KR102064253B1 - Method of managing certification information for single sign on - Google Patents

Abstract

The present invention relates to a method for managing authentication information for integrated authentication that can enhance security by encrypting and managing shared authentication information with different values between service devices. Each service device of the integrated authentication is unique for each user. The first encrypted user authentication information is applied by applying a user salt value having a value, and secondly encrypted and stored by applying a service provider salt value having a unique value for each service provider.

Description

Method of managing certification information for single sign on

The present invention relates to an integrated authentication technology, and more particularly, in an integrated environment in which a plurality of service devices share authentication information of a user including a password, the shared authentication information is encrypted and managed between different service devices. The present invention relates to a method of managing authentication information for integrated authentication that can enhance security.

According to the development of mobile communication network and communication technology, various services are provided based on wired / wireless communication network. However, since user identification system is distributed and managed by various services, customer convenience, information security and legal compliance Difficulties, introduction of new services and interfering with the linkage between services have arisen, and the necessity of integrating user IDs of various services is emerging, and an integrated ID management system (tentative name) that manages one integrated ID is emerging. Development is underway.

In constructing such an integrated ID management system, user ID integration includes flexibility to accommodate various member policies (membership / scope, member verification method, etc.) for each service, operational stability, service maintainability, and future expandability. This should be considered.

In particular, in order to integrate authentication from multiple web services or applications so that multiple web services or applications can be used with one authentication, a separate integrated authentication server is built to authenticate multiple different services or applications. This can be done through an integrated server or single sign-on (SSO) technology to pass authentication information from a specific application or service to another service or authentication server, eliminating the need for users to log in again. Related technologies can be divided into methods using cookies, sessions, authentication tokens, tickets, etc., depending on the method of delivering authentication information, and depending on the integration target, single authentication between web services, single authentication between applications, network connection and services. It can be divided into a single authentication.

In such an integrated ID environment, service providers that provide various web services or applications that are subject to ID integration must share authentication information of the same user, for example, a user ID and a password. In this case, when a user ID and password are exposed by a hacking or the like on one service provider side, there is a problem in that security is weak because it is accessible to the other service provider side using the exposed ID and password.

Korean Laid-Open Patent Publication 10-2007-0059891 A, released June 12, 2007 (Name: Application authentication security system and its authentication security method)

Accordingly, the present invention has been proposed to enhance security in an ID integrated environment, and in particular, authentication information management for integrated authentication that can enhance security by encrypting and managing shared authentication information with different values between service devices. To provide a method.

In particular, the present invention is applied to each service device by applying a user salt value having a unique value for each user, the first encrypted user authentication information, and again applies a service provider salt value having a unique value for each service provider 2 By encrypting and storing the data, an authentication information management method for integrated authentication with enhanced security is provided.

As a means for solving the above problems, the present invention provides a communication unit for transmitting and receiving data with the user device and the integrated authentication device; An authentication processing unit for controlling to encrypt and store the user authentication information by applying a service provider salt value having a unique value for each service provider and receiving the first encrypted user authentication information from the integrated authentication device; And a storage unit for storing the second encrypted user authentication information.

In the service device according to an embodiment of the present invention, when the authentication processing unit receives the user authentication information from the user device through the communication unit, it is characterized in that for transmitting the received user authentication information to the integrated authentication device.

In addition, the authentication processing unit may process user authentication using the second encrypted user authentication information stored in the storage unit.

In addition, the first encrypted user authentication information is characterized by being encrypted by applying a user salt value having a unique value for each user.

In addition, the present invention is another means for solving the above problems, Communication unit for communicating with one or more service devices using integrated authentication; When the user authentication information is received from the specific service device through the communication unit, a user salt value having a unique value for each user is generated, the received user authentication information is first encrypted by applying the generated user salt value, and the specific service device is provided. A control unit for transmitting to one or more service apparatuses including and controlling the first encrypted user authentication information using a shared encryption key shared with the one or more service apparatuses; And a storage unit for storing the user authentication information re-encrypted by the shared encryption key after the primary encryption by the control unit.

