KR100936530B1 - Network device and method for sharing authorization information - Google Patents

Abstract

A method is disclosed in which a plurality of network devices share authentication information. A method of sharing authentication information by a plurality of network devices, wherein the first network device receives the authentication information, transfers the received authentication information to the second network device, and transfers the authentication information to the second network device. And disabling authentication of the first network device to share authentication information.

According to the present invention, since authentication information for using a network service can be shared with other network devices, it is not necessary to newly authenticate at another network device. You can use network services naturally.

Authentication, network devices, network, share credentials

Description

Network device and method for sharing authorization information {Network device and method for sharing authorization information}

The present invention relates to a method of sharing authentication information between network devices, and in particular, a method of transmitting network authentication information to another network device using short-range communication so that another network device can access the network using the authentication information and the same. It relates to a device for.

In order to use a network service, a network device needs to authenticate a service to be used by accessing a network using a modem attached to the network device.

The authentication process can be performed in various ways. However, when a network device requests an authentication by accessing a network, the network device determines whether to permit the requested authentication and allocates authentication information to the corresponding network device to perform network service. Make it available.

Conventional network devices have a single authentication module to access a network and be authenticated to use network services. Therefore, even if the user has a plurality of network devices, there is a problem in that after using the authentication module mounted on each network device, authentication is required to use the service.

In addition, since one network module includes one authentication module, there is a problem in that a service cannot be naturally moved from one network device to another network device.

Accordingly, the present invention for solving the above problems is to propose a method of sharing authentication information among a plurality of network devices.

Another object of the present invention is to propose a method of sharing authentication information so that a service can be naturally moved from one network device to another network device, and a network device therefor.

Other objects of the present invention will be readily understood through the description of the following examples.

In order to achieve the above objects, according to an aspect of the present invention there is provided a method for sharing authentication information.

A method of sharing authentication information between a plurality of network devices according to an embodiment of the present invention, the method comprising: receiving and setting, by a first network device, the authentication information; Communicating the authentication information to a second network device; And when the transfer of the authentication information is completed, releasing the authentication of the first network device.

According to another aspect of the present invention, a network device is provided.

A network device capable of sharing authentication information according to an embodiment of the present invention, comprising: a modem communication unit configured to receive the authentication information and to transmit the authentication information to a second network device; An authentication information storage unit for storing the received authentication information; An authentication setting unit for setting the received authentication information; And a controller configured to generate a control signal for releasing authentication of the first network device when the authentication information is transmitted to the second network device.

As described above, the present invention can share the authentication information for using the network service among the network devices, there is an advantage that does not need to be newly authenticated even when using the network service using another network device.

In addition, even if the user changes the subject of the network service from one network device to another network device, there is an advantage that the network service can be used naturally.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

The terms first, second, A, B, etc. may be used to describe various components, but the components are not limited by the terms, but merely for distinguishing one component from other components. Only used as For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. It should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings, it will be described in detail an embodiment of the present invention. Hereinafter, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

In the present specification, the first network device is a network device that performs authentication for using a network service by connecting to a network, and transmits authentication information to another network device. A generic term for a network device that acts as a sender.

In addition, the second network device is a network device that receives authentication information from the first network device, and means a network device that serves as a receiver of authentication information in the device sharing the authentication information.

That is, the first network device and the second network device are not always fixed and should be interpreted as the first network device even when the same network device delivers the authentication information, and the second network device when the authentication information is received. .

1 is a configuration diagram schematically illustrating an authentication system including one network device according to the IEEE 802.1x standard as a whole.

The IEEE 802.1x standard defines three entities: authentication supplicant, authenticator, and authentication server.

The authentication requester is an entity for providing a user's information to the authenticator and making an authentication request, which corresponds to the first network device. An example of the first network device may be a wired or wireless terminal to connect to a network. The initial initial port status of the authenticator when the first network device receiving authentication information requests the authenticator is set to uncontrolled port status, in which case the first network device and the authenticator are scalable authentication protocols. Communication is possible only with (EAP: Extensible Authentication Protocol).

Meanwhile, the authenticator transmits the information and the authentication request received from the first network device to the authentication server. When the authentication is successful from the authentication server, the authenticator delivers the authentication success message and authentication information to the first network device and uses the port of the authenticator ( Controlled port status). Examples of such an authenticator may be an access point, a router, a switch, and the like.

