KR101021374B1 - System and method for sharing profile of user connected to network - Google Patents

Abstract

A network connected user profile sharing system and method are disclosed. The network connection user profile sharing system according to the present invention includes an AAA server for processing authentication and authorization for a user accessing a network, a profile database for storing a user profile that the user has already provided for accessing the network; And a profile sharing server for providing the stored user profile to an application service server providing the application service in response to a request of the application service when the user profile is required when the user uses the application service. do. According to the present invention, by using a user profile secured for network access, a user can safely and conveniently use an application service provided on the Internet without repetitive subscription and authentication procedures. Even users who do not directly subscribe to the provided service can provide the application service to the user without repeated subscription and authentication procedures.

Network access, application services, user profiles

Description

System and method for sharing profile of user connected to network}

The present invention relates to a network connected user profile sharing system and method, and more particularly, to a system and method for sharing a user profile already provided by a user to access a network with an application service provider.

The internet access service and the application service provided on the internet each have an authentication function that allows access after confirming that the user who requested the service has the proper authority in using the service, so that the service can be provided only to legitimate users. . Authentication is generally a process in which the service requester checks whether the service requester has the right and right to subscribe to the service through a proper procedure and to receive the service properly. To this end, a service subscription procedure for securing user information related to service provision is defined between a user and a service provider, and when a user subscribes to a service or requests for authentication, the user provides predetermined user profile information to identify himself or herself to the service provider. Done.

The most representative authentication method is a method in which a user is given a user ID and password that will be used to identify himself or herself through a service subscription in advance, and proves that the user is a legitimate user at the time of connection. In general, a service provider constructs and manages a database of basic information of various customers necessary for providing a service, in addition to a basic identifier and password for user identification. Such personal information may be an important asset for the service provider, but from the user's point of view, it may be inconvenient and insecure to use the service even while providing his or her personal information through a complicated subscription procedure.

Currently, various access services for internet access are provided, such as high speed internet, wireless LAN, portable internet, and dial-up connection, and these services confirm that they are legitimate users through different authentication schemes. In order to use a wired or wireless network access service for internet use, a service provider verifies or verifies whether the user is a legitimate user through subscription, authentication, and identity verification. To this end, before using the service, the user provides his or her information to the service provider so that when the user uses the service later, the service provider can verify the identity based on the information. This information includes a large amount of information with various attributes, such as the subscriber's name, gender, social security number, address, telephone number, and e-mail address.

In general, in order to use an application service on the Internet after a network connection, a user must go through various types of subscription and authentication procedures according to a procedure required by an individual service provider providing the application service. In this repetitive subscription and authentication process, personal information of an individual may be excessively exposed, and a subscriber may feel inconvenient in using a service due to a repetitive subscription and authentication process. In addition, even from the standpoint of an application service provider, in order to provide an application service to a user, it is cumbersome to perform registration and authentication for each user, and thus, it is difficult to secure a wide range of application service users.

The technical problem to be achieved by the present invention is to enable the user to safely and conveniently use the application services provided on the Internet without repeated subscription and authentication procedures, and does not allow the application service provider to directly subscribe to the services provided by the application service provider. The present invention provides a network access user profile sharing system and method for providing an application service to a non-user without repetitive subscription and authentication procedures.

In order to solve the above technical problem, a network access user profile sharing system according to the present invention comprises: an AAA server for processing authentication and authorization for a user accessing a network; A profile database for storing a user profile that the user has already provided for accessing the network; And a profile sharing server for providing the stored user profile to an application service server providing the application service according to the request of the application service when the user profile is required when the user uses the application service. It is done.

The system may further include an access controller connected to a user terminal of the user and providing a network resource to the user terminal according to an authentication result of the user.

In addition, the profile sharing server may allow the user to be authenticated to the application service by providing the application service server with a master ID or token generated in the process of accessing the network.

In addition, the profile sharing server may provide the stored user profile only when the user agrees to provide the user profile. Here, the consent to the provision of the user profile may be made in an explicit or implied form.

The system may further include a service management server that obtains the user profile from the user and receives a subscription of a service provided by the system from the user and a provider of the application service.

Further, the profile sharing server may pay the predetermined amount of money to the provider of the application service on behalf of the user when the user needs to pay a predetermined amount to the provider of the application service.

The profile sharing server may reconfigure and manage the stored user profile into a dynamic profile, which is information that may change every time the network is connected, and a static profile, which is information that does not change every time the network is connected.