The controller of the integrated authentication device may transmit the first encrypted user authentication information to the corresponding service device according to a request of each of the one or more service devices.

In this case, when an additional subscription request for a pre-registered user is received from another service device, the controller of the integrated authentication device restores the user authentication information stored in the storage unit to the first encrypted user authentication information as a user salt value. It may transmit to the other service device.

In addition, the present invention is another means for solving the above problems, the integrated authentication device for applying the user salt value having a unique value for each user by first encrypting the user authentication information and transmitting to one or more service devices; And receiving user authentication information from a user terminal, providing the user authentication information to the integrated authentication device, and receiving the first encrypted user authentication information from the integrated authentication device, the first encrypted user authentication information for each service provider. The present invention may further provide an integrated authentication system including one or more service devices configured to perform secondary encryption and management by applying a service provider salt value having a unique value.

In addition, the present invention is another means for solving the above problems, the service device for providing a specific service to the user device, comprising the steps of: setting a service provider salt value having a unique value for each service provider; Receiving primary encrypted user authentication information from the integrated authentication device; Secondly applying the service provider salt value to the received user authentication information; It provides a method for managing authentication information for integrated authentication comprising the step of storing the second encrypted user authentication information.

In the authentication information management method for integrated authentication according to an embodiment of the present invention, the first encrypted user authentication information may be one-way encrypted user authentication information by applying a user salt value set to have a unique value for each user. .

In addition, the authentication information management method for integrated authentication according to an embodiment of the present invention, before the step of receiving the first encrypted user authentication information, receiving the user authentication information from the user device; The method may further include transmitting the received user authentication information to the integrated authentication device.

In addition, the present invention is another means for solving the above problems, the integrated authentication device, receiving a user authentication information to be used for integrated authentication from a specific service device; Generating a user salt value having a unique value for each user; First encrypting the received user authentication information by applying the generated user salt value; Transmitting the first encrypted user authentication information to one or more service devices used by the user; And re-encrypting and storing the first encrypted user authentication information using a shared encryption key.

In the authentication information management method for integrated authentication, the step of transmitting to one or more service devices, the primary encrypted user authentication information may be transmitted to the service device according to a request of each of the one or more service devices.

The authentication information management method for integrated authentication may restore the stored user authentication information to a first encrypted user authentication information by applying a user salt value according to a request of one or more other service devices, and then restore the first encrypted information. The method may further include transmitting user authentication information to the one or more other service devices.

According to the above-mentioned solution, the present invention provides a combined environment in which a plurality of service devices share authentication information of a user including a password, wherein the plurality of service devices are provided with information for user authentication, for example, user ID. While sharing user authentication information such as a corresponding password, security can be improved by allowing service devices to encrypt and manage different values.

In particular, in the present invention, even if the authentication information is exposed by hacking or the like in any one of the service devices that share the user's authentication information for identity integration, the other service device cannot know the authentication information encrypted and managed by the other service device. It can continue to provide stable services.

1 is a block diagram illustrating an integrated authentication system according to an exemplary embodiment of the present invention.
2 is a block diagram illustrating a configuration of a service device for integrated authentication according to an embodiment of the present invention.
3 is a block diagram illustrating a configuration of an integrated authentication device for integrated authentication according to an embodiment of the present invention.
4 is a flowchart illustrating a method for integrated authentication of a service device according to an embodiment of the present invention.
5 is a flowchart illustrating a method for integrated authentication of an integrated authentication device according to an embodiment of the present invention.
6 is a message flow diagram illustrating an example of a processing procedure of an integrated authentication method according to an embodiment of the present invention.
7 is a message flow diagram illustrating an example of a processing procedure of an integrated authentication method according to another embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in the following description and the accompanying drawings, detailed descriptions of well-known functions or configurations that may obscure the subject matter of the present invention will be omitted. In addition, it should be noted that like elements are denoted by the same reference numerals as much as possible throughout the drawings.

1 is a block diagram illustrating an integrated authentication system according to an exemplary embodiment of the present invention.

Referring to FIG. 1, an integrated authentication system according to an embodiment of the present invention includes a user device 100, a plurality of service devices 200, and an integrated authentication device that are directly or indirectly interconnected through a communication network 400. 300 may be included.

