User authentication system, industrial control device connection-type user authentication device, and control method therefor

Abstract

A user authentication system, an industrial control device connection-type user authentication device, and a control method therefor are provided. The user authentication device comprises: a communication unit for receiving an authentication code from a device that requests access to an industrial control device (hereinafter, referred to as an access request device); and a processor that allows access to the industrial control device according to a verification result of a verification-performing entity for the authentication code, wherein the verification-performing entity is a verification server communicating with the user authentication device through the communication unit or a verification module included in the user authentication device, and the processor determines, on the basis of a pre-stored IP list, whether to request verification of the authentication code from the verification-performing entity.

Description

User authentication system, industrial control device-connected user authentication device and control method thereof

[0001] The present disclosure relates to a user authentication system, a user authentication device connected to an industrial control device, and a control method thereof.

[0002] Code-based data is used in many areas. Examples of code-based data include card numbers and account numbers used for payment, as well as IPIN numbers and resident registration numbers used for user identification.

[0003] However, there are frequent cases of data leaks during the use of this code. Card numbers are often printed on the card's surface, making them visible to others. Furthermore, card numbers are also leaked when magnetic stripe payments are made, transmitting them directly to the POS device.

[0004] There have been many attempts to use virtual code to prevent the actual code from being leaked, but data to identify the user was needed to search for the actual code corresponding to the virtual code.

[0005] However, in the case of OTP (One Time Password), a separate OTP generation device is required, which is inconvenient, and in particular, in the case of user terminals, there is a security vulnerability due to the leakage of seed data used for OTP generation.

[0006] Therefore, a method is needed to increase security by generating OTP codes, such as generating virtual security codes required for user authentication based on card data held by many users, without requiring a separate OTP generation device, and at the same time preventing seed data from being leaked.

[0007] The purpose of the embodiments disclosed in the present disclosure is to provide a user authentication system, an industrial control device-connected user authentication device, and a control method thereof.

[0008] The problems to be solved by the present disclosure are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

[0009] In order to achieve the above-described technical problem, an industrial control device-connected user authentication device according to one aspect of the present disclosure includes a communication unit that receives an authentication code from a device requesting access to an industrial control device (hereinafter, an access request device), and a processor that allows access to the industrial control device based on a verification result of a verification performing entity for the authentication code, wherein the verification performing entity is a verification server that communicates with the user authentication device through the communication unit or a verification module included in the user authentication device, and the processor can determine whether to request verification of the authentication code to the verification performing entity based on a pre-stored IP list.

[0010] In addition, the processor may check whether the IP of the access request device is included in the IP list, and if included, allow the access of the access request device to the industrial control device without requesting verification of the authentication code from the verification performing entity, and if not included, request verification of the authentication code from the verification performing entity.

[0011] Additionally, the IP list may include at least one IP of a device directly connected to the user authentication device for access to the industrial control device and a device remotely connected to the user authentication device for access to the industrial control device.

[0012] In addition, the processor can bypass an access request from the access request device without going through the verification process of the verification performing entity when there is an abnormality in the user authentication device based on a bypass function.

[0013] In addition, when the bypass function is implemented as a separate device, whether there is a problem with the user authentication device is determined by the separate device, and if it is determined that there is a problem with the user authentication device, the access request of the access request device is bypassed through the separate device, and if it is determined that there is no problem with the user authentication device, the authentication code can be transmitted to the user authentication device through the separate device.

[0014] Additionally, if the above bypass function is implemented as a separate device, the user authentication device can be implemented in the form of software installed on an industrial PC.

[0015] Additionally, a log of an access request device that is permitted to access the industrial control device may be managed by the verification server.

[0016] In addition, a user authentication system according to another aspect of the present disclosure for achieving the above-described technical task may include a user authentication device implemented in a form in which software is installed on an industrial PC, and a separate device for determining whether there is a problem with the user authentication device, bypassing an access request to an industrial control device of an access request device if it is determined that there is a problem with the user authentication device, and transmitting an authentication code received from the access request device to the user authentication device if it is determined that there is no problem with the user authentication device.

[0017] In addition, according to another aspect of the present disclosure for achieving the above-described technical task, a method for user authentication connected to an industrial control device includes a step of receiving an authentication code from a device requesting access to an industrial control device (hereinafter, an access request device), and a step of allowing access to the industrial control device based on a verification result of a verification performing entity for the authentication code, wherein the verification performing entity is a verification server communicating with the user authentication device or a verification module included in the user authentication device, and may further include a step of determining whether to request verification of the authentication code to the verification performing entity based on a pre-stored IP list after receiving the authentication code.

