KR101981604B1 - Apparatus and System for controlling entry based on card information and terminal information and method thereof - Google Patents

Abstract

And an apparatus, system, and method for controlling access to a user who has been successfully authenticated based on card information and terminal information. The apparatus includes: a collecting unit for collecting terminal information of a user terminal received by an Access Point (AP) apparatus in the vicinity of an access device; A receiving unit for receiving a request for access authentication including card information of a user read by the access device; Authentication of the MFA (Multi Factor Authentification) including the card authentication for determining whether the card information requested for authentication is the registered card information and the terminal authentication for determining whether the terminal information of the received card information is the terminal information collected at the collection unit A judging unit for judging; And a control unit for transmitting the control information in which the determined authentication result is successful to the access device to control access permission of the user.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus, a system, and a method for controlling access based on card information and terminal information,

The present invention is a technology of access control, more specifically, collects terminal information of a user and, when receiving a request for access authentication including card information of a user, authenticates the collected terminal information and requested card information, And more particularly, to a device, system, and method for controlling whether or not to enter or exit.

Conventionally, a user is authenticated using biometric information such as a fingerprint or irregularity of a user, or a password, and the user is selectively permitted to enter and exit according to the authentication result.

Furthermore, technologies for access control based on RFID (Radio Frequency Identification) have been developed. The access management technology using the RFID authenticates whether or not the RFID received from the user's terminal or card is the registered identification information, and allows the user to access the RFID tag.

However, in the access management technology using the RFID, when the user loses the terminal or the card in which the RFID is registered or lends it to another person, the security of the other user can be successfully authenticated as a user by using the terminal or card of the user as a user Vulnerability. That is, the other user who secured the RFID means of the user succeeds in authentication at any time by the user's access.

Here, MFA (Multi Factor Authentication) is a multi-factor authentication used for authentication. If an additional authentication factor is added to the RFID based on the MFA, even if the RFID authentication succeeds, authentication fails because the added authentication factor fails and the other user impersonates the user.

Korean Patent No. 10-1329520 (November 31, 2013)

The present invention has been made in view of the above-described prior art, and it is an object of the present invention to provide an apparatus, system, and method for authenticating a card ID and terminal information of a user for which access authentication is requested based on an MFA, And to provide the above objects.

In addition, the present invention divides the peripheral area in which the access device is located into a wifi zone, collects the location information of the user terminal, and stores the location of the access device for which authentication of the card ID is requested and the location information of the collected terminal When it is confirmed that there is a match, another purpose is to control the opening and closing of the access device that the user passes by the success of access authentication.

According to an aspect of the present invention, there is provided an apparatus for controlling access based on card information and terminal information, comprising: a collecting unit for collecting terminal information of a user terminal received by an Access Point (AP) apparatus in the vicinity of an access device; A receiving unit for receiving a request for access authentication including card information of a user read by the access device; A card authentication for determining whether the card information requested for authentication is registered card information, and a terminal authentication for determining whether the terminal information of the received card information is the collected terminal information is judged by an MFA (Multi Factor Authentification) A determination unit; And a control unit for transmitting the control information in which the determined authentication result is successful to the access device to control the access permission of the user.

The collecting unit collects, as the terminal information, terminal identification information received by the AP apparatus via Wi-Fi communication or beacon communication.

The collecting unit collects the terminal information by executing the Wi-Fi of the user terminal on which the function of always searching for the AP apparatus is performed even when the Wi-Fi receiving function is turned off.

The receiving unit receives RFID (Radio Frequency IDentification) of the access card read by the reader of the access device as the card information.

The apparatus further includes a DB (Data Base) for storing a card ID of the access card of the user and matching terminal identification information of the user terminal, and the determination unit may receive the card ID of the card information requested for authentication from the DB If the stored card ID and the terminal identification information are retrieved, the card authentication is determined to be successful. If the retrieved terminal identification information is the collected terminal identification information, the terminal authentication is determined to be successful. If the card authentication and the terminal authentication are successful The authentication result of the MFA is judged to be successful.

The control unit transmits control information of access permission to the gate controller of the access device, and the gate controller controls access to the gate device through which the user passes according to the transferred control information.