Here, the communication network 400 performs a series of data transmission / reception operations for data transmission and information exchange between the user device 100 and the plurality of service devices 200. Such a communication network 400 may use various types of communication networks, for example, wireless LAN (WLAN, Wireless LAN), Wi-Fi, Wibro, Wimax, high speed downlink packet access ( Wireless communication methods such as HSDPA, High Speed Downlink Packet Access (HSDPA) or Ethernet, xDSL (ADSL, VDSL), Hybrid Fiber Coax (HFC), Fiber to The Curb (FTTC), and Fiber To The Home (FTTH) It may include one or more of the wired communication scheme. In addition, the communication network 400 may include a mobile communication network including GSM, WCDMA, LTE, and the like. The communication network 400 is not limited to the above-described communication method, and may include all types of communication methods well-known or developed in addition to the above-described communication method.

In addition, the plurality of service apparatuses 200 and the integrated authentication apparatus 300 may be interconnected through a separate dedicated network, as shown in FIG. 1, but, alternatively, may be connected using the communication network 400. have.

Hereinafter, the operation of each device based on the network described above is performed as follows.

The user device 100 is a device of a user who uses the services by subscribing to different services provided by the plurality of service devices 200, and includes a communication network such as a smartphone, a tablet PC, a PDA, a personal computer (PC), and the like. Any device may be used as long as the device can access the service device 200 through 400. The user device 100 accesses the service device 200 using a browser program, uses a service provided by the service device 200, or installs a predetermined application interworking with the service device 200. By executing the application, a service provided by the service device 200 can be used.

The plurality of service apparatuses 200 are server apparatuses for providing a predetermined service to the user apparatus 100, and may be operated by different service providers or may be operated by the same service provider and provide different services. It may be.

The plurality of service apparatuses 200 perform user authentication through integrated authentication in which user authentication information of a user of the user device 100 is shared. In this case, the plurality of service apparatuses 200 encrypts and manages the user authentication information by applying a unique service provider salt value assigned to the service device 200 to solve a security problem caused by the exposure of the user authentication information. Accordingly, the plurality of service apparatuses 200 may store user authentication information of the same user at different values, and even if the user authentication information is exposed at a specific service apparatus 200, the safety of other service apparatuses may be guaranteed. To this end, when the plurality of service devices 200 first receive user authentication information (for example, ID and password) from the user device 100 through a membership registration procedure or a user account creation procedure, the received user authentication information is received. To the integrated authentication device 300. In this case, the plurality of service apparatuses 200 may encrypt and transmit the user authentication information through one-way encryption when transmitting the user authentication information to the integrated authentication device 300. In addition, the plurality of service apparatuses 200 receives encrypted user authentication information by applying a user salt value having a unique value for each user from the integrated authentication apparatus 300, and encrypts the user authentication in the integrated authentication apparatus 300. The information is again encrypted by applying a service provider salt value having a unique value for each service provider. The plurality of service apparatuses 200 respectively store user authentication information re-encrypted by applying its service provider salt value.

In an embodiment of the present disclosure, for convenience of description, the plurality of service apparatuses 200 may be classified into a first service apparatus 200a and a second service apparatus 200b.

The integrated authentication device 300 is a configuration for supporting integrated authentication between the plurality of service devices 200. To this end, the integrated authentication device 200 supports sharing user authentication information among a plurality of service devices 200. Specifically, when the integrated authentication device 200 receives user authentication information to be used for integrated authentication from a specific service device, for example, the first service device 200a, a user salt value having a unique value for each user. After applying the first encryption of the received user authentication information, and distributes the first encrypted user authentication information to a plurality of service apparatuses 200 that the user uses. In more detail, the integrated authentication device 300 transmits the first encrypted user authentication information to the first service device 200a. In addition, the integrated authentication device 300 stores the first encrypted user authentication information by second encrypting the shared encryption key. In this case, it is preferable that the shared encryption key is not shared to the service apparatuses 200a and 200b. Then, when the integrated authentication request for the user device 100 from another service device, for example, the second service device 200b, the user encrypts the primary encrypted user authentication information by decrypting the stored user authentication information. It may be provided to the subscribed second service device 200b. That is, each time the user subscribes to the service, the stored user authentication information is decrypted and the first encrypted user authentication information is applied to the corresponding service device 200 to which the user further subscribes by applying the user salt value.

