SYSTEM AND METHOD FOR UPDATING USER IDENTIFIERS (IDs)

• US 20090235326A1
• Filed: 06/15/2006
• Published: 09/17/2009
• Est. Priority Date: 12/07/2004
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Seung-Hyun, Choi, Dae-Seon, Jin, Seung-Hun, Cho, Sang-Rae, Noh, Jong-Hyouk, Kim, Tae-Sung, Cho, Yeong-Sub
• Granted Patent: US 8,522,305 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Provided are a system and method for updating a user identifier (ID). The user ID updating method includes: (a) collecting unauthorized access attempt information for a user ID; (b) creating a user ID update policy for an encoded user ID obtained by encoding the user ID, according to the unauthorized access attempt information collected in operation (a); (c) storing the user ID update policy created in operation (b); (d) loading the user ID update policy stored in operation (c) and determining whether or not to update the user ID; and (e) creating a new user ID if it is determined in operation (d) that the user ID should be updated, and changing the user ID to the new user ID. Therefore, it is possible to ensure security for user IDs, by dynamically creating and updating user IDs according to security environments.

Claims

1. A user identifier (ID) update system comprising:

a security environment collecting unit collecting unauthorized access attempt information for a user ID;

an ID policy creating unit creating a user ID update policy for an encoded user ID obtained by encoding the user ID, according to the unauthorized access attempt information received from the security environment collecting unit;

an ID policy storage unit storing the user ID update policy; and

an ID update unit loading the user ID update policy from the ID policy storage unit, creating a new user ID according to the user ID update policy, and changing the user ID to the new user ID.

2. The system of claim 1, further comprising:

an ID policy transmitting unit transmitting the user ID update policy to a service provider server which is federated with the user ID update system through the user ID.

3. The system of claim 1, further comprising:

an ID policy receiving unit receiving a user ID update policy created by a service provider server which is federated with the user ID update system, and storing the received user ID update policy in the ID policy storage unit.

4. The system of claim 1, wherein the ID update unit includes:

an ID creating part loading a user ID update policy from the ID policy storage unit and creating a new user ID according to the user ID update policy; and

an ID storage part storing the new user ID created by the ID creating part and changing the user ID to the new user ID.

5. The system of claim 4, further comprising:

an ID receiving unit receiving the new user ID created by the federated service provider server and storing the new user ID in the ID storage part.

6. The system of claim 1, further comprising:

an ID transmitting unit transmitting the new user ID created by the ID update unit to a service provider server which is federated with the user ID update system.

7. The system of claim 1, wherein the user ID update policy is one of:

an update_Now policy for immediately updating the user ID when the unauthorized access attempt information indicates that the user ID has been accessed without authorization;

an update_Short policy for updating the user ID after a first period has elapsed when the unauthorized access attempt information indicates that a number of unauthorized access attempts on the user ID exceeds a predetermined number;

an update_Long policy for updating the user ID after a second period longer than the first period has elapsed when the unauthorized access attempt information indicates that the number of unauthorized access attempts on the user ID is less than the predetermined number; and

an update_Normal policy for updating the user ID after a third period longer than the second period has elapsed when the unauthorized access attempt information indicates that there has been no unauthorized access attempt on the user ID.

8. A user identifier (ID) updating method comprising:

(a) collecting unauthorized access attempt information for a user ID;

(b) creating a user ID update policy for an encoded user ID obtained by encoding the user ID, according to the unauthorized access attempt information collected in operation (a);

(c) storing the user ID update policy created in operation (b);

(d) loading the user ID update policy stored in operation (c) and determining whether or not to update the user ID; and

(e) creating a new user ID if it is determined in operation (d) that the user ID should be updated, and changing the user ID to the new user ID.

9. The method of claim 8, further comprising:

transmitting the user ID update policy created in operation (b) to a service provider server which is federated with the user ID update system through the user ID.

10. The method of claim 8, further comprising:

transmitting the new user ID created in operation (e) to a service provider server which is federated with the user ID update system through the user ID.

11. The method of claim 8, wherein the user ID update policy is one of:

an update_Now policy for immediately updating the user ID when the unauthorized access attempt information indicates that the user ID is hacked;

an update_Short policy for updating the user ID after a first period has elapsed when the unauthorized access attempt information indicates that a number of unauthorized access attempts on the user ID occur exceeds a predetermined number;

an update_Long policy for updating the user ID after a second period longer than the first period has elapsed when the unauthorized access attempt information indicates that the number of unauthorized access attempts on the user ID is less than the predetermined number; and

an update_Normal policy for updating the user ID after a third period longer than the second period has elapsed when the unauthorized access attempt information indicates that there has been no unauthorized access attempt on the user ID.

12. The method of claim 11, wherein, in operation (d), determining whether or not to update the user ID depends on whether or not a predetermined period corresponding to the user ID update policy has elapsed.

13. A user identifier (ID) updating method comprising:

(a) receiving a user ID update policy created by a service provider server which is federated with a user ID update system through the user ID;

(b) storing the user ID update policy received in operation (a);

(c) loading the user ID update policy stored in operation (b) and determining whether or not to update the user ID; and

(d) creating a new user ID if it is determined in operation (c) that the user ID should be updated, and changing the user ID to the new user ID.

14. The method of claim 13, further comprising:

transmitting the new user ID created in operation (d) to the service provider server.

15. The method of claim 13, wherein, in operation (a), the policy ID update policy is one of:

an update_Now policy for immediately updating the user ID when unauthorized access attempt information indicates that the user ID has been accessed without authorization;

an update_Short policy for updating the user ID after a first period has elapsed when the unauthorized access attempt information indicates that a number of unauthorized access attempts on the user ID exceeds a predetermined number;

an update_Long policy for updating the user ID after a second period longer than the first period has elapsed when the unauthorized access attempt information indicates that the number of unauthorized access attempts on the user ID is less than the predetermined number; and

a update_Normal policy for updating the user ID after a third period longer than the second period has elapsed when the unauthorized access attempt information indicates that there has been no unauthorized access attempt on the user ID.

16. The method of claim 15, wherein, in operation (c), determining on whether or not to update the user ID depends on whether or not a predetermined period corresponding to the user ID update policy has elapsed.