[0018] In addition, a computer program stored in a computer-readable recording medium for executing a method for implementing the present disclosure may be further provided.

[0019] In addition, a computer-readable recording medium recording a computer program for executing a method for implementing the present disclosure may be further provided.

[0020] According to the aforementioned problem solving means of the present disclosure, the security of the industrial control device can be enhanced by connecting a user authentication device to the industrial control device, causing the user authentication device to process access to the industrial control device and transmit the processing result to the industrial control device.

[0021] Additionally, the user authentication device can prevent processing delays in the user authentication device by allowing immediate access to IPs registered in the whitelist without going through the authentication code verification process through whitelist management.

[0022] Additionally, the bypass function allows access to industrial control devices without user authentication when the user authentication device has a hardware or software failure, thereby enabling temporary access to industrial control devices in situations where the user authentication device is not functioning properly.

[0023] The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

[0024] FIG. 1 is a schematic diagram illustrating a user authentication system according to one embodiment of the present disclosure.

[0025] FIG. 2 is a block diagram of an industrial control device-connected user authentication device according to one embodiment of the present disclosure.

[0026] FIG. 3 is a flowchart of a user authentication method for an industrial control device connection according to one embodiment of the present disclosure.

[0027] FIG. 4 is a diagram for explaining a whitelist management function according to one embodiment of the present disclosure.

[0028] FIG. 5 is a drawing for explaining a bypass function according to one embodiment of the present disclosure.

[0029] FIG. 6 and FIG. 7 are drawings for explaining a case where a bypass function according to one embodiment of the present disclosure is included in a separate device.

[0030] Throughout this disclosure, the same reference numerals denote the same components. This disclosure does not describe all elements of the embodiments, and any content that is common in the technical field to which this disclosure pertains or that overlaps between embodiments is omitted. The terms "part, module, element, block" used in the specification may be implemented in software or hardware, and depending on the embodiments, multiple "parts, modules, elements, blocks" may be implemented as a single component, or a single "part, module, element, block" may include multiple components.

[0031] Throughout the specification, when a part is said to be "connected" to another part, this includes not only direct connection but also indirect connection, and indirect connection includes connection via a wireless communication network.

[0032] Additionally, when a part is said to "include" a component, this does not mean that it excludes other components, but rather that it may include other components, unless otherwise specifically stated.

[0033] Throughout the specification, when we say that an element is "on" another element, this includes not only cases where the element is in contact with the other element, but also cases where another element exists between the two elements.

[0034] The terms first, second, etc. are used to distinguish one component from another, and the components are not limited by the aforementioned terms.

[0035] Singular expressions include plural expressions unless the context clearly indicates otherwise.

[0036] The identification codes for each step are used for convenience of explanation and do not describe the order of each step. Each step may be performed in a different order than specified unless the context clearly indicates a specific order.

[0037] The operating principle and embodiments of the present disclosure are described below with reference to the attached drawings.

[0038] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0039] Before proceeding, the meanings of terms used in this specification will be briefly explained. However, it should be noted that the explanation of terms is intended to aid understanding of this specification, and therefore, unless explicitly stated to limit the disclosure, they are not intended to limit the technical concepts of this disclosure.

[0040] As used herein, the term "device" encompasses a variety of devices capable of performing computational processing and providing results to a user. For example, a device may include a computer, a server, or a portable terminal, or may be any one of these.

[0041] Here, the computer may include, for example, a notebook, desktop, laptop, tablet PC, slate PC, etc. equipped with a web browser.

[0042] The above server device is a server that processes information by communicating with an external device, and may include an application server, a computing server, a database server, a file server, a game server, a mail server, a proxy server, and a web server.

[0043] The above portable terminal may include, for example, a wireless communication device that ensures portability and mobility, and may include all kinds of handheld-based wireless communication devices such as a PCS (Personal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), WiBro (Wireless Broadband Internet) terminal, a smart phone, and a wearable device such as a watch, a ring, a bracelet, an anklet, a necklace, glasses, contact lenses, or a head-mounted device (HMD).

