KR101553482B1 - Authentication System For Password And Method - Google Patents

Abstract

An authentication system that improves security by using a random code according to an embodiment of the present invention is characterized in that the authentication system includes a random code provision device for generating a random code, Requesting a random code from the random code providing apparatus, receiving the random code from the random code providing apparatus, generating a recombination password by combining the received random code and a previously stored basic password, and using the generated recombination password And a server for performing user authentication.

Description

[0001] The present invention relates to a password authentication system,

The present invention relates to a password authentication system and method.

Generally, the user performs user authentication when connecting to the server. The user identifier (ID) and password are commonly used for user authentication.

IT managers usually need access to dozens or hundreds of servers. Therefore, IT administrators need to set a password for each server that needs access. Setting different passwords for each server is not convenient, and setting all the same passwords has a problem of poor security.

It is an object of the present invention to provide an authentication system capable of performing authentication with a different password to a plurality of servers using a single password.

It is another object of the present invention to limit connection of an associated server when a connection error occurs in one server.

To this end, an authentication system according to an embodiment of the present invention includes a random code providing device for generating a random code, a basic code storing device for storing a basic code, and a random code providing device And a server for receiving a random code from the random code providing device, generating a recombination password by combining the received random code and a previously stored basic password, and performing a user authentication using the generated recombination password .

The random code includes a position value at which a character string and a character string are to be placed, and a character string included in the random code is inserted into a position of the character string of the basic password in order to combine the basic password and the random code. .

The server transmits an authentication requestor identifier including at least one of an identifier of the first terminal or the identifier of the user and an identifier of the server to the random code providing device when requesting the random code.

The random code providing apparatus includes a memory for storing information of one or more servers, and when the random code is requested from the server, the generated random code is transmitted to the second terminal that is matched with the authentication requestor identifier and stored .

When the random code providing device is notified of the failure of the password authentication from the server, the random code providing device enters a security mode state in which a random code request including the authentication requestor identifier from the server other than the server is not generated, .

And the random code providing device transmits an identifier of a server requesting the random code when transmitting the generated random code to the second terminal.

According to an embodiment of the present invention, there is provided a password authentication method including: a first terminal requesting a connection by inputting a user ID to a server; requesting a random code from the random code providing device by the server; Generating a random code and transmitting the generated random code to the server and a second terminal stored in advance; generating a recombination secret by combining the received random code and a previously stored basic secret; The method of claim 1, further comprising: transmitting a reconfirmation password received from a user to the server; comparing the reconfirmation password generated by the server with a reconfirmation password received from the first terminal to perform user authentication; And notifying the terminal and the random code providing apparatus.

The generating of the recombination password may include inserting a character string included in the random code into a position of the character string of the basic password indicated by the position value.

If the authentication result notified by the random code providing device is an authentication failure after the step of notifying the server of the authentication result to the first terminal and the random code providing device, the random code request from the server other than the server Into a security mode state in which an error is not generated without generating a random code.

According to an embodiment of the present invention, even if a user manages only one password, different passwords are used for a plurality of servers, thereby satisfying both user convenience and security.

Even when a connection error occurs with one of the plurality of servers, there is an effect that security is improved by restricting access to other servers.

1 is a diagram for explaining a configuration of an authentication system according to an embodiment of the present invention.
2 is a diagram for explaining a configuration of a managed server according to an embodiment of the present invention.
3 is a diagram for explaining a configuration of a random code providing apparatus according to an embodiment of the present invention.
4 is a flowchart illustrating an authentication method of an authentication system according to an embodiment of the present invention.
FIG. 5 is a view for explaining the entry into the security mode of the authentication system according to the embodiment of the present invention.
FIG. 6 is a flowchart illustrating a security mode entry method of an authentication system according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The configuration of the present invention and the operation and effect thereof will be clearly understood through the following detailed description. Before describing the present invention in detail, the same components are denoted by the same reference symbols as possible even if they are displayed on different drawings. In the case where it is judged that the gist of the present invention may be blurred to a known configuration, do.

1 is a diagram for explaining a configuration of an authentication system according to an embodiment of the present invention.

Referring to FIG. 1, an authentication system may include a user terminal 10, one or more managed servers 200, and a random code providing device 300, as shown in FIG.

