WO2021080110A1 - System and method for managing and identifying affiliation of terminal in cloud environment - Google Patents

Abstract

The present invention relates to a system and method for managing and identifying the affiliation of a terminal in a cloud environment. A system according to an embodiment of the present invention is a system in a cloud environment, and includes: a terminal connected to a server; and the server which sets the affiliation of the terminal by using information received from the terminal, and manages the terminal by using the set affiliation. In a first case, in which the terminal recognizes the affiliation information of the terminal from information stored in the terminal, uses the recognized affiliation information to generate a hash of a certain size as an affiliation identifier, and transmits the generated affiliation identifier to the server, the server sets the affiliation of the terminal by using the affiliation identifier received from the terminal.

Description

System and method for identification and management of a device's affiliation in a cloud environment

The present invention relates to a system and method for identifying and managing affiliation of a terminal in a cloud environment, and more particularly, identification of affiliation of a terminal and software installed in the terminal in a cloud environment, and a terminal whose affiliation is identified, and It relates to a system and method capable of managing software by division.

In a cloud environment, a server (or set of servers) supports terminals of various organizations, companies, or departments. At this time, when the terminal is newly set up (registered), it is necessary to identify the affiliation and accurately set the identifier for the belonging of the terminal.

In the conventional method of identifying affiliation (hereinafter, referred to as “conventional technology”), an administrator or a terminal user directly inputs affiliation information from the terminal and transmits it to the server, and approves the affiliation information received from the server or sets it to an unspecified group. This is a manual method in which the administrator reassigns the affiliation after the operation.

However, in the case of such a conventional technology, it is a manual method that requires direct intervention of a user and an administrator every time a device belongs to a terminal. Therefore, in the case of using the conventional technique of such a manual method, it takes a lot of time and causes inconvenience in setting up a terminal belonging, and there is a problem in that a terminal belonging configuration error, such as an incorrect affiliation is set, may often occur.

In order to solve the problems of the prior art as described above, the present invention enables identification of the affiliation of a terminal connecting to and communicating with a server in a cloud environment and software installed in the terminal, and Its purpose is to provide a system and method that can be managed by division.

However, the problem to be solved by the present invention is not limited to the problems mentioned above, and other problems that are not mentioned can be clearly understood by those of ordinary skill in the art from the following description. There will be.

The system according to an embodiment of the present invention for solving the above problems includes (1) a terminal accessing a server, and (2) setting the affiliation of the terminal using information received from the terminal, and determining the set affiliation. It is a system of a cloud environment each including a server that manages a terminal by performing license management, software update management, policy management, or security management for each of its affiliates.

The terminal knows the terminal's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, it grasps the affiliation information from it, and uses the identified affiliation information to belong to a hash of a certain size. It is generated as an identifier, but when the belonging information is composed of a plurality of layers, the belonging identifier is determined by selecting at least two layers and selecting to include the lowest layer, combining the belonging information of the selected layers, and processing the combination information with a hash function. Can be generated.

In the first case in which the terminal transmits the generated belonging identifier to the server, the server may set the belonging of the terminal using the belonging identifier received from the terminal.

The affiliation information may include a first layer, which is information related to an organization or company, and a second layer, which is information related to a team, department, or group.

In the second case, in which the server stores corresponding information including the belonging identifier and the belonging information matched thereto in the first case, if the belonging identifier received from the terminal corresponds to the belonging identifier of the corresponding information, the corresponding information belongs. The affiliation of the terminal can be set using the information.

In the first case, in the third case, in which the terminal transmits its own belonging information in addition to the belonging identifier, if the format of the belonging identifier received from the terminal conforms to a predetermined format, the terminal uses the belonging information received together. You can set the affiliation of.

In the first case, in the fourth case, in which the terminal transmits its own private IP address and public IP address in addition to the belonging identifier, if the format of the belonging identifier received from the terminal conforms to the predetermined format, the received private IP address together. The affiliation of the terminal can be set using the IP address and public IP address.

Unlike the first case, the server uses the received private IP address and public IP address in the fifth case in which the terminal fails to grasp its belonging information and transmits its own private IP address and public IP address instead of the belonging identifier. You can use this to set the affiliation of the terminal.

The server may select a terminal belonging setting method in any one of the second to fifth cases according to the security level.

The fifth case may be applied with a lower level of security than the second to fourth cases.

The server may store the terminal's belonging identifier to be displayed in the form of a string of m base numbers (where m is a multiple of 4) separated by a delimiter.

The terminal according to an embodiment of the present invention connects to a server and transmits information, so that the server sets its own affiliation and uses the set affiliation to perform license management, software update management, policy management, or security management for each affiliation. As a terminal in a cloud environment that allows the terminal to manage itself by performing (1) a storage unit that stores information, (2) the information stored in the storage unit identifies the terminal's own affiliation information, but provides authentication information of the installed software or When there is additional information, the affiliation information is identified from it, and a hash of a certain size is generated as an affiliation identifier using the identified affiliation information.If the affiliation information consists of multiple layers, select at least two layers and be sure to be the lowest. It includes a control unit that selects to include a layer, combines belonging information of the selected layers, processes the combination information with a hash function to generate a belonging identifier, and controls to transmit the generated belonging identifier to the server, wherein the belonging information is the organization Or a first layer, which is information related to a company, and a second layer, which is information related to a team, department, or group.