[0044] In this specification, “character” is a component that constitutes a code, and includes all or part of uppercase alphabets, lowercase alphabets, numbers, and special characters.

[0045] In this specification, “code” means a string of characters.

[0046] In this specification, “authentication code” may mean an OTAC (One Time Authentication Code) temporarily generated for authentication of at least one of a user and a device.

[0047] In this specification, "authentication code generation function" refers to a function that generates an authentication code. Examples include, but are not limited to, a One Time Password (OTP).

[0048] In this specification, “detail code generation function” means a function that generates each detail code that constitutes an authentication code.

[0049] In this specification, “detail code combination function” means a function that generates a virtual code by combining or combining multiple detail codes.

[0050] In this specification, a "unit count" is defined as a unit set at a specific time interval and changed as the time interval elapses. For example, 1 count may be set and used at a specific time interval (e.g., 1.5 seconds).

[0051] In this specification, “storage location” means the point (count) on the track corresponding to the time when user or device (device) registration is requested.

[0052] In this specification, "industrial control devices" may include, but are not limited to, a Programmable Logic Controller (PLC), a Distributed Control System (DCS), a Remote Terminal Unit (RTU), a Human-Machine Interface (HMI), and an Industrial Control Systems (ICS). Here, the HMI may also be used as an input window for entering information necessary for controlling the industrial control devices.

[0053] Cyberattacks targeting industrial control systems have been on the rise recently. Among the components of industrial control systems, industrial control devices are a core component. A cyberattack targeting these devices could potentially cause damage to the entire industrial control system.

[0054] Accordingly, in the present disclosure, an industrial control device can be protected from hacking risks by using an authentication method using a dynamic authentication code (One-Time Authentication Code, OTAC).

[0055] Hereinafter, a user authentication system for a device attempting to access an industrial control device will be described with reference to FIG. 1.

[0056] FIG. 1 is a schematic diagram illustrating a user authentication system according to one embodiment of the present disclosure.

[0057] Referring to FIG. 1, a system (1) for user authentication for an industrial control device may include a user authentication device (10), an access request device (20), and an industrial control device (30). However, in some embodiments, the system (1) may include fewer or more components than the components illustrated in FIG. 1.

[0058] The user authentication device (10) is a device connected to the industrial control device (30) by a wire, and can allow or block an access request to the industrial control device (30) from the access request device (20) through user authentication.

[0059] The access request device (20) is a device that attempts to access an industrial control device (30). It may be a device at the same hierarchical level (Control Level) as the industrial control device (30), a device at a different hierarchical level (Field Level, Supervisory Level) from the industrial control device (30), or a remotely connected device.

[0060] The access request device (20) can request access to the industrial control device (30) by transmitting an authentication code input by the user or generated within the device (20) to the user authentication device (10).

[0061] When an authentication code is entered by the user into the access request device (20), the authentication code (OTAC) can be generated on a user terminal (not shown). The user terminal may be a mobile device or a smart card for identification or access (entry). However, the present invention is not limited thereto, and any device that includes an authentication code generation module can be used.

[0062] The industrial control device (30) can be set to lock or manipulate other terminals than the terminal to which the user authentication device (10) is connected. This ensures that other devices must unconditionally go through the user authentication device (10) to gain access to control the industrial control device.

[0063] Although the user authentication device (10) is described above as being wired to the industrial control device (30), the user authentication device (10) is not limited thereto and may be wirelessly connected to the industrial control device (30), in which case all terminals of the industrial control device (30) may be set or manipulated as locked.

[0064] When the user authentication device (10) receives an authentication code from the access request device (20), it can allow or block access to the industrial control device (30) of the access request device (20) based on the verification result of the verification performing entity for the authentication code.

[0065] At this time, the verification performing entity may be a verification module (not shown) included in the user authentication device (10), or may be a verification server (not shown) communicating with the user authentication device (10). That is, the user authentication device (10) may directly perform verification of the authentication code, or request it from the verification server (not shown).

[0066] However, before directly performing or requesting verification of an authentication code, the user authentication device (10) can first verify whether the device requesting access (20) is a device registered in the whitelist by verifying the IP address of the device requesting access. If the device requesting access (20) is a device registered in the whitelist, access can be granted immediately without having to go through the authentication code verification process.

[0067] Additionally, the user authentication device (10) may bypass access to the access request device (20) without the user authentication process, such as IP verification or authentication code verification, described above. A detailed description of this will be provided later.

