KR20140090279A - Service security authentication method and web application server therof - Google Patents

Abstract

A method for authenticating a service security in a web application server supporting a service based on cloud computing, the method comprising: performing a first authentication with a user terminal to upload an application program based on a first certificate; Storing an uploaded application program from the user terminal; Obtaining a unique identifier for identifying whether the user terminal is a terminal having a proper uploading authority; Performing a secondary authentication for connection to the user terminal based on the second certificate when the user terminal is determined to be a terminal having a proper uploading authority; Transmitting a token to be used for activation control of the uploaded application program to the user terminal when the secondary authentication is normally performed; And performing activation control of the uploaded application program in accordance with the received activation control message when an activation control message including the token is received from the user terminal.

Description

[0001] DESCRIPTION [0002] SERVICE SECURITY AUTHENTICATION METHOD AND WEB APPLICATION SERVER THEROF [

The present invention relates to a service security authentication method in a web application server supporting a cloud computing based service.

Cloud computing technology refers to a technology that supports virtual computing environments to store data, use application programs, and use content through servers on the Internet. Therefore, even if the application program, contents, etc. are not directly stored in a user PC or a smart phone for using a specific program or service, the user can receive various services through the cloud computing technology.

However, in recent years, some security problems have arisen in such cloud computing-based services. For example, when uploading a specific application program to a web application server that provides a cloud service, a malicious program such as a hacking program or a virus program is inserted in the program, thereby damaging the server itself as well as members using the server . In addition, it often happens that the above problem is caused by hacking the certificate of the member who receives the cloud service. Therefore, a service security authentication method with enhanced security is required in order to distinguish malicious users and to identify whether the user is a user having a right authority.

The present invention provides a service security authentication method in which service security is enhanced through cross-certification between a web application server supporting a cloud computing-based service and a user terminal, and a web application server therefor.

In addition, the present invention uses a unique identifier that can not be duplicated in order to identify the uploader of a party authority, and independently obtains a data channel for uploading an application program and a control channel for activation control of the application program, And a web application server for the service security authentication method.

According to an aspect of the present invention, there is provided a service security authentication method in a web application server supporting a service based on a cloud computing,

Performing a primary authentication with a user terminal to upload an application program based on the first certificate;

Storing an uploaded application program from the user terminal;

Obtaining a unique identifier for identifying whether the user terminal is a terminal having a proper uploading authority;

Performing a secondary authentication for connection to the user terminal based on the second certificate when the user terminal is determined to be a terminal having a proper uploading authority;

Transmitting a token to be used for activation control of the uploaded application program to the user terminal when the secondary authentication is normally performed; And

And performing activation control of the uploaded application program according to the received activation control message when an activation control message including the token is received from the user terminal.

In one embodiment, the first certificate is a certificate used by the user terminal for connection authentication to the web application server, issued by the web application server to the user terminal or allowed by the web application server,

The second certificate may be a certificate stored in the web application server and used for connection authentication of the web application server to the user terminal.

In one embodiment, performing the primary authentication comprises:

And performing a primary authentication for connecting to the server according to a connection request from the user terminal using the first certificate.

In one embodiment, the unique identifier may be a CPU (Central Processing Unit) ID of the user terminal.

In one embodiment, prior to performing the secondary authentication,

Transmitting an activation request message for requesting activation of the uploaded application program to the user terminal; And

And receiving a token request message requesting to provide the token from the user terminal that has received the activation request message.

At this time, the unique identifier may be included in the token request message.

In one embodiment, the application program is transmitted to the web application server via a data channel granted through the primary authentication,

The activation control message may be transmitted to the web application server through a control channel assigned through the secondary authentication as a separate secure channel distinguished from the data channel.

In one embodiment, the activation control message is a control message for installing the uploaded application program,

The step of performing the activation control may be the step of installing the uploaded application according to the activation control message.

According to another aspect of the present invention, there is provided a web application server supporting a service based on cloud computing,

A communication unit for performing communication with a user terminal;

A primary authentication processing unit for performing primary authentication with a user terminal to upload an application program based on the first certificate;

A determination unit for determining whether the user terminal is a terminal having a proper upload authority based on a unique identifier received from the user terminal after the first authentication is normally performed;

A secondary authentication processing unit for performing secondary authentication for connection to the user terminal based on the second certificate when the user terminal is determined as a terminal having a proper uploading authority; And

A token to be used for activation control of the uploaded application program is transmitted to the user terminal through the communication unit after the secondary authentication is normally performed and when an activation control message including the token is received from the user terminal, And a control unit for performing activation control of the uploaded application program in accordance with the received activation control message.