The server according to an embodiment of the present invention sets the affiliation of the terminal using information received from the terminal accessing it, and license management, software update management, policy management, or security management for each affiliation using the set affiliation. As a server in a cloud environment that manages the terminal by performing (1) a communication unit that communicates with the terminal, (2) a control unit that controls to set the affiliation of the terminal by using the identification when a belonging identifier is received by the communication unit, and the The terminal knows about the terminal's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, it grasps the affiliation information from it, and uses the identified affiliation information to obtain a hash of a certain size as a member identifier. However, if the belonging information consists of multiple layers, select at least two layers and select to include the lowest layer, combine the belonging information of the selected layers, and process the combination information with a hash function to create a belonging identifier. The affiliation information includes a first layer, which is information related to an organization or company, and a second layer, which is information related to a team, department, or group.

A method according to an embodiment of the present invention is a method for identifying and managing affiliation of a terminal in a cloud environment of a terminal and a server, comprising: (1) a transmission step in which the terminal accesses the server and transmits information, (2) the server The configuration step of setting the affiliation of the terminal using the information received from the server, (3) management of managing the terminal by performing license management, software update management, policy management, or security management for each affiliation using the affiliation in which the server is set. Includes steps.

In the transmitting step, the terminal identifies the terminal's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, the affiliation information is identified therefrom, and a certain size of the affiliation information is used. A hash is generated as a membership identifier, but if the membership information is composed of a plurality of layers, selecting at least two layers and selecting to include the lowest layer, combining the membership information of the selected layers, and processing the combination information with a hash function. Generating a belonging identifier, and transmitting the generated belonging identifier to the server may be included.

The setting step may include the step of setting the affiliation of the terminal by the server using the belonging identifier received from the terminal.

The affiliation information may include a first layer, which is information related to an organization or company, and a second layer, which is information related to a team, department, or group.

In the setting step, in the second case, in which the server stores corresponding information including a belonging identifier and affiliation information matched thereto in the first case, if the affiliation identifier received from the terminal corresponds to the affiliation identifier of the corresponding information, the corresponding response It may include the step of setting the affiliation of the terminal by using the belonging information of the information.

In the setting step, in the third case, in which the server transmits its own belonging information in addition to the belonging identifier in the first case, if the format of the belonging identifier received from the terminal conforms to the predetermined format, the received belonging information is stored together. It may include the step of setting the affiliation of the terminal by using.

In the setting step, in the fourth case, in which the server transmits its own private IP address and public IP address in addition to the belonging identifier in the first case, if the format of the belonging identifier received from the terminal conforms to the predetermined format, It may include the step of setting the belonging of the terminal using the received private IP address and public IP address.

Unlike in the first case, in the setting step, in the fifth case in which the terminal fails to grasp its affiliation information and transmits its own private IP address and public IP address instead of the affiliation identifier, the received private IP address and public IP address are performed in the setting step. It may include the step of setting the affiliation of the terminal using the IP address.

The setting step may include a step in which the server can select a terminal belonging setting method from the second case to the fifth case according to the security level, and the fifth case is more than the second case to the fourth case. It can be applied with a lower level of security.

The setting step may include storing, by the server, the belonging identifier of the terminal to be displayed in the form of a string of m base numbers (where m is a multiple of 4) separated by a delimiter.

The present invention configured as described above has the advantage of being able to identify affiliation of a terminal that connects to a server and communicates with a server in a cloud environment and the software installed in the terminal, and manages the terminal and software with which the affiliation is identified by division. .

In addition, the present invention eliminates the need for direct intervention of users and administrators each time a terminal affiliation is set, thus increasing the convenience of the terminal affiliation setting, reducing the time required for the terminal affiliation setting, and preventing an error in the terminal affiliation setting. There is an advantage to be able to.

In addition, according to the present invention, as various types of terminal transmission information and a method of setting a server according thereto are proposed, there is an advantage in that the belonging of the terminal can be set by reflecting various security levels.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those of ordinary skill in the art from the following description. will be.

1 shows a configuration diagram of a system 100 according to an embodiment of the present invention.

2 shows a block diagram of the terminal 10.

3 shows a block diagram of the server 20.

4 is a flowchart of a method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention.

5 shows an example of a process of a method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention.

[Explanation of code]

10: terminal 20: server

11, 21: input unit 12, 22: storage unit

13, 23: communication unit 14, 24: display unit

15, 25: control unit 100: system

The above objects and means of the present invention and effects thereof will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, those of ordinary skill in the technical field to which the present invention pertains to facilitate the technical idea of the present invention. I will be able to do it. In addition, in describing the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted.