[0068] Hereinafter, the user authentication device (10) will be described with reference to FIG. 2.

[0069] FIG. 2 is a block diagram of an industrial control device-connected user authentication device according to one embodiment of the present disclosure.

[0070] Referring to FIG. 2, the user authentication device (10) may include a communication unit (11), a memory (12), and a processor (13). However, in some embodiments, the user authentication device (10) may include fewer or more components than the components illustrated in FIG. 2.

[0071] The communication unit (11) may include one or more modules that enable wireless or wired communication between the user authentication device (10) and the access request device (20), between the user authentication device (10) and the industrial control device (30), between the user authentication device (10) and a verification server (not shown), between the user authentication device (10) and a bypass device to be described later, and between the user authentication device (10) and a communication network. For example, the communication unit may include at least one of a wired communication module, a wireless communication module, a short-range communication module, and a location information module.

[0072] The communication network can use various types of communication networks, for example, wireless communication methods such as WLAN (Wireless LAN), Wi-Fi, Wibro, WiMAX, and HSDPA (High Speed ​​Downlink Packet Access), or wired communication methods such as Ethernet, xDSL (ADSL, VDSL), HFC (Hybrid Fiber Coax), FTTC (Fiber to The Curb), and FTTH (Fiber to The Home) can be used.

[0073] Meanwhile, the communication network is not limited to the communication methods presented above, and may include all other widely known or future-developed communication methods in addition to the above-described communication methods.

[0074] The wired communication module may include various wired communication modules such as a Local Area Network (LAN) module, a Wide Area Network (WAN) module, or a Value Added Network (VAN) module, as well as various cable communication modules such as a Universal Serial Bus (USB), a High Definition Multimedia Interface (HDMI), a Digital Visual Interface (DVI), RS-232 (recommended standard 232), power line communication, or plain old telephone service (POTS).

[0075] The wireless communication module may include a wireless communication module that supports various wireless communication methods such as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), UMTS (universal mobile telecommunications system), TDMA (Time Division Multiple Access), LTE (Long Term Evolution), 4G, 5G, and 6G, in addition to a WiFi module and a Wireless Broadband module.

[0076] The short-range communication module is for short-range communication, and can support short-range communication using at least one of Bluetooth, RFID (Radio Frequency Identification), Infrared Data Association (IrDA), UWB (Ultra Wideband), ZigBee, NFC (Near Field Communication), Wi-Fi (Wireless-Fidelity), Wi-Fi Direct, and Wireless USB (Wireless Universal Serial Bus) technologies.

[0077] The memory (12) may store at least one process related to user authentication for an access request device (20) attempting to access an industrial control device (30).

[0078] The memory (12) can store data supporting various functions of the user authentication device (10), a program for the operation of the processor (13), can store input / output data (e.g., music files, still images, moving images, etc.), and can store a plurality of application programs (or applications) run on the user authentication device (10), data for the operation of the user authentication device (10), and commands. At least some of these application programs can be downloaded from an external server via wireless communication.

[0079] The memory (12) may include at least one type of storage medium among a flash memory type, a hard disk type, an SSD (Solid State Disk type), an SDD (Silicon Disk Drive type), a multimedia card micro type, a card type memory (e.g., SD or XD memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, and an optical disk. In addition, the memory (12) is separate from the user authentication device (10), but may be a database connected by wire or wirelessly.

[0080] The processor (13) can perform the aforementioned operations using a memory that stores data regarding an algorithm for controlling the operation of components within the user authentication device (10) or a program that reproduces the algorithm, and the data stored in the memory. In this case, the memory (12) and the processor (13) may each be implemented as separate chips. Alternatively, the memory (12) and the processor (13) may be implemented as a single chip.

[0081] In addition, the processor (13) can control one or a combination of the components discussed above to implement various embodiments according to the present disclosure described in FIGS. 3 to 7 below on the user authentication device (10).

[0082] Hereinafter, with reference to FIGS. 3 to 7, a user authentication process for strengthening the security of industrial control devices in the OT (Operational Technology) field will be described.

[0083] FIG. 3 is a flowchart of a user authentication method for an industrial control device connection according to one embodiment of the present disclosure.

[0084] FIG. 4 is a diagram for explaining a whitelist management function according to one embodiment of the present disclosure.

