KR101141101B1 - Access point access approval system and method - Google Patents

Abstract

PURPOSE: An AP(Access Point) connection approval system and a method thereof are provided to reinforce the security of AP connection by transmitting an encoding key for AP connection to a client terminal. CONSTITUTION: A determining unit(103) determines whether received member information and received AP information are stored in a database. If the received member information and received AP information are stored in the database, an encoding key extracting unit(104) extracts an encoding key about a target AP. An encoding key transmitting unit(105) transmits the extracted encryption key to a client terminal. A result transmitting unit(106) transmits the determination result to the client terminal.

Description

[0001] ACCESS POINT APPROVAL SYSTEM AND METHOD [0002]

An access point (AP) access authorization system and method are disclosed. In particular, embodiments of the present invention relate to a system and method for granting access rights to client terminals that wish to access an AP using a wireless LAN.

2. Description of the Related Art Recently, various portable devices such as a smart phone have become widespread, and a technique for a local area network such as a wireless LAN has become a subject of interest.

Especially, with the launch of portable devices equipped with a wireless LAN communication module, the wireless Internet service market is rapidly growing.

Accordingly, service providers are trying to provide wireless Internet services to consumers having portable devices equipped with a wireless LAN communication module by constructing an access point (AP) in various places.

However, since the APs currently being built do not have the proper encryption schemes, they may be vulnerable to security, and resources may be wasted due to unreasonable access to the APs.

Therefore, it is necessary to study how to enhance the security by encrypting the access procedure to the AP, preventing unauthorized access to the AP, and providing a more comfortable wireless Internet service to the consumers.

In embodiments of the present invention, when the client terminal desires to access a predetermined target access point (AP), it is checked whether the user of the client terminal and the target AP are users and APs registered in the database, And transmits an encryption key for accessing the AP to the terminal, thereby enhancing the security of access to the AP.

In addition, embodiments of the present invention attempt to guarantee quality of service (QoS) for the client terminal by blocking indiscreet connection of the terminals to the target AP.

The AP access authorization system according to an embodiment of the present invention includes a database in which at least one access point (AP) information, at least one member information and at least one encryption key are stored, A determination unit for determining whether the received AP information and the received AP information are stored in the database, a determination unit for determining whether the received AP information is stored in the database, An encryption key extracting unit for extracting an encryption key for the target AP among the at least one encryption key from the database when it is determined that the received membership information and the received AP information are stored in the database, Key to the client terminal And an encryption key transmitting unit, wherein the client terminal accesses the target AP based on the encryption key.

Also, the AP connection approval method according to an embodiment of the present invention includes managing a database storing at least one AP information, at least one member information, and at least one encryption key, The method comprising the steps of: receiving AP information about a target AP and membership information for a user of the client terminal; determining whether the received membership information and the received AP information are stored in the database; And extracting an encryption key for the target AP among the at least one encryption key from the database if the received AP information is determined to be stored in the database, The method comprising the steps of: The client terminal accesses the target AP based on the encryption key.

In embodiments of the present invention, when the client terminal desires to access a predetermined target access point (AP), it is checked whether the user of the client terminal and the target AP are users and APs registered in the database, By transmitting the encryption key for accessing the AP to the terminal, the security for the access to the AP can be enhanced.

In addition, embodiments of the present invention can ensure quality of service (QoS) for the client terminal by blocking indiscreet connection of the terminals to the target AP.

1 is a diagram illustrating a structure of an access point (AP) access authorization system according to an embodiment of the present invention.
2 is a flowchart illustrating an operation of the AP connection approval system according to an embodiment of the present invention.
3 is a flowchart illustrating an AP connection approval method according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a structure of an access point (AP) access authorization system according to an embodiment of the present invention.

Referring to FIG. 1, an AP access authorization system 100, a client terminal 120, and a target AP 130 are shown.

Here, the client terminal 120 refers to a microprocessor-based device such as a smart phone, a notebook computer, or a PDA.

Referring to FIG. 1, an AP access authorization system 100 includes a database 101, an information receiving unit 102, a determination unit 103, an encryption key extraction unit 104, and an encryption key transmission unit 105.

The database 101 stores at least one AP information, at least one member information, and at least one encryption key.

When the user of the client terminal 120 desires to use the wireless Internet, the client terminal 120 can search for the nearby AP and display it to the user. At this time, ) To allow the client terminal 120 to access the target AP 130. [

At this time, the user can input member information such as an ID and a password to the client terminal 120.

