KR20020083551A - Development and Operation Method of Multiagent Based Multipass User Authentication Systems - Google Patents

Abstract

The present invention relates to a development and operation method of a multi-level user authentication system. In the prior art, user authentication is mostly performed using a password authentication method and is performed in a single process, and a password encryption process is also dependent on a server. There is a problem that there is a risk of exposing a user ID or password when connecting. In order to solve this problem, the present invention provides a user authentication agent on a server and a client to perform a user authentication process. Automatically install the client user authentication agent by automatically plugging in the server at the first user registration. When the user requests authentication, the user ID and password are encrypted using the client agent and the cipher text is transmitted to the server through the network. The server performs a user authentication process of determining whether a user accesses the received encryption ID and password of the user through the authentication process of the server user authentication agent. At this time, the authentication process is not performed in a single step but in multiple steps. The ID and password, which are user authentication information, are also encrypted and stored. It encrypts the file name that stores the user authentication information and stores it in an arbitrary place.Also, multiple passwords can be registered and used by the user, and the password name and password are dualized and stored as two files and used for user authentication. It's a multi-level user authentication system.

Description

Development and Operation Method of Multiagent Based Multipass User Authentication Systems

The present invention performs encryption and authentication using an authentication agent in a user authentication system, and also performs an authentication method in a single step to a multi-step method. After registering a plurality of user passwords, the server authentication agent receives a password arbitrarily requested. Perform authentication. In addition, the purpose of the development and operation of a multi-level user authentication system that can fundamentally block the problem of password exposure on the network by transmitting the encrypted cipher text from the client authentication agent to the server through the network.

Therefore, the present invention relates to a user authentication method and operation process, and to the development and operation of an authentication system. In particular, the present invention must go through a user authentication process when attempting to perform an arbitrary operation by remotely accessing a server using an information and communication network. The multi-step user authentication system development and operation by implementing a technology that can ensure a stronger authentication by performing the user authentication process in a multi-step through the authentication agent.

Recently, with the rapid spread of the Internet, all business and commerce are also under the Internet-based information and communication network. Therefore, the development of computer and information communication technology has been developed and settled as an infrastructure that forms the knowledge and information society.

As a user authentication method of various servers, an authentication method using ID and password is basically used. It is a technique that allows access by storing the password information corresponding to the user ID in the encrypted state in the server and encrypting the password of the user attempting to connect to the stored value. In this case, it is simple to implement and use, but the user password is simply encoded in plain text and transmitted to the server, which is vulnerable to a replay attack, and the server has a burden of managing user ID and password information.

In addition, most web browser users access the Internet server, that is, the general web server or the ftp server, without revealing their identity, but there is no way to verify the user's identity on the server. Due to the anonymity of the web, it is not easy to implement proper access control for the server, and confidentiality cannot be expected because messages are transmitted in plain text on the network. Therefore, the browser user cannot know even when attacked by an illegal attacker. In this reality, the basic password authentication method is a serious problem in security because the following problems exist.

First, the security strength is low with one password authentication.

Second, passwords can be exposed by hacking methods such as password interception using packet filtering techniques.

Third, the password transmitted from the client to the server is plain text, and there is a risk of exposure on the network.

Fourth, password management methods are exposed and individual management is burdened.

In order to solve the above problems, the present invention solves the following technical problems with respect to the user authentication method, authentication system development and operation between the server and the client connected on the network.

First, the server and the client have an agent for user authentication to perform the authentication process.

Second, by automating the installation of the authentication agent of the client, the client agent that was initially present on the server is automatically plugged in upon initial user registration and automatically installed on the client.

Third, in performing user authentication, the security strength can be enhanced by adopting a multi-level authentication method rather than a single authentication method.

Fourth, the user registers a keyword, which is a plurality of password names, to use one password for the user ID as an authentication password.

Fifth, although the storage location of the password file stored in the server is exposed, in the present invention, the registered authentication information file name is also encrypted and stored in an arbitrary place to secure confidentiality.

Sixth, the problem of password exposure can be fundamentally solved by transmitting the user ID or the registered password name and the corresponding password by the client agent to the server.

1 is a block diagram of a multi-agent-based multi-user authentication system of the present invention.

2 is a partial configuration diagram of a user authentication system of the present invention.

3 is an overall flowchart of the user authentication system of the present invention.

* Description of the main parts of the drawings

100: client (PC) 101: client agent

102: encryption module (Encoder) 103: decryption module (Decoder)

200: server (workstation or mainframe) 201: server agent

203: Decoder module 204: Random generator

300: database 301: password name (keyword) file

302: password file

11,21,22,33: Plain text information 12,32,112,222,232: Password information

-N: New registration mode -U: User mode -M: Administrator mode

-i: ID information-k: Keyword information-p: Password information

The multi-stage user authentication system configuration of the present invention is shown in FIG. 1, and the client and server are connected by a network. Client agent consists of client, server agent consists of server and authentication DB. Client agent consists of Encoder module and Decoder module. Server agent consists of Decoder module and Random Generator module. It consists of. The authentication DB storing the authentication information includes a password name file and a password file.