In one embodiment, the control unit may transmit an activation request message for requesting activation of the uploaded application program to the user terminal through the communication unit before the secondary authentication processing unit performs the secondary authentication,

When the token request message including the unique identifier is received from the user terminal that has received the activation request message, the determination unit may extract the unique identifier from the token request message and perform the determination.

In one embodiment, the application program is transmitted to the web application server via the data channel assigned by the control unit through the primary authentication,

The activation control message may be transmitted to the web application server through a control channel assigned by the control unit through the secondary authentication as a separate secure channel distinguished from the data channel.

According to another aspect of the present invention, there is provided a method for managing a service security authentication, comprising the steps of: storing one or more programs including instructions for causing a user terminal to perform a method relating to service security authentication through interworking with a web application server A computer readable storage medium,

Performing a primary authentication for a server connection based on a first certificate used for connection authentication to the web application server;

Uploading an application program selected by a user to the web application server when the primary authentication is normally performed;

Sending a token request message to the web application server requesting to provide a token to be used for activation control of the uploaded application program from the web application server; And

And transmitting to the web application server an activation control message including the token if the token has been received after the secondary authentication with the web application server based on the second certificate has been successfully performed. A medium is provided.

In one embodiment, the service security authentication method comprises:

Prior to transmitting the token request message to the web application server,

Receiving an activation request message for an activation request of the uploaded application program from the web application server,

The token request message may include a unique identifier for identifying that the user terminal has a proper uploading authority.

According to an embodiment of the present invention, a service security authentication method in which service security is enhanced through cross-certification between a web application server supporting a cloud computing-based service and a user terminal and a web application server for the same can be provided.

Further, according to an embodiment of the present invention, a unique identifier that can not be duplicated is used to identify an uploader of a party authority, and a data channel for uploading an application program and a control channel for activation control of the application program are independently The service security can be further strengthened by bringing it.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram illustrating a configuration of a web application server to which a service security authentication method according to an embodiment of the present invention is applied; FIG.
2 is a service flow diagram illustrating a service security authentication method according to an embodiment of the present invention.

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, in this specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a configuration of a web application server to which a service security authentication method according to an embodiment of the present invention is applied.

Referring to Figure 1, a first user terminal 100, a web application server 200 and a second user terminal 300 are shown. Here, the first user terminal 100 represents a terminal on the user side acting as an uploader for uploading an application program to the web application server 200, and the second user terminal 300 is a web application server 200). ≪ / RTI > Therefore, it is obvious that the first user terminal 100 and the second user terminal 300 can exist in plural, regardless of the drawings. That is, FIG. 1 is a conceptual diagram for explaining a service security authentication method according to an embodiment of the present invention, in order to facilitate convenience and concentration of the drawings and the drawings. Here, the first user terminal 100 and the second user terminal 300 may be member terminals that are members to receive the cloud computing service through the web application server 200.

1, the web application server 200 includes a communication unit 210, a certificate storage unit 220, a program storage unit 230 (FIG. 1) A control unit 240, a primary authentication processing unit 250, a secondary authentication processing unit 260, a determination unit 270, and a token providing unit 280.

However, all of the above components may not necessarily be necessary components for implementing the service security authentication method of the present invention, and the web application server 200 may be implemented including fewer components. Of course, it may be implemented with more components than this. In addition, in the web application server 200 shown in FIG. 1, each component is merely focused on each individual function. Therefore, it is needless to say that two or more components may be integrally implemented as one component, and one component may be separately implemented as a plurality of subdivided components. For this reason, if a specific configuration performs the same function as at least one configuration element in the embodiment of the present invention, regardless of the division into each configuration element and the name thereof, It should be interpreted.

A client-side program (hereinafter referred to as a client program 50) for executing the service security authentication method according to the embodiment of the present invention in relation to the web application server 200 is installed in the first user terminal 100 . The user-side client program 50 can be downloaded from a specific web page or an application store provided by the web application server 200. Of course, the client program 50 may also be downloaded from a site and application store operated by a portal site provider (not shown) or various application providers (not shown). To this end, the web application server 200, the portal site provider, the application provider, and the like may store the user-side client program in a specific storage medium (not shown).

Hereinafter, the roles and functions of the respective components constituting the web application server 200 and the functions of the client program 50 will be described together in the description of the service flow diagram shown in FIG.

FIG. 2 is a service flowchart illustrating a service security authentication method according to an embodiment of the present invention.

Referring to FIG. 2, in step S210, the primary authentication between the first user terminal 100 and the web application server 200 to upload a specific application program is performed. The primary authentication is for server authentication, and the primary certificate 12 stored in the first user terminal 100 may be used for the primary authentication.