The profile sharing server may further include: a profile sharing interface module for retrieving a user profile requested by the application service and delivering the same to the application service server; A connection state information module for providing the network connection information, master ID or token of the user to the application service server; And a profile location lookup module for building location information of the user profile and delivering the location of the user profile requested by the application service to the application service server.

According to another aspect of the present invention, there is provided a network access user profile sharing method comprising: (a) authenticating a user accessing a network, and allowing the user to access the network according to the authentication result; (b) receiving a request for providing the user profile from an application service server providing the application service when the user requires a user profile when using the application service; And (c) providing the application service server with a user profile that the user has already provided to access the network according to the request.

The method may further include allowing the user to authenticate to the application service by providing the application service server with a master ID or token generated during the user's connection to the network.

In addition, the method further comprises the step of confirming whether or not the user agrees to the provision of the user profile, and the step (c) includes the user profile only when the user agrees to provide the user profile. Can be provided. Here, the consent to the provision of the user profile may be made in an explicit or implied form.

In addition, the step (b) may include, if the user profile is required, receiving from the user to provide the profile already provided; And receiving a request for providing the user profile from an application service server providing the application service according to the user's designation.

In addition, in the step (c), the user profile may be reconfigured into a dynamic profile, which is information that may change every network connection, and a static profile, which is information that does not change every network connection, and provided to the application service server.

The method may further include obtaining the user profile from the user and receiving a subscription of a service providing the user profile from the user and a provider of the application service.

In addition, the method may further comprise paying the predetermined amount of money on behalf of the user to the provider of the application service if the user is required to pay a predetermined amount to the provider of the application service.

In order to solve the above another technical problem, a computer readable recording medium having recorded thereon a program for executing the network access user profile sharing method according to the present invention is provided.

According to the present invention, a user profile secured for network access can be used to allow a user to safely and conveniently use an application service provided on the Internet without repetitive subscription and authentication procedures. Even users who do not directly subscribe to the provided service can provide the application service to the user without repeated subscription and authentication procedures.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, substantially the same components are denoted by the same reference numerals, and redundant description will be omitted. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

First, the profile sharing service proposed by the present invention will be described. 1 is a conceptual diagram of a profile sharing service model according to an embodiment of the present invention. Referring to FIG. 1, a user is a subject that accesses a network and uses the Internet, a profile sharing service provider is a subject that provides network resources and a profile sharing service to the user, and an application service provider is a user based on the Internet. It is a subject that provides various application services.

The user should subscribe to the network access service and profile sharing service of the profile sharing service provider. Then, the profile sharing service provider processes the information collected through the user's network access service and the profile sharing service subscription and network connection process, and uses the authentication service, user personal information providing service, and payment agent service as shown in FIG. And application service providers. The application service provider may subscribe to the profile sharing service provided by the profile sharing service provider and provide the same level of service to the subscribers who do not directly subscribe to the service provided by the profile sharing service provider.

The authentication service uses the information gathered during the network connection process and the specific type of key value generated at this time, for example, a universal identifier (master ID) or token, to separate or authenticate the application service provided by the application service provider. It is a service that makes application services available without a procedure. The profile sharing service provider grants the user a universal identifier or token during the process of authenticating the user's network connection or the profile-specific service. If the user wants to use the application service, the profile sharing service provider delivers it to the application service module in an implicit manner. You can use the application service without signing up for an application service or entering an ID and password. Accordingly, the application service provider may form a reliable relationship with a user who is not a subscriber to the service by using the received universal identifier or token.

User privacy service is a service that establishes user personal information provided to a profile sharing service provider in a database during the process of subscribing and accessing a network service or subscribing to a profile sharing service, and providing the information when requested by an application service provider through appropriate procedures. to be. Therefore, a user can use an application service requiring user personal information without directly providing the user personal information to the application service provider. Of course, the sharing of user personal information between the profile sharing service provider and the application service provider is based on the user's consent, and the user personal information should not be exposed in the provision process.

The payment agent service is a service for the user to skip the cumbersome subscription and credit information sharing process for online payment when the user and the application service provider need to make online financial transactions. For example, if a user is required to pay a certain amount to an application service provider in exchange for receiving the application service without a subscription to the application service and a mutual trust relationship with the application service provider. Instead of performing complicated mutual identification and security setting procedures for this, the application service provider receives a certain amount instead from the profile sharing service provider and the user pays a certain amount afterwards to the profile sharing service provider. The detailed payment method of the amount may be made according to various methods already known.

