Web traffic detection and access control method using authentication context information

Abstract

A user access control system and method are disclosed, which can control access to a service by detecting user-level authentication-based threats in incoming web traffic. The user access control system receives identification information of a target user and identification information of a target terminal, generates an authentication context using these, combines the generated authentication context with web traffic incoming from an external source, detects user-level authentication-based threats in the web traffic to generate a detection result, and controls the target user's access to the service using the generated detection result. By doing so, access to the service can be controlled by detecting user-level authentication-based threats through the authentication context in the web traffic.

Description

Technology Field

[0001] The present invention relates to a user access control system and a user access control method using the same, and more specifically, to a user access control system capable of controlling access to any service by any user's account and a user access control method using the same. Background Technology

[0002] Both firewalls and Web Application Firewalls (WAFs) aim to block external threats by inspecting traffic, but there is a critical difference in which layer and what data is inspected.

[0003] First of all, the aforementioned firewall is a network security system that monitors and controls the flow of data (traffic) inside and outside the network according to predetermined security rules, thereby blocking unauthorized malicious traffic or external intrusions and protecting important data.

[0004] On the other hand, the aforementioned web firewall may be a security solution that analyzes and blocks web traffic to prevent attacks targeting web applications. Specifically, the web firewall defends against attacks such as SQL (Structured Query Language) injection, XSS (Cross-Site Scripting), and DDoS (Distributed Denial of Service), and can prevent information leakage, tampering, and illegal logins of web services by supplementing vulnerabilities in the web layer that general firewalls cannot protect against. In other words, the web firewall is positioned between the web server and the user to filter HTTP / HTTPS communication and to detect and block malicious requests.

[0005] However, the aforementioned web firewall fails to identify authentication-based attacks, such as sharing user accounts or hijacking login sessions, and thus cannot perform defense against them. Here, the aforementioned authentication-based attack may be a cyber attack in which an attacker illegally accesses a system and steals data by stealing or deceiving legitimate user account information (ID, password, etc.) and using the stolen authentication information.

[0006] As such, since the above web firewall cannot identify the identity of users and connected terminals solely through the analysis of web traffic from the outside, a problem may arise in that it cannot determine duplicate logins of the same account, session reuse, insider access, etc. The problem to be solved

[0007] The objective of the present invention, which aims to solve the aforementioned problems, is to provide a user access control system capable of detecting user-level authentication-based threats in incoming web traffic and controlling access to a service.

[0008] In addition, another objective of the present invention is to provide a user access control method using the above-described user access control method. means of solving the problem

[0009] A user access control system according to an embodiment of the present invention for achieving the above objective includes an integrated authentication module and a web firewall module. The integrated authentication module receives identification information of a target user and identification information of a target terminal from a target terminal, which is one of at least one user terminal, in order to access an arbitrary service through the target user's account, and creates an authentication context using the received identification information of the target user and identification information of the target terminal. The web firewall module receives the authentication context from the integrated authentication module, combines the received authentication context with web traffic flowing in from the outside, detects user-unit authentication-based threats in the web traffic combined with the authentication context to generate a detection result, and transmits the generated detection result to the integrated authentication module. The integrated authentication module controls the target user's access to the service using the detection result received from the web firewall module.

[0010] The web firewall module above can combine the authentication context with the web traffic by inserting the authentication context into the HTTP (HyperText Transfer Protocol) header of the web traffic.

[0011] The above integrated authentication module, in generating the authentication context using the identification information of the target user and the identification information of the target terminal, generates pseudonymous user identification information for the target user corresponding to the identification information of the target user, generates pseudonymous terminal identification information for the target terminal corresponding to the identification information of the target terminal, and can generate the authentication context including the pseudonymous user identification information and the pseudonymous terminal identification information.

[0012] The above integrated authentication module can perform an electronic signature on the generated authentication context. The web firewall module can generate the detection result by detecting user-level authentication-based threats in the web traffic combined with the authentication context, and can generate the detection result by detecting user-level authentication-based threats in the web traffic combined with the authentication context for which an electronic signature has been performed.

[0013] The web firewall module can generate the detection result by detecting whether multiple authentication-based threat patterns are included within the web traffic combined with the authentication context, in order to detect user-level authentication-based threats in the web traffic combined with the authentication context.