Hereinafter, a configuration of each device for managing authentication information in the integrated authentication environment according to the present invention will be described in more detail with reference to FIGS. 2 and 3.

2 is a block diagram illustrating a configuration of a service device for integrated authentication according to an embodiment of the present invention.

Referring to FIG. 2, the service apparatus 200 according to the embodiment of the present invention may include a communication unit 210, an authentication processing unit 220, a storage unit 230, and a service providing unit 240. have.

The communication unit 210 is a configuration for transmitting and receiving data with the user device 100 and the integrated authentication device 300. The communication unit 210 may be a part communicating with the user device 100 and a part communicating with the integrated authentication device 300 may be separated from each other, or may be integrated into one. For example, the communication unit 210 may receive a service request message from the user device 100, and may receive user authentication information for user authentication to the user device 100 as necessary. In addition, the communication unit 210 may be connected to the integrated authentication device 300 and transmit the user authentication information received for integrated authentication to the integrated authentication device 300, on the contrary, encrypted user authentication information from the integrated authentication device 300 You can also receive.

The authentication processing unit 220 is a component that is responsible for authentication processing for the user device 100 that requested the service, and may perform the authentication process through interworking with the integrated authentication device 300. In addition, the authentication processing unit 220 may share and manage authentication information for integrated authentication processing.

In detail, the authentication processing unit 220 may, when the user device 100 requests a service for the first time or requests to join, the user authentication information for authentication processing, for example, an ID and password of a user for login processing. 100). In addition, the received user authentication information may be transmitted to the integrated authentication device 300. In this case, the authentication processing unit 220 may encrypt and transmit the user authentication information in order to avoid exposing the information. In addition, the authentication processing unit 220 may receive the first encrypted user authentication information by reflecting a user salt value having a unique value for each user from the integrated authentication device 300. In addition, when the user registered in the integrated authentication service through the other service device requests to join the service, the authentication processor 220 requests the integrated authentication device 300 to receive primary encrypted user authentication information of the corresponding user. can do. In addition, the authentication processing unit 220 encrypts the received first encrypted user authentication information by applying a service provider salt value having a unique value for each service provider, and stores the storage unit for authentication processing at a later login request. 230). To this end, a service provider salt value is preset in the authentication processor 220. In addition, the authentication processing unit 220 receives the user authentication information from the user device 100 when the service request from the user device 100 subscribed to the service, the input user authentication information and the storage unit 230 User authentication may be performed by comparing previously stored user authentication information.

The storage unit 230 is a means for storing data and programs necessary for the operation of the service device 200. The storage unit 230 may include various types of recording media and data management systems. In particular, in the present invention, the storage unit 230 stores and manages user authentication information re-encrypted by the authentication processing unit 220.

Finally, the service provider 240 is a component for providing any service preset to the user device 100 authenticated by the authentication processor 220. The service provided by the service provider 240 may be, for example, a community service such as SNS, an instant messenger service, an e-commerce service, or a sound source service. However, in the present invention, the service provided by the service device 200 is not particularly limited, and any service may be provided as long as the service requires user authentication.

3 is a block diagram showing the configuration of the integrated authentication device 300 according to an embodiment of the present invention.

Referring to FIG. 3, the integrated authentication device 300 according to an embodiment of the present invention may include a communication unit 310, a control unit 320, and a storage unit 330.

The communication unit 310 is a configuration for transmitting and receiving data by communicating with a plurality of service apparatuses 200 using integrated authentication. As described above, the communication unit 310 may communicate with a plurality of service apparatuses 200 through a separate dedicated network, or may communicate through an open communication network 300. The communication unit 210 may be used to receive and distribute user authentication information for integrated authentication.