Here, the first certificate 12 is used for authentication of connection to the web application server 200 of the first user terminal 100, and is a certificate (certificate) issued by the web application server 200 to the first user terminal 100 Or a certificate that the web application server 200 allows (e.g., using a public certificate, but having a certificate registered with the web application server 200). In this way, when the first user terminal 100 tries (requests) connection authentication to the web application server 200 using the first certificate 12, the first authentication processing unit 250 of the web application server 200 May perform the primary authentication through interworking with the client program 50 of the first user terminal 100 based on the first certificate 12.

If the primary authentication is normally performed, the first user terminal 100 transmits the application program to be uploaded to the web application server 200 in step S220. At this time, the upload of the application program may be performed through the specific data channel assigned by the control unit 240 of the web application server 200 according to the primary authentication. At this time, the uploaded application program may be stored in a specific storage space of the web application server 200 (in this embodiment, see the program storage unit 230 of FIG. 1).

When the uploading of the application program is completed, the control unit 240 of the web application server 200 transmits an activation request message for requesting the activation of the uploaded application program through the communication unit 210 To the first user terminal 100.

Accordingly, in step S240, the client program 50 of the first user terminal 100 can transmit a token request message including the unique identifier to the web application server 200. [

Here, the unique identifier is used to identify whether the corresponding user terminal has a proper upload right in the service security authentication process according to the embodiment of the present invention. For example, if it is assumed that the first certificate used in the previous first authentication process is duplicated or hacked by a malicious user, only that the first authentication has been normally performed, the user who has performed the first authentication is a legitimate user It can be difficult to confirm. Therefore, in the embodiment of the present invention, as a purpose of re-confirming whether the user who has performed the primary authentication is a party uploader again, the user terminal is further requested to have a unique identifier. Such a unique identifier may be various identifiers as long as it can identify the user terminal, but is used as an application for distinguishing a malicious user. Therefore, an identifier (for example, a CPU ID or the like) Is preferably used. In some cases, the unique identifier may be encrypted and transmitted according to a predefined encryption scheme between the user terminal and the web application server.

When the unique identifier is received in the above-described manner, the determination unit 270 of the web application server 200 determines whether the corresponding user terminal is a legitimate uploader, based on the received unique identifier. If it is determined that the user terminal is a legitimate uploader in step S250, the secondary authentication processing unit 260 of the web application server 200 notifies the client program 50 of the first user terminal 100 The second authentication is performed between the first authentication and the second authentication.

At this time, the secondary authentication is for terminal authentication, which can be performed based on the second certificate 14 stored in the certificate storage unit 220 of the web application server 200. Here, the second certificate 14 is used to authenticate the connection to the first user terminal 100 of the web application server 200, and is a separate certificate distinguished from the first certificate 12. [

As described above, in the embodiment of the present invention, the second authentication process using the second certificate 14 stored in the web application server 200 is performed again after the partial uploader is discriminated based on the unique identifier . In other words, according to the embodiment of the present invention, the uploading of the application program itself can be accomplished only by the first authentication process normally. However, if the activation of the uploaded application program is normally performed until the second authentication process This is strengthening the security of the service by limiting it to only one.

In step S260, the token providing unit 280 of the web application server 200 transmits the token to the first user terminal 100 through the communication unit 210. If the second authentication is successful, The token provided to the first user terminal 100 through this step is used for controlling the activation of the application program uploaded from the first user terminal 100 to the web application server 200, Thereafter, the service security of various control messages is determined using the token.

In addition, according to the embodiment of the present invention, after the second authentication process is completed, the message transmission / reception between the user terminal and the server is performed by a separate security (authentication) channel distinguished from the data channel provided through the first authentication process Lt; RTI ID = 0.0 > a < / RTI > predetermined control channel. As described above, in the embodiment of the present invention, by differentiating the communication channel for uploading the application program after the primary authentication and the communication channel for transmitting and receiving the control message after the secondary authentication, the service security is further enhanced I have to.

That is, according to the service security authentication method according to the embodiment of the present invention described above, even after the upload of the application program is performed through the data channel assigned in the primary authentication process, the partial uploader authentication process based on the unique identifier, The security of the entire system can be strengthened through several layers of security enhancement steps such as an activation control process through a separate secure channel provided that the second authentication process is normally performed.

Thereafter, when a predetermined activation control message including the provided token is delivered from the first user terminal 100 via the control channel, which is a separate secure channel, as in step S270, the web application server 200 may perform the activation control operation of the uploaded application program in accordance with the activation control message. For example, the control unit 240 can perform an installation operation of the uploaded application program based on the received activation control message. In this case, since the process of installing the program is performed after the second authentication process, the problem that the malicious code / hacking program has been installed / diffused can be solved by installing the uploaded program from the malicious user, not the party uploader .

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims And changes may be made without departing from the spirit and scope of the invention.