Looking at each function in the system configuration as described above, the client agent and the server agent performs the authentication operation through mutual communication, and decrypts the encrypted password name transmitted from the server and the encryption module for encrypting ID and password in the client agent There is a decryption module. An encrypted packet is transmitted to a packet transmitted on a network, and a function of a server includes a decryption module that decrypts an administrator ID for generating and managing an authentication DB required for user authentication and authentication. In addition, there is a random number generator module for generating an index required for retrieving a password and a keyword that is an arbitrary password name. In the authentication DB, there are two encrypted files, a password name file storing authentication information required for user authentication and a corresponding password file. The encryption and decryption module uses a self-developed Secure Revolution Key (SRK) algorithm.

When described in detail with reference to the accompanying drawings the operation of the present invention as follows.

1 shows the flow of components and information in the system configuration diagram of the present invention. 100 is a client, 101 is a client agent, 102 is an encryption module, 103 is a decryption module, 11 is plain text ID or password information input by a user, 12 is encrypted ID and password information, and 32 is encryption from a server. Password name information, and 31, is password name information decrypted in plain text. 200 denotes a server, 201 denotes a server agent, 203 denotes a decryption module, and 204 denotes a random number generator module, 21 denotes index information for the decrypted user ID, and 22 denotes random information index information based on 21 requests. 300 is an authentication DB, 301 is a keyword encrypted file which is a password name, and 302 is an encrypted password information file.

2 illustrates a flow of information according to a specific operation of the client 100. When the user inputs the ID 11i, the encryption module 102 operates to generate an encrypted ID 12i as a result of the agent ( 101). This packetizes 112 on the network and sends it to the server 200. The agent 101 receives the packet 232 transmitted from the server through the network, transmits the password name 32k to the decryption module 103, and decrypts 103 to transmit the password name 31k of the plain text to 101. Display on the screen. When the user inputs the plain text password 11p corresponding to the password name, 101 transmits the data to 102 and generates an encrypted password 12p and transmits the encrypted packet 112 to the server 200 through the network again. . In the case of a newly registered user, the encryption module 102 encrypts the ID 11i, the password name 11k, and the password 11p in the plain text format to encrypt the encrypted ID 12i, name 12k, and password 12p. When transmitted to the agent 101, the encrypted packet 112 is transmitted to the server 200 through the network.

3 illustrates a flow of information according to a specific operation of the server 200, and the packet 112 transmitted from the client 100 decodes the user ID 12i by the agent 201. Decoded and processed by 203, the user index 21i is transmitted to the agent 201, and then transmitted to the random number generation module 204 to generate the random number index 22 as a storage location. 201 receives and transmits the password index 222p, which is the search index, to the authentication DB 300, and transmits the corresponding password value 232p to the agent 201 again. Perform the process. If the packet 112 transmitted from the client is a packet requiring a password name, the agent 201 decrypts the user ID 12i by the decryption module 203 and processes the agent index 20i. When transmitting to the random number generating module 204 is transmitted again to generate a random number index 22 as a storage location. 201 receives a password name index 222k, which is a search index, is transmitted to the authentication DB 300, and transmits the corresponding password name value 232k to the agent 201 again. Send to 100. In the case of a newly registered user, the search index 21i, which is the location where the ID 12i is extracted and stored from the encrypted packet 112, is generated and the remaining password names 12k and passwords 12p are transmitted in the order in which they have been transmitted. It is processed into encrypted information (222k) and stored in each file to complete the registration.

[Figure 4] is a flow diagram of the system-wide information flow functional center [Figure 1] in the block diagram format. [Figure 5] is a flow chart of the new registration process (100N), and [FIG. 6] is divided into a user authentication process (100U) and administrator work process (100M) is represented in detail in the flow chart of the information flow function-oriented . Here, information correction work 100C is also expressed at the lower right.

The effects of the present invention as described above are as follows.

First, it can reduce the load on the server by allowing the client agent to perform encryption.

Second, it is possible to automate the installation of the client agent by performing the plug-in function.

Third, the security level can be increased by multiplying the authentication stage.

Fourth, the name of the authentication password is arbitrarily set by the user and registered with the corresponding password, thereby eliminating the burden of password management of the user.

Fifth, by storing the file name of the authentication information file stored in the server as an encrypted file name and storing the storage location in any place, it is possible to block the leakage of authentication information due to server intrusion.

Sixth, the message transmitted on the network at the time of authentication is encrypted by the client agent, thereby blocking the exposure of ID and password.

Seventh, it is possible to reduce the burden on the security management of the authentication information of the administrator because all information about authentication is encrypted and automatically managed.

Claims (3)

Developing a user authentication system based on an agent; putting an authentication agent separately on a client and a server; Includes a decryption function as a module in the agent; the server does not perform encryption but merely performs authentication, new registration, user information modification, etc., and places a random number generator in the server authentication agent; The authentication system is not performed in a single step, but in any multi-step authentication method; and the technology of communicating with each other through a network in encrypted packets; and an authentication system and an operation method related thereto. The method of claim 1, wherein a user required for multi-level authentication registers a password name at the time of new registration arbitrarily and the agent arbitrarily requests and authenticates the password; Dualization with different password name files and password files in the authentication DB; encrypting and storing file contents and file names; and storing and storing arbitrary storage places automatically by the agent instead of storing them in a fixed place. Methodology, and the development and operation of certification systems. The method according to claim 1, wherein the client encrypts the user ID and password packet to the server instead of transmitting the plain text user ID and password when the packet is transmitted through the network. Automatic installation on client using plug-in function; and authentication system development technology and operation method accordingly.