WO2021015686A1

WO2021015686A1 - A security system for a computer network

Info

Publication number: WO2021015686A1
Application number: PCT/TR2019/050711
Authority: WO
Inventors: Ahmet TOPRAKCI; Emrah USLU; Fatih Dogan; Kadir Can TOPRAKCI; Kivanc BAKDI
Original assignee: Peakup Teknoloji AS
Current assignee: Peakup Teknoloji AS
Priority date: 2019-07-23
Filing date: 2019-08-28
Publication date: 2021-01-28
Anticipated expiration: 2022-01-23
Also published as: EP3847564A1

Abstract

A security system for a computer network (1) comprising an operation server (10) accessible to a directory service (12) of the computer network (1) and a mobile device (20) connected with the operation server (10) by means of an electronic message service (32) adapted to transmit electronic messages between the operation server (10) and the mobile device (20). The security system further comprises an access control server (40) with a processor (42) which is configured to receive and parse a first electronic message (26) from the mobile device (20), establish a data connection with the directory service (12) via a network connection module (44) and pair the device identification information (26) with a registered user on a user database of the directory service (12), generate a new password data (A) for authorization of the registered user to the computer network (1) by a security protocol and overwrite on a stored password data (B) on the directory service (12) with the new password data (A) and send a second electronic message (46) including new password data (B) directly to the mobile device (20) via electronic message service.

Description

A SECURITY SYSTEM FOR A COMPUTER NETWORK

TECHNICAL FIELD

The present invention relates to a security system for a computer network with a directory service, particularly authentication systems processing user credentials.

PRIOR ART

Computer networks operate directory services to store password information and authenticate users to access any password protected services over the computer network. When a user forgot the password, a system administrator manually reset the password on the directory service and inform user manually. If the computer network provide a web based password reset system, user is obliged to fill out a web form and submit to the web server to submit a password reset request to the computer network. Additionally, a one time verification code is generated by the password reset system and user asked to use a graphical user interface to provide verification code in correct manner. This procedure is time consuming and for the most of the time very complex for an ordinary computer user.

EP3407536 discloses a server device in communication with a control panel device in a region can include a database of authorized users and phone numbers of mobile devices associated with the authorized users. In these embodiments, the control panel device can generate a onetime password or security token, and when the control panel device generates the onetime password or security token, the control panel device can use GSM capability to transmit the onetime password or security token to the server device, and the server device can identify from the database one of the authorized users associated with the region in which the control panel device is located, identify from the database the phone number of a mobile device associated with the one of the authorized users, and transmit the onetime password or security token to the mobile device associated with the one of the authorized users for use in programming and updating software or firmware of the control panel device.

SUMMARY OF THE INVENTION

The object of the invention is to facilitate providing a new permanent password upon request to a user allowing access to a password protected computer network. In order to achieve above objective, invention relates to a security system for a computer network comprising an operation server accessible to a directory service of the computer network and a mobile device connected with the operation server by means of an electronic message service adapted to transmit electronic messages between the operation server and the mobile device. In a preferred application, an access control server in communication with a processor of the computer network is configured such that receive and parse a first electronic message from the mobile device into an identification data of the mobile device and a predetermined command, validate predetermined command with a stored pattern thereon; establish a data connection with the directory service via a network connection module and pair the device identification information with a registered user on a user database of the directory service, generate a permanent new password data for authorization of the registered user to the computer network by a security protocol and overwrite on a stored password data on the directory service with the new password data and send a second electronic message including new password data directly to the mobile device via electronic message service. Security system provide easy access to the computer network by a user of the mobile device when the mobile device is known to the directory service of the computer network. Directory service can be provided on the multiple operation servers for various services, e.g. active directory, SAP directory etc. distributed over the computer network communicating with the access control server using TCP/IP protocol. A single first message to the access control server will suffice to retrieve the new password data without any need for a further security steps to be followed by the user of the mobile device. In a possible application, additional security measures can be taken. Herein the permanent password means a password that is not changing during each cycle of the described operation. The password in the second electronic message can be a temporary password for the operation server and user can be forced to change the password after using the permanent password provided in the second electronic message. The operation server can be a single server or can be a group of servers providing single or integrated directory service of various services. In a possible application, the processor under the computer network belong to the operation server. In another application, the processor can be a CPU provided at the access control server.