2 is a configuration diagram of a network connection user profile sharing system according to an embodiment of the present invention for realizing the profile sharing service described above.

2, the system according to the present embodiment includes an access controller 220, an AAA server 250, a service management server 230, a profile database 240, and a profile sharing server 260. The system according to the present embodiment is connected to the user terminal 210 of the user through a network, and is also connected to the application service servers 270 that provide an application service to the user through the network. Here, the network may be a wireless or wired network. Hereinafter, the application service server 270 will be considered to mean any one of the application service servers 270 illustrated in FIG. 1.

The user terminal 210 is a device that can use a variety of application services on the Internet through a network, such as a personal computer (PC), personal digital assistants (PDA) and the like.

The access control unit 220 is connected to the user terminal 210, and receives an authentication request message from the user to the AAA server 250 to be described later, so that only a suitable user can access the network, the AAA server 250 The network resource is provided to the user terminal 210 according to the authentication result. For example, the access controller 220 may include a router for wired Internet, an access point (AP) for wireless internet, and the like.

The service management server 230 receives from the user and the application service provider a service provided by the system according to the present embodiment, that is, a service related to accessing and using the network and a profile sharing service. In addition, the service management server 230 obtains a user profile required to enable the user to access and use the network. The user profile may include user authentication information such as a user ID and password for authenticating access to a network, or user personal information related to a user's identity such as a user's name, gender, age, address, e-mail, and telephone number, or billing. It includes billing information such as account information, card information, payment limit information for.

The profile database 240 stores user profiles already provided by the user through the service management server 230 for the user to access the network.

The profile sharing server 260 provides a user profile stored in the profile database 240 to the application service server 270 according to a request of the application service server 270 when a user profile is required when the user uses the application service. . Here, it is preferable that the profile sharing server 260 provides this only when the user agrees to provide his user profile to the application service provider. Here, the user's consent may be made explicitly or implicitly. Explicit consent may be in the form of requesting consent from a user and receiving a response when, for example, attempting to provide a user profile to the application service server 270. An implied consent is obtained when the user obtains prior consent for providing the user profile to the application service server 270, and when the application service server 270 requests the user profile, the user is regarded as agreed, and without the actual consent procedure. It may be in the form of providing to the application service server 270.

In addition, if the user needs to pay a predetermined amount to the application service provider, the profile sharing server 260 pays it to the application service provider on behalf of the user, and requests the amount after the user.

3 is a conceptual diagram illustrating a form in which a user profile is provided to an application service provider according to an embodiment of the present invention.

Referring to FIG. 3, a user accesses a network through a network access service subscribed to by a user terminal 210. At this time, the user is authenticated using his ID, and in this process, network connection information such as an IP address, access time, MAC address, access terminal, etc. is collected and stored in the AAA server 250. On the other hand, the user subscribes to a profile sharing service before or after accessing the network. When a user wants to receive a profile sharing service at the time of network connection, authentication for this is performed explicitly separately from the network connection, such as a login for the profile sharing service separately from the login for the network connection, or in advance. Under the premise of the agreement, when the authentication for the network is completed, the authentication for the profile sharing service may be performed implicitly at the same time as the network connection, such that the user is completed without the user's action.

Profile sharing service subscription information generated during the profile sharing service subscription process is stored in the profile database 240. In addition, the user provides user personal information to the profile sharing service provider through a subscription procedure in advance for network connection authentication and authentication of the profile sharing service, which is stored in the profile database 240. In addition, the user provides billing information or personal preference information through interaction with the profile sharing service provider or the application service provider, which is also stored in the profile database 240.

The profile sharing server 260 processes the information stored in the AAA server 250 and the profile database 240 into a form suitable for providing an authentication service, a user personal information service, a payment agent service, etc. to an application service provider. For example, as shown in FIG. 2, it is reconfigured and managed as identity state information, which is a dynamic profile that can be changed at every network connection or profile service login, and attribute information, which is a static profile that is not changed and fixed.

The managed information is used to provide an authentication service, a user personal information service, a payment agent service, etc. to an application service provider who subscribes to a profile sharing service. The dynamic profile may be provided to an application service server to be used for user authentication or to be used in a service using location information of the user terminal. The static profile is an application service for checking user's personal information and verifying identity. Can be provided to the server.

4 is a flowchart of a user profile sharing method performed in the system shown in FIG. 1 according to an embodiment of the present invention.