The controller 320 is a component that controls and performs overall processing for integrated authentication support. Specifically, when receiving the user authentication information from the specific service device 200 through the communication unit 310, the control unit 320 generates a user salt value having a unique value for each user, and generates the generated user salt value Apply and firstly encrypt the received user authentication information. This process only needs to be done once upon initial subscription to the user's integrated authentication service. The controller 320 transmits the first encrypted user authentication information by applying the user salt value to one or more service devices 200 including the specific service device. For example, the at least one service device 200 may be a service device set to share mutual user authentication information. For example, the at least one service device 200 may be at least one service device 200 that has been agreed to by the user through the integrated subscription process. In one embodiment of the present invention, the transmission of the first encrypted user authentication information may be performed collectively for a plurality of service apparatuses 200, and the user requests for additional service subscription for each service apparatus 200. When generated, it may be done.

In addition, the controller 320 controls the primary encrypted user authentication information to be encrypted and stored using a shared encryption key. Here, even if a specific service device 200 is exposed to malicious attacks, in order to protect user authentication information, it is preferable that the shared encryption key is not shared with other service device 200.

The storage unit 330 is a means for storing data and programs necessary for the operation of the integrated authentication device 300. In particular, under the control of the controller 320, after the primary encryption by applying the user salt value, the shared encryption is performed. Stores user authentication information re-encrypted with a key. The user authentication information re-encrypted with the shared encryption key may be provided to another service device 200 after decrypting the user authentication information with primary encryption by applying a user salt value if necessary by the controller 320. .

In the above, the configuration of the service device 200 and the integrated authentication device 300 has been described, but the configuration of the service device 200 and the integrated authentication device 300 shown in FIGS. 2 and 3 is merely a configuration of the device. It is shown as being divided into functional units, and does not refer to an independent hardware device or software.

For example, the service device 200 or the integrated authentication device 300 according to the present invention may be driven by a command that causes one or more processors to perform the functions and processes described below. For example, such instructions may include interpreted instructions, such as script instructions such as JavaScript or ECMAScript instructions, or executable instructions or other instructions stored on a computer readable medium. Furthermore, the service device 200 and the integrated authentication device 300 according to the present invention may be implemented in a distributed manner over a network, such as a server farm, or may be implemented in a single computer device. In addition, the processor mounted in the service device 200 or the integrated authentication device 300 according to the present invention may be a single-threaded processor, in another embodiment the processor may be a multithreaded processor. have. In addition, the service device 200 and the integrated authentication device 300 according to an embodiment of the present invention, in addition to hardware, for example, code constituting processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more thereof. Etc., may include code that forms an execution environment for a computer program upon request.

In addition, the service device 200 and the integrated authentication device 300 according to an embodiment of the present invention includes a back-end component such as, for example, a data server, or includes a middleware component such as, for example, an application server, or for example, a user It may be implemented as a front-end component such as a web browser or client computer having a graphical user interface that can interact with the implementations of the described subject matter, or as a system including any combination of one or more of these back-end, middleware or front-end components.

Next, the authentication information management method for the integrated authentication of the service device 200 and the integrated authentication device 300 configured as described above will be described with reference to FIGS. 4 and 5.

4 is a flowchart illustrating a method for integrated authentication of a service device according to an embodiment of the present invention, and FIG. 5 is a flowchart illustrating a method for integrated authentication of an integrated authentication device according to an embodiment of the present invention.

First, referring to FIG. 4, the service device 200 that provides a specific service to the user device 100 sets a service provider salt value SALT_SST having a unique value for each service provider (S105). The service provider salt value SALT_SST is set to have a different value among a plurality of service devices 200 bound by integrated authentication. Here, the salt SALT is a temporary variable added for encryption, and in particular, the service provider salt value SALT_SST means a salt value generated to have different values for each service provider, that is, for each service, not for a user. The service provider salt value SALT_SST may be generated through a function that takes service identification information (service ID) as an input.

Subsequently, the service device 200 may receive user authentication information from the user device 200 through a membership registration procedure or an account creation procedure (S110). The user authentication information is information designated by a user for user authentication and may be a user ID and password information of the user.