[0014] The above authentication context may include the time of login to the target user's account, the IP address of access to the target user's account, and the duplicate login status to the target user's account.

[0015] The above authentication-based threat patterns may include a first authentication-based threat pattern in which a target user's account is simultaneously accessed through multiple terminals within a first reference time, a second authentication-based threat pattern in which the access IP address is changed within a second reference time for the target user's account, and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the target user's account.

[0016] The integrated authentication module above, in controlling the target user's access to the service using the detection result, determines one of a plurality of risk levels as the user risk level, which is the risk level for the target user, using the detection result, and controls access to the service for the target user's account according to one of a control method corresponding to the user risk level among a plurality of access control methods corresponding to each of the risk levels.

[0017] The above risk levels may include at least one immediate action risk level and at least one cumulative action risk level. The access control methods may include at least one immediate control method corresponding to each of the immediate action risk levels and immediately controlling access to the service for the target user's account, and at least one cumulative control method corresponding to each of the cumulative action risk levels and controlling access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score.

[0018] The above cumulative risk score can be increased each time it is controlled by the above cumulative control method.

[0019] Next, a user access control method according to an embodiment of the present invention for achieving the above objective is a method performed by a user access control system that exchanges signals with at least one user terminal, and comprises the steps of: receiving identification information of the target user and identification information of the target terminal from a target terminal, which is one of the user terminals, in order to access an arbitrary service through the account of the target user; generating an authentication context using the received identification information of the target user and identification information of the target terminal; combining the generated authentication context with web traffic flowing in from the outside; detecting a user-unit authentication-based threat in the web traffic combined with the authentication context and generating a detection result; and controlling the access of the target user to the service using the generated detection result.

[0020] The step of combining the authentication context with the web traffic may include the step of combining the authentication context by inserting it into the HTTP (HyperText Transfer Protocol) header of the web traffic.

[0021] The step of generating the authentication context using the identification information of the target user and the identification information of the target terminal may include: generating pseudonymous user identification information for the target user corresponding to the identification information of the target user; generating pseudonymous terminal identification information for the target terminal corresponding to the identification information of the target terminal; and generating the authentication context including the pseudonymous user identification information and the pseudonymous terminal identification information.

[0022] The step of generating the authentication context using the identification information of the target user and the identification information of the target terminal may further include the step of performing an electronic signature on the generated authentication context. The step of generating the detection result by detecting user-unit authentication-based threats in the web traffic combined with the authentication context may include the step of generating the detection result by detecting user-unit authentication-based threats in the web traffic combined with the authentication context for which the electronic signature has been performed.

[0023] The step of detecting user-level authentication-based threats in the web traffic combined with the authentication context and generating the detection result may include the step of detecting whether multiple authentication-based threat patterns are included within the web traffic combined with the authentication context and generating the detection result.

[0024] The above authentication context may include the time of login to the target user's account, the IP address of access to the target user's account, and the duplicate login status to the target user's account.

[0025] The above authentication-based threat patterns may include a first authentication-based threat pattern in which a target user's account is simultaneously accessed through multiple terminals within a first reference time, a second authentication-based threat pattern in which the access IP address is changed within a second reference time for the target user's account, and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the target user's account.

[0026] The step of controlling the target user's access to the service using the detection result may include: determining one of a plurality of risk grades using the detection result as a user risk grade, which is a risk grade for the target user; and controlling access to the service for the target user's account according to one of a control method corresponding to the user risk grade among a plurality of access control methods corresponding to each of the risk grades.

[0027] The above risk levels may include at least one immediate action risk level and at least one cumulative action risk level. The access control methods may include at least one immediate control method corresponding to each of the immediate action risk levels and immediately controlling access to the service for the target user's account, and at least one cumulative control method corresponding to each of the cumulative action risk levels and controlling access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score.

[0028] The above cumulative risk score can be increased each time it is controlled by the above cumulative control method. Effects of the invention

[0029] According to the user access control system and user access control method using the same according to the present invention as described above, the user access control system combines an authentication context generated when logging in with a target user's account with web traffic flowing in from the outside, thereby enabling a Web Application Firewall (WAF) capable of defending against traffic attacks in said web traffic to preemptively detect user-level authentication-based threats and control service access to said target user's account using the detection results.