The information receiving unit 102 receives the AP information about the target AP 130 to which the client terminal 120 wants to connect and the member information about the user of the client terminal 120 from the client terminal 120. [

The determination unit 103 determines whether the received membership information and the received AP information are stored in the database 101. [

In this case, according to an embodiment of the present invention, the AP connection approval system 100 may further include a result transmission unit 106.

The result transmitting unit 106 transmits the determination result of the determining unit 103 to the client terminal 120.

If it is determined that the received membership information and the received AP information are stored in the database 101, the encryption key extracting unit 104 extracts, from the database 101, the target AP 130 of the at least one encryption key, Lt; / RTI >

The encryption key transmitting unit 105 transmits the extracted encryption key to the client terminal 120.

At this time, the client terminal 120 receives the encryption key, decrypts the received encryption key, performs an integrity check on the encryption key, and transmits an authentication request to the target AP 130.

When the target AP 130 completes authentication with respect to the client terminal 120, the client terminal 120 accesses the target AP 130 and performs encryption-based communication with the target AP 130.

The AP access authorization system 100 according to an exemplary embodiment of the present invention allows the user of the client terminal 120 and the target AP 130 to access the target AP 130, It is possible to enhance the security of the AP connection by transmitting the encryption key for the AP connection to the client terminal 120 after confirming whether the AP is the user registered in the database 101 or the AP.

The AP access authorization system 100 may further include a location information receiving unit 107, an AP information selecting unit 108, and an AP information transmitting unit 109 according to an embodiment of the present invention.

The location information receiving unit 107 receives the location information of the client terminal 120 from the client terminal 120.

The AP information selection unit 108 selects an AP located in a predetermined distance from the location of the client terminal 120 among the at least one AP information stored in the database 101 based on the received location information Select the AP information.

The AP information transmitting unit 109 transmits the selected AP information to the client terminal 120.

The following is an example of the above process.

When the user inputs member information to the client terminal 120 in order to use the wireless Internet, the client terminal 120 accesses the client terminal 120 using a Global Positioning System (GPS) module included in the client terminal 120, And then transmits the location information to the AP connection approval system 100. [

At this time, the location information receiving unit 107 receives the location information from the client terminal 120.

The AP information selection unit 108 then transmits the AP information stored in the database 101 based on the received location information to the AP located within a predetermined distance from the location of the client terminal 120 Select the AP information.

For example, the AP information selection unit 108 may select AP information for an AP located within a radius of 50 m from the location of the client terminal 120 among the at least one AP information based on the location information.

Then, the AP information transmitting unit 109 transmits the selected AP information to the client terminal 120.

At this time, the client terminal 120 may receive the selected AP information and display the selected AP information.

Accordingly, the user can control the client terminal 120 to access the selected AP by selecting a specific AP after confirming the AP information located within a predetermined distance from the current position of the user.

At this time, according to an embodiment of the present invention, at least one AP recommendation criterion may be stored in the database 101.

At this time, the determination unit 103 may set the AP recommendation rank by applying the at least one AP recommendation criterion to the AP information selected by the AP information selector 108. [

At this time, the result transmitting unit 106 may transmit the AP recommendation order to the client terminal 120.

The following is an example of the above process.

The location information receiving unit 107 receives location information of the client terminal 120 from the client terminal 120 and transmits the location information of the AP 120 to the AP information selecting unit 108. [ Based on the received location information, AP information for APs located within a predetermined distance from the location of the client terminal 120 among the at least one AP information stored in the database 101. [

At this time, the determination unit 103 may set the AP recommendation rank by applying the at least one AP recommendation criterion stored in the database 101 to the selected AP information.

According to an embodiment of the present invention, the database 101 may store the at least one AP recommendation criterion as shown in Table 1 below.