The user terminal 10 may include a first terminal 100 and a second terminal 400. In another embodiment of the present invention, the first terminal 100 and the second terminal may be substantially one terminal.

The first terminal 100 is a terminal used by a user to access a managed server 200 and perform tasks such as a tablet PC, a laptop, a personal computer (PC) Can be used.

The second terminal 400 is a portable terminal of a manager using the first terminal 100, and may be a smart phone, for example. The other customer terminals 100 may include a PC, a notebook PC, a tablet PC, and the like.

When the managed server 200 receives a request for connection from the first terminal 100, the managed server 200 permits or denies the connection by performing user authentication.

The managed server 200 may be connected to the first terminal 100 and the random code providing apparatus 300 through a communication network. The network can be an in-house private network. Or wireless LAN (WLAN), Wi-Fi, Bluetooth, Zigbee, or other communication networks such as 2G, 3G, 4G, WiBro, WiMax, LTE, Near Field Communication (NFC), or near-field communication network.

When the random code providing device 300 receives a request for a random code from the managed server 200, the random code providing device 300 generates a random code and transmits the generated random code to the second terminal 400 and the managed server 200, which are stored in advance. To this end, when a random code is requested from the managed server 200, the authentication requester identifier is received together with the number of the second terminal 400 stored in advance matching with the authentication requester identifier.

The managed server 200 generates a reassembly password by combining the random code received from the random code providing device 300 and the basic password, and performs the user authentication using the reassembled password.

The managed server 200 transmits the authentication result to the random code providing device 300. [

When the random code providing device 300 recognizes the authentication failure as a result of checking the authentication result received from the managed server 200, the random code providing device 300 enters the security mode state with respect to the authentication requestor identifier. When entering the security mode, the random number is not generated for the random code request including the corresponding authentication requestor identifier from the server other than the server, and is notified of the error to the stored second terminal 400 by matching with the authentication requester identifier.

With this system, even if the user sets the same basic password to a plurality of servers, it is possible to manage the connection through a different password by using a random code at each connection, which is advantageous in terms of user convenience and system security.

2 is a diagram for explaining a configuration of a managed server according to an embodiment of the present invention.

The managed server 200 may include a control unit 210, a communication unit 220, and a storage unit 230.

The control unit 210 controls the overall operation of the managed server 200. In particular, the control unit 210 performs user authentication using a random code.

The communication unit 220 transmits and receives signals required for the operation of the managed server 200. The communication unit 220 may receive a signal or information for connection request from the first terminal 100, for example. Here, the information for the connection request may include an authentication requester identifier including at least one of an identifier of the first terminal or a user identifier.

Also, the communication unit 220 may transmit a signal or information for requesting a random code to the random code providing apparatus (300 of FIG. 1).

The communication unit 220 may transmit the user authentication result performed by the control unit 210 to at least one of the first terminal 100 and the random code providing apparatus 300.

The storage unit 230 stores information received from the first terminal 100 or the random code providing apparatus 300 such as user information (user identifier, terminal identifier, basic password, etc.) or random code, The control unit 210 stores intermediate information necessary for user authentication, for example, a combination of the stored passwords, and the controller 210 can store user log information.

The storage 230 may be implemented as a physically separate storage device, e.g., a database server. In this case, the communication unit 220 may communicate with the storage unit 230 to acquire necessary data from the storage unit 230, and transmit the generated data to the storage unit 230 to store the data.

3 is a diagram for explaining a configuration of a random code providing apparatus according to an embodiment of the present invention.

3, the random code providing apparatus 300 may include a communication unit 310, a control unit 320, a memory unit 330, and a random code generating unit 340. [

The communication unit 310 transmits and receives signals necessary for the operation of the random code providing apparatus 300. The communication unit 310 may receive a signal or information requesting a random code from the managed server 200, for example. Here, the signal or information requesting the random code may include an authentication requester identifier including at least one of the identifier of the first terminal or the user, and an identifier (server identifier) of the server requesting the random code.

In addition, the communication unit 220 may transmit the generated random code to the managed server 200 and the second terminal (400 of FIG. 1) when the random code is generated.