Unless otherwise defined, all terms used in the present specification may be used with meanings that can be commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not interpreted ideally or excessively unless explicitly defined specifically.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 shows a configuration diagram of a system 100 according to an embodiment of the present invention.

The system 100 (hereinafter referred to as “this system”) according to an embodiment of the present invention is a system in a cloud environment, and includes a terminal 10 and a server 20, as shown in FIG. 1, It is a system that enables identification and management of the affiliation of the terminal 10. However, the terminal 10 or the server 20 may be plural.

In this case, affiliation may collectively refer to one independent organization or company, or a team, department, or group belonging to it. In general, one terminal 10 may belong to only one organization or company, but in the case of a team, group, or department having a characteristic of a hierarchical structure, one terminal 10 It may belong to the target you belong to.

In particular, in a cloud environment, the server 20 may support multiple organizations, companies, teams, groups, or departments. Therefore, when the terminal 10 is newly registered, it must be possible to identify affiliation and accurately register the belonging identifier of the terminal 10, and the system 100 can perform this function.

Specifically, the terminal 10 is an electronic device that connects to the server 20 and communicates, and is an electronic device belonging to a certain affiliation. In this case, the terminal 10 may be an electronic device that requires membership setting (registration) through identification of its belonging in the server 20, or may be an electronic device in which the membership setting has already been made in the server 20. Hereinafter, when referred to as “terminal 10”, it is assumed that the server 20 has not yet set up affiliation, and when referred to as “registered terminal 10”, it is assumed that affiliation setting has been made at the server 20. Do it.

For example, the terminal 10 is a desktop PC (desktop personal computer), a laptop PC (laptop personal computer), a tablet PC (tablet personal computer), a netbook computer (netbook computer), a workstation (workstation), PDA (personal digital computer). assistant), a smartphone, a smartpad, a mobile phone, or an Internet of Things (IoT) device, but is not limited thereto.

The terminal 10 communicates with the server 20 to transmit and receive various types of information. In general, during communication, the terminal 10 transmits its own hardware-related unique identifier (eg, MAC address, etc.), a public IP address, and the like to the server 20. In addition, the terminal 10 may transmit information that enables the server 20 to identify a member of the terminal 10 itself, that is, an affiliation identifier or a private IP address, to the server 20.

2 shows a block diagram of the terminal 10.

The terminal 10 may include an input unit 11, a storage unit 12, a communication unit 13, a display unit 14, a control unit 15, and the like, as shown in FIG. 2.

The input unit 11 is a component that receives various types of information. That is, the input unit 11 generates input data in response to a user's input. The input unit 11 may include at least one input means.

The storage unit 12 is a component that stores various types of information. That is, various types of information necessary for the operation of the terminal 10 (that is, a hardware-related unique identifier of the terminal 10, a public IP address, affiliation information, an affiliation identifier, a private IP address, etc.), software, and the like may be stored.

The communication unit 13 is a component that communicates with the server 20 and the like. In particular, the communication unit 13 transmits information (such as belonging identifier or private IP address) that enables identification of affiliation of the terminal 10 itself, in addition to its own hardware-related unique identifier, public IP address, etc. I can. In addition, the communication unit 13 may receive a request for its own current state information from the server 20 and transmit information on the corresponding current state to the server 20. In addition, the communication unit 13 may receive management information according to affiliation of the terminal 10 from the server 20. In this case, the communication unit 13 may include a wired/wireless communication module of various communication methods.

The display unit 14 is a component that displays display data according to the operation of the terminal 10. In addition, the display unit 14 may be combined with the input unit 11 to be implemented as a touch screen or the like.

The control unit 15 is a component that controls the input unit 11, the storage unit 12, the communication unit 13, the display unit 14, and the like. In particular, the control unit 15 collects/generates various information (such as belonging identifier or private IP address) for identification of its belonging, and transmits it to the server 20 together with its own hardware-related unique identifier and public IP address. Control to do it. This function may be performed through software installed in the storage unit 12.

The server 20 establishes (registers) affiliation of the terminal 10 by using the information received from the terminal 10. Thereafter, the server 20 may manage the registered terminal 10 for each of its affiliations by using the set belonging information.

3 shows a block diagram of the server 20.

The server 20 may include an input unit 21, a storage unit 22, a communication unit 23, a display unit 24, a control unit 25, and the like, as shown in FIG. 3.

The input unit 21 is a component that receives various types of information. That is, the input unit 21 generates input data in response to the input of the server manager. The input unit 21 may include at least one input means. The storage unit 22 is a component that stores various types of information. That is, various types of information necessary for the operation of the server 20 (ie, a hardware-related unique identifier of the terminal 10, a public IP address, affiliation information, a membership identifier, a private IP address, etc.), software, and the like may be stored. This information may be information received by the terminal 10.

The communication unit 23 is a component that communicates with the terminal 10 and the like. In particular, the communication unit 23, in addition to the hardware-related unique identifier of the terminal 10 from the terminal 10, a public IP address, etc., information that enables identification of affiliation for the terminal 10 itself (affiliation identifier or private IP address, etc.) ) Can be received. In addition, the communication unit 23 may request the current state information of the terminal 10 and receive the corresponding current state information. In addition, the communication unit 23 may transmit management information according to affiliation of the terminal 10 to the terminal 10. In this case, the communication unit 23 may include wired/wireless communication modules of various communication methods.