division factor Rating Explanation Availability aspect Concurrent users Recommendation: less than 5
Medium: 5 ~ 10 or less
Deprecated: more than 10 Because it affects the performance of the wireless AP depending on the number of concurrent users, it recommends the most efficient AP by classifying the number of concurrent users. User popularity Recommendation: More than 5 people recommended
Normal: 5 or less recommended
Deprecated: no more than 5 people Recommended APs with popularity by using popularity of AP users Performance aspect Electric wave intensity Recommendation: over 40db
Normal: 10 to 40db or less
Deprecated: Less than 10db Recommended AP with the best radio wave intensity Street Recommended: within 5m
Normal: Within 5 ~ 20m
Deprecated: more than 20m It compares the GPS information of the terminal with the registration position information of the AP and recommends the AP having the closest distance Wireless AP Supported Standards Recommendation: IEEE802.11n, IEEE802.11a, g
Normal: IEEE802.11b Recommended according to supported wireless LAN standard Wireless AP Equipment Performance Recommendation: Wireless AP equipment performance recommendation list
Normal: AP not listed Recommended by the performance of the equipment supported by the wireless AP manufacturer Security aspect Key safety Recommendation: WPA, WPA2
Deprecated: SSID, WEP Recommended AP with high safety of key Authentication AP Recommendation: Authentication
Deprecated: Unauthorized Recommended APs registered in the authentication server from the wireless AP list transmitted from the terminal

When the determination unit 103 completes the setting of the AP recommendation order, the result transmitter 106 may transmit the AP recommendation order to the client terminal 120.

At this time, the client terminal 120 may attempt to automatically connect to the first AP based on the AP recommendation rank, and may connect the client terminal 120 to an AP that the user wishes to access based on the AP recommendation rank .

Also, according to an embodiment of the present invention, the information receiving unit 102 may receive at least one AP information collected from the client terminal 120 based on the signal strength of the client terminal 120.

At this time, the determination unit 103 may set the AP recommendation rank by applying the at least one AP recommendation criterion stored in the database 101 to the at least one AP information received from the client terminal 120. [

Then, the result transmitting unit 106 may transmit the AP recommendation order to the client terminal 120. [

In other words, the AP connection approval system 100 may search for an AP around the client terminal 120 based on the location information of the client terminal 120, and may set an AP recommendation rank for the searched AP, The AP terminal 120 may receive the AP information retrieved by the client terminal 120 and set the AP recommendation rank for the received AP information.

According to an embodiment of the present invention, at least one connection permission information may be stored in the database 101.

The determination unit 103 refers to the at least one connection permission information based on the membership information and the AP information received from the client terminal 120 and determines the connection to the target AP 130 of the client terminal 120 It is possible to judge whether or not it is allowed.

In this case, according to an embodiment of the present invention, the AP access authorization system 100 may further include an access blocking unit 110.

The connection blocking unit 110 blocks connection to the target AP 130 of the client terminal 120 when the determination unit 103 determines that the client terminal 120 can not access the target AP 130 do.

In this case, according to an embodiment of the present invention, the database 101 may store the at least one connection permission information as shown in Table 2 below.

division factor Rating Explanation Availability aspect Terminal OS Block: OS in question
Allow: Allow non-blocking OS Blocks operating systems that cause compatibility issues with wireless APs Terminal type Block: The terminal registered in the Block List
Allowed: Outside List Blocks devices with performance problems Performance aspect Termination of service Block: Terminals accessing the AP registered in the service revocation list
Allowed: Terminals that connect to the AP other than the blocked list An AP that has terminated the use of this service is denied access. Security aspect Black List Block: The terminal registered in Black List
Allowed: Black List Unregistered terminal Users who are registered as dangerous terminals are blocked White List Block: Terminals not registered in the White List
Allowed: Terminal registered in White List Only users who are registered as safe Malware infection Block: Malicious code-infected device
Allow: Malicious code-infected device Blocking malicious code Root permission hacked Block: Terminal with root privilege hacked
Allow: Terminal without root hacking privileges Hacking the root privilege of the terminal and blocking the smartphone which acquired the arbitrary privilege

That is, when the client terminal 120 transmits the membership information of the user and AP information about the target AP 130 to access the target AP 130, the determination unit 103 determines whether the client terminal 120 The client terminal can determine whether to allow access to the target AP 130 by referring to the at least one connection permission information.

Thus, it is possible to guarantee QoS (Quality of Service) for the client terminal 120 by blocking indiscreet connection of the terminals to the target AP 130.

The operation of the AP connection approval system 100 has been described above. Hereinafter, an operation flow between the AP access authorization system 100, the client terminal 120, and the target AP 130 will be described with reference to FIG.

2 is a flowchart illustrating an operation of the AP connection approval system according to an embodiment of the present invention.

In step S210, the client terminal 120 transmits the AP information about the target AP 130 and the member information of the user of the client terminal 120 to the AP access authorization system 100.