[0030] In addition, as the user access control system provides the authentication context to the web firewall after performing an electronic signature on it, the web firewall can combine the authentication context of integrity (free from tampering and verified authenticity of the authentication subject) with the web traffic.

[0031] In addition, the user access control system can ensure safety when responding to legal regulations regarding the use of personal information and when integrating with external services by pseudonymizing the user's identification information and the terminal's identification information to create and utilize the authentication context. Brief explanation of the drawing

[0032] FIG. 1 is a conceptual diagram illustrating a user access control system according to one embodiment of the present invention. FIG. 2 is a block diagram for explaining in detail an example of the user access control system of FIG. 1. FIG. 3 is a block diagram for explaining in detail another example of the user access control system of FIG. 1. FIG. 4 is a flowchart for explaining a user access control method performed by the user access control system of FIG. 1. Figure 5 is a flowchart for explaining in detail the process of creating an authentication context among the user access control methods of Figure 4. Figure 6 is a flowchart for explaining in detail the service access control process among the user access control methods of Figure 4. Figure 7 is a table to explain an example of a risk level and access control method according to an authentication-based threat pattern in the user access control method of Figure 4. FIG. 8 is a conceptual diagram illustrating an example of a generalized computing system that can be applied to the user access control system of FIG. 1. Specific details for implementing the invention

[0033] In addition to the above objectives, other objectives and features of the present invention will become apparent through the description of embodiments with reference to the accompanying drawings.

[0034] The present invention is capable of various modifications and may have various embodiments, and specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the invention to specific embodiments, and it should be understood that the invention includes all modifications, equivalents, and substitutions that fall within the spirit and scope of the invention.

[0035] Terms such as first, second, A, B, etc., may be used to describe various components, but said components should not be limited by said terms. These terms are used solely for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be named the second component, and similarly, the second component may be named the first component. The term "and / or" includes a combination of a plurality of related described items or any of a plurality of related described items.

[0036] In the embodiments of the present application, "at least one of A and B" may mean "at least one of A or B" or "at least one of one or more combinations of A and B". Additionally, in the embodiments of the present application, "at least one of A and B" may mean "at least one of A or B" or "at least one of one or more combinations of A and B".

[0037] When it is stated that one component is "connected" or "connected" to another component, it should be understood that while it may be directly connected or connected to that other component, there may also be other components in between. On the other hand, when it is stated that one component is "directly connected" or "directly connected" to another component, it should be understood that there are no other components in between.

[0038] The terms used in this application are used merely to describe specific embodiments and are not intended to limit the invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, terms such as "comprising" or "having" are intended to specify the presence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0039] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by those skilled in the art to which the present invention pertains. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in this application.

[0040] Meanwhile, even if technology is known prior to the filing date of this application, it may be included as part of the composition of the present invention if necessary, and such details are described in this specification to the extent that they do not obscure the spirit of the present invention. However, in describing the composition of the present invention, detailed descriptions of matters that are known prior to the filing date and are obvious to those skilled in the art may obscure the spirit of the present invention; therefore, overly detailed descriptions of known technology are omitted.

[0041] FIG. 1 is a conceptual diagram for explaining a user access control system according to one embodiment of the present invention, FIG. 2 is a block diagram for explaining in detail one example of the user access control system of FIG. 1, and FIG. 3 is a block diagram for explaining in detail another example of the user access control system of FIG. 1.

[0042] Referring to FIGS. 1 and 3, the user access control system (100) according to the present embodiment may be a control system that controls access to any service through login authentication while performing the function of a Web Application Firewall (WAF). Specifically, the user access control system (100) may control access to the service by performing a web firewall process on web traffic flowing in from the outside after performing login authentication with any user's account by exchanging signals with at least one user terminal (200), for example, a plurality of user terminals (200).

[0043] The above user terminal (200) is a computer system capable of exchanging signals with the user access control system (100) via a wired or wireless network, for example, the Internet, and may be a general computer system such as a laptop or desktop, or a mobile terminal such as a smartphone or tablet PC.

[0044] The user access control system (100) may include, for example, an integrated authentication module (110) and a web firewall module (120). The user access control system (100) may include one server system or multiple server systems. For example, the user access control system (100) may be configured as a single server system, as shown in FIG. 2, where both the integrated authentication module (110) and the web firewall module (120) are in operation. Alternatively, the user access control system (100) may be configured as a first server system where the integrated authentication module (110) is in operation and a second server system where the web firewall module (120) is in operation, as shown in FIG. 3.

