Method and apparatus for packet classification based on user authentication for differential security services in shipboard networks

Abstract

To provide a user authentication-based packet classification method and apparatus for providing differentiated security services in a ship network.SOLUTION: A user authentication-based packet classification method includes the steps of: receiving an authorization code request message from a user terminal including a client; authenticating and authorizing a user of the client based on the authorization code request message; transmitting an authorization code response message to the user terminal in response to the authorization code request message; receiving an access token request message from the user terminal based on the authorization code response message; and transmitting an access token response message including an access token to the user terminal in response to the access token request message.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a packet classification technique based on user authentication, and more particularly to a method and apparatus for packet classification based on user authentication for providing differential security services in ship networks. [Background technology]

[0002] With the changing environment in the shipbuilding, marine and port industries, such as the introduction of autonomous ships that apply cutting-edge digital technology and artificial intelligence, the need for ship networks to prepare for the era of autonomous ships is also increasing rapidly.In addition, the need for cyber security is also increasing rapidly due to the increase in various network connections and information sharing between ships and shore, and between major systems on ships.

[0003] In fact, the severity of damage caused by marine accidents is more than six times that of road traffic, meaning there is a high risk of secondary damage occurring at sea, which is an evacuation space in the event of an accident. Cyber ​​attacks on operation technology (OT) systems have increased by 900% since 2017. It was also reported that cyber attacks across the entire marine industry increased fourfold between February and May 2020.

[0004] Due to the nature of ships, cybersecurity equipment must be operated with limited resources, and research into a suitable optimized ship security system is needed. Ships must be designed to operate a cybersecurity system with limited network equipment and resources, as they navigate rivers and oceans for a certain period of time. Therefore, in order to use cybersecurity gateways that have been used on land in ship networks, their efficiency needs to be improved, and the integration of services with the next generation of security technologies that will continue to evolve is also required.

[0005] Next-generation security technology expands the scope of application of security technology from the network layer to the application layer in a single security product. In other words, next-generation security technology is configured to provide multiple integrated security services rather than a single service.

[0006] However, since it is usually not necessary for all network packets to use all security services, it is necessary to improve efficiency by providing differential security services for each user class in the next generation security technology. Also, it is necessary to provide differential network and security services according to the security class, sensitivity, origin, etc. of the packet, rather than simply controlling the access authority of the system. In particular, it is necessary to improve the inefficiency of the conventional next generation security technology, such as redundancy check for repeated access of an initially authorized address. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Korean Patent Publication No. 10-2021-0001728 (2021.01.06) Summary of the Invention [Problem to be solved by the invention]

[0008] The present invention has been derived to address the needs of the prior art, and an object of the present invention is to provide a method and apparatus for packet classification based on user authentication, which can improve the operational efficiency of a security gateway used in a ship network environment.

[0009] Another object of the present invention is to provide a method and apparatus for user authentication-based packet classification that can provide differential security services through integrated authentication-based packet classification that leverages open standard protocols for authorization. [Means for solving the problem]

[0010] A packet classification method based on user authentication according to one aspect of the present invention for solving the above technical problems is a packet classification method based on user authentication for differential security services of a ship network performed by a service provider including a processor, and includes the steps of receiving an authentication code request message from a user terminal including a client, approving authentication and authority for a user of the client based on the authentication code request message, transmitting an authentication code response message to the user terminal in response to the authentication code request message, receiving an access token request message based on the authentication code response message from the user terminal, and transmitting an access token response message including an access token to the user terminal in response to the access token request message.

[0011] The packet classification method based on user authentication may further include the steps of receiving a resource request message including the access token from the user terminal, and transmitting a resource response message including a resource or resource information to the user terminal in response to the resource request message.

[0012] The packet classification method based on user authentication may further include a step of referring to a user class management table for providing differential security services based on a user class defined in an extension parameter in the resource request message, and a step of applying differential security services to packets of the user terminal based on an action according to the user class defined in the user class management table.

[0013] The method for classifying packets based on user authentication may further include a step of changing a processing procedure for packet data based on a priority queue according to the user class.

[0014] The method for packet classification based on user authentication may further include receiving a pre-registration of a client service from the client.