The control unit 320 controls the overall operation of the random code providing apparatus 300. [ In particular, the control unit 320 controls the random code generation unit 230 according to a request from the managed server 200 to generate a random code.

The random code generating unit 340 generates a random code. For example, the random code may include a string and a position value at which the string is to be located. A string can contain one or more kinds of numbers, letters, and symbols.

The memory unit 330 stores the information received from the random code providing apparatus 300 and the access log of the server, and stores the transmission history of the generated random code.

Also, the memory unit 330 may include a user database, and the user database may store the user ID (and / or the first terminal identifier) and the contact information of the second terminal in association with each other.

The specific operation of each component in the configuration of the authentication system will be described later in detail with reference to FIG. 4 to FIG.

4 is a flowchart illustrating an authentication method of an authentication system according to an embodiment of the present invention.

Referring to FIG. 4, the first terminal 100 requests a connection by inputting a user ID to any server 200 that wants to connect among a plurality of managed servers.

When the server 200 receives a connection request from the first terminal 100, the server 200 transmits the received user identifier (or first terminal identifier) and its server identifier to the random code providing apparatus 300, do.

When the random code providing apparatus 300 receives the user identifier (or first terminal identifier) from the server 200 and the server identifier of the server 200, the random code providing apparatus 300 stores the random number as a connection log (S30), and generates a random code according to the request S40). The access log can be used by the system administrator for future security checks.

The random code providing apparatus 300 transmits the generated random code to the server 200 and the second terminal (S50). In an embodiment of the present invention, information on the second terminal is previously stored in the random code providing device 300, but in another modification, the random code may be received from the server 200 when the random code is requested.

When the server 200 receives the random code from the random code providing apparatus 300, the server 200 generates a reassembled password (hereinafter referred to as a reassembly password) in combination with the previously stored basic password (S60).

For example, the random code may be a string consisting of a combination of one or more letters, numbers, and symbols, and the string may further include a position value of a string to be arranged on the basic password. For example, if the default password is "Aserver4 @" and the random code is (KW #, 4), the string of random code is "KW #" and the position value is 4, Subsequently, the string "KW #" is included. The generated recombination password is AserKw # ver4 @ ".

The user also confirms the random code received in the second terminal 400, generates a recombination password by recombining with the basic password, and inputs the generated recombination password through the first terminal 100 (S70).

The first terminal 100 transmits the reconfirmation password received from the user to the server 200 (S80).

In step S90, the server 100 performs user authentication based on whether the reassembly password generated in step S60 and the reassembly password received in step S80 match each other.

The server 100 may notify at least one of the first terminal 100 and the random code providing apparatus 300 of the authentication result of performing the authentication (S100).

If the authentication result indicates that the authentication is successful, the user can access the managed server 200 through the first terminal 100 and perform an operation.

In case of authentication failure, it may enter a security mode for temporarily prohibiting the connection of the user who made the connection request and the other server through the first terminal 100.

The entry into the security mode will be described later in detail with reference to FIGS. 5 and 6. FIG.

FIG. 5 is a view for explaining the entry into the security mode of the authentication system according to the embodiment of the present invention.

 First, when the user authentication is failed in the A-server 201 receiving the connection request by the first terminal 100, the A-server 201 authenticates the first terminal 100 and the random code providing device 300 (S1). ≪ / RTI >

The random code providing apparatus 300 notified of the authentication failure enters the security mode for the authentication requester identifier (S2).

In the security mode, even if a random code is requested for the authentication requestor identifier from the servers 202, 203, 304,... Other than the A server 201, error processing is performed without generating a random code.

Therefore, when the random code providing device 300 receives a random code from the D server 204 (S3), the D server 204 and / or the second terminal 400 does not generate a random code, (S4).

FIG. 6 is a flowchart illustrating a security mode entry method of an authentication system according to an embodiment of the present invention.

The random code providing apparatus 300 receives a signal or information indicating that the user authentication has failed with respect to the authentication requester identifier from the A server 201 (S110). At this time, the identifier of the A server can be received together.

The random code providing device 300 enters the security mode for the authentication requester identifier (S120).