In addition, the authentication server is an entity that receives an authentication request for the first network device from the authenticator and determines whether to be authenticated. The authentication server stores and manages information about the user in an internal database, or communicates with an external entity. Received to determine whether to authenticate. At this time, the protocol used between the authentication server and the authenticator is not defined in IEEE 802.1x, but it is recommended to use the protocol used in general AAA (Authentication, Authorization, Accounting) server. Accordingly, the RADIUS (Remote Authentication Dial-In User Service) protocol is becoming an industry standard (De-Facto Standard).

In case of communication between authenticator and authentication server using RADIUS protocol, network access authority control for user is determined by authentication server's internal authentication algorithm and RADIUS attributes that can be transmitted in authentication success message. And vendor-specific RADIUS attributes (VSA).

2 is a flowchart illustrating an authentication process according to the IEEE 802.1x standard.

The first network device provides the authenticator with basic information necessary for authentication. The basic information may be current location information of the first network device, user information of the first network device, information unique to the first network device, and the like, and any type of information that can be used for authentication is irrelevant.

Upon receiving basic information from the first network device, the authenticator requests authentication to the first network device from the authentication server, and the authentication server receives the authentication request and determines whether to permit the authentication. To pass.

Thereafter, the authenticator transmits a message indicating that the authentication is successful and authentication information to the first network device, and provides the network access authority to the first network device.

The authentication information is information including whether the first network device is authorized to access the network and whether the network service can be used, and only the first network device having the authentication information accesses the network, or the network. The service is available.

Such authentication information may be stored in a storage unit of the first network device or in a corresponding authentication module in a first network device having a separate authentication module.

3 is a configuration diagram schematically illustrating an authentication system including a plurality of network devices.

Referring to FIG. 3, a plurality of network devices make an authentication request and receive and store authentication information from an authenticator. Since the authentication request is performed separately for each network device, the authentication information received by each network device is also configured in a different form.

For example, for convenience of understanding and explanation, it is assumed that network device # 1 and network device # 3 are separate network devices that want to access the same network and use the same network service.

Since the authentication information already received from the network device # 1 could not be utilized by the network device # 3, the network device # 3 must receive the authentication information separately to access the same network as the network device # 1 or use the same network service. There was a problem.

Hereinafter, a method of sharing the authentication information received by the first network device with another network device will be described in more detail.

4 is a configuration diagram showing a configuration of a first network device according to the present invention.

Referring to FIG. 4, the first network device 100 includes a modem communication unit 410, an input unit 420, an authentication setting unit 430, an authentication information storage unit 440, and a control unit 450. The modem communication unit 410 may also include an authentication information transfer unit 411 and a modem unit 413. Although not shown in FIG. 4, it is obvious that a display unit for outputting a list of the second network device 200 to which authentication information is to be transmitted may be further included.

The authentication information is information configured for acquiring the right to use the network by the network device, and the type thereof is irrelevant. For example, the authentication information may include location information of a network device in the case of a network serviced only in a specific region, and in the case of a service provided only in a specific network device, unique information of the network device may also be authentication information.

The modem communication unit 410 may include a modem unit 411 for receiving authentication information from an authenticator and an authentication information transfer unit 413 for transferring authentication information to the second network device 200. In FIG. 4, the authentication information transmitting unit 413 is shown as one component of the modem communication unit 410, but the authentication information transmitting unit 413 serves to transmit authentication information to the second network device 200. As it is, it is obvious that the modem communication unit 410 can be configured separately.

The modem unit 411 transmits basic information of the first network device 100 to the authenticator, and receives authentication information from the authenticator. Here, the basic information may be a current location, a user ID and a password of the first network device. User authentication is requested based on the basic information delivered to the authenticator.

When authentication is permitted as a result of the authentication, the modem unit 411 receives authentication information from the authenticator. The authentication information includes information such as a right to access the network, and only a network device having the authentication information can access the corresponding network and use the corresponding network service.

The authentication information transmitter 413 transfers the authentication information stored in the first network device 100 to the second network device 200. There are a variety of ways in which the authentication information can be delivered to the second network device 200.

As an embodiment of a method of transmitting authentication information in the authentication information transmitting unit 413, the authentication information transmitting unit 413 may transmit the authentication information using a Bluetooth communication method.

Originally, Bluetooth was a word for a standard for low power wireless communication between devices, but it also refers to a communication method using the Bluetooth standard. The Bluetooth technology standard is a technology standard for providing low-cost wireless data and voice short-range wireless access using 2.4 GHz, based on the IEEE 802.11 standard. The data rate of Bluetooth is 433.9kbps for symmetrical and 723.2kbps for asymmetrical communication mode.