The apparatus includes a DB in which a peripheral area of the access device is divided into a plurality of unit areas and intensity of a radio signal received from peripheral AP devices in each unit area is stored as position information per unit area, The collecting unit collects the terminal information including the terminal identification information of the user terminal and the intensity of each radio signal received in the unit area through the AP apparatus.

The determination unit searches the best matching position information from the DB using the strength of the collected radio signal as a key, and determines the unit area of the inquired location area as a unit area where the user terminal is located.

The DB further stores the unit area information in which the access device is located,

The determination unit determines the terminal authentication as successful if the unit area information of the collected terminal information is used as a key to inquire the unit area information of the access device from the DB.

According to another aspect of the present invention, there is provided a system for controlling access based on card information and terminal information, comprising: a user terminal for receiving a radio signal from each AP device and transmitting and receiving terminal information; An AP device installed in the vicinity of the access device and receiving the terminal information from a user terminal that receives the wireless signal and transmitting the terminal information to the control device; An access device that reads card information of a user requesting access permission, requests access authentication including the card information, receives control information of an authentication result and permits or disallows user access; And a controller for collecting terminal information through the AP device, receiving the authentication request from the access device, determining whether the received card information is registered card information, and transmitting the terminal information of the received card information to the collected terminal And a control device for determining the authentication result of the MFA including the terminal authentication for determining whether the information is information, and transmitting the control information in which the determined authentication result is successful to the access device.

According to another aspect of the present invention, there is provided a method of controlling access based on card information and terminal information, the method comprising: collecting terminal information of a user terminal received by an AP apparatus in the vicinity of an access device; Receiving an access authentication request including the card information of the user read by the access device; Determining card authentication for determining whether card information requested for authentication is registered card information and terminal authentication for determining whether terminal information of received card information is collected terminal information; And controlling access to the user by transmitting the control information in which the determined authentication result is successful to the access device.

The present invention is advantageous in that security of the access management can be improved by permitting the access of the user only if both the card authentication and the terminal authentication are successful based on the MFA.

In addition, according to the present invention, when a third party having a deported access card requests an access authentication by impersonating a user of an access card, access is denied due to failure of the terminal authentication, and in order for the third party to succeed in access authentication, Access authentication is strengthened since it is necessary to take a seizure.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate preferred embodiments of the invention and, together with the description of the invention below, And should not be construed as interpretation.
1 is a schematic block diagram of a system according to an embodiment of the present invention.
2 is a schematic internal configuration diagram of the control server of FIG.
3 is a signal flow diagram of an MFA authentication process according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating location information based on RSSI (Received Signal Strength Identification) according to another embodiment of the present invention.
FIG. 5 is a diagram illustrating an example where positional information of the unit area of FIG. 4 is stored.
6 is an exemplary diagram of a control server for collecting RSSI-based location information of FIG.
7 is a signal flow diagram of an MFA authentication process according to another embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

1 is a schematic block diagram of a system 100 according to an embodiment of the present invention.

The system 100 according to an exemplary embodiment of the present invention includes a user terminal 110 in which terminal information is collected, an access card 111 in which card information is read, an AP apparatus 130 that receives terminal information of the user terminal 110 The control server 150 reads the card information of the access card 111 and requests access to the control server 150 for authentication based on the terminal information and the card information. And an access device 170 that receives the MFA authentication result from the user and permits or denies access of the user.

The user terminal 110 includes a smart terminal (e.g., a smart phone) that receives a wireless communication service through the AP device 130. The user terminal 110 can receive respective radio signals from a plurality of AP devices 130 installed in the vicinity. When each wireless signal is received, the user terminal 110 selects a primary AP device 130 and receives a wireless communication service.

Here, the user terminal 110 receives a wireless signal based on beacon communication and Wi-Fi communication from the AP device 130, and transmits the terminal information such as the MAC address, the USIM identification information, and the IMSI as the response information of the received wireless signal to the AP To the device 130 to receive the wireless communication service. The terminal information does not have any particular limitation as long as information that uniquely identifies the user terminal 110 is included.

In addition, the user terminal 110 must have a communication function for receiving a radio signal and for responding to the terminal information. In the case of Wi-Fi communication, the user terminal 110 preferably has a function of searching for the neighboring AP device 130 at all times. That is, the "always search permitted" function (for example, Android version 4.3 (SDK 18) or later) is set in the WiFi receiving function in the user terminal 110. Then, the user terminal 110 can scan the neighboring AP apparatus 130 even when the Wi-Fi receiving function is turned off.