[0015] The packet classification method based on user authentication may further include a step of defining an extension parameter specifying a user class for differential security services based on user authentication in a response (hypertext transfer protocol) corresponding to the access token response message of the authentication server of the service provider.

[0016] According to another aspect of the present invention, a packet classification device based on user authentication for a ship network differential security service includes a memory storing at least one instruction for classifying packets based on user authentication, and a processor coupled to the memory for executing the at least one instruction, wherein the at least one instruction causes the processor to perform the following steps: receiving an authentication code request message from a user terminal including a client, approving authentication and authorization for a user of the client based on the authentication code request message, transmitting an authentication code response message to the user terminal in response to the authentication code request message, receiving an access token request message from the user terminal based on the authentication code response message, and transmitting an access token response message including an access token to the user terminal in response to the access token request message.

[0017] The packet classification device based on user authentication may be further configured such that the processor performs the steps of receiving a resource request message including the access token from the user terminal, and transmitting a resource response message including a resource or resource information to the user terminal in response to the resource request message.

[0018] The user authentication based packet classification device may be further configured to perform the steps of: the processor referring to a user class management table for providing differential security services based on a user class defined in an extension parameter in the resource request message; and applying differential security services to packets of the user terminal based on an action by the user class defined in the user class management table.

[0019] The user authentication based packet classification device may be configured to further perform a step in which the processor changes a processing procedure for packet data based on a priority queue according to the user class.

[0020] The user class management table may include a class field, a priority field, and an action field. The class field is a class tag indicating a user class and may be defined by a service provider. The action field may define a type of security service to be performed on the corresponding traffic or a preset action for each class.

[0021] The extension parameters may include a user class field that defines a user class and a priority, a class information field that displays version information of the user class management table, and a constraints field.

[0022] The user authentication based packet classification apparatus may be further configured such that the processor performs the step of receiving a pre-registration of a client service from the client.

[0023] The user authentication-based packet classification device may be further configured to: define, in a hypertext transfer protocol (HTTP) response corresponding to the access token response message of the authentication server of the service provider, an extension parameter specifying a user class for user authentication-based differential security services. Effect of the Invention

[0024] According to the present invention, by providing differential security services through packet classification based on integrated authentication utilizing an open standard protocol for authentication, it is possible to improve packet detection and response speed and improve the efficiency of network resource utilization.

[0025] In addition, according to the present invention, the operation functions of differential security services based on user authentication can be easily designed, and the functions of a security gateway for managing user classes in a ship network can be efficiently defined.

[0026] In addition, according to the present embodiment, an extension parameter is defined that can classify users into tokens issued by the single sign-on authentication (SSO) of the ship network access party according to the security requirements of each ship system, and predefined actions for differential security services can be effectively performed based on a user class management table including settings for the user class defined by the extension parameter and the action determined by the user class.

[0027] Furthermore, according to this embodiment, in a ship network environment with limited resources, differential security services based on user classes can be provided to conserve resources, and packets can be detected accurately and quickly through a data processing process based on priority queues based on user classes, thereby improving security response speed. [Brief description of the drawings]

[0028] [Figure 1] 1 is a flowchart for explaining a packet classification method based on user authentication for differential security services of a ship network according to an embodiment of the present invention (hereinafter simply referred to as a "packet classification method"); [Diagram 2] 2 is an exemplary diagram for explaining an extension parameter of a security gateway that can be adopted in the packet classification method of FIG. 1; [Diagram 3] 2 is an exemplary diagram for explaining a data processing process based on a priority queue of a security gateway that can be adopted in the packet classification method of FIG. 1; [Figure 4] 4 is a detailed exemplary diagram of a packet processing procedure that can be adopted in the data processing process based on the priority queue of FIG. 3; [Diagram 5] 13 is a schematic block diagram of a configuration of a packet classification device (hereinafter simply referred to as a "packet classification device") based on user authentication for differential security services of a ship network according to another embodiment of the present invention. [Figure 6] 11 is an exemplary diagram illustrating an access control procedure of a ship network in which a packet classification device according to another embodiment of the present invention can be adopted. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0029] The present invention can be modified in various ways and can have various embodiments, and a specific embodiment will be described in detail with reference to the drawings. However, this is not intended to limit the present invention to the specific embodiment, and it should be understood that the present invention includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention.