[0085] FIG. 5 is a drawing for explaining a bypass function according to one embodiment of the present disclosure.

[0086] FIG. 6 and FIG. 7 are drawings for explaining a case where a bypass function according to one embodiment of the present disclosure is included in a separate device.

[0087] Referring to FIG. 3, the processor (13) of the user authentication device (10) can receive an authentication code from a device (hereinafter, access request device) (20) requesting access to an industrial control device (30) through a communication unit (11) (S310).

[0088] Specifically, an engineering program for controlling an industrial control device (30) is installed in the access request device (20), and when the engineering program is executed to control the engineering industrial control device (30), a web or agent capable of inputting an authentication code is executed so that the authentication code can be input.

[0089] In this way, the authentication code entered through the web or agent can be transmitted to the user authentication device (10).

[0090] The processor (13) of the user authentication device (10) can allow access to the industrial control device (30) based on the verification result of the verification performing entity for the authentication code (S320).

[0091] According to an embodiment, the processor (13) may perform authentication code verification through a verification module included in the user authentication device (10). Specifically, the verification module may perform verification by comparing secret data included in the authentication code with previously stored secret data, and upon completion of verification, may transmit the verification result to the processor (13). The processor (13) may grant or deny access based on the verification result.

[0092] In some embodiments, the processor (13) may request verification of an authentication code from a verification server. Specifically, the verification server may perform verification by comparing the secret data included in the authentication code with previously stored secret data, and upon completion of verification, may transmit the verification result to the processor (13). The processor (13) may grant or deny access based on the verification result.

[0093] According to an embodiment, when communication with the verification server is possible, the processor (13) may request authentication code verification from the verification server, and when communication with the verification server is not possible, the authentication code verification may be performed through a verification module included in the user authentication device (10). Specifically, the verification server or verification module may perform verification through a comparison between secret data included in the authentication code and previously stored secret data, and upon completion of verification, may transmit the verification result to the processor (13). The processor (13) may permit or deny access based on the verification result.

[0094] The aforementioned secret data may be data generated using the user's identification information (such as a user ID or user key). Here, the user key may refer to a value assigned to the user during registration to generate an authentication code. The user key may be generated by the verification server and transmitted to the authentication code generation device, or it may be generated by the authentication code generation device.

[0095] In this way, the user authentication device (10) may perform user authentication for the access request device (20) through authentication code verification, but may also perform user authentication through IP verification without the authentication code verification process.

[0096] The processor (13) can determine whether to request verification of the authentication code to the verification performing entity based on the previously stored IP list (the whitelist described above).

[0097] Specifically, the processor (13) checks whether the IP of the access request device (20) is included in the IP list, and if the IP of the access request device (20) is included, the processor can allow the access of the access request device (20) to the industrial control device (30) without requesting verification of the authentication code from the verification performing entity. If the IP of the access request device (20) is not included, the processor can request verification of the authentication code from the verification performing entity as described above.

[0098] Here, the IP list may include at least one IP of a device directly connected to the user authentication device (10) for access to the industrial control device (30) and a device remotely connected to the user authentication device (10) for access to the industrial control device.

[0099] The IP list can be managed by the verification server. Specifically, the verification server can register the IP addresses of devices that will be granted access without authentication code verification in the IP list, and can also delete the IP addresses of specific devices from the IP list so that authentication code verification is required for future access by those devices.

[0100] Referring to FIG. 4, the processor (13) can receive an authentication code and the IP address of the corresponding device from the access request device (20) (S410).

[0101] The processor (13) can check whether the IP of the device is a white IP (check whether it is included in the IP list) (S420).

[0102] If the IP of the device is a white IP (included in the IP list), the processor (13) can immediately allow access to the device (S430).

[0103] If the IP of the device is not a white IP (not included in the IP list), the processor (13) can request authentication code verification as a verification performing entity (S440). That is, the request can be made to a verification module or a verification server.

[0104] The processor (13) receives a verification result from the verification performing entity (S450), and can allow or block (reject) access to the device based on the verification result (S460).

[0105] In addition, if a software or hardware problem occurs in the user authentication device (10) and it does not operate or does not respond normally to a request, all access requests may be temporarily (until the problem is resolved) passed without user authentication.

[0106] The processor (13) can bypass the access request of the access request device (20) without going through the verification process of the verification performing entity when there is an abnormality in the user authentication device (10) based on the bypass function.