As such, when the user authentication information is input, the service device 200 transmits the received user authentication information to the integrated authentication device 300.

Steps S110 to S115 may be performed only in any one of a plurality of service devices 200 in which an authentication scheme is integrated, and other service devices may be authenticated by a user without a separate member registration process or an account creation process. Information will be shared. That is, the steps S110 to S115 may be omitted in some service apparatus 200.

In addition, each service device 200 may receive primary encrypted user authentication information from the integrated authentication device 300 (S120). Here, the primary encrypted user authentication information is user authentication information encrypted by the integrated authentication device 300 by applying a user salt value having a unique value for each user. The step S120 may be performed when the user device 100 requests or permits membership or creation of an account for each service device 200, and may be performed by a request from the service device 200.

In this way, the service device 200 that has received the first encrypted user authentication information from the integrated authentication device 300 performs second encryption on the received user authentication information by applying the preset service provider salt value thereof (S125). ). In more detail, the user salt value is added to the encrypted user authentication information, and the service provider salt value is applied again and re-encrypted.

The second encrypted user authentication information is stored in the corresponding service device 200 (S130), and can be used for user authentication at a later login.

Meanwhile, as shown in FIG. 5, the integrated authentication device 300 may receive user authentication information to be used for integrated authentication from the specific service device 200 (S205). The step S205 may be performed together with a request to register or create an account.

In this case, the integrated authentication device 300 first generates a user salt value having a unique value for each user (S210). In step S210, a function of inputting the user's ID may generate a user's own salt value.

Subsequently, the integrated authentication device 300 first encrypts the received user authentication information by applying the generated user salt value (S215).

In addition, the integrated authentication device 300 transmits the first encrypted user authentication information to one or more service devices used by the user (S220). This is a step for distributing user authentication information to the plurality of service apparatuses 200, and may transmit primary encrypted user authentication information at different times for each service apparatus 200, and simultaneously transmits the first user authentication information to the plurality of service apparatuses 200. The second encrypted user authentication information may be transmitted.

In addition, the integrated authentication device 300 performs secondary encryption using the shared encryption key to share the primary encrypted user authentication information with one or more service devices 200 (S225).

In the above-described authentication information management method for integrated authentication, encryption may be performed through various forms of encryption techniques, and two or more different encryption techniques may be used together.

6 is a message flow diagram illustrating a method for managing authentication information for integrated authentication according to an embodiment of the present invention. The following embodiments may be applied when a user collectively performs a service subscription for a plurality of services, that is, the first and second service devices 200a and 200b.

In the following description, it is assumed that a user requests membership registration or account creation for integrated authentication of the first service device 200a and the second service device 200b through the first service device 200a. .

Referring to FIG. 6, in an embodiment of the present disclosure, a user requests membership or account creation for the first and second service devices 200a and 200b through the first service device 200a and the user device. The user authentication information, for example, a password, to be used by the user may be input through 100 (S300).

At this time, the user device 100 transmits the plain text password Plain_PW received from the user to the first service device 200a (S305).

The first service device 200a encrypts the received plain text password Plain_PW using a one-way encrypted SHA (Secure Hash Algorithm) (S310), and integrates the encrypted password SHA (Plain_PW) into the integrated authentication device 300. Transfer to (S315).

Upon receiving this, the integrated authentication device 300 first generates a user salt value SALT_oneID having a unique value for each user, adds the user salt value SALT_oneID to the received password SHA, Plain_PW, and then uses one-way encryption. The primary encryption using the SHA of the technique (S320). The primary encrypted password is SHA_oneID (SHA (Plain_PW) + SALT_oneID).

The integrated authentication device 300 transmits the first encrypted password SHA_oneID (SHA (Plain_PW) + SALT_oneID) to the service devices that are combined with the integrated authentication, that is, the first service device 200a and the second service device 200b. (S325). The service devices for transmitting the primary encrypted password may be set according to a user's selection through the user device 100 or may be predefined according to a subscription policy.