[0030] Terms such as first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms may be used only to distinguish one component from another. For example, a first component may be named a second component, and similarly, the second component may be named the first component, without departing from the scope of the invention. The term "and / or" includes a combination of two or more associated listed items or any of two or more associated listed items.

[0031] In the examples of this application, "at least one of A and B" can mean "at least one of A or B" or "at least one of a combination of one or more of A and B." Also, in the examples of this application, "one or more of A and B" can mean "one or more of A or B" or "one or more of a combination of one or more of A and B."

[0032] When an element is referred to as being "coupled" or "connected" to another element, it should be understood that it may be directly coupled or connected to the other element, but that there may also be other elements between them. On the other hand, when an element is referred to as being "directly coupled" or "directly connected" to another element, it should be understood that there are no other elements between them.

[0033] The terms used in this application are merely used to describe certain embodiments and are not intended to limit the present invention. A singular expression includes a plural expression unless the context clearly indicates otherwise. In this application, the terms "include" or "have" are intended to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should be understood not to preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0034] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the present invention belongs. Terms as commonly used and predefined should be interpreted as having a meaning consistent with the meaning they have in the context of the relevant art, and should not be interpreted as idealized or overly formal unless expressly defined in this application.

[0035] Hereinafter, a preferred embodiment of the present invention will be described in more detail with reference to the accompanying drawings. The following detailed description is provided for illustrative purposes only and should not be construed as limiting the concept of the present invention to any specific physical configuration. In describing the present invention, the same reference numerals are used for the same components on the drawings, and duplicated descriptions of the same components are omitted, in order to facilitate overall understanding.

[0036] FIG. 1 is a flowchart illustrating a packet classification method based on user authentication for differential security services in a ship network according to an embodiment of the present invention (hereinafter simply referred to as a "packet classification method").

[0037] The packet classification method of this embodiment may be performed through the interaction of a source owner (100), a client (200), an authorization server (300), and a resource server (400).

[0038] Here, the source user 100 may refer to a user located inside the ship network corresponding to a specific source, a user outside the ship corresponding to a specific source, or a user terminal used by such a user. The user terminal may include a personal computer, a personal portable communication device, a mobile terminal, etc.

[0039] The client (200) may refer to a user terminal and a means, such as software, installed in the user terminal that can transmit and receive signals and data with the service provider (500) according to a preset procedure or protocol, or may refer to a component, such as hardware, that performs a function corresponding to such a means.

[0040] The combination of source user (100) and client (200) may simply be referred to as a user terminal, as a user that accesses the ship's network or accesses other user terminals or data within the ship's network.

[0041] The authentication server (300) and the resource server (400) can be regarded as a service provider (500) that provides an integrated authentication (single sign-on, SSO) service based on an access token and a packet classification service based on user authentication using the same. The authentication server can be regarded as an authorization server, and the service provider (500) may include a ship network administrator.

[0042] Referring to FIG. 1, in an integrated authentication process that can be adopted in a packet classification method, a client (200) can pre-register a client service with an authentication server (300) (S10).

[0043] Next, the source user (100) can request a service from the client (200) (S11). The client (200) can check the source user's (100) access to the service request.

[0044] Next, the client 200 can request an authorization code from the authentication server 300 (S12). The authentication server 300 can verify the client 200's access to the authorization code request.

[0045] Then, the authentication server (300) can authenticate the source user (100) through communication with the source user (100) and share information regarding the authorization of the source user (100) (S13). Also, the authentication server (300) can transmit an authentication code response to the authentication code request to the client (200) (S14).

[0046] Next, the client (200) can request an access token from the authentication server (300) based on the authentication code response of the authentication server (300) (S15).

[0047] Then, the authentication server (300) can transmit an access token response to the client (200) in response to the access token request of the client (200) (S16). The access token response message may include an extension parameter. The extension parameter includes a parameter definition of the authentication server that can manage a user class for the operation of a differential security service. The extension parameter can be defined in a form to be included in the body of a hypertext transfer protocol (HTTP) response.

[0048] Then, the client (200) can request a resource from the resource server (400) using the authenticated user and their authority defined in the extension parameters in the access token (S17). The resource request message may include the access token.

