KR20180034199A - Unified login method and system based on single sign on service - Google Patents

Abstract

According to the embodiment of the present invention, even though the integrated login window based on the SSO service is presented on the screen of the user terminal, after inputting the user ID so that the user can confirm whether the corresponding login window is provided by a legitimate SSO server, A confirmation number is presented on the service screen, and provides an authentication form identification technology that allows you to verify the SSO confirmation number with your mobile SSO verification app. Here, the SSO server for confirming whether the integrated login window is provided by the SSO server is provided with a login window in response to the SSO login window connection request, receives the user ID, You can pass the SSO server variable to the SSO verification server, receive the SSO server verification value generated by the SSO verification server, and display the SSO server verification value in the user login window.

Description

TECHNICAL FIELD [0001] The present invention relates to a mutual authentication method and system based on a single sign-on service,

The present invention relates to a mutual authentication method and system based on a Single Sign On (SSO) service, and more particularly, to a mutual authentication method and system based on an SSO ≪ / RTI >

A variety of SSO services are available, such as social login, where users can log into one account and use the service without joining multiple services.

If you look at the typical operation flow of an SSO service implemented with technologies such as SAML, OAuth 2.0, and OpenID Connect depending on the implementation, the SSO service is implemented as follows. That is, in the case of the SSO service, the user accesses the online service and attempts to authenticate with the integrated SSO service instead of trying to authenticate with the ID and password subscribed to the online service. In the integrated login window provided by the integrated SSO service After entering the ID and password, and when the authentication is completed, the online service that was first accessed will be available.

However, if the integrated login window of the SSO service is falsified to induce user authentication information input in order to seize the SSO service's integrated ID and password, the user regards the corresponding login window as the login window of the SSO service, Information may be deodorized. If an integrated SSO account is hijacked, the security of all the online services of that user available to the SSO service will be compromised.

In order to prevent this, we have strengthened the ability to input the secondary authentication means such as OTP after inputting the ID and password to the SSO server. However, if the ID and password input window and the OTP input window are made false, I can not stop it.

Therefore, there is a need for a new technique in which authentication information is not captured by a hacking service that masquerades as an SSO service.

When the user ID is input, the SSO service confirmation number is presented on the login form so that the user can confirm whether the login window is provided by a legitimate SSO server when the integrated login window based on the SSO service is presented to the user terminal, Provides a method and system that allows you to verify your SSO verification number on your mobile app.

In addition, the present invention provides an SSO service for using various online services by providing user authentication information for one integrated account, wherein when a user authentication information input screen is a forged screen for taking user authentication information, Provides an apparatus and a system that can explicitly confirm the authenticity of the SSO service after inputting the user ID to the integrated account.

According to an aspect of the present invention, even if the integrated login window based on the SSO service is presented on the screen of the user terminal, after inputting the user ID so that the user can confirm whether the login window is provided by a legitimate SSO server, A confirmation number is presented on the service screen, and provides an authentication form identification technology that allows you to verify the SSO confirmation number with your mobile SSO verification app.

Here, the SSO server for confirming whether the integrated login window is provided by the SSO server is provided with a login window in response to the SSO login window connection request, receives the user ID, You can pass the SSO server variable to the SSO verification server, receive the SSO service confirmation generated by the SSO verification server, and display the SSO server confirmation value in the user login window.

According to the embodiment of the present invention, when a user uses a variety of online services using an integrated account of the SSO service, the SSO service confirmation value indicating whether the corresponding SSO service is authenticated after inputting the user ID is specified in the login window It is possible to provide a secure integrated user authentication service.

FIG. 1 and FIG. 2 are diagrams showing an overall flow of an SSO check server and a mobile SSO checker (mobile app) that can confirm whether an integrated login window is provided by a true SSO server according to an embodiment of the present invention.
Figure 3 illustrates an example screen that allows an unified login window displayed on a user terminal to be driven with an SSO confirmation value.
4 illustrates a screen example of an SSO login window holding an SSO confirmation value and an execution confirmation window on a mobile SSO identifier.
5 and 6 illustrate a standard flow for operation of an Oauth2 authentication server performing SSO functions and services connected thereto.
7 to 10 are flowcharts showing an SSO check server and a mobile SSO checker having a service check function for an Oauth2 authentication server.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Also, throughout the specification, when an element is referred to as being "connected" or "connected" with another element, the element may be directly connected or directly connected to the other element, It should be understood that, unless an opposite description is present, it may be connected or connected via another element in the middle.

Also, throughout the specification, when an element is referred to as "including" an element, it is understood that the element may include other elements as well, without departing from the other elements unless specifically stated otherwise. Also, the terms "a "," module ", and the like in the description mean a unit for processing at least one function or operation, which means that it can be implemented by one or more hardware or software or a combination of hardware and software . In addition, the push ID represented in the present specification generally means a push token expressed by mobile application developers, and the push message service is a message service provided on a mobile operating system such as Google or Apple for each application.