[0045] First, when a target terminal, which is one of the user terminals (200), inputs login information to access a target service, which is an arbitrary service, through the account of a target user, which is an arbitrary user, and transmits it to the user access control system (100), the user access control system (100) can perform a login authentication process using the received login information. The login information may include, for example, user authentication information including the ID of the target user and the password for the account of the target user.

[0046] In this embodiment, when the target terminal transmits the login information to the user access control system (100), it may also transmit the identification information of the target user and the identification information of the target terminal. That is, the integrated authentication module (110) may receive the identification information of the target user and the identification information of the target terminal from the target terminal.

[0047] Next, the integrated authentication module (110) can create an authentication context using the identification information of the target user and the identification information of the target terminal received from the target terminal.

[0048] To explain specifically with an example, the integrated authentication module (110) may generate pseudonym user identification information for the target user corresponding to the received identification information of the target user, generate pseudonym terminal identification information for the target terminal corresponding to the received identification information of the target terminal, and then generate the authentication context including the pseudonym user identification information and the pseudonym terminal identification information.

[0049] Subsequently, the integrated authentication module (110) can perform an electronic signature on the generated authentication context and then transmit the electronically signed authentication context to the web firewall module (120). In this embodiment, the integrated authentication module (110) can transmit the electronically signed authentication context as metadata.

[0050] To explain specifically with an example, the integrated authentication module (110) may generate a private key and a public key for the electronic signature of the authentication context and store them in a separate key management unit, then electronically sign the authentication context using the private key provided from the key management unit, and then transmit the electronically signed authentication context to the web firewall module (120). At this time, the integrated authentication module (110) may also transmit the public key to the web firewall module (120) together with the electronically signed authentication context when transmitting it. Alternatively, the integrated authentication module (110) may transmit the public key to the web firewall module (120) before transmitting the electronically signed authentication context.

[0051] In addition to the pseudonym user identification information and the pseudonym terminal identification information, the authentication context may further include the time of login to the target user's account, the IP address accessed to the target user's account, and the duplicate login status to the target user's account. Here, the accessed IP address may include an endpoint IP.

[0052] The web firewall module (120) can verify the integrity of the digitally signed authentication context after receiving it from the integrated authentication module (110). For example, the web firewall module (120) can verify the integrity of the digitally signed authentication context using the public key that it receives and stores. At this time, if the integrity verification of the digitally signed authentication context passes, the web firewall module (120) can perform the following process; however, if the integrity verification of the digitally signed authentication context does not pass, it can request the digitally signed authentication context again from the integrated authentication module (110) and receive new data from the integrated authentication module (110) to perform the integrity verification.

[0053] The web firewall module (120) can combine the received authentication context with web traffic flowing in from the outside when the integrity verification of the electronically signed authentication context passes. In this embodiment, the web firewall module (120) can combine the received authentication context by inserting it into the HTTP (HyperText Transfer Protocol) header of the web traffic.

[0054] Subsequently, the web firewall module (120) can detect user-level authentication-based threats in the web traffic combined with the authentication context and generate detection results.

[0055] To explain specifically with an example, the web firewall module (120) can generate the detection result by detecting whether multiple authentication-based threat patterns are included in the web traffic combined with the authentication context. That is, the web firewall module (120) can detect whether the authentication-based threat patterns are included in the web traffic by using the pseudonym user identification information, the pseudonym terminal identification information, the login time, the connection IP address, and the duplicate login status included in the authentication context.

[0056] In the present embodiment, the authentication-based threat patterns may include a first authentication-based threat pattern in which a plurality of terminals simultaneously access a single account of the target user within a first reference time, a second authentication-based threat pattern in which the access IP address is changed within a second reference time for a single account of the target user, and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the account of the target user.

[0057] The web firewall module (120) can generate the detection result and then transmit the generated detection result to the integrated authentication module (110).

[0058] The integrated authentication module (110) can control the target user's access to the target service using the detection result received from the web firewall module (120).

[0059] To explain specifically with an example, the integrated authentication module (110) can determine one of a plurality of risk levels as the user risk level, which is the risk level for the target user, using the received detection result. Subsequently, the integrated authentication module (110) can control access to the target service for the target user's account according to one of a control method corresponding to the user risk level among a plurality of access control methods corresponding to each of the risk levels.