First, when the user attempts to access the network through the user terminal 210 (step 311), the AAA server 250 authenticates the user (step 313), and allows the user to access the network according to the authentication result. At this time, the AAA server 250 generates a master ID or token to be given to the user. When the user authentication is completed, the user can use the network resources, and attempts to connect to the application service server 270 to use the application service (step 315). Then, the profile sharing server 260 provides the generated master ID or token to the application service server 270 to the application service server 270 (step 317), and the application service server 270 receives the master ID or the received master ID or token. The user is authenticated to the application service using the token (step 321). When a user uses an application service, a user profile such as user personal information such as an address and a phone number or billing information such as payment information may be required. In this case, the application service server 270 requests a necessary user profile (323). step). In this case, the user does not directly input the requested user profile, and specifies that the profile sharing service is to be used, that is, the user profile that the user has already provided to the profile sharing service provider to access the network is provided to the application service provider. Step 325). Then, the application service server 270 requests the profile sharing server 260 the necessary user profile according to the user's designation (step 327), and the profile sharing server 260 requests the user's consent to be obtained (331). step). In this case, the profile sharing server 260 may provide the application service server 270 with a URL including an interface for obtaining user consent. In response to the request for obtaining the user's consent of the profile sharing server 260, the application service server 270 requests the user's consent (step 333). In this case, the application service server 270 may be redirected to a URL provided by the profile sharing server 260, and the user may be provided with an interface for accessing the URL to request user consent. If the user agrees to provide the user profile (step 335), the application service server 270 requests the profile sharing server 260 to provide the user profile (step 337). If the user has implied consent for providing his user profile to the application service provider, steps 331 to 337 described above may be omitted. Finally, the profile sharing server 260 provides the requested user profile to the application service server 270 in response to the request to the application service server 270 (step 341).

5 is a detailed configuration diagram of the profile sharing server 260 and the application service server 270 according to an embodiment of the present invention. Referring to FIG. 5, the profile specific server according to the present embodiment includes an authentication module, a database 261, a profile sharing interface module, a connection state information module, a user management profile module, a subscriber interworking module 265, and a profile search module. Is done.

The database 261 stores the user profile in a form suitable for providing to an application service provider. At this time, as described above, the database 261 manages the user profile by dividing the user profile into identity status information, which is a dynamic profile, and attribute information, which is a static profile.

The profile sharing interface module retrieves the profile requested by the application service server 270 and delivers it to the application service server 270. As an interworking interface for this, Simple Object Access Protocol (SOAP), Extensible Markup Language (XML), Security Assertion Markup Language (SAML), Sh interface based on the DIAMETER protocol, and the like may be used.

The connection status information module 263 has access status information of the user collected during the network connection authentication and profile sharing service authentication process performed in the AAA server 250, and the user subscribed to the profile sharing service subscribes to the profile sharing service. When using an application service provided by the service provider, the master ID or token and network access information are provided to the application service server 270 to perform anonymous authentication or implicit authentication.

The user profile management module 264 transforms the user profile stored in the database 261 into a data structure that can be transmitted to the application service server 270 according to the network connection state of the user.

The subscriber interworking module 265 obtains consent from the user regarding the provision of the user profile to the application service provider before providing the user profile to the application service server 270.

The profile lookup module 266 requests the user profile provisioning of the application service to request the user profile of the application service to deliver the user profile managed by the database 261 and the user profile management module 264 to the application service server 270. It acts as a directory to tell you where it exists. Since the actual information of the user profile is generally distributed and stored in various databases 261, when the profile location module 266 builds the location of the actual user profile in the form of a directory, and the application service provider requests the user profile It provides an address from which to retrieve the corresponding user profile.

In addition, the application service server 270 according to the present embodiment includes a profile sharing interworking module 271 and an application service resource.

The profile sharing interworking module 271 is an API type module provided to an application service provider. The profile sharing interworking module 271 performs a function of authenticating a user who wants to use an application service and inquiring and searching for a location of a user profile from the profile sharing service provider. At this time, the profile interworking module is provided with an address for searching for a user profile from the profile position lookup module 266 of the profile sharing server 260 and requests a profile to the profile sharing interface module 262 to make a profile sharing interface. The corresponding user profile is provided from module 262. In addition, the profile interworking module performs a function of receiving authentication information such as a master ID or a token from the profile sharing server 260, and requesting and acquiring a user agreement made in steps 333 and 335 illustrated in FIG. 4. .

The application service resource 272 has various programs and data for providing an application service to a user.