FIG. 1 and FIG. 2 are diagrams showing an overall flow of an SSO check server and a mobile SSO checker (mobile app) that can confirm whether an integrated login window is provided by a true SSO server according to an embodiment of the present invention. FIG. 3 is a diagram illustrating an example of a screen in which an integrated login window displayed on a user terminal can be driven by an SSO confirmation value. FIG. 4 illustrates an SSO login window having an SSO confirmation value and a And a screen example of a confirmation window. Hereinafter, an embodiment of the present invention will be described in detail with reference to flowcharts of FIGS. 1 and 2, with reference to the exemplary screens of FIG. 3 and FIG.

Here, FIGS. 1 and 2 are a series of procedures executed in succession according to an embodiment of the present invention. 1 and 2, a user terminal is a computing device used by a user to access an online service, and collectively refers to various terminals such as a user's PC, a smart phone, and the like. 1 and 2, the mobile SSO authenticator includes an application program (i.e., an agent program for authentication purposes) generated for the purpose of performing service authentication and user authentication in performing an SSO-based integrated login according to an embodiment of the present invention. ). The mobile SSO authenticator may be directly installed in a user's own authentication terminal (e.g., a smart phone), but may be separately provided as a dedicated authentication terminal. Although the user terminal and the mobile SSO identifier are physically separated from each other in FIGS. 1 and 2, they are not necessarily the same. For example, if the user terminal is a smartphone and a mobile SSO authenticator is installed in the smartphone, the smartphone may be implemented in one object. However, for convenience and concentration of explanation, it is assumed that the user terminal is a PC and the mobile SSO identifier is an application installed in a user's smartphone.

1 and 2, when the user accesses the service using the terminal and selects SSO login (see S1 in FIG. 1), the online service (i.e., online service server) To the user terminal (see S2 in Fig. 1). At this time, it is obvious that various additional information such as a session value, a Redirect URI value, and an SSO Client ID value may be provided according to the SSO implementation method.

The user requests a login window access to the SSO server through the SSO login window access information through the user terminal (refer to S3 in FIG. 1), and accordingly, the SSO server provides the corresponding login window (see S4 in FIG. 3 (a) and 3 (b), the login window provided to the user by the SSO server includes an SSO service confirmation value (refer to the SSO confirmation code in FIG. 3) ), Or it can be configured to input only the SSO unified ID without a user password input form and to display the SSO service confirmation value.

Accordingly, when the user inputs the integrated ID into the SSO login window displayed on the user terminal, the ID is transmitted to the SSO server (refer to S5 in FIG. 1).

In this case, the SSO server may pass a specific variable value to the SSO confirmation server, which can generate the SSO server confirmation value associated with the corresponding ID and the SSO session, and request the SSO server confirmation value (see S6 in FIG. 1). At this time, the SSO server may transmit the unique value of the first online service server that the user terminal has sent to the SSO server to the SSO check server, generate a random value of itself, and deliver it to the SSO check server, It may pass any pre-specified eigenvalues to the SSO confirmation server, such as the session ID of the server created to provide the window. Although the case of transferring the server variable value is exemplified in S6 of FIG. 1, it goes without saying that various values other than the transmitted variable value can be used.

The SSO confirmation server can generate an SSO service confirmation value using the received ID and the SSO server variable (refer to S7 in FIG. 1), and can transmit the generated SSO service confirmation value back to the SSO server (refer to S8 in FIG. 1) ] At the same time, the SSO confirmation server can forward the generated SSO service confirmation value or the confirmation value generation variable to the mobile SSO identifier through the mobile network (see S12 in FIG. 1). In this case, it is obvious that an SSO service confirmation value can be generated according to a predetermined rule such as a private key value and a generation time associated with the ID in the SSO server variable received from the SSO server in generating the SSO service confirmation value.

The SSO server transmits the SSO service confirmation value received from the SSO confirmation server to the user terminal so that the SSO service confirmation value can be displayed in the login window displayed on the screen of the user terminal (S9 and S10 in FIG. 1, 4 (a)]. Thereafter, the SSO server waits until the user consent to the confirmation of the SSO service confirmation value is completed or periodically confirms whether the user consent has been completed (see S11 of FIG. 1).

Also, the mobile SSO checker may display the SSO service confirmation value received from the SSO confirmation server through the corresponding application screen (refer to S13 in FIG. 1), or generate the SSO confirmation value using the confirmation value generation variable received from the SSO confirmation server It can be displayed through the corresponding application screen.

At this time, according to the implementation method, the user checks whether the SSO service confirmation value displayed on the app screen of the mobile SSO checker matches the SSO service confirmation value displayed on the SSO login window in the terminal, It is obvious that you can enter the user password directly, and you can automatically log in without entering the user password through the value received from the mobile SSO verifier app.