[0060] In this embodiment, the risk classes may include at least one immediate action risk class and at least one cumulative action risk class.

[0061] Additionally, the access control methods may include at least one immediate control method corresponding to each of the immediate action risk levels and at least one cumulative control method corresponding to each of the cumulative action risk levels.

[0062] The above immediate control method can immediately control access to the target service for the target user's account. For example, the above immediate control method may include at least one of an immediate blocking method that immediately blocks access to the target service for the target user's account, a method that restricts future access to the target service through the target user's account or strengthens access rights (authority regarding the scope of service usage), and a method that immediately performs additional authentication for the target user's account and controls access to the target service according to the result of the additional authentication.

[0063] The above cumulative control method can control access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score. In this embodiment, the cumulative risk score may be increased each time it is controlled by the cumulative control method. That is, the integrated authentication module (110) determines the cumulative action risk grade as the user risk grade based on the received detection result, and each time it is controlled according to the cumulative control method, the cumulative risk score may be increased by the score corresponding to the cumulative action risk grade.

[0064] In this way, the integrated authentication module (110) can control access to the service for the target user's account when, as a result of controlling according to the cumulative control method, the cumulative risk score up to that point is greater than or equal to the reference score.

[0065] In this embodiment, the method for controlling access to the service for the target user's account when the accumulated risk score is greater than or equal to the reference score may include at least one of sending a risk alarm message to the target terminal, restricting access to the target service through the target user's account, downgrading the access authority to the target service through the target user's account, performing additional authentication for the target user's account, and blocking access to the target service for the target user's account.

[0066] Meanwhile, the integrated authentication module (110) may control access to the service for the target user's account in stages according to the accumulated risk score. For example, when the accumulated risk score is greater than or equal to a first threshold score, a risk alarm message may be sent to the target terminal; when it exceeds the first threshold score and becomes greater than or equal to a second threshold score, access to the target service through the target user's account may be restricted or the access authority to the target service through the target user's account may be downgraded; and when it exceeds the second threshold score and becomes greater than or equal to a third threshold score, access to the target service for the target user's account may be blocked while requiring additional authentication for the target user's account.

[0067] Below, we intend to explain in detail the user access control method performed by the user access control system described above.

[0068] FIG. 4 is a flowchart for explaining a user access control method performed by the user access control system of FIG. 1, FIG. 5 is a flowchart for explaining in detail the process of creating an authentication context among the user access control method of FIG. 4, FIG. 6 is a flowchart for explaining in detail the service access control process among the user access control method of FIG. 4, and FIG. 7 is a table for explaining an example of a risk level and an access control method according to an authentication-based threat pattern in the user access control method of FIG. 4.

[0069] Referring to FIGS. 4 to 7, in a user access control method according to the present embodiment, the user access control system (100) may receive identification information of the target user and identification information of the target terminal from the target terminal (S100). For example, the user access control system (100) may receive identification information of the target user and identification information of the target terminal from the integrated authentication module (110).

[0070] Next, the user access control system (100) can generate an authentication context using the identification information of the target user and the identification information of the target terminal received from the target terminal (S200). For example, the user access control system (100) can generate an authentication context using the identification information of the target user and the identification information of the target terminal received from the target terminal in the integrated authentication module (110).

[0071] To specifically explain the process of creating the authentication context (S200) above, first, the user access control system (100) can generate pseudonym user identification information for the target user using the received identification information of the target user (S210). Additionally, the user access control system (100) can generate pseudonym terminal identification information for the target terminal using the received identification information of the target terminal (S220). At this time, steps S210 and S220 may be performed simultaneously, or step S210 may be performed first and step S220 later, or step S220 may be performed first and step S210 later. Subsequently, the user access control system (100) can generate the authentication context including the generated pseudonym user identification information and the generated pseudonym terminal identification information (S230). Subsequently, the user access control system (100) can perform an electronic signature on the generated authentication context (S240).

[0072] In this embodiment, the authentication context may further include, in addition to the pseudonym user identification information and the pseudonym terminal identification information, the time of login to the target user's account, the IP address accessed to the target user's account, and the duplicate login status to the target user's account.