[0049] Then, the resource server 400 may transmit a request response message to the client 200 in response to the resource request message including the access token from the client 200 (S18). The request response message may include the requested resource.

[0050] The client 200 can then transmit the request response message received from the resource server 400 and the corresponding service response to the source user 100. The service response message may include a resource and information about the resource.

[0051] FIG. 2 is an exemplary diagram for explaining extension parameters of a security gateway that can be adopted in the packet classification method of FIG.

[0052] 2, the authentication server of this embodiment can issue a valid access token in response to an access token request from a client. In this case, the authentication server can define extension parameters (22) for the access token included in the access token response message (20).

[0053] The access token response message 20 may have the form of an HTTP response message. For example, the access token response message 20 may have a status line, a header, and a body, and the extension parameters 22 may be defined in the form of being added to the body.

[0054] For example, in this embodiment, the status line of the access token response message (20) is displayed as "Content-Type: application / json;charset=UTF-8", the header is displayed as two lines, "Cache-Control: no-stroe" and "Pragma: no-cache", and the body including the extended parameters (22) is displayed as eight lines.

[0055] The five lines of text can be displayed in the order listed below. “access_token”:“2YotnFZFEjr1zCsicMWpAA”, “token-type”:“bearer”, “expires_in”:3600, “refresh_token”:“tGzv3JOkF0XG5Qx2TIKWIA”, “scope”:“create”,

[0056] Furthermore, the three lines of the extension parameters (22) defined in the present text can be defined as follows: “user_class”:1, “class_info”:3, “constraint”:“!location:boston”

[0057] Among the items of the extended parameters (22), the user class defines the user class and priority, and defines the action to be taken based on the return value of the class tag in the user class management table defined in the authentication server.

[0058] Among the items of the extended parameters (22), the class information (class info.) defines version information of the user class management table, i.e., version information of the user class management table that determines the class value of the user class, and is intended to assist in management of whether or not a class has been updated to match the latest class table.

[0059] Among the items of the extended parameters (22), the constraint defines further matters that need to be observed, and defines the contents of the constraints that need to be observed in addition to the user class information defined in the user class.

[0060] In this way, according to the present embodiment, in order to provide differential security services based on user authentication, extended parameters for user class management can be defined and used. In other words, in a security gateway that provides multiple security services such as unified threat management (UTM), in order to operate and manage security services differentially according to user classes, extended parameters can be defined and used in the present embodiment.

[0061] Next, the user class management table for providing the above-mentioned differential security service will be described in more detail.

[0062] A service provider, for example, a ship network manager, can define a class management field in advance to manage users who connect to the network. That is, the authentication server can define or have a class management table to manage the access control level of users. For example, the authentication server can have a list for specific users who do not need a separate security check.

[0063] Also, the authentication server can create a class table based on an internet protocol (IP) address, a port number, and a protocol according to the security requirements of the service provider.

[0064] The user class management table may include fields for source address, source port, destination address, destination port, protocol, class or return value, priority, and action.

[0065] The fields of the user class management table, along with their descriptions and examples, are shown in Table 1 below.

[0066] [Table 1]

[0067] In Table 1, the class field is a class tag that indicates a user class and can be defined by a service provider. For example, if the return value of the class tag is 0, the class can be defined as performing all security services for all user traffic in a basic state where no priority is given. Also, if the return value of the class tag is a positive number such as 1, the class can be used to define user priorities and actions according to the security requirements of the service provider.

[0068] Also, in Table 1, the action field can be used to define the type of security service to be performed on the corresponding traffic, e.g., an action for each pre-defined class such as a firewall, an intrusion detection system (IDS), etc.

[0069] Fig. 3 is an exemplary diagram for explaining a data processing process based on a priority queue of a security gateway that can be adopted in the packet classification method of Fig. 1. Also, Fig. 4 is a detailed exemplary diagram for a packet processing procedure that can be adopted in the data processing process based on the priority queue of Fig. 3.

[0070] In this embodiment, the security gateway may be at least a part of a service provider or ship network operator.