Meanwhile, the first and second service apparatuses 200a and 200b which receive the primary encrypted password SHA_oneID (SHA (Plain_PW) + SALT_oneID) respectively re-encrypt and store the received password by adding a preset service provider salt value. (S330, S335)

At this time, since the service provider salt value of the first service apparatus 200a is SALT_SST1, the password is encrypted in the first service apparatus 200a by SHA_SST1 (SHA_oneID (SHA (Plain_PW) + SALT_oneID) + SALT_SST1).

On the contrary, since the service provider salt value of the second service apparatus 200b is SALT_SST2, the password in the second service apparatus 200a is encrypted with SHA_SST1 (SHA_oneID (SHA (Plain_PW) + SALT_oneID) + SALT_SST1).

That is, the password encrypted in the first service device 200a and the password encrypted in the second service device 200b have different values.

On the other hand, the password is encrypted and stored in the integrated authentication device 300, the integrated authentication device 300 encrypts the primary encrypted password using a two-way encryption (AES) (S340). Therefore, the password stored in the integrated authentication device 300 becomes AES_oneID (SHA_oneID (SHA (Plain_PW) + SALT_oneID)) At this time, the encryption key is not shared with the first and second service devices 200a and 200b. It is preferable.

7 is a message flow diagram illustrating a method for managing authentication information for integrated authentication according to another embodiment of the present invention. Another embodiment of the present invention may be applied when a plurality of services, that is, service subscriptions to the first and second service devices 200a and 200b are performed at different times.

In the following description, it is assumed that a user requests a second subscription to the second service device 200b after requesting a service subscription to the first service device 200a.

Referring to FIG. 7, in an embodiment of the present disclosure, in order to use a service provided by the first service device 200a, the user requests a membership registration or account creation for integrated authentication (S400) and the user device ( Through 100), user authentication information, for example, a password, to be used by the user may be input.

In this case, the user device 100 transmits the plain text password Plain_PW received from the user to the first service device 200a (S405).

The first service device 200a encrypts the received plain text password Plain_PW using a one-way encrypted SHA (Secure Hash Algorithm) (S310), and integrates the encrypted password SHA (Plain_PW) into the integrated authentication device 300. Transmit to (S415).

Upon receiving this, the integrated authentication device 300 first generates a user salt value SALT_oneID having a unique value for each user, adds the user salt value SALT_oneID to the received password SHA, Plain_PW, and then uses one-way encryption. Primary encryption using the SHA of the technique (S420). The primary encrypted password is SHA_oneID (SHA (Plain_PW) + SALT_oneID).

The integrated authentication device 300 transmits the primary encrypted password SHA_oneID (SHA (Plain_PW) + SALT_oneID) to the first service device 200a (S425).

The first service apparatus 200a receiving the primary encrypted password SHA_oneID (SHA (Plain_PW) + SALT_oneID) adds a preset service provider salt value to re-encrypt the received password and then re-encrypts the password. Store the (S430).

At this time, since the service provider salt value of the first service apparatus 200a is SALT_SST1, the password is encrypted in the first service apparatus 200a by SHA_SST1 (SHA_oneID (SHA (Plain_PW) + SALT_oneID) + SALT_SST1).

Thereafter, the first service apparatus 200a may decrypt the encrypted and stored password when the user requests a login, and perform user authentication.

Meanwhile, the integrated authentication device 300 encrypts and stores the password, but the integrated authentication device 300 applies only the user salt value and encrypts the primary encrypted password using a two-way encryption method (SES) (S435). Therefore, the password stored in the integrated authentication device 300 becomes AES_oneID (SHA_oneID (SHA (Plain_PW) + SALT_oneID)) At this time, it is preferable that the encryption key is not shared with any service devices.

Thereafter, the user may register user authentication information through the first service device 200a and then request additional subscription to another service device, that is, the second service device 200b.

The subscription request is transmitted to the integrated authentication device 300 through the second service device 200b (S440).

As such, the integrated authentication device 300 that receives the additional subscription request for the other service device of the pre-registered user decrypts the previously stored user's password AES_oneID (SHA_oneID (SHA (Plain_PW) + SALT_oneID)), and user salt value Service that restored the encrypted password SHA_SST1 (SHA (Plain_PW) + SALT_oneID) + SALT_SST1), and the second service that requested additional subscription to the restored primary encryption password It transmits to the device 200b (S445).