In the case of voice transmission, 64kbps synchronous transmission method is used, up to three voice channels are available, and 10Mbps-class technology that can transmit video is under development.

In order to transmit authentication information using the Bluetooth communication method, the authentication information transmitting unit 413 should be a means capable of transmitting and receiving in a Bluetooth manner.

As another example, the authentication information may be transmitted through a Zigbee communication.

ZigBee is a wireless personal area network specification that operates at 868 MHz, 902-928 MHz, and 2.4 GHz. A wireless personal area communication network refers to a personal area communication network in which peripheral device connection is wireless. ZigBee allows you to send and receive r / data.htm "data at speeds of up to 250 Kbps between peripherals within a 50m distance within a wireless personal area network. ZigBee is approved by IEEE-SA. It is based on the 802.15 specification.

In addition, the modem method uses a direct sequence spread spectrum (DS-SS).

In order to transmit authentication information using the Zigbee communication method, the authentication information transmitting unit 413 should be a means capable of transmitting and receiving in the Zigbee method.

As another example, authentication information may be delivered using near-field communication (NFC).

NFC is a wireless access technology that enables short-range communication between electronic devices. NFC, developed jointly by Philips and Sony, connects consumer devices to enable fast and easy communication. This communication solution is intuitive to operate, making it easy for consumers to use, and its security features make it ideal for payment and ticketing applications.

Devices with NFC capabilities can exchange data in either active or passive mode.

In passive mode, the NFC initiator (master device) supplies the RF field throughout the communication session. The device sends data to the NFC target (slave device) at 106Kbps, 212Kbps, or 424Kbps. The NFC target does not need to create a field, but uses load modulation technology to send data back to the initiator at the same rate. This communication mechanism is compatible with contactless smart cards, allowing NFC initiators in passive mode to detect and establish contacts using the same connection and initialization procedures.

In active mode, each device must generate its own RF field when it wants to send data to another device, and initiators and target devices must create their own RF field for smooth communication. This approach achieves very fast connection setup as a standard mode for peer-to-peer communication.

Mobile devices, operating primarily in passive mode, can achieve significant power savings and extend valuable battery life. NFC devices may switch roles between an initiator and a target in an application session. This feature allows devices with less battery power to act as targets in passive mode instead of initiators.

NFC is an open platform technology standardized to ETSI TS 102 190 V1.1.1 and ISO / IEC 18092 as well as ECMA 340. These standards specify the modulation scheme, coding, transmission rate, and frame format of the RF interface of NFC devices, as well as initialization schemes and conditions (both passive and active NFC modes) for data collision control at initialization.

NFC devices can serve as contactless smart cards, read / write terminals for smart cards, and data transfer links between devices. NFC applications can be divided into four basic categories: touch and go, touch and confirm; These are touch and connect and touch and explore. The reader / writer capabilities of NFC-enabled phones allow subscribers to get rich information or download content just by contacting smart media. Such smart media have low-cost RFID tags that can be read by a mobile phone to access more services. Contacting smart media initiates a service request over the mobile network, which immediately increases network traffic for the service provider. Operators can use this tool to improve revenue from premium value-added services.

In order to transmit authentication information using the NFC method, the authentication information transmitting unit should be a means capable of transmitting and receiving in the NFC method.

That is, the configuration of the authentication information transmitter 413 may vary depending on how the first network device 100 transmits the authentication information to the second network device 200, and is performed by short-range wireless communication. The authentication information transmitting unit 413 should include a short range wireless communication module.

For example, the authentication information transfer unit 413 preferably includes any one of a Bluetooth module, a Zigbee module, and an NFC module.

The input unit 420 selects another network device to transmit authentication information from the user. When the method of transmitting authentication information is Bluetooth communication or Zigbee communication, when there are a plurality of other network devices capable of wireless communication with the first network device 100, a target network device to which the authentication information is transmitted, that is, the second network device 200. ) Is selected through the input unit 420.

In the case of the NFC method, the user may bring the first network device closer to the second network device 200 by using a contactless communication method, so that the authentication information may be transmitted. The process of selecting 200 may be omitted.

For example, the input unit 420 may be implemented as a plurality of key buttons including numbers / letters or the like or in the form of a touch screen.