When the random code providing apparatus 300 requests to generate a random code from an arbitrary server after entering the security board (S130), the random code providing apparatus 300 determines whether the server requesting the random code generation is an A server (S140). When requesting generation of a random code, an identifier of a requesting server is transmitted together, so that a server requesting generation of a random code can be identified.

If the server requesting the generation of the random code is the A server, the random code may be generated to perform the user authentication. In another modification, it is also possible to perform one step higher security authentication according to the pre-stored flow, for example, user authentication through authorized authentication.

If the server requesting the generation of the random code is not the A server, the server notifying the random code is notified to the second terminal stored matching the authentication request identifier with the server requesting the random code.

At this point, it will be appreciated that the combinations of blocks and flowchart illustrations in the process flow diagrams may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, so that those instructions, which are executed through a processor of a computer or other programmable data processing apparatus, Thereby creating means for performing functions. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory The instructions stored in the block diagram (s) are also capable of producing manufacturing items containing instruction means for performing the functions described in the flowchart block (s). Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible for the instructions to perform the processing equipment to provide steps for executing the functions described in the flowchart block (s).

In addition, each block may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative implementations, the functions mentioned in the blocks may occur out of order. For example, two blocks shown in succession may actually be executed substantially concurrently, or the blocks may sometimes be performed in reverse order according to the corresponding function.

Herein, the term " part " used in the present embodiment means a hardware component such as software or an FPGA or an ASIC, and 'part' performs certain roles. However, 'part' is not meant to be limited to software or hardware. &Quot; to " may be configured to reside on an addressable storage medium and may be configured to play one or more processors. Thus, by way of example, 'parts' may refer to components such as software components, object-oriented software components, class components and task components, and processes, functions, , Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. The functions provided within the components and components may be further combined with a smaller number of components and components, or further components and components. In addition, the components and components may be implemented to play back one or more CPUs in a device or a secure multimedia card.

It will be understood by those skilled in the art that the present specification may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. The scope of the present specification is defined by the appended claims rather than the foregoing detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents are included in the scope of the present specification Should be interpreted.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It is not intended to limit the scope of the specification. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

10: User terminal
200: Managed Server
300: random code providing device
310:
320:
330: memory unit
340: random code generation unit

Claims (9)

A random code provision device for generating a random code;
A random code is received from the random code providing device, and the received random code is combined with a previously stored basic secret code. A server that generates a reassembly password and performs user authentication using the generated reassembly password
Lt; / RTI >
When the random code providing device is notified of the failure of the password authentication from the server, the random code providing device enters a security mode state in which a random code request including an authentication requestor identifier from a server other than the server is not generated, Password authentication system that features. The method of claim 1, wherein the random code includes a position value at which a character string and a character string are to be positioned,
Wherein a string included in the random code is inserted into a position of the string of basic passwords in order to combine the basic password and the random code. The random code generation apparatus according to claim 1, wherein the server transmits an authentication requestor identifier including at least one of an identifier of a first terminal or a user identifier and a server identifier to the random code providing apparatus when the random code is requested Password authentication system. 4. The method of claim 3, wherein the random code providing device comprises a memory for storing information of one or more servers, and when receiving a random code from the server, the generated random code is matched with the authentication requester identifier, And transmits the password. delete 5. The system of claim 4, wherein the random code providing device transmits an identifier of a server requesting the random code when transmitting the generated random code to the second terminal. The first terminal inputs a user ID to the server to request a connection;
The server requesting a random code from a random code providing device;
Generating a random code by the random code providing device and transmitting the generated random code to the server and the pre-stored second terminal;
Generating a recombination secret by combining the received random code and a previously stored basic secret;
Transmitting, by the first terminal, the reconfirmation password received from the user to the server;
Performing a user authentication by comparing the generated reassembly password with the reconfirmation password received from the first terminal;
The server notifying the authentication result to the first terminal and the random code providing device; And
If the authentication result notified from the random code providing device is an authentication failure, entering a security mode state for notifying a random code request from a server other than the server without generating a random code,
. 8. The method of claim 7,
Wherein the random code includes a position value at which a character string and a character string are to be positioned,
Wherein the generating the recombination secret key comprises:
And inserting the character string included in the random code into a position of the character string of the basic password indicated by the position value.




delete

Images