For example, when the user terminal 110 is set as a " always search allowed " function as a smartphone, if a specific SSID is scanned with a background function supported by the Android OS, the smart phone automatically activates the Wi-Fi function. The smart phone monitors the SSID transmitted from the AP device 130 or the base station and activates the Wi-Fi function when a specific SSID transmitted from the AP device 130 in the vicinity of the access device 170 is scanned. When the Wi-Fi function is activated in the smartphone, the AP device 130 may receive the terminal information of the smartphone and transmit it to the control server 150 in the course of processing SSID-based access from the smartphone. Then, the control server 150 can collect the terminal information of the smartphone close to the access device 170 through the AP device 130. [

The AP device 130 is installed in a peripheral area where the access device 130 is located and transmits the wireless signal to surrounding user terminals 110 to establish a wireless communication service and provide a wireless Internet service .

In the process of setting up the wireless communication service, the AP device 130 receives the terminal information from the user terminal 110 which has received the transmitted wireless signal (①), and transmits the received terminal information to the control server 150 (2).

The access card 111 is a card (e.g., an RF card) possessed by a user for access authentication, and stores a card ID such as an RFID in an internal storage. The access card 111 can be applied to various communication methods for transmitting the card ID and is not necessarily limited to RF communication.

When the access card 111 is a mobile card, the user terminal 110 stores the card information of the mobile card and transmits the card information to the user terminal 110 through various communication methods (e.g., Wi-Fi, Bluetooth, NFC, The card information can be transmitted.

The access device 170 is configured to include a reader 171, a controller 173, and a gate 175 in order to permit and deny access of a user according to an authentication process. Assuming that the access device 170 is installed in the office, the user enters the office area through the access device 170 in the external area. In addition, the user passes through the access device 170 in the office area and exits to the outside area.

The control server 150 is an apparatus for controlling access to a user by performing authentication processing based on card information and terminal information of the present invention. The control server 150 performs wired and wireless communication with the AP device 130 and the access device 170 to provide an access control service.

It is assumed that the user uses the access control service using the RF type access card 111 made of a plastic material. The user tags the access card 111 to the reader 171 and the reader 171 reads the card information including the RFID of the access card 111 (2). The controller 173 receives the card information of the RFID from the reader 171 and transmits it to the control server 150 to request access authentication of the user (5).

Then, the control server 150 receives the access authentication request, and determines that the card authentication is successful if the received RFID matches the previously stored RFID. If the authentication of the card is successful, the control server 150 inquires terminal information previously stored in the RFID. If the inquired terminal information matches the terminal information received from the AP device 130, the control server 150 determines that the terminal authentication is successful. The MFA authentication includes the card authentication and the terminal authentication. If both the card authentication and the terminal authentication are successful, the control server 150 determines that the MFA authentication is successful and transmits the authentication result of the control information for permitting the user's access to the controller 173 (6). That is, the MFA authentication verifies whether the user of the RFID received matches the user of the collected terminal information. If the authentication is either card authentication or terminal authentication, the control server 150 transmits the authentication result of the control information denying access by the user to the controller 173.

The controller 173 receives the authentication result from the control server 150 and controls the opening and closing operation of the gate 175 according to the received authentication result (7). Of course, when an authentication result of success is received, the controller 173 controls the operation of the gate 175 so as to disallow the user's access. Here, the gate 175 allows or prohibits the user from entering or exiting the apparatus through operations such as screen output, audio output, and bar access according to the opening / closing control received from the controller 173. [

2 is a schematic internal configuration diagram of the control server 150 of FIG.

Control server 150 may include a memory, a memory controller, one or more processors (CPUs), a peripheral interface, an input / output (I / O) subsystem, a display device, an input device, and a communications circuit. The memory may include high speed random access memory and may also include one or more magnetic disk storage devices, non-volatile memory such as flash memory devices, or other non-volatile semiconductor memory devices. Access to the memory by other components such as the processor and the peripheral interface may be controlled by the memory controller. The memory can store various information and program instructions, and the program is executed by the processor.