In step S220, the AP connection approval system 100 determines whether the received AP information and membership information are stored in the database 101. [

In step S230, when it is determined that the received AP information and the member information are stored in the database 101, the AP connection approval system 100 transmits an encryption key for the target AP 130 from the database 101 .

In step S240, the AP connection approval system 100 transmits the extracted encryption key to the client terminal 120. [

In step S250, the client terminal 120 decrypts the encryption key.

In step S260, the client terminal 120 performs an integrity check on the encryption key.

In step S270, the client terminal 120 accesses the target AP 130 based on the encryption key, and then communicates with the target AP 130. [

3 is a flowchart illustrating an AP connection approval method according to an embodiment of the present invention.

In step S310, a database storing at least one AP information, at least one member information, and at least one encryption key is managed.

In step S320, the client terminal receives the AP information about the target AP to which the client terminal desires to access and the member information on the user of the client terminal.

In step S330, it is determined whether the received membership information and the received AP information are stored in the database.

In step S340, if it is determined that the received membership information and the received AP information are stored in the database, an encryption key for the target AP among the at least one encryption key is extracted from the database.

In step S350, the extracted encryption key is transmitted to the client terminal.

At this time, the client terminal accesses the target AP based on the encryption key.

According to an embodiment of the present invention, the AP access authorization method may further include receiving location information of the client terminal from the client terminal after step S320.

Then, the AP access authorization method selects AP information for APs located within a predetermined distance from the position of the client terminal among the at least one AP information stored in the database based on the received location information And transmitting the selected AP information to the client terminal.

At this time, according to an embodiment of the present invention, at least one AP recommendation criterion may be stored in the database.

The AP access method may further include setting an AP recommendation order by applying the at least one AP recommendation criterion to the selected AP information, and transmitting the AP recommendation order to the client terminal .

According to an embodiment of the present invention, the AP access authorization method may further include receiving at least one AP information collected from the client terminal based on the signal strength of the client terminal.

The method further includes setting an AP recommendation rank by applying the at least one AP recommendation criteria stored in the database to the at least one AP information received from the client terminal, To the client terminal.

According to an embodiment of the present invention, at least one connection permission information may be stored in the database.

According to an embodiment of the present invention, the AP connection approval method may further include, after step S320, referring to the at least one connection permission information based on the membership information and the AP information received from the client terminal, The method comprising the steps of: determining whether the client terminal is allowed to access the target AP; and blocking the client terminal from accessing the target AP if it is determined that the client terminal can not access the target AP .

The AP access method according to an embodiment of the present invention has been described above with reference to FIG. Here, the AP accessing method according to an embodiment of the present invention may correspond to the configuration of the AP accessing approval system 100 described with reference to FIG. 1, so that a detailed description thereof will be omitted.

The AP access method according to an exemplary embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

100: AP access authorization system
101: Database 102: Information Receiving Unit
103: Determination unit 104: Encryption key extraction unit
105: encryption key transfer unit 106: result transfer unit
107: Position information receiver 108: AP information selector
109: AP information transmitting unit 110:
120:
130: target AP

Claims (13)