In a preferred application, the electronic message service is an SMS service over a GSM network provided by a GSM operator. SMS prioritization is provided by the GSM operator so that resources of security system is not allocated by such a task. This allow installation of a scalable security system in an affordable cost. In another preferred application, the identification data is GSM subscription number assigned by the GSM network. Simply registration of the GSM subscription number to the directory service of the computer network will allow easy authentication by the access control server to provide a sensitive information, i.e. new password data to user of the mobile device.

In another preferred application, the access control server is equipped with a SIM shield in a persistent connection with the GSM network. Thereby, the access control server on various computer networks provide with persistent connection with the GSM network over the electronic messaging service and will allow any user to access new password data to access the computer network at any time.

In another preferred application, the access control server further comprises a memory module in which a pattern for predetermined command is stored such that access control server is enabled to terminate the remaining process when predetermined command does not match with the stored pattern. Memory module can be RAM or any SSD or hard drive storing the pattern for a predetermined command to compare with the first message. Integrated memory module provide box type server device running as access control server to be installed in a computer network. Predetermined command can be any alphanumerical character or a gesture data captured by the mobile device. In some instances, predetermined command can be blank.

In a preferred application, the network connection module is configured to access local area network to establish a data connection with the directory service on the computer network. Therefore, instant access to the operation server by the access control server is possible. In order to comply with security requirements of the computer network, data connection can be encrypted over an SSL protocol.

In order to achieve above objective, an operating method for a mobile device comprising the steps of sending a first electronic message having an identification data of the mobile device and a predetermined command for password renewal request from the mobile device to an access control server under a computer network by means of a first electronic message; interpretation of the first electronic message by an operation server at the computer network via LAN connection to the access control server to parse into an identification data and a predetermined command; validate the predetermined command with a stored pattern thereon; connect to a directory service; pair a registered user on a user database of the directory service using the identification data; generate a new password data for the registered user and overwrite on a stored password data. In a preferred application, further comprising the step of sending a second electronic message including new password data directly to the mobile device over an electronic messaging service.

In a preferred application, the electronic messaging service connecting the mobile device and the access control server is SMS over a GSM network.

BRIEF DESCRIPTON OF THE DRAWINGS

Figure 1 shows a schematic view of a security system for a computer network according to an exemplary application of the present invention.

DETAILED DESCRIPTION

While this invention is susceptible of an embodiment in many different forms, there are shown in the drawings and will be described herein in detail specific embodiments thereof with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention. It is not intended to limit the invention to the specific illustrated embodiments.

Figure 1 , a security system for a computer network (1 ) is schematically shown. An operation server (10), namely a group of servers providing various services in the same network area, e.g. operating system, ERP, CRM, etc. is actively connected or separately providing a directory service (12) to the computer network (1 ) under a known protocol, e.g. Active Directory, LDAP, from an assigned port and handle requests from the computer network (1 ). Outside traffic through the computer network (1 ) is managed by a firewall (not shown) blocking unauthorized requests to the computer network (1 ) and allow remote users to access operation server (10) via secure internet communication (14). The directory service (12) store user information such as, username, password, mobile phone number, e-mail address, role of the user, etc. in an encrypted manner. When a user try to login the computer network (1 ) using a computer (60) login request including username and password verified by operation server (10) via directory service (12) and unauthorized access requests are refused. If a user forgot current password information, the password is reset by an administrator having access to change password information.

Alternatively, user operate a mobile device (20) which is equipped with a SIM Card (22) having an assigned mobile phone number as identification data (261 ) to change a stored password data (A) on the directory service (12). Mobile device (20) is a cell phone with graphical user interface or SIM interface to send an electronic message through electronic messaging service (32) of a GSM network (30).

An access control server (40) in the computer network (1 ) is arranged such that post data to the directory service (12) of the operation server (10) using a middleware (50) running on the operation server (10). Access control server (40) has a processor (42), a memory module (43) and a network connection module (44) which are connected to each other in an electronic signal transmitting manner. Additionally, a SIM shield (48) is adapted into the access control server (40) providing access to the GSM network (30) by means of a SIM card inserted inside the SIM shield (48). A GSM operator has assigned a unique subscription number to the SIM card inside the SIM shield (48) and configured such that allowing access to the electronic messaging service (32), namely SMS service. The middleware (50) run on the operation control server (10) interprets the electronic messages received by the SIM shield (46). The middleware (50) is a piece of software run by a processor and has full access rights on the directory service (12) and in connection with the access control server (40) by means of the network connection module (44) and can send electronic messages to the access control server (40). The access control server (40) forward the electronic messages by means of the SIM shield (48) to the GSM network.