[0107] Specifically, when there is an abnormality in the user authentication device (10), the bypass function included in the user authentication device (10) is activated so that an access request coming into the device can be passed directly.

[0108] Referring to FIG. 5, when the processor (130) receives an access request, if there is no problem with the user authentication device (10), it can determine whether to allow access to the access request device (20) through user authentication (IP verification or authentication code verification as described above). When the processor (130) receives an access request, if there is a problem with the user authentication device (10), access to the access request device (20) can be immediately allowed.

[0109] As described above, the bypass function may be included in the user authentication device (10), but the bypass function may also be implemented as a separate device (bypass switch).

[0110] In this case, when the bypass function is implemented as a separate device, the user authentication system (1) may further include a separate device. In this case, the separate device determines whether there is a problem with the user authentication device (10), and if it is determined that there is a problem with the user authentication device (10), it bypasses the access request for the industrial control device (30) of the access request device (20), and if it is determined that there is no problem with the user authentication device (10), it may transmit the authentication code received from the access request device (20) to the user authentication device (10).

[0111] Additionally, when the bypass function is implemented as a separate device, the user authentication device (10) can be implemented in a form in which software is installed on an industrial PC (e.g., IPC).

[0112] Additionally, when the bypass function is implemented as a separate device, whether there is an abnormality in the user authentication device (10) can be determined by the separate device.

[0113] An individual device can transmit information for a status check in real time or periodically to check for abnormalities in the user authentication device (10) (or IPC), and receive feedback on the information from the user authentication device (10). If there is no feedback on the information from the user authentication device (10) or an abnormal response is received, the individual device can determine that there is an abnormality in the user authentication device (10).

[0114] If it is determined that there is a problem with the user authentication device (10), the access request of the access request device (20) is bypassed through the individual device, and if it is determined that there is no problem with the user authentication device (10), the authentication code can be transmitted to the user authentication device (10) through the individual device.

[0115] Referring to FIGS. 6 and 7, a user authentication device (10) may be included in an IPC as a software module. Furthermore, the IPC may be connected to individual devices (40) via In / Out terminals (65, 66), and an access request device (20) and an industrial control device (30) may be connected to each of the individual devices (40). Additionally, a verification server (OTAC server) may be connected to another terminal (67) of the IPC.

[0116] In FIGS. 6 and 7, the verification server (OTAC server) is shown as being connected to a terminal (67) other than the In / Out terminal (65, 66) connected to the individual device (40), but depending on the embodiment, the verification server (OTAC server) may be connected to any one of the In / Out terminals (65, 66) connected to the individual device (40).

[0117] Figure 6 illustrates a case where there is no abnormality in the user authentication device (10).

[0118] Referring to Fig. 6, if it is determined that there is no abnormality in the user authentication device (10), among the terminals of the individual device (40), the terminal (61) to which the access request device (20) is connected and the terminal (62) connected to the In terminal (65) of the IPC can be connected, and the terminal (64) to which the industrial control device (30) is connected and the terminal (63) connected to the Out terminal (66) of the IPC can be connected.

[0119] In this state, when an access request is received from the access request device (20), an authentication code and an IP address are transmitted through the connection of terminals (61, 62), and the modular user authentication device (10) can perform user authentication through IP verification or authentication code verification as described above.

[0120] If it is confirmed that it is a white IP, or if it is not a white IP but the authentication code has been normally generated by the verification performing entity, the IPC (or the modular user authentication device (10) included in the IPC) can activate (ON) the Out terminal (66) to allow a connection with the individual device (40). If the connection is allowed in this way, the access request device (20) is able to access the industrial control device (30).

[0121] Figure 7 illustrates a case where there is an abnormality in the user authentication device (10).

[0122] Referring to Fig. 7, if it is determined that there is a problem with the user authentication device (10), the connection between the terminal (61) to which the access request device (20) is connected and the terminal (62) connected to the In terminal (65) of the IPC among the terminals of the individual device (40) may be disconnected, and the terminal (64) to which the industrial control device (30) is connected and the terminal (63) connected to the Out terminal (66) of the IPC may be disconnected.

[0123] In this state, when an access request is received from the access request device (20), the access request is bypassed through the individual device (40), so that the access request device (20) can immediately access the industrial control device (30).