100: first user terminal
200: Web Application Server
210:
220: Certificate storing unit
230: Program storage unit
240:
250: primary authentication processing unit
260: secondary authentication processing unit
270:
280: Token Offering

Claims (14)

A service security authentication method in a web application server supporting a service based on cloud computing,
Performing a primary authentication with a user terminal to upload an application program based on the first certificate;
Storing an uploaded application program from the user terminal;
Obtaining a unique identifier for identifying whether the user terminal is a terminal having a proper uploading authority;
Performing a secondary authentication for connection to the user terminal based on the second certificate when the user terminal is determined to be a terminal having a proper uploading authority;
Transmitting a token to be used for activation control of the uploaded application program to the user terminal when the secondary authentication is normally performed; And
Performing activation control of the uploaded application program corresponding to the received activation control message when an activation control message including the token is received from the user terminal
The method comprising the steps of:
The method according to claim 1,
Wherein the first certificate is a certificate used by the user terminal to authenticate connection to the web application server and issued by the web application server to the user terminal or allowed by the web application server,
Wherein the second certificate is used for connection authentication of the web application server to the user terminal and is a certificate stored in the web application server.
The method according to claim 1,
The step of performing the primary authentication includes:
And performs a primary authentication for connection to a server according to a connection request from the user terminal using the first certificate.
The method according to claim 1,
And the unique identifier is a central processing unit (CPU) ID of the user terminal.
The method according to claim 1,
Before the step of performing the secondary authentication,
Transmitting an activation request message for requesting activation of the uploaded application program to the user terminal; And
Further comprising receiving a token request message requesting to provide the token from a user terminal that has received the activation request message,
Wherein the unique identifier is included in the token request message.
6. The method of claim 5,
Wherein the application program is transmitted to the web application server through a data channel assigned through the primary authentication,
Wherein the activation control message is transmitted to the web application server through a control channel assigned through the secondary authentication as a separate secure channel distinguished from the data channel.
The method according to claim 1,
The activation control message is a control message for installing the uploaded application program,
Wherein performing the activation control comprises installing the uploaded application according to the activation control message.
As a web application server that supports services based on cloud computing,
A communication unit for performing communication with a user terminal;
A primary authentication processing unit for performing primary authentication with a user terminal to upload an application program based on the first certificate;
A determination unit for determining whether the user terminal is a terminal having a proper upload authority based on a unique identifier received from the user terminal after the first authentication is normally performed;
A secondary authentication processing unit for performing secondary authentication for connection to the user terminal based on the second certificate when the user terminal is determined as a terminal having a proper uploading authority; And
A token to be used for activation control of the uploaded application program is transmitted to the user terminal through the communication unit after the secondary authentication is normally performed and when an activation control message including the token is received from the user terminal, A control unit for performing activation control of the uploaded application program in accordance with the received activation control message,
A web application server.
9. The method of claim 8,
Wherein the first certificate is used for authentication of connection of the user terminal to the web application server and is stored in the user terminal, and the certificate is issued to the user terminal or a certificate ego,
Wherein the second certificate is used to authenticate connection to the user terminal of the web application server and is a certificate stored in the web application server.
9. The method of claim 8,
Wherein,
Transmitting an activation request message for requesting activation of the uploaded application program to the user terminal through the communication unit before the secondary authentication processing unit performs the secondary authentication,
Wherein the determination unit extracts the unique identifier from the token request message and performs the determination when the token request message including the unique identifier is received from the user terminal that has received the activation request message.
9. The method of claim 8,
Wherein the application program is transmitted to the web application server via the data channel assigned by the control unit through the primary authentication,
Wherein the activation control message is transmitted to the web application server via a control channel assigned by the control unit through the secondary authentication as a separate secure channel distinguished from the data channel.
A computer-readable storage medium having stored thereon one or more programs that, when executed by a user terminal, include instructions for causing the user terminal to perform a method for service security authentication through interworking with a web application server, The service security authentication method,
Performing a primary authentication for a server connection based on a first certificate used for connection authentication to the web application server;
Uploading an application program selected by a user to the web application server when the primary authentication is normally performed;
Sending a token request message to the web application server requesting to provide a token to be used for activation control of the uploaded application program from the web application server; And
And transmitting to the web application server an activation control message including the token if the token has been received after the secondary authentication with the web application server based on the second certificate has been successfully performed. media.
13. The method of claim 12,
The service security authentication method includes:
Prior to transmitting the token request message to the web application server,
Receiving an activation request message for an activation request of the uploaded application program from the web application server,
Wherein the token request message includes a unique identifier for identifying that the user terminal is a terminal having a proper uploading authority.
14. The method of claim 13,
And the unique identifier is a CPU (Central Processing Unit) ID of the user terminal.

Images