The authentication setting unit 430 sets authentication information received through the modem communication unit 410 to the first network device 100. That is, the first network device may access the corresponding network and may be set in the first network device 100 to have a right to use the corresponding network service.

The method of setting the authentication information in the first network device 100 can be changed in various ways. Preferably, the authentication information is set to secure information in a predetermined portion of the first network device.

The authentication information storage unit 440 stores the authentication information received from the modem communication unit 410. The authentication information storage unit 440 is irrelevant as long as it is a means for storing authentication information. For example, the authentication information storage unit 440 may be an authentication module or may be a memory of the first network device 100.

The control unit 450 controls each component of the first network device 100 (for example, the modem communication unit 410, the input unit 420, the authentication setting unit 430, the authentication information storage unit 440, etc.). Can be controlled.

In particular, the control unit 450 generates a control signal for releasing the authentication of the first network device 100 when the transmission of the authentication information from the authentication information transfer unit 413 to the second network device 200 is completed. Deactivation of the authentication of the first network device 100 may include setting authentication of the first network device set by the authentication setting unit 430 under the control of the control unit 450 when receiving the authentication completion signal from the second network device 200. To no_value.

This is to prevent a plurality of network devices from connecting to the network at the same time.

A method of releasing authentication will be described later in more detail with reference to FIG. 5.

The method of sharing the authentication information described above is only one embodiment of various embodiments for implementing the same technical idea, and it is obvious that the present invention may be variously changed.

5 is a flowchart illustrating a process of sharing authentication information by transferring authentication information to a second network device according to an embodiment of the present invention.

The first network device 100 receives authentication information from the network (in detail, the authenticator) (step S510). The reception of the authentication information is performed by the modem communication unit 410 as described above.

The first network device 100 receiving the authentication information sets the authentication information received in step S510. The setting of the authentication information may be performed by the authentication setting unit 430 under the control of the controller 450, and may include storing the authentication information in the authentication information storage unit 440 when the authentication information is set.

In operation S530, it is determined whether to transmit the authentication information to the second network device 200. Determination of whether to transmit to the second network device 200 may be performed by a method of receiving selection of whether to transmit authentication information from a user. As described above, the selection of the second network device 200 may be performed by the input unit 420.

If it is determined in step S530 that it is not delivered to the second network device 200, the procedure ends. If it is delivered to the second network device 200, the flow proceeds to step S540.

When the authentication information is transmitted in step S540, the second network device 200 to be delivered is searched. The search of the second network device 200 depends on how the authentication information is to be transmitted. As described above, the authentication information may be transmitted by the Bluetooth method, the Zigbee method, and the NFC method. If the authentication information is transmitted to the second network device 200 from the first network device 100, the type of the authentication information is irrelevant and may be performed by a method of short-range wireless communication.

In this case, when a plurality of network devices to which authentication information is to be transmitted, that is, a plurality of second network devices 200 is searched, one network device is determined as a second network device by a user's selection.

Thereafter, the authentication information is transmitted from the first network device 100 to the second network device 200 in step S550. The authentication information is transmitted from the authentication information delivery unit 413 under the control of the control unit 450, and the module included in the authentication information delivery unit 413 is different depending on what the authentication information delivery method is. Since it has been described in the description will be omitted.

In operation S560, the second network apparatus 200 sets authentication information. The setting of the authentication information is similar to that of step S520 of the first network device 100, but the first network device 100 may receive the authentication information directly from the network (authenticator), and the second network device 200 There is a difference in that the authentication information is received from the first network device 100 and configured.

In operation S570, the second network apparatus 200 generates a signal indicating that the setting of the authentication information is completed, and transmits the signal to the first network apparatus 100. This is to cancel the authentication information setting of the first network device 100 because only one network device can be connected to one network even though the same authentication information is included.

In operation S580, when the authentication completion report is received from the second network apparatus 200, the first network apparatus 100 performs a process of releasing the authentication set in operation S520. In the method of releasing authentication, when the authentication completion signal is received, the authentication information set in the authentication setting unit 430 may be changed to no_value by the control of the controller 450, and the authentication information may be converted into the first network device 100. This can be done by completely deleting from.

When the first network device 100 releases authentication, the second network device 200 performs an operation of initializing the network based on the authentication information set in step S560 (step S590). This is a process performed between the network and the second network device 200. The network grants the right to access the network from the second network device 200 when the authentication information is appropriate, and allows the network service to be used. Can be given.

Although not shown in FIG. 5, when authentication is set in the second network device 200, the authentication information may be stored in a storage unit of the second network device 200.