[0071] Referring to Fig. 3, the security gateway 30 is provided between the ship external user 40 and the ship network, and between the ship internal users 31, 32, and can provide networking and security services and process data based on a priority queue. The security gateway 30 may also be connected to a specific server 50 belonging to the ship network. The specific server 50 may be a business server and may be at least a part of the ship network manager.

[0072] The business server 50 may include a user interface 70 that returns class tags 72 based on the user class management table. The user interface 70 may be configured to support single sign-on (SSO) authentication of users inside or outside the vessel. The users may include first through fourth users (user1, user2, user3, user4).

[0073] The user interface 70 can generate and return a class tag for a user who has accessed the interface through integrated authentication based on an access token received after user authentication is completed.

[0074] In this embodiment, the class tag of the first user is 0, the class tag of the second user is 3, the class tag of the third user is 1, and the class tag of the fourth user is 2, for example.

[0075] In the above case, the business server (50) can process the corresponding data or packets according to a pre-set or stored priority list (42) for each class tag (S43), as shown in Fig. 4. That is, by packet processing based on the priority queue, the packet processing order may be changed from the order in which the packets entered, i.e., the order written as User 1's packet, User 2's packet, User 3's packet, and User 4's packet, to the order written as User 3's packet, User 4's packet, User 2's packet, and User 1's packet.

[0076] In this way, the business server 50 can execute a business, for example, process data of the ship network, according to the class tag. That is, the business server 50 processes a plurality of services in sequence, but can function to check whether a user's packet has passed, or whether it has passed before or after, based on the corresponding class tag information, and then process the packet.

[0077] FIG. 5 is a schematic block diagram of a configuration of a user authentication based packet classifier ("packet classifier") for differential security services in a ship network according to another embodiment of the present invention.

[0078] 5, the packet classification device 500 may be configured as at least some of the functional units or components of a service provider or a ship network administrator. The service provider or ship network administrator may be configured as some of the functional units or components of a business server, and may be implemented as a specific router or a specific switch having the functionality of a router or switch in the ship network, depending on the implementation example.

[0079] Such a packet classification device 500 may include at least one processor 510, a memory 520, and a transceiver 530 that is connected to and communicates with a security gateway mounted on a router or switch of a ship network. The packet classification device 500 may further include an input interface device 540, an output interface device 550, and a storage device 560. Each component included in the packet classification device 500 is connected to each other by a bus 570 to communicate with each other.

[0080] Furthermore, each component included in the packet classification device 500 may be connected via an individual interface or individual bus centered around the processor 510, rather than via a common bus 570. For example, the processor 510 may be connected to at least one of the memory 520, the transceiver device 530, the input interface device 540, the output interface device 550, and the storage device 560 via a dedicated interface.

[0081] The processor 510 may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to embodiments of the present invention are performed.

[0082] Each of the memory 520 and the storage device 560 may be composed of at least one of a volatile storage medium and a non-volatile storage medium, for example, the memory 520 may be composed of at least one of a read only memory (ROM) and a random access memory (RAM).

[0083] The transceiver 530 may include a sub-communication system for communicating with the security gateway, which may be configured to support wired and / or wireless communication methods.

[0084] The input interface device (540) may include at least one selected from input means such as a keyboard, a microphone, a touchpad, a touchscreen, etc., and an input signal processing unit that maps or processes signals input by the at least one input means with pre-stored instructions.

[0085] The output interface device (550) may include an output signal processing unit that maps or processes a signal output under the control of the processor (510) into a pre-stored signal form or level, and at least one output means that outputs a signal or information in the form of vibration, light, etc. according to a signal from the output signal processing unit. The at least one output means may include at least one selected from output means such as a speaker, a display device, a printer, an optical output device, and a vibration output device.

[0086] The aforementioned processor (510) can execute program commands stored in at least one of the memory (520) and the storage device (560). The program commands may include at least one command according to an integrated authentication procedure based on an access token (see FIG. 1), at least one command according to a data processing procedure based on a priority queue (see FIGS. 3 and 4), etc.

[0087] According to the packet classification device 500 of the present embodiment, a class tag for user class management can be defined by extending the authentication framework of an open standard protocol for authorization presented in the IETF (Internet Engineering Task Force) RFC (Request for Comments) 6749 standard for OAuth 2.0. For example, an extension parameter for providing a differential security service can be further defined in the HTTP response entity-body of an authorization server defined in the conventional OAuth 2.0 IETF RFC 6749, thereby improving the operation efficiency of a cyber security gateway.