When a user of the mobile device (20) forgot the password stored on the directory service (12), e.g. active directory password to remotely access operating system, create and send an SMS and send the message as a first electronic message (26) to the assigned phone number of the SIM shield (48) by accessing GSM network (30). GSM operator of the GSM network (30) has means to prioritize the messages to the SIM shield (48) and provide a number of electronic messages, namely SMS to the access control server (40) by means of the SIM shield (48).

Access control server (40) persistently connected to the GSM network (30) by SIM shield (48). When GSM network (30) provide a list of electronic messages, access control server (40) initiate a read and validation procedure by running software commands for each one of the electronic messages independently. If the first electronic message (26) is unreadable, access control server (40) break the interpretation operation and terminate the first electronic message (26). Otherwise, forward the first electronic message (26) to the middleware (50) over the network connection module (44). Middleware (50) running on the operation server (10) initiate a parse procedure and split the first electronic message into several pieces including an identification data (261 ) and a predetermined command (262). Identification data (261 ) is the assigned subscriber number of the SIM card (22) in the mobile device (20). Middleware (50) establish a connection with the directory service (12) to check phone number information of the users registered to the directory service (12). If the identification data pairs with a user with the identification data (261 ) generate a new password data (B) according to the internal password policy of the computer network and send a command to the directory service (12) to overwrite a stored password data (A) accordingly. If the password change at the directory service (12) is successful, middleware (50) prepare a plain text password information from the new password data (B) and forward the access control server (40) to create an electronic message as the second electronic message (46) and send back to the mobile device (20) over the GSM network (30) using SIM shield (48). The user receive the new password data (B) from the mobile device (20). User can be able to access operation server (10) using the new password data (B) over the secure internet connection (14) using the computer (60).

REFERENCE NUMBERS

1 Computer network 30 GSM network

10 Operation server 32 Electronic messaging service

12 Directory service 40 Access control server

14 Secure internet connection 42 Processor

20 Mobile device 43 Memory module

22 SIM Card 44 Network connection module

24 GSM Connection 46 Second electronic message

26 First electronic message 48 SIM Shield

261 Identification data 50 Middleware

262 Predetermined command 60 Computer

A Stored password data

B New password data

Claims

1 - A security system for a computer network (1) comprising an operation server (10) accessible to a directory service (12) of the computer network (1 ) and a mobile device (20) connected with the operation server (10) by means of an electronic message service (32) adapted to transmit electronic messages between the operation server (10) and the mobile device (20) characterized in that an access control server (40) in communication with a processor (42) of the computer network (1 ) is configured such that receive and parse a first electronic message (26) from the mobile device (20) into an identification data (261 ) of the mobile device (20) and a predetermined command (262), validate predetermined command (262) with a stored pattern thereon; establish a data connection with the directory service (12) via a network connection module (44) and pair the device identification information (26) with a registered user on a user database of the directory service (12), generate a permanent new password data (A) for authorization of the registered user to the computer network (1 ) by a security protocol and overwrite on a stored password data (B) on the directory service (12) with the new password data (A) and send a second electronic message (46) including new password data (B) directly to the mobile device (20) via electronic message service.

2- A security system according to claim 1 , wherein the electronic message service (32) is SMS service over a GSM network (30) provided by a GSM operator.

3- A security system according to claim 2, wherein the identification data (261 ) is GSM subscription number assigned by the GSM network (30).

4- A security system according to claims 2-3, wherein the access control server (40) is equipped with a SIM shield (48) in a persistent connection with the GSM network (30).

5- A security system according to any one of the preceding claims, wherein the network connection module (44) is configured to access local area network to establish a data connection with the directory service (12) on the computer network (1 ).

6- An operating method for a mobile device (20) characterized by comprising the steps of sending a first electronic message (26) having an identification data (261 ) of the mobile device (20) and a predetermined command (262) for password renewal request from the mobile device (20) to an access control server (40) under a computer network (1 ) by means of a first electronic message (26); interpretation of the first electronic message (26) by an operation server (10) at the computer network (1 ) via LAN connection to the access control server (40) to parse into an identification data (261 ) and a predetermined command (262); validate the predetermined command (262) with a stored pattern thereon; connect to a directory service (12); pair a registered user on a user database of the directory service (12) using the identification data (262); generate a new password data (A) for the registered user and overwrite on a stored password data (B) and send a second electronic message (46) including new password data (B) directly to the mobile device (20) over an electronic messaging service (32). 7- An operating method for a mobile device (20) according to claim 7, wherein the electronic messaging service (32) connecting the mobile device (20) and the access control server (40) is SMS over a GSM network.