The display unit 24 is a component that displays display data according to the operation of the server 20. In addition, the display unit 24 may be combined with the input unit 21 to be implemented as a touch screen or the like.

The control unit 25 is a component that controls the input unit 21, the storage unit 22, the communication unit 23, the display unit 24, and the like. Particularly, the control unit 25 collects/generates various information (such as belonging identifier or private IP address) for identification of its belonging, and transmits it to the server 20 together with its own hardware-related unique identifier and public IP address. Control to do it. This function may be performed through software installed in the storage unit 22.

For example, the input units 11 and 21 are a keyboard (key board), a keypad (key pad), a dome switch (dome switch), a touch panel (touch panel), a touch key (touch key), a mouse (mouse), or It may include a menu button or the like, but is not limited thereto.

For example, the storage units 12 and 22 may have a hard disk type, a magnetic media type, a compact disc read only memory (CD-ROM), an optical recording medium type ( Optical Media type), magneto-optical media type, multimedia card micro type, flash memory type, read only memory type, or RAM It may be a type (random access memory type) or the like, but is not limited thereto. In addition, the storage unit 22 may be a cache, a buffer, a main memory device, an auxiliary memory device, or a storage system separately provided depending on its purpose/location, but is not limited thereto.

For example, the communication units 13 and 23 are 5G (5th generation communication), LTE-A (long term evolution-advanced), LTE (long term evolution), Bluetooth, BLE (bluetooth low energe), or NFC (near field) communication) may be performed, and wired communication such as cable communication may be performed, but the present invention is not limited thereto.

For example, the display units 14 and 24 include a liquid crystal display (LCD), a light emitting diode (LED) display, an organic light emitting diode (OLED) display, and a microelectromechanical system (MEMS). ; micro electro mechanical systems) may include a display or an electronic paper display, but is not limited thereto.

For example, the controllers 15 and 25 may be a processor or software executed by a corresponding processor, but are not limited thereto.

Hereinafter, a method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention (hereinafter, referred to as “this method”) will be described.

4 is a flowchart of a method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention. In addition, FIG. 5 shows an example of a process of a method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention.

A method for identifying and managing affiliation of a terminal in a cloud environment according to an embodiment of the present invention (hereinafter, referred to as “this method”) includes S100 to S300, as shown in FIG. 4. S100 to S300 may be controlled by the controllers 15 and 25 of the terminal 10 and the server 20. In this case, the controllers 11 and 21 may perform a control function for S100 to S300 using dedicated software installed in the terminal 10 and the server 20.

S100 is a step in which the terminal 10 collects/generates information for identifying its belonging and transmits it to the server 20. In other words, so that the server 20 can identify and set the terminal 10's own belonging, the terminal 10 may identify affiliation, such as a belonging identifier or private IP address, in addition to its own hardware-related unique identifier and public IP. The information for it may be transmitted to the server 20 together.

S200 is a step in which the server 20 sets (registers) the affiliation of the terminal 10 by using the information received from the terminal 10.

However, at or before S200, the server 20 may pre-store a belonging database that may belong to the terminal 10. For example, the belonging database may include a name, address, phone number, domain, email, or IP address related to an organization, company, team, department, or group. In this case, the IP address may include a private IP address in addition to the public IP address. This is because in the case of using a router, the public IP may be the same even if the team, department, or group is different. That is, even if the public IP address is the same, the private IP address of the terminal 10 may vary according to a team, a department, or a group.

In particular, according to the information for identification of affiliation transmitted by the terminal 10 in S100 and a method of setting affiliation performed by the server 20 receiving the same, S200 may perform various identification and setting of affiliation for the terminal 10. have.

First, in S100, when the terminal 10 generates itself as its belonging identifier and transmits it to the server 20 (hereinafter referred to as “first case”), the server 20 is the belonging identifier received from the terminal 10 It is possible to identify and set the affiliation of the terminal 10 by using.

That is, in the first case, the terminal 10 can grasp its own belonging information from information previously stored therein. Thereafter, the terminal 10 may generate a hash of a predetermined size as a membership identifier by using the identified belonging information. That is, the terminal 10 may generate a hash by processing the identified belonging information with a hash function. Thereafter, the terminal 10 may transmit the generated belonging identifier to the server 20.

At this time, the belonging information is information related to the belonging of the terminal 10. For example, the affiliation information may be a name, address, phone number, domain, or email related to an organization, company, team, department, or group. Such affiliation information may be identified using authentication information of software installed inside the terminal 10 or additional information of the software. That is, when the software is installed, its own authentication information may be stored together in the terminal 10 according to affiliation, or additional information about affiliation may be stored together by the installer's writing. Accordingly, the terminal 10 can grasp its own belonging information by using this belonging information.