The peripheral interface connects the input / output peripheral of the control server 150 to the processor and memory. The one or more processors execute various functions for the control server 150 and process data by executing a set of instructions stored in various software programs and / or memories. The I / O subsystem provides an interface between I / O peripheral devices such as display devices, input devices, and peripheral interfaces. The display device can use liquid crystal display (LCD) technology or light emitting polymer display (LPD) technology.

A processor is a processor configured to perform an operation associated with control server 150 and to perform instructions and to receive and manipulate input and output data between components of control server 150 using, for example, Can be controlled. The communication circuit performs communication via an external port or communication by an RF signal. The communication circuit converts the electrical signal to an RF signal and vice versa, and is capable of communicating with the communication network, other mobile gateway devices, and the communication device through the RF signal.

2, the control server 150 includes a terminal information collecting unit 251, a card information receiving unit 253, a determining unit 255, a controller 257, and a DB 259, . Such components may be implemented in software, stored in memory and executed by a processor, or may be implemented in a combination of software and hardware.

The terminal information collecting unit 251 collects terminal information of the user terminal 110 through the AP apparatus 130 in the vicinity of the access device 170.

Here, it is assumed that a user having the user terminal 110 enters within a predetermined area from the access device 170 and the user terminal 110 is in the area of the access device 170. The AP device 130 in the vicinity of the access device 170 periodically transmits wireless signals of Wi-Fi or beacon frames to the user terminals 110 in the communication coverage area. The communication coverage area corresponds to an area where the access device 170 is located. The user terminal 110 receives the transmitted radio signal and responds to the AP apparatus 130 with the terminal information. The AP device 130 transmits the terminal information returned to the terminal information collection unit 251. Then, the terminal information collecting unit 251 collects the terminal information through the AP device 130. [

The card information receiving unit 253 receives from the controller 173 a request for access authentication including card information of the access card 111 tagged by the user entering and exiting through the access device 170. The card information received by the access authentication request may include a card ID (e.g., RFID), a classification of entry or exit, information on an entrance gate, and the like.

The determination unit 255 inquires the DB 259 and processes the MFA authentication including card authentication and terminal authentication. The DB 259 stores a card ID (e.g., RFID) of the access card 111 of each user who has registered access and terminal identification information (e.g., MAC address, USIM information) of the user terminal 110 matched with the card ID Etc.). The DB 259 includes a plurality of DBs 259 according to information to be stored.

First, the determination unit 255 queries the DB 259 for a matching card ID and matched terminal identification information using the card ID requested as the authentication key. When the matched card ID is retrieved from the DB 259, the determination unit 255 determines that the authentication is requested to the valid access card 111 and processes the card authentication success.

Next, when the card authentication is successful, the determination unit 255 compares the terminal identification information retrieved from the DB 259 with the terminal information recently received by the terminal information collection unit 251. [ If it is determined that the matching terminal information has been received, the determination unit 255 determines that the user having the user terminal 110 has requested access authentication in the area of the access device 170, and processes the terminal authentication success. If both the card authentication and the terminal authentication are successful, the MFA-based authentication is successfully processed.

The controller 257 transmits control information according to the MFA-based authentication result to the access device 170 to control access of the user. If the MFA authentication is successful, control information permitting access by the user is transmitted to the access device 170. Of course, if the MFA authentication fails, the control information that the user can not access is transmitted to the access device 170.

3 is a signal flow diagram of an MFA authentication process according to an embodiment of the present invention.

First, the control server 150 registers the information of the user terminal 110 of the user entering and exiting through the access device 170 and registers it in the DB 259. Upon the registration, the user terminal 110 accesses the control server 150 and transmits terminal information to request authentication of terminal registration (S301). Here, the control server 150 may carry out log-in authentication of the ID and password received from the user terminal 110, and register the received terminal information in the DB 259 when the authentication is successful. When the effective registration is completed, the control server 150 replies the registration authentication result to the user terminal 110 (S303).

After the registration of the terminal information is completed, the control server 150 can provide the access authentication service. Each AP device 130 of the access device 170 transmits a wireless signal to the user terminals 110 located within the coverage of the wireless communication. Then, the user terminal 110 receives the transmitted radio signal and scans the AP devices 130 (S311).

When the user terminal 110 scans at least one AP apparatus 130 in the vicinity by receiving the transmitted radio signal, the AP apparatus 130 selected as the primary apparatus transmits the terminal information of the user terminal 110 to the AP apparatus 130 (S313). Then, the AP device 130 transmits the terminal information returned to the control server 150, and the control server 150 collects the terminal information through the AP device 130 (S315).