When the user confirmation of the SSO service confirmation value is completed (see S14 in FIG. 2), the mobile SSO confirmer transmits the user confirmation value to the SSO confirmation server (see S15 in FIG. 2). At this time, it is obvious that various user authentication means such as biometric recognizer, pattern input, FIDO installed in the mobile terminal can be additionally provided from the simple confirmation button input to the user confirmation input method.

The SSO confirmation server receives the user confirmation value transmitted from the mobile SSO identifier, and verifies whether or not the received user confirmation value is a confirmation value of the corresponding user (refer to S16 in FIG. 2). At this time, the verification of the user confirmation value can be verified by using a predetermined method previously matched with the mobile terminal. When the received user confirmation value is verified, the SSO confirmation server transmits the verification result to the SSO server (see S17 in FIG. 2).

Accordingly, the SSO server receives the user confirmation result, and can transmit the user ID and the SSO service confirmation result value based on the user consent confirmation request for the SSO service confirmation (see S18 in FIG. 2). At this time, the user ID and the SSO service confirmation result value may be the same as the confirmation value according to the existing user ID and the password agreement, but it is obvious that the confirmation result value transmitted according to the implemented method may vary. When implemented using the OAuth 2.0 standard technology, the Token value for authentication of the account information according to the user ID and the password coincidence can be used as the SSO service confirmation result value (refer to FIG. 6 or FIG. 9).

The user terminal attempts to log in to the online service server using the received result value (refer to S19 in FIG. 2), and the online service server can again verify to the SSO server whether the received result value is issued from the SSO server [ See S20 and S21 in Fig. 2). After the SSO server verifies the SSO login attempt, it can transmit the result value to the online service server, and the online service server provides the service to the user terminal (refer to S22 in FIG. 2).

According to another embodiment of the present invention, an SSO server registration unit may be provided in the SSO check server so that the SSO server can be requested to generate an SSO service check value only from the SSO server registered in advance, Alternatively, it may store information that the SSO verification server issued.

Although the embodiment of the present invention has been described above with reference to FIGS. 1 and 2, the core technical features of the present invention described above may be implemented in combination with the standard OAuth 2.0 technology. 5 and 6 attached hereto illustrate the SSO service operation flow according to the standard technique. Such an SSO service according to the OAuth 2.0 technology can be implemented according to the flowcharts of FIGS. 7 to 10, when combined with the key technical features described hereinabove.

Here, the procedures of reference numerals 1 to 6 in FIG. 7 are the same as those in reference numerals 1 to 6 in FIG. 5, and the procedures from reference numeral 31 in FIG. 9 to reference numeral 42 in FIG. 5 from the reference numeral 8 to the reference numeral 19 in Fig. That is, when the SSO service according to the OAuth 2.0 technology is combined with the core technical features of the present invention, a series of procedures from the reference numeral 7 in Fig. 7 to the reference numeral 30 in Fig. 9 can be added according to the embodiment of the present invention have.

The single sign-on service based mutual authentication method according to the above-described embodiment of the present invention can be implemented as a computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the following claims And changes may be made without departing from the spirit and scope of the invention.

Claims (5)

In a mutual authentication system based on a Single Sign On (SSO) service,
An SSO confirmation server for performing an operation for confirming the authenticity of an SSO server performing an integrated login procedure for online services subscribed to the SSO service, and a mobile SSO identifier installed in the mobile device,
The SSO confirmation server,
An SSO service confirmation value for confirming the authenticity of the SSO server in response to a user's integrated login request for the online service through the access terminal, And transmits the SSO service confirmation value to the SSO server and the mobile SSO confirmer so that the SSO service confirmation value can be posted through the window and the application screen of the mobile SSO confirmer.
The method according to claim 1,
The SSO confirmation server,
Receiving an SSO server variable value input from the user from the SSO server and generating the SSO service confirmation value using the SSO server variable value in a predetermined manner according to the received SSO service ID, Mutual authentication system.
The method according to claim 1,
The SSO confirmation server,
When a user confirmation value based on a user confirmation on the SSO service confirmation value is received from the mobile SSO confirmation device, performs verification on the user confirmation value received in a predetermined manner, and when the received user confirmation value is received Wherein the SSO server is configured to send a user confirmation result to the SSO server when a valid value corresponding to the integrated ID is confirmed to be a valid value.
The method according to claim 1,
The SSO server,
And provides an integrated login window in response to the SSO login window access request through the access terminal. When the integrated ID of the user is received through the access terminal, the integration ID and the SSO server variable are transmitted to the SSO confirmation server , SSO service based mutual authentication system.
The method according to claim 1,
The SSO server,
And transmits the SSO service confirmation value to the access terminal so that the SSO service confirmation value received from the SSO confirmation server is displayed in the integrated SSO login window.

Images