6 is a flowchart illustrating a process of selecting a second network device according to an embodiment of the present invention.

In operation S610, the first network device 100 searches for a network device to which authentication information is to be delivered.

In operation S610, when the network device is found, a list of searched network devices is output (step S620) so that the second network device 200 may be selected from the searched network devices by the user.

Thereafter, after receiving the selection of the second network device from the user in step S630, a process of transmitting authentication information to the selected second network device is performed (step S640).

When the authentication information is transmitted through the NFC method, the user may bring the first network device 100 closer to the second network device 200, thereby transmitting the authentication information, thereby providing the second network device 200. The selection process can be omitted.

That is, when the authentication information is transmitted using short range wireless communication such as Bluetooth communication or Zigbee communication, a process of searching for the second network device 200 is essentially performed due to the characteristics of the Bluetooth communication or Zigbee communication.

7 is an exemplary diagram illustrating a process of selecting a second network device according to an embodiment of the present invention.

FIG. 7 is a screen displayed after searching for a network device in step S610 and shows a list of network devices that can receive current authentication information.

The network device may be any type of network device, for example, a mobile communication terminal, a PDA, a notebook computer, a personal computer, or the like, and may display a name or name unique to the network device.

The method of outputting the list of searched network devices can be changed and implemented in various ways. For example, the list of network devices can be outputted in the form of text, an image of the network device, and a form of an icon.

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art that various modifications of the present invention without departing from the spirit and scope of the invention described in the claims below And can be changed.

1 is a configuration diagram schematically illustrating an authentication system including one network device according to an embodiment of the present invention according to the IEEE 802.1x standard as a whole.

2 is a flowchart illustrating an authentication process according to the IEEE 802.1x standard.

3 is a configuration diagram schematically illustrating an authentication system including a plurality of network devices.

4 is a configuration diagram showing a configuration of a first network device according to the present invention.

5 is a flowchart illustrating a process of sharing authentication information by transferring authentication information to a second network device according to an embodiment of the present invention.

6 is a flowchart illustrating a process of selecting a second network device according to an embodiment of the present invention.

7 is an exemplary diagram illustrating a process of selecting a second network device according to an embodiment of the present invention.

Claims (16)

In a method in which a plurality of network devices share authentication information, Receiving and setting the authentication information by a first network device; Receiving a selection of a second network device; Communicating the authentication information to a second network device; And When the transfer of the authentication information is completed, including the step of releasing the authentication of the first network device, The step of receiving the selection of the second network device, Searching for a network device capable of short-range wireless communication with the first network device; Outputting a list of the retrieved network devices; And And selecting one of the network devices included in the output list. delete The method of claim 1, Receiving and setting the authentication information by the first network device, Connecting the first network device to a network; Receiving authentication information from the connected network; And And setting an authentication to communicate with the network using the authentication information. delete The method of claim 1, Delivery of the authentication information, Authentication information sharing method characterized in that performed by the short-range wireless communication. The method of claim 5, The short range wireless communication is authentication information sharing method, characterized in that performed by any one of Bluetooth (Bluetooth) communication, Zigbee (zigbee) communication and NFC. The method of claim 1, Completion of delivery of the authentication information, And when the authentication completion signal is received from the second network device, determining that the transmission of the authentication information is completed. The method of claim 1, And the authentication information includes any one or more of the location information of the first network device and the first network device information. A network device capable of sharing authentication information, A modem communication unit which receives the authentication information and transmits the authentication information to a second network device; An authentication information storage unit for storing the received authentication information; An authentication setting unit for setting the received authentication information; And And a controller configured to generate a control signal for releasing authentication of the first network device when the authentication information is transmitted to the second network device. The modem communication unit, An authentication information transfer unit configured to transfer the authentication information to the second network device, The authentication information transmission unit, A network device for performing near field communication. The method of claim 9, The network device further comprises an input unit for receiving the selection of the second network device. The method of claim 9, The control unit, And generating a control signal for controlling to search for a second network device capable of short-range communication with the first network device. delete delete The method of claim 9, The authentication information transmission unit, And a Bluetooth module, a Zigbee module, and an NFC module capable of performing the short range wireless communication. The method of claim 9, The modem communication unit, And receive an authentication completion signal from the second network device. The method of claim 15, The control unit, And when the modem communication unit receives the authentication completion signal, determines that the transfer of the authentication information is completed, and generates a signal for releasing the authentication of the first network device.

Images