Thereafter, when the user tags the access card 111 to enter through the access device 170, the access device 170 reads the card information of the tagged access card 111 (S321). In addition, the control server 150 receives the card information from the access device 170 and receives a request for access authentication (S323). When access authentication is requested, the control server 150 processes the card authentication for the card information requested for authentication, and performs MFA authentication for the terminal information corresponding to the card information (S325). When the MFA authentication is completed, the control server 150 transmits the control information according to the authentication result to the access device 170 (S327).

FIG. 4 is a diagram illustrating location information based on RSSI (Received Signal Strength Identification) according to another embodiment of the present invention.

In another embodiment of the present invention, each AP device 430 in the vicinity of the access device 470 receives the terminal information including the location information of the user terminal 110, and transmits the received terminal information to the control server 150 send.

Here, the neighboring area where the access device 470 is located is divided into a plurality of grid areas and divided into the unit areas 401. Each of the divided unit areas 401 is provided with an AP apparatus 430 so as to receive a radio signal from a plurality of AP apparatuses 430.

For example, at least three AP radio signals are received in each of the 5 * 4 = 20 individual unit areas 401 in FIG. Then, the intensity (e.g., RSSI) of each radio signal received from a plurality of neighboring AP apparatuses 430 in each unit area 401 is unique and can be identified as location information. In each unit area 401, RSS (Received Signal Strength) of a signal received from a plurality of neighboring AP devices 430 is measured several times. The measured RSS values are averaged and stored in the DB 259 as unique position information that identifies the unit area 401. The position information of each unit area 401 stored in the DB 259 corresponds to the score map of the RSS value.

The control server 150 receives the terminal information including the location information of the user terminal 110 through the AP apparatus 430 and inquires the location information stored in the DB 259 using the received location information as a key, The location of the user is identified as a unit area where the user terminal 110 is located.

Here, it is assumed that the user moves from the 5 or 8 unit area, which is the outer area, to the 4 or 7 unit area, which is the office area, based on the access device 470. Also, moving from the 4 or 7 unit area, which is the office area, to the 5 or 8 unit area, which is the outside area, is exited from the office.

Accordingly, the control server 150 stores the 5 and 8-unit areas as the location information of the entry area of the access device 470 in the DB 259 for effective authentication of entry, and stores 4 and 7 units Area is stored in the DB 259 as the position information of the exit area of the access device 470. The control server 150 receives an authentication request for office entry from the access device 470 and if the corresponding user terminal 110 confirms via the DB 259 that it is located in the 5 or 8 unit area, Permits the position of the identified user. In addition, when the control server 150 receives an authentication request for leaving the office from the access device 470 and confirms that the corresponding user terminal 110 is located in the 4 or 7-unit area, Allows the user to exit. That is, the control server 150 checks the unit area where the user terminal 110 is located based on the terminal information collected from the user terminal 110 of the user who has successfully authenticated the card, If it is confirmed that the access unit 470 is installed, it is determined that the user has requested access authentication in a valid unit area, and the MFA authentication is successfully processed.

If it is assumed that the movement of the user is considered, the control server 150 stores in the DB 259 a valid movement path for the unit areas 4, 5, 7, 8 in which the access device 470 is located. For example, the effective travel paths for positioning in the unit area 5 are five, namely 2-> 5, 3-> 5, 6-> 5, 9-> 5 and 8-> 5. The control server 150 determines whether any one of the five movement paths stored in the DB 259 is a movement path of the terminal information collected through the AP device 430 If it is confirmed, it treats it as a successful MFA authentication and grants the user's position.

FIG. 5 is a diagram illustrating an example in which position information of the unit area 401 of FIG. 4 is stored.

The positional information includes a vector value 503 of the RSSI received from the four AP devices 430 of a, b, c, and d with respect to the position coordinate 501 of the unit area 401, (505) is stored in the DB 259 as table information.

On the other hand, the position information for each unit area 401 is not necessarily limited to the vector value and the error range. Various signal pattern information based on the RSSI signal can be position information of the unit area 401. For example, the signal strength received from each AP apparatus 430 may be converted into the fingerprint information of the unit area 401 by a predetermined conversion method and stored in the DB 259.