[0088] In addition, according to the above-described embodiment, the operation functions of differential security services based on user authentication can be easily designed, and the functions of the security gateway for user class management in the ship network can be efficiently defined.

[0089] In addition, according to the above-described embodiment, an extension parameter is defined that can classify users into tokens issued by the single sign-on authentication (SSO) of the ship network access party according to the security requirements of each ship system, and pre-defined actions for differential security services can be effectively performed based on a user class management table including settings for the user class defined by the extension parameter and the action determined by the user class.

[0090] Furthermore, according to the above-mentioned embodiment, in a ship network environment with limited resources, differential security services according to user classes can be provided to save resources, and packets can be detected accurately and quickly through a data processing process based on priority queues according to user classes, thereby improving security response speed.

[0091] FIG. 6 is an exemplary diagram illustrating an access control procedure of a ship network in which a packet classification device according to still another embodiment of the present invention can be adopted.

[0092] 6, a ship network may be configured to include an apparatus for access control between submarine networks within a ship (hereinafter, simply referred to as "access control apparatus") (600). The submarine networks may include an operational technology (OT) network (610), an information technology (IT) network (620), a crew network (630), and the like.

[0093] Here, the OT network (610) may include a first gateway (G / W, 611), a plurality of user terminals (user devices, 614), a sensor (sensor, 612) connected to a specific user terminal, an actuator (actuator, 613) connected to a specific user terminal, etc. The IT network (620) may include a second gateway (G / W, 621), a plurality of user terminals (624), etc. Also, the crew network (630) may include a third gateway (G / W, 631), a plurality of user terminals (634), etc.

[0094] The access control device 600 may be implemented as a network control device based on user authentication so as to control data traffic between lower networks in the ship network, and may be provided at a higher layer of the lower network. Specifically, the access control device 600 may be implemented as a computer device for a service provider or ship network manager, and may provide differential security services based on user authentication when exchanging data between the OT network 610, the IT network 620, and the crew network 630, or between these internal networks and external users.

[0095] For example, when an external network (700) or a user inside the ship accesses a specific lower network, the access control device (600) can form an authorized data flow ("authorized flow") for packet data in a differential security service environment by controlling a security gateway (G / W) based on user authentication of the user and an access token given after authentication (see "Data flow by the control device"). In addition, the access control device (600) can operate to prevent unauthorized data flows ("unauthorized flows") from occurring by blocking the passage of packets that have failed user authentication or by denying access to the corresponding lower network.

[0096] The OT network (610), IT network (620) and crew network (630) can be connected to a ship network access control device (hereinafter simply referred to as the access control device) (600) via their respective gateways (G / W) (611, 621, 631), or a network access control channel based on user authentication controlled by the access control device (600).

[0097] The operation of the method according to the embodiment of the present invention may be embodied as a computer readable program or code in a computer readable recording medium. The computer readable recording medium includes any kind of recording device in which information readable by a computer system is stored. In addition, the computer readable recording medium may be distributed among computer systems connected via a network, and the computer readable program or code may be stored and executed in a distributed manner.

[0098] The computer-readable recording medium may also include hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. The program instructions may include not only machine code, such as produced by a compiler, but also high-level language code that can be executed by a computer using an interpreter, etc.

[0099] Although some aspects of the invention have been described in the context of an apparatus, it may also be presented as a corresponding method description, where a block or apparatus corresponds to a method step or a feature of a method step. Similarly, aspects described in the context of a method may be presented as a corresponding block or item, or as a feature of a corresponding apparatus. Some or all of the method steps may be performed by (or using) a hardware apparatus, such as, for example, a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, at least one or more of the most important method steps may be performed by such an apparatus.

[0100] In an embodiment, a programmable logic device (e.g., a field programmable gate array) may be used to perform some or all of the functions of the methods described herein. In an embodiment, a field programmable gate array may work in conjunction with a microprocessor to perform one of the methods described herein. In general, the methods are preferably performed by any hardware device.

[0101] Although the present invention has been described above with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various modifications and variations of the present invention can be made without departing from the spirit and scope of the present invention as set forth in the following claims.