In operation S450, the second service apparatus 200b encrypts the received first encrypted password by applying a service provider salt value assigned thereto and stores the second encrypted password (S450).

Since the service provider salt value of the second service apparatus 200b is SALT_SST2, the password is encrypted in the second service apparatus 200a as SHA_SST1 (SHA_oneID (SHA (Plain_PW) + SALT_oneID) + SALT_SST1).

As a result, the first service device 200a, the second service device 200b, and the integrated authentication device 300 each have a different encrypted password.

Through the above process, the integrated authentication device 300 and the first and second service devices 200a and 200b share authentication information for integrated authentication with each other. In this case, the shared authentication information may be stored with different encryption values. As a result, even if authentication information is exposed in one device, security problems may be prevented from occurring to other devices.

The authentication information management method for integrated authentication according to the present invention may be implemented in a software form readable through various computer means and recorded on a computer readable recording medium. Here, the recording medium may include a program command, a data file, a data structure, etc. alone or in combination. The program instructions recorded on the recording medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in computer software. For example, the recording media may be magnetic media such as hard disks, floppy disks, and magnetic tapes, optical disks such as compact disk read only memory (CD-ROM), digital video disks (DVD), Magnetic-Optical Media, such as floppy disks, and hardware devices specially configured to store and execute program instructions, such as ROM, random access memory (RAM), flash memory, and the like. do. Examples of program instructions may include high-level language code that can be executed by a computer using an interpreter as well as machine code such as produced by a compiler. Such hardware devices may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In addition, the program instructions may be deployed to be executed on a single computer or on multiple computers located on one device or distributed across a plurality of devices and interconnected by a communication network.

Specific embodiments of the subject matter described in this specification have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order but still achieve desirable results. As an example, the process depicted in the accompanying drawings does not necessarily require that particular depicted or sequential order to obtain desirable results. In certain implementations, multitasking and parallel processing may be advantageous.

As described above, although the present specification and drawings disclose preferred embodiments of the present invention, it is understood that other modifications based on the technical idea of the present invention can be implemented in the technical field to which the present invention pertains. It is self-evident to those of ordinary knowledge. In addition, although specific terms are used in the specification and the drawings, they are only used in a general sense to easily explain the technical contents of the present invention and to help the understanding of the present invention, and are not intended to limit the scope of the present invention.

According to the above-mentioned solution, the present invention provides a combined environment in which a plurality of service devices share authentication information of a user including a password, wherein the plurality of service devices are provided with information for user authentication, for example, user ID. While sharing user authentication information such as a corresponding password, security can be improved by allowing service devices to encrypt and manage different values.

In particular, in the present invention, even if the authentication information is exposed by hacking or the like in any one of the service devices that share the user's authentication information for identity integration, the other service device cannot know the authentication information encrypted and managed by the other service device. It can continue to provide stable services.

100: user device
200, 200a, 200b: service unit
300: integrated authentication device
400: network

Claims (13)

delete delete delete delete delete delete delete delete A service device that provides a specific service to the user device,
Setting a service provider salt value having a unique value for each service provider;
Transmitting user authentication information including information on a user's password received from the user device to an integrated authentication device;
Adding a user salt value having a unique value for each user to the password from the integrated authentication device, and receiving user authentication information that is firstly encrypted by a one-way encryption method;
Performing second encryption by applying the service provider salt value to the first encrypted user authentication information; And
Storing the second encrypted user authentication information;
Authentication information management method for integrated authentication comprising a. delete delete Integrated authentication device,
Receiving user authentication information to be used for integrated authentication from a specific service device;
Generating a user salt value having a unique value for each user;
Adding the user salt value to a password included in the user authentication information and first encrypting the user authentication information by a one-way encryption method;
Transmitting the first encrypted user authentication information to one or more service devices used by the user; And
Re-encrypting and storing the first encrypted user authentication information using a shared encryption key;
Authentication information management method for integrated authentication comprising a. delete

Images