In particular, the belonging information identified by the terminal 10 may be composed of a plurality of hierarchies. For example, if there are various departments within a company, or various sub-departments exist within the department, the information on the affiliation constitutes a plurality of layers (first layer, second layer, etc.). In this case, the first layer corresponds to a layer higher than the second layer. In this case, it is reflected in the belonging database stored in the server 20 to store the plurality of hierarchies.

For example, in the identified belonging information, the first layer may include information related to an organization or company, and the second layer may include information related to a team, department, or group. That is, the first layer may be information on a name, address, phone number, domain, or email related to an organization or company. In addition, the second layer may be information about a name, address, phone number, domain, or email related to a team, department, or group. However, the second layer may include a plurality of lower layers. That is, in a team, department, or group according to the second layer, a plurality of sub-teams, sub-departments, or sub-groups may exist.

In particular, when the identified belonging information has a plurality of layers, the terminal 10 may select at least two layers, but select to necessarily include the lowest layer to generate combination information combining the belonging information of the selected layers. . This is because affiliation information about the lowest level allows you to grasp information about the upper level as well. For example, if company A has departments B and C, and department B has subdivisions a, b, and c, then the information on the hierarchy of subdivisions b is sufficient for the B department and company A above it. Can be grasped.

However, in the case of the lowest level, the name may be mixed and used by different departments. For example, the a, b, and c subdivisions exist in department C. Therefore, in order to grasp more identified information, in addition to the selection of the lowest layer, it is necessary to also select another layer higher than that of the lowest layer. In this case, combination information having a larger identification function can be generated by using the minimum belonging information. However, the present invention is not limited thereto, and the terminal 10 may generate combination information by selecting belonging information of all the identified layers. Thereafter, according to the first case, the terminal 10 may generate a belonging identifier by processing the combination information with a hash function and transmit it to the server 20.

For example, the terminal 10 may generate a membership identifier by combining and lowering the identified belonging information and generating a hash using a Message-Digest Algorithm 5 (MD5) hash function.

However, since the generated hash is displayed in a binary form, in order to improve its compatibility and readability, the terminal 10 may convert the hash into a certain format and display it. That is, the terminal 10 may convert the hash to be displayed in the form of a string of m base numbers (where m is a multiple of 4) separated by a separator. In addition, the terminal 10 may transmit the converted information to the server 20 as a belonging identifier. This hash conversion function may be performed by the server 20. In particular, when the hash is converted into a string format and displayed, in S200 to be described later, when a manual confirmation of the server 20 side administrator is required when identifying and setting affiliation of the terminal 10, the readability of the recognition can be improved. have. At this time, the administrator may decide to approve, suspend, or reject when requesting a new registration.

For example, hashes are 36 characters (8-4-4-4-4-12) such as “231e2310-e31b-31d4-a231-231231231231”, similar to the format of a universally unique identifier (UUID). Can be converted to be marked with a hyphen (-). In this case, each character may be a hexadecimal number, and a separator may be omitted, such as “231e2310e31b31d4a231231231231231”.

In particular, there may be a case in which the server 20 stores corresponding information by itself (hereinafter, referred to as “second case”). In this case, the correspondence information includes belonging information matching the received belonging identifier, and may be information including information about the belonging identifier in the belonging database. For example, the correspondence information may be information in which an affiliation identifier and affiliation information matched therewith are stored in the form of a table or the like.

In the case of receiving the belonging identifier of the terminal 10 according to the first case and storing the corresponding information according to the second case, the server 20 responds when the received belonging identifier corresponds to the belonging identifier of the corresponding information. The affiliation of the terminal 10 may be identified and set using the belonging information of the information. For example, after checking whether the received belonging identifier is in the belonging database, the server 20 may set the affiliation of the corresponding terminal 10 according to the belonging information according to the checked information.

In addition, in the first case, there may be a case in which the terminal 10 transmits, in addition to the belonging identifier, its own belonging information previously identified for generating the belonging identifier (hereinafter, referred to as “third case”). In this case, the server 20 can identify and set the affiliation of the terminal 10 even if there is no corresponding information. That is, the server 20 may set the affiliation of the terminal 10 using the belonging information received together if the format of the belonging identifier received from the terminal 10 conforms to a predetermined format. For example, if the received affiliation identifier format conforms to a predetermined format, the server 20 checks whether the affiliation information received together is in the belonging database, and then the corresponding terminal 10 according to the affiliation information according to the checked information. You can set your affiliation.

In this case, the predetermined format may be related to a format that can only be generated according to a method in which the terminal 10 generates a belonging identifier in S100. For example, whether or not the belonging identifier has a predetermined size, whether the belonging identifier can be displayed in the form of a string of a predetermined size of m base numbers (however, m is a multiple of 4) separated by a delimiter, such as UUID. However, it is not limited thereto.