[0124] Meanwhile, the log of the access request device (20) that is permitted to access the industrial control device (30) in this way can be managed by the verification server. Specifically, when a user (access request device (20)) accesses the industrial control device (30) through authentication code verification, IP verification, or bypass, the log data for the access can be stored in the verification server. Through this log data, the verification server can determine which user made a normal access or attempted an abnormal access at which time, and thereby can manage and monitor the user (access request device (10)) that attempted an abnormal access.

[0125] Below, a detailed description will be given of how an authentication code generation device (user terminal or access request device (20)) generates an authentication code.

[0126] The authentication code generation device can generate one or more detailed codes. A detailed code refers to a portion of the code that constitutes the authentication code. The authentication code may consist solely of detailed codes, or it may be formed by combining one or more detailed codes with a virtual security code generated by the OTP function to form an authentication code (OTAC).

[0127] The authentication code generation device includes a code generation function that generates an authentication code, and the code generation function includes a detail code generation function that generates one or more detail codes, and a detail code combination function that combines the detail codes to generate a virtual code (i.e., a rule for combining multiple detail codes).

[0128] That is, when the authentication code includes multiple detailed codes, the code generation function generates multiple detailed codes using multiple detailed code generation functions, and generates an authentication code by combining the multiple detailed codes into a preset combination using the detailed code combination function.

[0129] A plurality of detailed codes have a correlation that is used by an authentication code verification device (verification module or verification server) to search for a storage location of information that can identify a user or a device. That is, the authentication code verification device has a search algorithm, and the search algorithm extracts a plurality of detailed codes included in the authentication code, and searches for a storage location of identification information of a user or a device (a value assigned to a user (e.g., a user key, a user ID, etc.)) based on the correlation between the plurality of detailed codes. As an embodiment of the correlation between the plurality of detailed codes, the search algorithm can search for the storage location by calculating the correlation between the plurality of detailed codes from a transit point corresponding to one or more of the plurality of detailed codes. At this time, the transit points may be one or more, and there are no restrictions on the number and order.

[0130] In addition, as an embodiment of a plurality of detailed codes, the plurality of detailed codes may include a first code and a second code, and the authentication code generation device may include a first function and a second function as detailed code generation functions to generate the first code and the second code. The first code and the second code have a correlation for searching the storage location within the authentication code verification device, but the authentication code generation device may only include a first function for generating the first code and a second function for generating the second code as detailed code generation functions in order to increase security, and may not include data regarding the correlation between the first code and the second code.

[0131] As a specific example of the correlation between the first and second codes, the first and second codes may each perform a role in searching for the storage location. That is, the first code may include information about the transit point, and the second code may include information necessary for an operation to reach the storage location from the transit point.

[0132] Meanwhile, in one embodiment of the present disclosure, the first code may be generated based on the first count, and the second code may be generated based on the second count. In this case, the first count may be the number of unit counts that have elapsed from the initial time point at which the code generation function is executed in the authentication code generation device or the authentication code verification device to the time point at which the authentication code is generated, and the second count may include the number of unit counts that have elapsed from the time point at which the identification information is stored in the OTAC verification module.

[0133] That is, the first function that generates the first code is a function that provides a specific code value corresponding to the first count, and the second function that generates the second code is a function that provides a specific code value corresponding to the second count.

[0134] Below, we will specifically explain how the authentication code verification device (verification module or verification server) verifies the authentication code.

[0135] In one embodiment of the present disclosure, the authentication code verification device can verify the authentication code by comparing the time data at which the authentication code was received with the time data included in the authentication code.

[0136] Specifically, the authentication code verification device verifies whether the authentication code was normally generated. That is, after receiving the authentication code, the authentication code verification device checks whether the received authentication code was normally generated at the current time based on the information stored in the OTAC verification module (i.e., the code generation function and seed data (secret data)) to determine whether the authentication code is normal. The authentication code verification device applies the inverse function of the code generation function to the authentication code to find the count corresponding to the time at which the authentication code was generated. Since there is a difference between the time at which the authentication code was generated and the time at which the authentication code verification device receives the authentication code due to the transmission time or delay of the authentication code, the count at which the authentication code verification device receives the authentication code and the count at which the OTP number for authentication is generated may not match, and therefore the authentication code verification device allows a margin of error from the count at which the authentication code was received.