According to the present invention described above, the user can use the application services of various application service providers subscribed to the profile sharing service without providing personal information by subscribing to various application services requiring subscription each time. In addition, the application service provider is a user of an application service that provides a large subscriber base subscribed to a profile sharing service of a network service provider that already has a large number of users, in addition to the subscribers who directly subscribe to the service provided by the application service provider. It can be secured. Furthermore, an application service provider may need to perform user authentication and provide application services to a user through the authentication service and the profile sharing service provided by the profile sharing service provider without implementing user authentication and user profile management functions. User profiles can be obtained.

Meanwhile, the above-described embodiments of the present invention can be written as a program that can be executed in a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. The computer-readable recording medium may be a magnetic storage medium (for example, a ROM, a floppy disk, a hard disk, etc.), an optical reading medium (for example, a CD-ROM, DVD, etc.) and a carrier wave (for example, the Internet). Storage medium).

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a conceptual diagram of a profile sharing service model according to an embodiment of the present invention.

2 is a block diagram of a network connection user profile sharing system according to an embodiment of the present invention.

3 is a conceptual diagram illustrating a form in which a user profile is provided to an application service provider according to an embodiment of the present invention.

4 is a flowchart of a user profile sharing method performed in the system shown in FIG. 1 according to an embodiment of the present invention.

5 is a detailed configuration diagram of a profile sharing server and an application service server according to an embodiment of the present invention.

Claims (18)

An AAA server provided at a network service provider and configured to process authentication and authorization for network access for a user accessing a network; A profile database provided at the network service provider and storing a user profile already provided by the user to access the network; And A profile sharing server providing the stored user profile to an application service server providing the application service according to the request of the application service when the user profile is required when the user uses the application service provided by the application service provider; Network connection user profile sharing system comprising a. The method of claim 1, And a connection control unit connected to the user terminal of the user and providing network resources to the user terminal according to the authentication result of the user. The method according to claim 1 or 2, And the profile sharing server provides the application service server with a master ID or token generated in the process of connecting to the network so that the user is authenticated to the application service. The method according to claim 1 or 2, The profile sharing server provides the stored user profile only if the user agrees to provide the user profile. The method of claim 4, wherein And consent to the provision of the user profile is in an explicit or implicit form. The method according to claim 1 or 2, And a service management server obtaining the user profile from the user and subscribing to the service provided by the system from the user and the provider of the application service. The method according to claim 1 or 2, And the profile sharing server pays the predetermined amount of money to the provider of the application service on behalf of the user when the user needs to pay a predetermined amount to the provider of the application service. The method according to claim 1 or 2, The profile sharing server manages the stored user profile by reconfiguring and managing the stored user profile into a dynamic profile, which is information that can be changed at every network connection, and a static profile, which is information that is not changed at every network connection. The method of claim 1, wherein the profile sharing server A profile sharing interface module for retrieving the user profile requested by the application service and delivering the same to the application service server; A connection state information module for providing the network connection information, master ID or token of the user to the application service server; And And a profile location lookup module for constructing location information of the user profile and delivering the location of the user profile requested by the application service to the application service server. (a) at the network service provider side, authenticating a user connecting to the network and allowing the user to access the network according to the authentication result; (b) receiving a request for providing the user profile from an application service server providing the application service when the user requires a user profile when using the application service provided by the application service provider; And (c) at the network service provider side, providing the application service server with the user profile that the user has already provided to access the network in response to the request. The method of claim 10, And providing the application service server with a master ID or token generated during the user's connection to the network, so that the user is authenticated to the application service. The method of claim 10, Confirming whether or not to agree to provide the user profile to the user; The step (c) of the network access user profile sharing method, characterized in that for providing the user profile only when the user agrees to provide the user profile. The method of claim 12, And consent for the provision of the user profile is in an explicit or implicit form. The method of claim 10, wherein step (b) comprises: If the user profile is required, receiving from the user to provide the already provided profile; And And requesting the provision of the user profile from an application service server providing the application service according to the designation of the user. The method of claim 10, In the step (c), the user profile is reconfigured into a dynamic profile, which is information that can be changed at every network connection, and a static profile, which is information that is not changed at every network connection, and provided to the application service server. How to share user profiles. The method of claim 10, Obtaining the user profile from the user, and subscribing to a service providing the user profile from the user and a provider of the application service. The method of claim 10, And if the user is required to pay a predetermined amount to the provider of the application service, paying the provider for the application service on behalf of the user. A computer-readable recording medium having recorded thereon a program for executing the network-connected user profile sharing method according to any one of claims 10 to 17.

Images