Unlike the third case, in the first case, there may be a case in which the terminal 10 transmits its own IP address in addition to the belonging identifier (hereinafter, referred to as “the fourth case”). In this case, the server 20 can identify and set the affiliation of the terminal 10 even if there is no corresponding information and the belonging information is not received from the terminal 10. That is, the server 20 may set the affiliation of the terminal 10 using the IP address received together if the format of the belonging identifier received from the terminal 10 conforms to a predetermined format. For example, if the received affiliation identifier format conforms to the predetermined format, the server 20 checks whether the IP address received together is in the affiliate database, and then the corresponding terminal 10 according to the affiliation information according to the checked information. You can set your affiliation.

Unlike the first case, there may be a case in which the terminal 10 fails to grasp its own belonging information in S100 and transmits its own IP address instead of the belonging identifier (hereinafter, referred to as “the fifth case”). In this case, the server 20 can identify and set the affiliation of the terminal 10 even if there is no corresponding information and the belonging identifier and the belonging information are not received from the terminal 10. That is, the server 20 may set the affiliation of the terminal 10 by using the IP address received from the terminal 10. For example, after checking whether the received IP address is in the belonging database, the server 20 may set the belonging of the corresponding terminal 10 according to the belonging information according to the checked information.

However, in the 4th and 5th cases, it may be desirable that the server 20 pre-stores information on affiliation of each IP address or IP address, and such information is It may be in a form that includes information. In particular, since a public IP can be used by a plurality of affiliates, it may be desirable to use a private IP as well to distinguish them. That is, in the fourth and fifth cases, the terminal 10 may transmit its own private IP address and public IP address to the server 20.

On the other hand, in S200, the server 20 may set a security level, select at least two of the second to fifth cases according to the security level, and set the belonging of the terminal 10 according to the selected case. have. In particular, when the security level is very high, in addition to performing the terminal 10 membership setting according to one of the second to fifth cases, it is possible to set the affiliation of the terminal 10 only when the final approval of the administrator occurs. It can also be implemented. That is, when the security level is high, the approval step is performed according to the security procedure, and the belonging of the terminal 10 may be set upon final approval by the administrator. On the other hand, when the security level is low, it may be implemented so that the belonging of the terminal 10 is automatically set according to the belonging setting of the terminal 10 according to any one of the second to fifth cases. However, a case other than the fifth case may correspond to a situation in which the security level is high. Accordingly, it may be preferable that the belonging setting of the terminal 10 according to the fifth case be used when the security level is lower than in other cases.

In addition, in S200, the server 20 may register the belonging identifier while setting the belonging to the terminal 10. That is, in the first to fourth cases, since the terminal 10 transmits the belonging identifier, the corresponding belonging identifier may be stored in the belonging database as the belonging identifier for the terminal 10, but is not limited thereto. That is, the server 20 may generate and store a membership identifier other than the received belonging identifier. In addition, in the fifth case, since the terminal 10 does not transmit the belonging identifier, the server 20 may separately generate the belonging identifier in the terminal 10 and store it in the belonging database.

S300 is a step of performing management of the registered terminal 10. That is, when the membership setting for the terminal 10 is completed in accordance with S200, the server 20 may manage the registered terminal 10 for each affiliation by using the stored affiliation identifier. For example, the management performed by the server 20 on the registered terminal 10 by affiliation may include license management, software update management, policy management, or security management, but is not limited thereto.

Specifically, the server 20 may request information on the current state of the registered terminal 10. For example, the current state information may be information related to the state of hardware or software of the registered terminal 10. Thereafter, the server 20 may receive the corresponding current state information from the registered terminal 10 and transmit management information according to the affiliation of the registered terminal 10 to the terminal 10 by referring to this information. For example, the management information may include updated license data, software data, policy data, or security data, and the terminal 10 may receive the corresponding management information and update it by reflecting it.

In particular, in S300, the server 20 may transmit management information of various levels to the registration terminal 10 according to which of the second to fifth cases the registration terminal 10 belongs to is set. That is, this corresponds to a case in which the registration terminal 10 (second terminal) according to other cases has a higher security level than the registration terminal 10 (first terminal) according to the fifth case. Therefore, even if the first terminal and the second terminal belong to the same, the server 20 may differently transmit the first management information for the first terminal and the second management information for the second terminal. For example, software data for specific software update may not be transmitted to the first terminal, but may be transmitted to the second terminal.

Meanwhile, a program according to an embodiment of the present invention is a program stored in a medium for identification and management of the belonging of the terminal 10 in a cloud environment according to the method described above. For example, a program according to an embodiment of the present invention may be recorded in a recording medium that can be read by a computer or a similar device.

For example, the recording medium is a hard disk type, magnetic media type, compact disc read only memory (CD-ROM), optical media type, and magnetic-optical medium. Type (magneto-optical media type), multimedia card micro type, card type memory (eg, SD or XD memory, etc.), flash memory type, ROM (read only memory); ROM), RAM (random access memory; RAM), or a buffer, a main memory device, or an auxiliary memory device formed of a memory composed of a combination thereof, but is not limited thereto.