[0073] Next, the user access control system (100) can combine the electronically signed authentication context with web traffic flowing in from the outside (S300). For example, the user access control system (100) can transmit the electronically signed authentication context from the integrated authentication module (110) to the web firewall module (120), and then combine the authentication context with the web traffic at the web firewall module (120).

[0074] Next, the user access control system (100) can detect user-level authentication-based threats in the web traffic combined with the authentication context and generate a detection result (S400). For example, the user access control system (100) can detect user-level authentication-based threats in the web traffic combined with the authentication context in the web firewall module (120) and generate a detection result.

[0075] To specifically explain the process of detecting the authentication-based threat (S400) above, the user access control system (100) can generate the detection result by detecting whether the authentication-based threat patterns are included in the web traffic combined with the authentication context. That is, the user access control system (100) can detect whether the authentication-based threat patterns are included in the web traffic by using the pseudonym user identification information, the pseudonym terminal identification information, the login time, the connection IP address, and the duplicate login status included in the authentication context.

[0076] The above authentication-based threat patterns may include, for example, a first authentication-based threat pattern in which a target user's account is simultaneously accessed through multiple terminals within a first reference time as shown in FIG. 7, a second authentication-based threat pattern in which the access IP address is changed within a second reference time as a target user's account, and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the target user's account.

[0077] Next, the user access control system (100) can control the target user's access to the target service using the generated detection result (S500). For example, the user access control system (100) can transmit the generated detection result from the web firewall module (120) to the integrated authentication module (110), and the integrated authentication module (110) can control the target user's access to the target service using the transmitted detection result.

[0078] To specifically explain the user access control process (S500) based on the detection result, the user access control system (100) can determine one of the risk levels as the user risk level using the detection result (S510). Subsequently, the user access control system (100) can control access to the target service for the target user's account according to one of the access control methods that corresponds to the user risk level (S520).

[0079] In the present embodiment, the risk levels may include at least one immediate action risk level and at least one cumulative action risk level. Additionally, the access control methods may include at least one immediate control method corresponding to each of the immediate action risk levels and at least one cumulative control method corresponding to each of the cumulative action risk levels.

[0080] The above immediate control method can immediately control access to the target service for the target user's account. For example, the above immediate control method may include at least one of an immediate blocking method that immediately blocks access to the target service for the target user's account, a method that restricts future access to the target service through the target user's account or strengthens access rights (authority regarding the scope of service usage), and a method that immediately performs additional authentication for the target user's account and controls access to the target service according to the result of the additional authentication.

[0081] The above cumulative control method can control access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score. In this embodiment, the cumulative risk score may be increased each time it is controlled by the cumulative control method. That is, the integrated authentication module (110) determines the cumulative action risk grade as the user risk grade based on the received detection result, and each time it is controlled according to the cumulative control method, the cumulative risk score may be increased by the score corresponding to the cumulative action risk grade.

[0082] For example, referring to FIG. 7, when the first authentication-based threat pattern is detected in the web traffic, the user access control system (100) can determine the user risk level to be one of the immediate action risk levels and control the target user's access to the target service according to one of the immediate control methods among the access control methods.

[0083] Additionally, if the second authentication-based threat pattern is detected within the web traffic, the user access control system (100) can determine the user risk level to be one of the immediate action risk levels and control the target user's access to the target service according to one of the immediate control methods among the access control methods.

[0084] Additionally, if the third authentication-based threat pattern is detected within the web traffic, the user access control system (100) can determine the user risk level as one of the cumulative risk levels and control the target user's access to the target service according to one of the cumulative control methods among the access control methods.

[0085] As such, according to the present embodiment, the user access control system (100) combines the authentication context generated when logging in to the target user's account with the web traffic flowing in from the outside, thereby enabling a web application firewall (WAF) capable of defending against traffic attacks in the web traffic to preemptively detect user-level authentication-based threats and control service access to the target user's account using the detection results.

[0086] Additionally, as the user access control system (100) provides the authentication context to the web firewall after performing an electronic signature on it, the web firewall can combine the authentication context with integrity (without tampering and with verified authenticity of the authentication subject) with the web traffic.

[0087] In addition, the user access control system (100) can ensure safety when responding to legal regulations regarding the use of personal information and when linking with external services by pseudonymizing the user's identification information and the terminal's identification information to create and utilize the authentication context.