delete delete A database storing at least one access point (AP) information, at least one member information and at least one encryption key;
An information receiver for receiving AP information about a target AP to which the client terminal wants to access from the client terminal and member information about the user of the client terminal;
A determination unit for determining whether the received membership information and the received AP information are stored in the database;
An encryption key extractor for extracting an encryption key for the target AP among the at least one encryption key from the database when it is determined that the received membership information and the received AP information are stored in the database;
An encryption key transmission unit for transmitting the extracted encryption key to the client terminal; And
And a result transmitting unit for transmitting a determination result of the determining unit to the client terminal,
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
A location information receiver for receiving location information of the client terminal from the client terminal;
An AP information selection unit for selecting AP information for APs located within a predetermined distance from the position of the client terminal among the at least one AP information based on the received location information; And
An AP information transmitting unit for transmitting the selected AP information to the client terminal,
Further comprising an AP access authorization system. The method of claim 3,
In the database,
At least one AP recommendation criterion is stored,
The determination unit
Setting an AP recommendation rank by applying the at least one AP recommendation criterion to the selected AP information,
The result transmitter
And transmits the AP recommendation order to the client terminal. A database storing at least one access point (AP) information, at least one member information and at least one encryption key;
An information receiver for receiving AP information about a target AP to which the client terminal wants to access from the client terminal and member information about the user of the client terminal;
A determination unit for determining whether the received membership information and the received AP information are stored in the database;
An encryption key extractor for extracting an encryption key for the target AP among the at least one encryption key from the database when it is determined that the received membership information and the received AP information are stored in the database;
An encryption key transmission unit for transmitting the extracted encryption key to the client terminal; And
And a result transmitting unit for transmitting a determination result of the determining unit to the client terminal,
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
In the database,
At least one AP recommendation criterion is stored,
The information receiver
From the client terminal, the at least one AP information collected by the client terminal based on the signal strength,
The determination unit
Setting an AP recommendation rank by applying the at least one AP recommendation criterion to the at least one AP information received from the terminal by the client,
The result transmitter
And transmits the AP recommendation order to the client terminal. A database storing at least one access point (AP) information, at least one member information and at least one encryption key;
An information receiver for receiving AP information about a target AP to which the client terminal wants to access from the client terminal and member information about the user of the client terminal;
A determination unit for determining whether the received membership information and the received AP information are stored in the database;
An encryption key extractor for extracting an encryption key for the target AP among the at least one encryption key from the database when it is determined that the received membership information and the received AP information are stored in the database; And
An encryption key transmission unit for transmitting the extracted encryption key to the client terminal,
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
In the database,
Wherein at least one connection permission information is stored,
Wherein the determination unit determines whether or not the client terminal is allowed to access the target AP by referring to the at least one connection permission information based on the received membership information and the received AP information. The method according to claim 6,
When the determination unit determines that the client terminal can not access the target AP, the connection termination unit blocks the connection to the target AP of the client terminal,
Further comprising an AP access authorization system. delete Managing a database in which at least one access point (AP) information, at least one member information, and at least one encryption key are stored;
Receiving AP information about a target AP that the client terminal desires to access from the client terminal and member information about the user of the client terminal;
Determining whether the received membership information and the received AP information are stored in the database;
Extracting an encryption key for the target AP among the at least one encryption key from the database if it is determined that the received membership information and the received AP information are stored in the database;
Transmitting the extracted encryption key to the client terminal
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
After receiving the member information and the AP information,
Receiving location information of the client terminal from the client terminal;
Selecting AP information for an AP located within a predetermined distance from the location of the client terminal among the at least one AP information based on the received location information; And
Transmitting the selected AP information to the client terminal
Further comprising the step of: 10. The method of claim 9,
In the database,
At least one AP recommendation criterion is stored,
The AP access method includes:
After selecting the AP information,
Setting an AP recommendation rank by applying the at least one AP recommendation criterion to the selected AP information; And
Transmitting the AP recommendation order to the client terminal
Further comprising the step of: Managing a database in which at least one access point (AP) information, at least one member information, and at least one encryption key are stored;
Receiving AP information about a target AP that the client terminal desires to access from the client terminal and member information about the user of the client terminal;
Determining whether the received membership information and the received AP information are stored in the database;
Extracting an encryption key for the target AP among the at least one encryption key from the database if it is determined that the received membership information and the received AP information are stored in the database;
Transmitting the extracted encryption key to the client terminal
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
In the database,
At least one AP recommendation criterion is stored,
The AP access method includes:
After the step of managing the database,
Receiving at least one AP information collected from the client terminal based on signal strength of the client terminal;
Setting an AP recommendation rank by applying the at least one AP recommendation criterion to the at least one AP information received from the client terminal; And
Transmitting the AP recommendation order to the client terminal
Further comprising the step of: Managing a database in which at least one access point (AP) information, at least one member information, and at least one encryption key are stored;
Receiving AP information about a target AP that the client terminal desires to access from the client terminal and member information about the user of the client terminal;
Determining whether the received membership information and the received AP information are stored in the database;
Extracting an encryption key for the target AP among the at least one encryption key from the database if it is determined that the received membership information and the received AP information are stored in the database;
Transmitting the extracted encryption key to the client terminal
Lt; / RTI >
The client terminal accesses the target AP based on the encryption key,
In the database,
Wherein at least one connection permission information is stored,
The AP access method includes:
After receiving the member information and the AP information,
Determining whether the client terminal is allowed to access the target AP by referring to the at least one connection permission information based on the received membership information and the received AP information; And
Blocking a connection to the target AP of the client terminal when it is determined that the client terminal can not access the target AP;
Further comprising the step of: A computer-readable recording medium recording a program for performing the method of any one of claims 9 to 12.

Images