System and method for authentication service
Provided is an authentication service system and authentication service method. According to embodiments of the present disclosure, when a plurality of authentication processes are performed using different authentication factors, an access token is issued based on an authentication factor used in a previous authentication process; and a subsequent authentication process is performed according to validity of the access token issued in the previous authentication process.
1. An authentication service method, comprising:
relaying a first authentication process for a user of a client device by receiving, from the client device, identification information for a first authentication factor and first authentication information generated based on the first authentication factor, and transmitting, to one of a plurality of authentication servers, the first authentication information based on the identification information for the first authentication factor;
generating a first access token, which includes the identification information for the first authentication factor based on the first authentication process being successful, and transmitting the generated first access token to the client device;
receiving the first access token from the client device and verifying validity of the received first access token;
relaying, based on the received first access token being valid, a second authentication process for the user of the client device by receiving, from the client device, identification information for a second authentication factor and second authentication information generated based on the second authentication factor, and transmitting, to one of the plurality of authentication servers, the second authentication information based on the identification information for the second authentication factor; and
generating a second access token, which includes the identification information for each of the first authentication factor and the second authentication factor, and transmitting the generated second access token to the client device based on the second authentication process being successful.
2. The method of claim 1 , wherein each of the first authentication factor and the second authentication factor is one from among a knowledge-based authentication factor, a possession-based authentication factor, and a feature-based authentication factor.
3. The method of claim 1 , wherein the plurality of authentication servers comprises at least one from among a Fast Identity Online (FIDO)-based authentication server, an OTP-based authentication server, a Short Message Service (SMS)-based authentication server, an e-mail based authentication server, a certificate-based authentication server, and an ID/password-based authentication server.
4. The method of claim 1 , further comprising:
calculating a risk score for the first authentication process based on risk factors associated with the first authentication process and the first authentication process being successful; and
determining whether the second authentication process is required based on the calculated risk score,
wherein the transmitting the generated first access token to the client device comprises transmitting a request for performing the second authentication process to the client device based on the second authentication process being required; and
wherein the receiving the first access token, the relaying the second authentication process and generating the second access token are performed based on the request for performing the second authentication process being transmitted.
5. The method of claim 1 , further comprising calculating, based on successful completion of the second authentication process, a risk score based on risk factors associated with the first authentication process and the second authentication process.
6. The method of claim 5 , further comprising determining whether a third authentication process is required based on the calculated risk score,
wherein the transmitting the generated second access token and a request for performing the third authentication process to the client device are performed based on the third authentication process being required.
7. The method of claim 6 , further comprising:
receiving the second access token from the client device, and verifying validity of the second access token;
relaying, based on the received second access token being valid, the third authentication process for the user of the client device by receiving, from the client device, identification information for a third authentication factor and third authentication information generated based on the third authentication factor, and transmitting, to one of the plurality of authentication servers, the third authentication information based on the identification information for the third authentication factor; and
generating a third access token, which includes the identification information for each of the first authentication factor, the second authentication factor, and the third authentication factor, and transmitting the generated third access token to the client device based on the third authentication process being successful.
8. The method of claim 7 , wherein each of the first authentication factor, the second authentication factor, and the third authentication factor is one from among a knowledge-based authentication factor, a possession-based authentication factor, and a feature-based authentication factor.
9. The method of claim 7 , further comprising calculating the risk score based on risk factors associated with the first authentication process, the second authentication process, and the third authentication process based on the third authentication process being successful.
10. An authentication service system, comprising:
one or more processors;
a memory; and
one or more programs configured to be executed by the one or more processors and stored in the memory,
wherein the one or more programs comprise instructions to control the authentication service system to perform:
relaying a first authentication process for a user of a client device by receiving, from the client device, identification information for a first authentication factor and first authentication information generated based on the first authentication factor, and transmitting, to one of a plurality of authentication servers, the first authentication information based on the identification information for the first authentication factor;
generating a first access token, which includes the identification information for the first authentication factor based on the first authentication process being successful, and transmitting the generated first access token to the client device;
receiving the first access token from the client device and verifying validity of the received first access token;
relaying, based on the received first access token being valid, a second authentication process for the user of the client device by receiving, from the client device, identification information for a second authentication factor and second authentication information generated based on the second authentication factor, and transmitting, to one of the plurality of authentication servers, the second authentication information based on the identification information for the second authentication factor; and
generating a second access token, which includes the identification information for each of the first authentication factor and the second authentication factor, and transmitting the generated second access token to the client device based on the second authentication process being successful.