FIG. 6 is an exemplary diagram of a control server 450 for collecting RSSI-based location information of FIG.

Each AP device 430 installed in an access area including each unit area 401 periodically transmits a wireless signal (e.g., a beacon frame) to notify AP operation information and coverage. When the user terminal 410 enters the access area, a beacon frame is received from each AP device 430 at each transmission interval (e.g., 100 ms), and RSSI-based position information and terminal identification information And transmits the terminal information to the AP device 430.

Here, the user terminal 410 may be installed with an application 610 to generate RSSI-based location information and transmit the generated location information to the AP device 430. Of course, when the function of the application 610 is supported through the OS, the installation of the application 610 may be omitted. The application 610 executed in the user terminal 410 transmits the terminal information including the terminal identification information and the RSSI information to the AP device 430.

Then, the terminal information collection unit 251 of the control server 450 collects the terminal information including the location information of the user terminal 410 through the AP apparatus 430. The determination unit 255 processes the card authentication and processes the terminal authentication for the user who has successfully authenticated the card. In the terminal authentication process, the determination unit 255 determines that the terminal authentication is successful if the unit area in which the user terminal 410 is located is the unit area in which the access device 470 is located, using the collected location information. If both the card authentication and the terminal authentication are successful, the MFA authentication is handled as a success.

7 is a signal flow diagram of an MFA authentication process according to another embodiment of the present invention.

First, a plurality of AP apparatuses 430 are installed in the peripheral area of the access device 470 to receive a plurality of AP signals for each unit area 401. The AP signal may be a beacon frame based on a beacon communication, an SSID based on a Wi-Fi communication, or the like depending on a service method, and does not have any particular limitation. The RSSI-based signal strength received from the neighboring AP apparatuses 430 is measured for each unit area 401. The measured information is stored in the DB 259 as RSSI-based position information for each unit area 401 As shown in Fig.

Then, in a peripheral area of the access device 470, the plurality of AP apparatuses 430 transmit wireless signals to neighboring user terminals 410 (S701). When the user terminal 410 enters the access area, it receives radio signals such as beacon frames and SSIDs from a plurality of AP apparatuses 430.

When the wireless signal is received, the user terminal 410 transmits the terminal information including the terminal identification information and the RSSI-based location information to the AP device 430 in step S703. (S705). The control server 450 collects the terminal information further including the location information of the user terminal 410 through the AP apparatus 430. [

Thereafter, when the user tags the access card 111 in the access device 470 for entry or exit, the access device 470 reads the card information including the card ID and transmits it to the control server 450 (S707 ).

When the card information is received, the control server 450 performs MFA authentication including card authentication and terminal authentication (S709). First, the control server 450 queries the DB 259 using the received card ID as a key, and if the matched card ID is retrieved, the accessing user determines that the user is a registered user and processes the card authentication success. Next, the control server 450 compares the position information of the collected terminal information corresponding to the terminal identification information of the user who has successfully authenticated the card with the unit area 401 of the access device 470 searched from the DB 259 If they match, the terminal determines that the user is located in a valid unit area and processes the terminal authentication success. If the card authentication and the terminal authentication are successful, the control server 450 processes the MFA authentication successfully.

When the MFA authentication process is completed, the control server 450 transmits the control information according to the MFA authentication result to the access device 470 (S711). The access device 470 permits or denies the user access according to the transmitted control information.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It goes without saying that various modifications and variations are possible within the scope of equivalence of the scope.

100: system 110: user terminal
111: access card 130: AP device
150: control server 170: access device

Claims (19)