[0088] FIG. 8 is a conceptual diagram illustrating an example of a generalized computing system that can be applied to the user access control system of FIG. 1.

[0089] Referring to FIG. 8, the user access control system (100) may be executed in a generalized computing system (1000) such as FIG. 8. For example, if the user access control system (100) is configured as a single server system including the integrated authentication module (110) and the web firewall module (120) as in FIG. 2, the single server system may be executed in the generalized computing system (1000). Additionally, if the user access control system (100) is configured as two server systems each including the integrated authentication module (110) and the web firewall module (120) as in FIG. 3, each of the two server systems may be executed in the generalized computing system (1000).

[0090] The computing system (1000) may include at least one processor (1100) and a memory (1200) that stores instructions that instruct the at least one processor to perform at least one step.

[0091] The processor (1100) may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to embodiments of the present invention are performed. The memory (1200) may be composed of at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory (1200) may be composed of at least one of a read-only memory (ROM) and a random access memory (RAM).

[0092] The computing system (1000) may include a communication interface (1300) that communicates with an external device through an external communication network. Additionally, the computing system (1000) may further include an input interface (140), an output interface (150), a storage device (160), etc. Each component included in the computing system (1000) may be connected by a bus (1700) to communicate with one another.

[0093] The operation of the method according to an embodiment of the present invention can be implemented as a computer-readable program or code on a computer-readable recording medium. A computer-readable recording medium includes all types of recording devices in which information that can be read by a computer system is stored. Additionally, the computer-readable recording medium may be distributed across networked computer systems, allowing computer-readable programs or code to be stored and executed in a distributed manner.

[0094] In addition, computer-readable recording media may include hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Program instructions may include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0095] Some aspects of the invention have been described in the context of a device, but may also be described according to a corresponding method, wherein a block or device corresponds to a method step or a feature of a method step. Similarly, aspects described in the context of a method may also be described according to a corresponding block or item or a feature of a corresponding device. Some or all of the method steps may be performed by (or using) a hardware device, such as, for example, a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, at least one of the most important method steps may be performed by such a device.

[0096] In the embodiments, a programmable logic device (e.g., a field-programmable gate array) may be used to perform some or all of the functions of the methods described herein. In the embodiments, a field-programmable gate array may operate with a microprocessor to perform one of the methods described herein. Generally, it is preferable that the methods be performed by some hardware device.

[0097] Although the present invention has been described with reference to preferred embodiments, those skilled in the art will understand that various modifications and changes can be made to the invention without departing from the spirit and scope of the invention as described in the following claims. Explanation of the symbols

[0098] 100: User Access Control System 110: Integrated Authentication Module 120 : Web Firewall Module 200 : User Terminal