In addition, a communication network such as the Internet, an intranet, a local area network (LAN), a wide LAN (WLAN), or a storage area network (SAN) in the program and input device according to an embodiment of the present invention, Alternatively, it may be stored in an attachable storage device that can be accessed through a communication network composed of a combination thereof.

In the present invention described above, it is possible to identify the affiliation of the terminal 10 that connects to the server and communicates with the server in the cloud environment and the software installed in the terminal 10, and manages the terminal and software for which the affiliation is identified. There is a possible advantage.

In addition, the present invention eliminates the need for direct intervention of users and administrators whenever the terminal 10 is assigned, thus increasing the convenience of setting the terminal affiliation and reducing the time required for the setting of the terminal affiliation. There is an advantage that can be prevented.

In addition, according to the present invention, as various types of transmission information of the terminal 10 and a method of setting the server 20 accordingly are presented, there is an advantage in that the belonging of the terminal 10 can be set by reflecting various security levels.

Although specific embodiments have been described in the detailed description of the present invention, various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention is not limited to the described embodiments, and should be defined by the claims to be described later and equivalents to the claims.

The present invention relates to a system and method capable of identifying affiliation of a terminal that connects to a server and communicates with a server in a cloud environment and the affiliation of the software installed in the terminal and manages the terminal and software with the identification of affiliation by division. There is availability.

Claims (6)