An apparatus for controlling access to an access device by setting and storing an entry area and an exit area for valid access authentication of a user based on an access device among unit areas in which signals of at least one AP (Access Point) device are received, As a result,
A collecting unit for collecting terminal information including the terminal identification information of the user terminal and the strength of a radio signal of at least one or more AP apparatuses received by the user terminal from an Access Point (AP) apparatus around the access apparatus;
A receiving unit for receiving a request for access authentication including card information of a user read by the access device;
Performing first authentication to determine whether the card information requested for authentication matches the previously registered card information, and determining whether the previously registered terminal identification information corresponding to the card information matches the collected terminal identification information Performing third authentication to determine whether the intensity of a radio signal of the collected at least one AP device matches the intensity of the pre-registered radio signal of the entry area or the exit area, If both the secondary and tertiary authentication are successful, it is determined that the MFA (Multi Factor Authentication) authentication is successful; And
And a control unit for controlling the access permission of the user by transmitting the control information in which the determined authentication result is successful to the access device
/ RTI > delete The method according to claim 1,
Wherein,
And collects the terminal information by executing a Wi-Fi operation of a user terminal on which the function of always searching for the AP apparatus is performed even when the Wi-Fi receiving function is turned off. The method according to claim 1,
The receiver may further comprise:
And receives RFID (Radio Frequency Identification) of the access card read by the reader of the access device as the card information. The method according to claim 1,
Further comprising a DB (Data Base) storing a card ID of a user's access card and terminal identification information of a matched user terminal,
Wherein,
If the stored card ID and terminal identification information are retrieved from the DB using the card ID of the card information requested to be authenticated as a key, the primary authentication is determined to be successful, and if the retrieved terminal identification information is the collected terminal identification information And determines that the secondary authentication is successful. The method according to claim 1,
Wherein,
The access control information is transmitted to the gate controller of the access device,
Wherein the gate controller controls access to the gate device through which the user passes by the transmitted control information. The method according to claim 1,
A DB in which the peripheral area of the access device is divided into a plurality of unit areas and the intensity of a radio signal received from each of the peripheral AP devices in each unit area is stored as position information for each unit area,
Wherein,
And collects the terminal information including the terminal identification information of the user terminal and the strength of each radio signal received in the unit area through the AP apparatus. 8. The method of claim 7,
Wherein,
Searches the most matching position information from the DB by using the strength of the collected radio signal as a key, and determines the unit area of the inquired location area as a unit area where the user terminal is located. delete delete A method for controlling entrance and exit of an access device in a control server,
Setting and storing an entry area and an exit area for valid access authentication of a user based on the access device among the unit areas in which signals of at least one access point (AP) device are received;
Collecting terminal information including the terminal identification information of the user terminal and the strength of a radio signal of at least one or more AP apparatuses received by the user terminal from the AP apparatus around the access apparatus;
Receiving an access authentication request including the card information of the user read by the access device;
Performing first authentication to determine whether the card information requested for authentication matches the previously registered card information, and determining whether the previously registered terminal identification information corresponding to the card information matches the collected terminal identification information Performing third authentication to determine whether the intensity of a radio signal of the collected at least one AP device matches the intensity of the pre-registered radio signal of the entry area or the exit area, If both the secondary and tertiary authentication are successful, it is determined that the MFA (Multi Factor Authentication) authentication is successful. And
Controlling access to the user by transmitting control information in which the determined authentication result is successful to the access device
≪ / RTI > delete 12. The method of claim 11,
Wherein the collecting comprises:
And collecting the terminal information by Wi-Fi execution of a user terminal on which a function of always searching for the AP apparatus is performed even when the Wi-Fi receiving function is turned off. 12. The method of claim 11,
Wherein the receiving comprises:
And the RFID of the access card read by the reader of the access device is received as the card information. 12. The method of claim 11,
The DB stores the card ID of the access card of the user and the terminal identification information of the matched user terminal,
Wherein the determining step comprises:
If the stored card ID and terminal identification information are retrieved from the DB using the card ID of the card information requested to be authenticated as a key, the primary authentication is determined to be successful, and if the retrieved terminal identification information is the collected terminal identification information And determines that the secondary authentication is successful. 12. The method of claim 11,
Wherein the controlling comprises:
The access control information is transmitted to the gate controller of the access device,
Wherein the gate controller controls access to the gate device through which the user passes by the transmitted control information. 12. The method of claim 11,
A DB in which the peripheral area of the access device is divided into a plurality of unit areas and the intensity of a radio signal received from each of the peripheral AP devices in each unit area is stored as position information for each unit area,
Wherein the collecting comprises:
And collecting the terminal information including the terminal identification information of the user terminal and the intensity of each radio signal received in the unit area through the AP apparatus. 18. The method of claim 17,
Wherein the determining step comprises:
Searching the most matching position information from the DB by using the strength of the collected radio signal as a key, and determining the unit area of the inquired location area as a unit area where the user terminal is located. delete

Images