11. The authentication service system of claim 10 , wherein each of the first authentication factor and the second authentication factor is one from among a knowledge-based authentication factor, a possession-based authentication factor, and a feature-based authentication factor.
12. The authentication service system of claim 10 , wherein the plurality of authentication servers comprise at least one from among a Fast Identity Online (FIDO)-based authentication server, an OTP-based authentication server, a Short Message Service (SMS)-based authentication server, an e-mail based authentication server, a certificate-based authentication server, and an ID/password-based authentication server.
13. The authentication service system of claim 10 , wherein the one or more programs further comprise instructions to control the authentication service system to perform:
calculating a risk score for the first authentication process based on risk factors associated with the first authentication process and the first authentication process being successful; and
determining whether the second authentication process is required based on the calculated risk score,
wherein the transmitting the generated first access token to the client device comprises transmitting a request for performing the second authentication process to the client device based on the second authentication process being required; and
wherein the receiving the first access token, the relaying the second authentication process and generating the second access token are performed based on the request for performing the second authentication process being transmitted.
14. The authentication service system of claim 10 , wherein the one or more programs further comprise instructions to control the authentication service system to perform calculating, based on successful completion of the second authentication process, a risk score based on risk factors associated with the first authentication process and the second authentication process.
15. The authentication service system of claim 14 , wherein the one or more programs further comprise instructions to control the authentication service system to perform determining whether a third authentication process is required based on the calculated risk score,
wherein the transmitting the generated second access token and a request for performing the third authentication process to the client device are performed based on the third authentication process being required.
16. The authentication service system of claim 15 , wherein the one or more programs further comprise instructions to control the authentication service system to perform:
receiving the second access token from the client device, and verifying validity of the second access token;
relaying, based on the received second access token being valid, the third authentication process for the user of the client device by receiving, from the client device, identification information for a third authentication factor and third authentication information generated based on the third authentication factor, and transmitting, to one of the plurality of authentication servers, the third authentication information based on the identification information for the third authentication factor; and
generating a third access token, which includes the identification information for each of the first authentication factor, the second authentication factor, and the third authentication factor, and transmitting the generated third access token to the client device based on the third authentication process being successful.
17. The authentication service system of claim 16 , wherein each of the first authentication factor, the second authentication factor, and the third authentication factor is one from among a knowledge-based authentication factor, a possession-based authentication factor, and a feature-based authentication factor.
18. The authentication service system of claim 16 , wherein the one or more programs further comprise instructions to control the authentication service system to perform, calculating the risk score based on risk factors associated with the first authentication process, the second authentication process, and the third authentication process based on the third authentication process being successful.
19. A non-transitory computer readable recording medium having embodied thereon a program, which when executed by a processor of an authentication service system, causes the authentication service system to execute a method, the method including:
relaying a first authentication process for a user of a client device by receiving, from the client device, identification information for a first authentication factor and first authentication information generated based on the first authentication factor, and transmitting, to one of a plurality of authentication servers, the first authentication information based on the identification information for the first authentication factor;
generating a first access token, which includes the identification information for the first authentication factor based on the first authentication process being successful, and transmitting the generated first access token to the client device;
receiving the first access token from the client device and verifying validity of the received first access token;
relaying, based on the received first access token being valid, a second authentication process for the user of the client device by receiving, from the client device, identification information for a second authentication factor and second authentication information generated based on the second authentication factor, and transmitting, to one of the plurality of authentication servers, the second authentication information based on the identification information for the second authentication factor; and
generating a second access token, which includes the identification information for each of the first authentication factor and the second authentication factor, and transmitting the generated second access token to the client device based on the second authentication process being successful.