Terminals that access the server and terminals that set the affiliation of the terminal using information received from the terminal, and use the set affiliation to set management information for license management, software update management, or security management for each affiliation. As a system in a cloud environment each including a server that manages the registered terminal by transmitting it to the (registered terminal), The terminal, Identify the device's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, identify the affiliation information from it, and use the identified affiliation information to generate a hash of a certain size as a member identifier. However, if the belonging information is composed of a plurality of layers, selecting at least two layers and selecting to necessarily include the lowest layer, combining the belonging information of the selected layers, and processing the combination information with a hash function to generate an belonging identifier, The server, In the first case in which the terminal transmits the generated belonging identifier to the server, the affiliation of the terminal is set using the belonging identifier received from the terminal, In the second case, in which correspondence information including various belonging identifiers and belonging information matching thereto is stored in the first case, if correspondence information corresponding to the belonging identifier received from the terminal is stored, belonging information of the corresponding correspondence information Use to set the affiliation of the terminal, In the first case, in the third case, in which the terminal transmits its own belonging information identified to generate the corresponding belonging identifier in addition to the belonging identifier, if the form of the belonging identifier received from the terminal conforms to the predetermined format, Set the affiliation of the terminal using the affiliation information, In the first case, in the fourth case, in which the terminal transmits its own private IP address and public IP address in addition to the belonging identifier, if the format of the belonging identifier received from the terminal conforms to the predetermined format, the private IP address received together And a public IP address to set the affiliation of the terminal, Unlike in the first case, in the fifth case in which the terminal fails to grasp its belonging information and transmits its own private IP address and public IP address instead of the belonging identifier, the received private IP address and public IP address are used. Set the affiliation of the terminal, According to the security level, the server may select a terminal belonging setting method among the second to fifth cases, but the fifth case is a lower level than the second to the fourth case. A system that applies the security level as a security level and transmits different management information to each of the registered terminals in the same affiliation according to the security level when the affiliation is set The method of claim 1, The affiliation information includes a first layer, which is information related to an organization or company, and a second layer, which is information related to a team, department, or group lower than the first layer. The method of claim 1, The server stores the terminal's belonging identifier to be displayed in the form of a string of m base numbers (where m is a multiple of 4) separated by a delimiter. By connecting to the server and transmitting information, the server establishes its own affiliation and uses the set affiliation to transfer management information for license management, software update management, or security management for each affiliation (registered terminal) As a terminal in a cloud environment that allows you to manage the registered terminal itself by sending it to, A storage unit for storing information; And The device's own affiliation information is identified from the information stored in the storage, but if there is authentication information or additional information of the installed software, the affiliation information is identified from it, and a hash of a certain size is generated as a member identifier using the identified affiliation information. However, if the belonging information is composed of a plurality of layers, selecting at least two layers and selecting to necessarily include the lowest layer, combining the belonging information of the selected layers, and processing the combination information with a hash function to generate an belonging identifier, Includes; a control unit that controls to transmit the generated belonging identifier to the server, The server, In the first case in which the terminal transmits the generated belonging identifier to the server, the affiliation of the terminal is set using the belonging identifier received from the terminal, In the second case, in which correspondence information including various belonging identifiers and belonging information matching thereto is stored in the first case, if correspondence information corresponding to the belonging identifier received from the terminal is stored, belonging information of the corresponding correspondence information Use to set the affiliation of the terminal, In the first case, in the third case, in which the terminal transmits its own belonging information identified to generate the corresponding belonging identifier in addition to the belonging identifier, if the form of the belonging identifier received from the terminal conforms to the predetermined format, Set the affiliation of the terminal using the affiliation information, In the first case, in the fourth case, in which the terminal transmits its own private IP address and public IP address in addition to the belonging identifier, if the format of the belonging identifier received from the terminal conforms to the predetermined format, the private IP address received together And a public IP address to set the affiliation of the terminal, Unlike in the first case, in the fifth case in which the terminal fails to grasp its belonging information and transmits its own private IP address and public IP address instead of the belonging identifier, the received private IP address and public IP address are used. Set the affiliation of the terminal, Depending on the security level, it is possible to select a terminal belonging setting method among the second to fifth cases, but the fifth case is a lower level of security than the second to the fourth case. Apply, A terminal that transmits different management information to each of the registered terminals of the same affiliation according to the security level at the time of establishment of the affiliation. The affiliation of the terminal is set using the information received from the terminal connected to the terminal, and management information for license management, software update management, or security management for each affiliation is set using the set affiliation (registered terminal ) As a server in the cloud environment that manages the registered terminal by sending it to, A communication unit that communicates with the terminal; And Including; a control unit that controls to set the affiliation of the terminal by using the belonging identifier when the communication unit is received, The terminal, Identify the device's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, identify the affiliation information from it, and use the identified affiliation information to generate a hash of a certain size as a member identifier. However, if the belonging information is composed of a plurality of layers, selecting at least two layers and selecting to necessarily include the lowest layer, combining the belonging information of the selected layers, and processing the combination information with a hash function to generate an belonging identifier, The control unit, In the first case in which the terminal transmits the generated belonging identifier to the server, control to set the belonging of the terminal using the belonging identifier received from the terminal, In the second case, in which correspondence information including various belonging identifiers and belonging information matching thereto is stored in the first case, if correspondence information corresponding to the belonging identifier received from the terminal is stored, belonging information of the corresponding correspondence information Control to set the affiliation of the terminal using In the first case, in the third case, in which the terminal transmits its own belonging information identified in order to generate the corresponding belonging identifier in addition to the belonging identifier, if the form of the belonging identifier received from the terminal conforms to a predetermined format, it is received together. Controls to set the affiliation of the terminal using the corresponding affiliation information, In the first case, in the fourth case, in which the terminal transmits its own private IP address and public IP address in addition to the belonging identifier, if the format of the belonging identifier received from the terminal conforms to the predetermined format, the private IP address received together And a public IP address to set the affiliation of the terminal, Unlike in the first case, in the fifth case in which the terminal fails to grasp its belonging information and transmits its own private IP address and public IP address instead of the belonging identifier, the received private IP address and public IP address are used. Controls to set the affiliation of the terminal, Depending on the security level, it is possible to select a terminal belonging setting method among the second to fifth cases, but the fifth case is a lower level of security than the second to the fourth case. Control to apply, A server that controls to transmit different management information to each of the registered terminals in accordance with the security level at the time of setting the affiliation of registered terminals of the same affiliation. As a method for identifying and managing affiliation of a terminal in a cloud environment of a terminal and a server, A transmission step of the terminal accessing the server and transmitting information; A setting step of setting the affiliation of the terminal by the server using the information received from the terminal; And A management step of managing a registered terminal by transmitting management information for license management, software update management, or security management for each affiliation by using the affiliation in which the server is set to the terminal (registered terminal) in which the affiliation is set; and, The transmitting step, The terminal knows about the terminal's own affiliation information from the information stored therein, but if there is authentication information or additional information of the installed software, it identifies the affiliation information from it, and uses the identified affiliation information to obtain a hash of a certain size as a member identifier. However, if the belonging information consists of multiple layers, select at least two layers and select to include the lowest layer, combine the belonging information of the selected layers, and process the combination information with a hash function to create a belonging identifier. And, including the step of transmitting the generated belonging identifier to the server, The setting step, In the first case in which the terminal transmits the generated belonging identifier to the server, the server sets the affiliation of the terminal using the belonging identifier received from the terminal, In the second case, in which the corresponding information including various belonging identifiers and belonging information matching thereto is stored in the first case, if the corresponding information corresponding to the belonging identifier received from the terminal is stored by the server, the corresponding corresponding information Set the affiliation of the terminal using the affiliation information, In the first case, in the third case, in which the terminal transmits its own belonging information identified to generate the corresponding belonging identifier in addition to the belonging identifier, if the format of the belonging identifier received from the terminal matches the predetermined format, The affiliation of the terminal is set using the received information of the affiliation, In the first case, in the fourth case, in which the terminal transmits its own private IP address and public IP address in addition to the belonging identifier, if the format of the belonging identifier received from the terminal by the server conforms to the predetermined format, the private received together Set the affiliation of the terminal using the IP address and public IP address, Unlike in the first case, in the fifth case in which the terminal fails to grasp its belonging information and transmits its own private IP address and public IP address instead of the belonging identifier, the private IP address and public IP address received by the server are used. Setting the affiliation of the terminal by using; And Depending on the security level, it is possible to select a terminal belonging setting method among the second to fifth cases, but the fifth case is a lower level of security than the second to the fourth case. Including; applying; The managing step includes transmitting different management information to each of the registered terminals according to the security level at the time of setting the affiliation, even for registered terminals belonging to the same affiliation.

Images