Claims

Claim 1 A user access control system comprising: an integrated authentication module that receives identification information of the target user and identification information of the target terminal along with login information for user authentication to access an arbitrary service through the account of the target user from a target terminal, which is at least one user terminal, and generates pseudonymous user identification information for the target user corresponding to the received identification information of the target user, generates pseudonymous terminal identification information for the target terminal corresponding to the received identification information of the target terminal, and generates an authentication context including the pseudonymous user identification information and the pseudonymous terminal identification information; and a web firewall module that receives the authentication context from the integrated authentication module, combines the received authentication context with web traffic flowing in from the outside, detects user-unit authentication-based threats in the web traffic combined with the authentication context to generate a detection result, and transmits the generated detection result to the integrated authentication module; wherein the integrated authentication module controls the access of the target user to the service using the detection result received from the web firewall module. Claim 2 A user access control system according to claim 1, wherein the web firewall module combines the authentication context with the web traffic by inserting the authentication context into the header of the HTTP (HyperText Transfer Protocol) of the web traffic. Claim 3 delete Claim 4 A user access control system according to claim 1, wherein the integrated authentication module performs an electronic signature on the generated authentication context, and the web firewall module detects user-unit authentication-based threats in the web traffic combined with the authentication context and generates the detection result, wherein the web firewall module detects user-unit authentication-based threats in the web traffic combined with the authentication context for which the electronic signature has been performed and generates the detection result. Claim 5 A user access control system according to claim 1, wherein the web firewall module detects user-unit authentication-based threats in web traffic combined with the authentication context and generates the detection result, by detecting whether a plurality of authentication-based threat patterns are included within the web traffic combined with the authentication context and generating the detection result. Claim 6 A user access control system according to claim 5, wherein the authentication context comprises: a time of login to the target user’s account; an IP address connected to the target user’s account; and a duplicate login status to the target user’s account. Claim 7 A user access control system according to claim 6, wherein the authentication-based threat patterns include: a first authentication-based threat pattern in which a plurality of terminals simultaneously access one account of the target user within a first reference time; a second authentication-based threat pattern in which the access IP address of one account of the target user is changed within a second reference time; and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the account of the target user. Claim 8 A user access control system according to claim 5, wherein the integrated authentication module controls access to the service of the target user using the detection result, determines one of a plurality of risk grades as a user risk grade which is a risk grade for the target user using the detection result, and controls access to the service of the target user's account according to one of a plurality of access control methods corresponding to the user risk grade among the risk grades. Claim 9 A user access control system according to claim 8, wherein the risk levels include at least one immediate action risk level; and at least one cumulative action risk level; and the access control methods include at least one immediate control method corresponding to each of the immediate action risk levels and immediately controlling access to the service for the target user's account; and at least one cumulative control method corresponding to each of the cumulative action risk levels and controlling access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score. Claim 10 A user access control system according to claim 9, wherein the cumulative risk score is increased each time it is controlled by the cumulative control method. Claim 11 A method for user access control performed by a user access control system that exchanges signals with at least one user terminal, comprising: receiving identification information of the target user and identification information of the target terminal, along with login information for user authentication to access an arbitrary service through the target user's account from a target terminal, which is one of the user terminals; generating pseudonym user identification information for the target user corresponding to the received identification information of the target user, generating pseudonym terminal identification information for the target terminal corresponding to the received identification information of the target terminal, and generating an authentication context including the pseudonym user identification information and the pseudonym terminal identification information; combining the generated authentication context with web traffic flowing in from the outside; detecting user-unit authentication-based threats in the web traffic combined with the authentication context and generating a detection result; and controlling the target user's access to the service using the generated detection result. Claim 12 A user access control method according to claim 11, wherein the step of combining the authentication context with the web traffic comprises the step of combining the authentication context by inserting it into the header of the HTTP (HyperText Transfer Protocol) of the web traffic. Claim 13 delete Claim 14 A user access control method according to claim 11, wherein the step of generating the authentication context further comprises the step of performing an electronic signature on the generated authentication context; and the step of detecting a user-unit authentication-based threat in the web traffic combined with the authentication context and generating the detection result comprises the step of detecting a user-unit authentication-based threat in the web traffic combined with the authentication context for which the electronic signature was performed and generating the detection result. Claim 15 A user access control method according to claim 11, wherein the step of detecting a user-unit authentication-based threat in the web traffic combined with the authentication context and generating the detection result comprises the step of detecting whether a plurality of authentication-based threat patterns are included in the web traffic combined with the authentication context and generating the detection result. Claim 16 A user access control method according to claim 15, wherein the authentication context comprises: a time of login to the target user's account; an IP address connected to the target user's account; and a duplicate login status to the target user's account. Claim 17 A user access control method according to claim 16, wherein the authentication-based threat patterns include: a first authentication-based threat pattern in which a plurality of terminals simultaneously access one account of the target user within a first reference time; a second authentication-based threat pattern in which the access IP address of one account of the target user is changed within a second reference time; and a third authentication-based threat pattern in which at least one traffic attack occurs while accessing the account of the target user. Claim 18 A user access control method according to claim 15, wherein the step of controlling access to the service by the target user using the detection result comprises: determining one of a plurality of risk levels using the detection result as a user risk level which is a risk level for the target user; and controlling access to the service for the target user's account according to one of a plurality of access control methods corresponding to the user risk level among the respective risk levels. Claim 19 A user access control method according to claim 18, wherein the risk levels include at least one immediate action risk level; and at least one cumulative action risk level; and the access control methods include at least one immediate control method corresponding to each of the immediate action risk levels and immediately controlling access to the service for the target user's account; and at least one cumulative control method corresponding to each of the cumulative action risk levels and controlling access to the service for the target user's account when the cumulative risk score to date is greater than or equal to a reference score. Claim 20 A user access control method according to claim 19, wherein the cumulative risk score is increased each time the cumulative control method is used.

Images