Claims

1. 1. A method for packet classification based on user authentication for differential security services in a ship network performed by a service provider including a processor, comprising: receiving an authentication code request message from a user terminal including a client; confirming authentication and authorization for the user of the client based on the authentication code request message; transmitting an authentication code response message to the user terminal in response to the authentication code request message; receiving an access token request message based on the authentication code response message from the user terminal; issuing an access token in response to an access token request from the user terminal via the access token request message; transmitting an access token response message including an access token to the user terminal in response to the access token request message; Including, The access token includes an extension parameter, and the extension parameter includes a class tag for management of each class of the corresponding user.

2. receiving a resource request message including the access token from the user terminal; transmitting a resource response message including resources or resource information to the user equipment in response to the resource request message; The method of claim 1, wherein the resource request message is generated by the user terminal to request resources from the resource server of the service provider according to an authentication user and an authority of the authentication user defined in an extension parameter in the resource request message.

3. referring to a user class management table for providing differential security services based on a user class defined in an extension parameter in the resource request message; applying a differential security service to packets of the user terminal based on an action according to the user class defined in the user class management table; The method for classifying packets based on user authentication according to claim 2, further comprising:

4. 4. The method for classifying packets based on user authentication according to claim 3, further comprising the step of changing a processing procedure for packet data based on the priority queue according to the user class.

5. The user class management table includes a class field, a priority field, and an action field, The class field is a class tag that indicates a user class and is defined by a service provider. The method of claim 3, wherein the action field defines a type of security service to be performed on the corresponding traffic or a preset class-specific action.

6. 4. The method of claim 3, wherein the extended parameters include a user class field that defines a user class and a priority, a class information field that displays version information of a user class management table, and a restriction field.

7. The method of claim 1, wherein the access token response message has a form of a hypertext transfer protocol (HTTP) response message.

8. The method of claim 1 , further comprising the step of receiving a pre-registration of a client service from the client.

9. a memory storing at least one instruction for classifying packets based on user authentication for differential security services of the ship network; a processor coupled to said memory for executing said at least one instruction; Including, The at least one instruction causes the processor to: receiving an authentication code request message from a user terminal including a client; confirming authentication and authorization for the user of the client based on the authentication code request message; transmitting an authentication code response message to the user terminal in response to the authentication code request message; receiving an access token request message based on the authentication code response message from the user terminal; issuing an access token in response to an access token request from the user terminal via the access token request message; transmitting an access token response message including an access token to the user terminal in response to the access token request message; Do the following: A packet classification device based on user authentication, wherein the access token includes an extension parameter, and the extension parameter includes a class tag for management of each class of the corresponding user.

10. The processor further performs the steps of receiving a resource request message from the user terminal, the resource request message including the access token; and transmitting a resource response message to the user terminal, the resource response message including a resource or resource information in response to the resource request message; The packet classification device based on user authentication according to claim 9, wherein the resource request message is generated by the user terminal to request resources from the resource server of the service provider according to an authentication user and an authority of the authentication user defined in an extension parameter in the resource request message.

11. The packet classification device based on user authentication of claim 10, wherein the processor further performs the steps of: referencing a user class management table for providing differential security services based on a user class defined in an extension parameter in the resource request message; and applying differential security services to packets of the user terminal based on an action by the user class defined in the user class management table.

12. The device for classifying packets based on user authentication according to claim 11, wherein the processor further performs a step of changing a processing procedure for packet data based on a priority queue according to the user class.

13. The user class management table includes a class field, a priority field, and an action field, The class field is a class tag that indicates a user class and is defined by a service provider. The device for classifying packets based on user authentication according to claim 11, wherein the action field defines a type of security service or a preset action for each class to be performed on the corresponding traffic.

14. 12. The device for classifying packets based on user authentication according to claim 11, wherein the extended parameters include a user class field for defining a user class and a priority, a class information field for displaying version information of a user class management table, and a restriction field.

15. 10. The device for packet classification based on user authentication of claim 9, wherein the processor further performs the step of receiving a pre-registration of a client service from the client.

16. The user authentication based packet classification device of claim 9, wherein the access token response message has a form of a hypertext transfer protocol (HTTP) response message.

Images