[0137] Meanwhile, in one embodiment of the present disclosure, an authentication code verification device can search for a storage location of user or device identification information based on the authentication code, extract the identification information, and perform user or device authentication based on the extracted identification information.

[0138] Although FIGS. 3 and 4 describe the steps as being executed sequentially, this is merely an example of the technical idea of ​​the present embodiment, and a person having ordinary skill in the technical field to which the present embodiment pertains can modify and apply various modifications and variations by changing the order described in FIGS. 3 and 4 or executing them in parallel without departing from the essential characteristics of the present embodiment, and therefore FIGS. 3 and 4 are not limited to a chronological order.

[0139] Meanwhile, in the above description, the steps described in FIGS. 3 and 4 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present disclosure. Furthermore, some steps may be omitted as needed, and the order of the steps may be changed.

[0140] Meanwhile, the disclosed embodiments may be implemented in the form of a recording medium storing computer-executable instructions. The instructions may be stored in the form of program code, and when executed by a processor, may generate program modules to perform the operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium.

[0141] Computer-readable storage media include all types of storage media that store instructions that can be deciphered by a computer. Examples include read-only memory (ROM), random access memory (RAM), magnetic tape, magnetic disks, flash memory, and optical data storage devices.

[0142] The disclosed embodiments have been described with reference to the attached drawings as described above. Those skilled in the art will understand that the present disclosure can be implemented in forms other than the disclosed embodiments without altering the technical spirit or essential features of the present disclosure. The disclosed embodiments are illustrative and should not be construed as limiting.

Claims

1. In a user authentication device connected to an industrial control device, A communication unit that receives an authentication code from a device requesting access to an industrial control device (hereinafter, “access request device”); and Including a processor that allows access to the industrial control device based on the verification result of the verification performing entity for the above authentication code, The above verification performing entity is a verification server that communicates with the user authentication device through the communication unit or a verification module included in the user authentication device. The above processor, Based on the previously stored IP list, the verification performing entity determines whether to request verification of the authentication code. User authentication device connected to industrial control devices.

2. In paragraph 1, The above processor, Check whether the IP of the access request device is included in the above IP list, and if included, allow access to the industrial control device of the access request device without requesting verification of the authentication code to the verification performing entity, and if not included, request verification of the authentication code to the verification performing entity. User authentication device connected to industrial control devices.

3. In paragraph 2, The above IP list includes at least one IP of a device directly connected to the user authentication device for access to the industrial control device and a device remotely connected to the user authentication device for access to the industrial control device. User authentication device connected to industrial control devices.

4. In paragraph 1, The above processor, Based on the bypass function, when there is an abnormality in the user authentication device, the access request of the access request device is bypassed without going through the verification process of the verification performing entity. User authentication device connected to industrial control devices.

5. In paragraph 4, If the above bypass function is implemented as a separate device, whether there is an abnormality in the user authentication device is determined by the separate device, If it is determined that there is an abnormality in the above user authentication device, the access request of the access request device is bypassed through the individual device. If it is determined that there is no problem with the user authentication device, the authentication code is transmitted to the user authentication device through the individual device. User authentication device connected to industrial control devices.

6. In paragraph 5, If the above bypass function is implemented as a separate device, the user authentication device is implemented in the form of software installed on an industrial PC. User authentication device connected to industrial control devices.

7. In paragraph 1, The log of the access request device that is allowed to access the above industrial control device is managed by the above verification server. User authentication device connected to industrial control devices.

8. A user authentication device implemented in the form of software installed on an industrial PC; and A device that determines whether there is a problem with the user authentication device, and if it is determined that there is a problem with the user authentication device, bypasses an access request to an industrial control device of an access request device, and if it is determined that there is no problem with the user authentication device, includes an individual device that transmits an authentication code received from the access request device to the user authentication device. User authentication system.

9. In a method performed by a user authentication device, A step of receiving an authentication code from a device requesting access to an industrial control device (hereinafter, “access request device”); and Including a step of allowing access to the industrial control device based on the verification result of the verification performing entity for the above authentication code, The above verification performing entity is a verification server communicating with the user authentication device or a verification module included in the user authentication device, After receiving the above authentication code, further comprising a step of determining whether to request verification of the authentication code to the verification performing entity based on the previously stored IP list. A user authentication method for connecting industrial control devices.

10. A computer-readable recording medium that is combined with a computer as hardware and stores a computer program that executes the method of claim 9.

Images