Method and apparatus for providing differential security services for ship networks using user authentication-based packet classification

1 . A method of providing differential security services for a ship network by a service provider connected to a client performing the differential security services, the method comprising:

receiving a service request from a user terminal by an authentication performing unit of a service provider including a processor;

returning or issuing, by the authentication performing unit, an ID token and an authentication code to the user terminal in response to the service request;

receiving, by the client, the ID token and the authentication code from the user terminal;

verifying, by the client, validity of the ID token;

setting, by the client, a session cookie for the service request when the validity is verified;

transmitting, by the client, an access token request including the authentication code to a token issuing unit of the service provider; and

receiving, by the client, an access token from the token issuing unit,

wherein when the validity is verified, generating, by the client, a user class management table corresponding to a current session based on a pre-stored user class management table.

2 . The method of claim 1 , further comprising transmitting, by the client, a resource request, which includes the access token and has an authenticated header, to a resource server of the service provider.

3 . The method of claim 2 , further comprising confirming, by the resource server, whether access to the resource is correct according to a scope specified by a user of the user terminal in the access token.

4 . The method of claim 3 , further comprising receiving, by the client, a response message including resource information or access information to the resource information from the resource server.

5 . The method of claim 4 , further comprising transmitting a service response to the service request to the user terminal in response to the response message.

6 . The method of claim 1 , wherein the user terminal is located inside or outside the ship network.

7 . A method of providing differential security services for a ship network by a service provider connected to a client performing the differential security services, the method comprising:

receiving, a service request from a user terminal by an authentication performing unit of a service provider including a processor;

returning or issuing, by the authentication performing unit, an ID token and an authentication code to the user terminal in response to the service request;

receiving, by the client, the ID token and the authentication code from the user terminal;

verifying, by the client, validity of the ID token;

setting, by the client, a session cookie for the service request when the validity is verified;

transmitting, by the client, an access token request including the authentication code to a token issuing unit of the service provider; and

receiving, by the client, an access token from the token issuing unit,

wherein the method further comprises adding, by the authentication performing unit, an additional field or a claim to a payload of the ID token when issuing the ID token.

8 . The method of claim 7 , wherein the claim includes a specific field for setting a unique identifier to identify a user of the user terminal.

9 . The method of claim 8 , further comprising obtaining, by the client, user information through the specific field included in the payload.

10 . The method of claim 1 , wherein the user class management table is shared with a security gateway (G/W) of the ship network.

11 . The method of claim 10 , wherein the access token includes an expanded parameter,

the expanded parameter includes fields for a user class and priority, and

the fields for the user class and priority define an action according to a return value of a class tag in the user class management table.

12 . An apparatus for providing differential security services for a ship network, comprising:

an authentication performing unit that receives a service request from a user terminal and returns or issues an ID token and an authentication code to the user terminal in response to the service request; and

a client that receives the ID token and the authentication code from the user terminal, verifies validity of the ID token, sets a session cookie for the service request when the validity is verified, transmits an access token request including the authentication code to a token issuing unit, and receives an access token from the token issuing unit,

wherein, when the validity is verified, the client generates a user class management table corresponding to a current session based on a pre-stored user class management table, and

wherein the user class management table is shared with a security gateway (G/W) of the ship network.

13 . The apparatus of claim 12 , further comprising a resource server,

wherein the client transmits a resource request, which includes the access token and has an authenticated header, to the resource server, and

wherein the resource server confirms whether access to the resource is correct according to a scope specified by a user of the user terminal in the access token.

14 . The apparatus of claim 13 , wherein the client receives a response message including resource information or access information to the resource information from the resource server, and transmits a service response to the service request to the user terminal in response to the response message.

15 . The apparatus of claim 12 , wherein the authentication performing unit adds an additional field or a claim to a payload of the ID token when issuing the ID token.

16 . The apparatus of claim 15 , wherein the claim includes a specific field for setting a unique identifier to identify a user of the user terminal.

17 . The apparatus of claim 12 , wherein the access token includes an expanded parameter,

the expanded parameter includes fields for a user class and priority, and the fields for the user class and priority define an action of a security service according to a return value of a class tag in the user class management table.