authentication) and compared.

The authentication by the authentication server 50 is to check whether the user has the right to access the operating system server 30 as in the normal authentication and the authentication of the authentication state checking unit 33 is performed by the smart card used at the time of login It is confirmed whether it is still validly used.

Next, a method for periodically checking the user authentication state according to an embodiment of the present invention will be described in more detail with reference to FIG. The above method is a method of managing a process according to the authentication right information in the authentication authority management unit 34 and the session management unit 35 of the secure kernel.

5, when the user or the client 12 logs into the operating system server 30 or re-authenticates the user, the authentication processing unit 32, which is executed on the application layer of the server operating system, (S31), the authentication right management unit 34 stores the authentication right information in the corresponding table 41 (S32). The authentication authority information is stored in the authentication authority information table 41, and each item is composed of a process ID, an authentication type (login authentication, re-authentication), a smart card identifier, a user terminal address, and an update time.

The newly added authentication authority information is transmitted to the session management unit 35 (S33). In addition, the authentication right information is stored in the process table 42 (S34). That is, the session management unit 35 of the secure kernel stores the added authentication right information received from the authentication right management unit 34 in the process table.

When the authentication status checking unit 33 transmits the information about the authentication validity, that is, information about the authentication check periodically judged to the authentication authority managing unit 34 of the secure kernel (S41), the authentication authority managing unit 34 transmits And updates the validity of the related authentication authority information based on the received information (S43). That is, when it is confirmed that the authentication is validated, the authentication authority table is updated.

In addition, the authentication authority information that has not been updated for a predetermined time is invalidated, and the invalidated process ID is transmitted to the session management unit 35 (S42). At this time, the session management unit 35 invalidates all the authentication right information of the process and the sub-processes.

Specifically, the session management unit 35 deletes all processes in the process table 42 including the lower process information (S44). Further, all of the authentication invalidated processes are terminated (S45), and all of the lower processes are also terminated (S46).

In other words, when the authentication authority information receives the invalidated process ID from the authentication authority management unit 34, the session management unit 35 deletes the authentication right information of the process from the process table, and the authentication right information Delete from the process table. It also terminates all processes for which authentication has been invalidated.

The authentication and authority state setting information of the authentication authority management unit 34 includes the login process ID, so that the highest-level process information of the login session can be known. In addition, when the authentication authority information is set in the process table in the session management unit 35, the top-level login process ID may be stored together to find all the processes related to the specific authentication right information. That is, by using the login process ID as a key, the related processes can be found in the authentication authority table and the process table. Through this, the session management unit 35 retrieves all the processes whose authentication has been invalidated and terminates them.

Next, an authentication authority management method in process creation according to an embodiment of the present invention will be described with reference to FIG.

As shown in FIG. 6, when a new process is created (S51), the session management unit 35 checks whether authentication right information is set in the parent process of the process (S52). If the authentication authority information is set, the session management unit 35 inherits the authentication authority information and adds it to the process table (S54).

Specifically, the session management unit 35 does not use the authentication authority table information. When the authentication authority information is set in the authentication authority management unit 34, the corresponding information is transmitted to the session management unit 35. The session management unit 35 stores the corresponding authentication authority information in the process table and then refers to the process table. The authentication credential information of each process is individually managed in the process table. That is, all the processes created by the user are managed using the process table, starting from the process created at the time of user login (the login process, the top-level process of the login session).

Next, an authentication authority control management method for a request operation of an application process according to an embodiment of the present invention will be described with reference to FIG.

7, when a user process (an application program or an application process) requests a job such as file access or process termination (S61), the access control unit 36 of the secure kernel manages And refers to the process table (S62). The session management unit 35 judges whether the authentication right information of the current process exists in the process table 42 (S63). If the authorization right information exists, the session management unit 35 permits the corresponding operation (S64). Otherwise, (S65).

The invention made by the present inventors has been described concretely with reference to the embodiments. However, it is needless to say that the present invention is not limited to the embodiments, and that various changes can be made without departing from the gist of the present invention.

10: user terminal 11: smart card
12: Client 20: Network
30: Operating system server 31: Interface unit
32: authentication processing unit 33:
34: authentication authority management unit 35: session management unit
36: access control unit 41: authentication authority table
42: Process table 50: Authentication server

Claims (8)

A system installed and operated on an operating system of an operating system server, wherein the operating system server is connected to a user terminal through which a smart card is inserted, from a user terminal to a user accessed by the user account of the operating system server, Wherein the server access control system comprises:
An interface unit for generating and activating a login process, accepting commands after login, and creating an application process;
An authentication processing unit, which is executed in an application layer of the operating system, performs authentication of the user using the authentication information stored in the smart card, and generates authentication right information of the user;
An authentication status checking unit, which is executed in an application layer of the operating system and periodically checks whether authentication information of the smart card is valid;
An authentication authority managing unit configured in the secure kernel of the operating system and receiving and storing the authentication right information of the user from the authentication processing unit;
A session management unit configured in the secure kernel of the operating system and setting authentication authorization information of the application process when the application process is generated; And
And an access control unit configured in the security kernel of the operating system and determining whether to permit the application resource by referring to the authentication right information of the application process when the application process requests system resources of the operating system,
Wherein the session management unit sets the authentication right information of the application process in the authentication right scope within the authentication right information of the user to which the application process belongs when the application process is created,
The authentication status checking unit may request the authentication information stored in the smart card, periodically check whether the authentication information received by the request matches the existing authentication information, periodically check the validity of the checked authentication information, Lt; / RTI >
The authentication authority management unit receives the periodic inspection result of the authentication state checking unit, updates the authentication right information, invalidates the authentication right information of the user that has not been updated for a predetermined period, and transmits the authentication right information of the revoked user To the session management unit,
And the session management unit terminates the processes based on the authentication right information of the invalidated user.
The method according to claim 1,
Wherein the authentication authority information includes at least one of a status of accessing a file on the operating system, an access mode of the file, a range of a file that can be accessed, and a range of processes that can be terminated. Server access control system.
The method according to claim 1,
The authentication authority management unit stores authentication authority information of users in an authentication authority table,
Wherein the session management unit stores the authentication authorization information of the process in the process table and manages it.
delete The method according to claim 1,
Wherein the session management unit inherits the authentication right information from the parent process when the application process is created, and sets the authentication right information of the application process as the authentication right information of the application process.
The method according to claim 1,
Wherein the authentication processing unit transmits the authentication information of the smart card to the authentication server, causes the authentication server to perform user authentication, and receives the authentication result from the authentication server. Access control system.
delete The method according to claim 1,
Wherein the session management unit terminates the invalidated process received from the authentication authority management unit and terminates all of the subordinate processes of the invalidated process.

Images