KR101017588B1 - Entrance and exit control system - Google Patents

Abstract

PURPOSE: An entry control system using a key distribution security technology is provided to improve the security and entrance control capability by applying THE key distribution security technique. CONSTITUTION: A sensor key(100) stores authentication information of people and applies the authentication information by using the body information of people. An entry restriction apparatus(200) receives the authentication information from the sensor key. A gate control apparatus(350) controls the operation of a driver according to a control command of the entry restriction apparatus. An entry control server(300) transfers the gate control apparatus.

Description

Access Control System {Entrance And Exit Control System}

The present invention relates to an access control system, and in particular, an object of the present invention is to provide security and access control capability by applying encryption and key distribution security technology in communication between an electronic key and an input device, and communication between an input device and a control device. An improved access control system.

Access control devices are installed and operated in places such as apartments, offices and laboratories because of security or restrictions on access. The access control device performs authentication of the accessor so that only the authorized access is made, and controls the opening / closing and locking / unlocking of the doorway according to the authentication result.

Conventional access control devices authenticate the accessor by a method such as wireless card key, password input, fingerprint recognition. Specifically, the conventional access control device reads the data recorded in the wireless card key by the reader and compares it with the pre-stored data, checks the input password and the preset number, or records the fingerprint data generated by the fingerprint recognition in advance. Authentication is performed by comparing with fingerprint data. To this end, the access control device is configured to include a control device for controlling authentication and operation of the doorway and an input device for acquiring wireless card key, password, and fingerprint information.

However, such a conventional access control device has a problem in that the security is weak because the communication between the wireless card key, the keypad, the fingerprint recognition device and the input device, and the communication between the input device and the control device are in the form of general data. In fact, the conventional access control device has a problem that the security is weak because it is easy to disable the access control device by easily obtaining the authorization information when the wireless signal emitted during communication between the input device and the control device near the input device. have.

In addition, the conventional access control device has a problem that it is impossible to install by adding a device other than the previously set authentication device. For example, a device for performing access control by inputting a password may be installed and used for access control of a general office. During the use of such a control device, the security level of the office where the device is installed may be raised, and thus, it may be necessary to install additional access control means, for example, an electronic key, fingerprint recognition, and various sensors. In this case, the conventional access control device has to remove the existing device, and reinstall the device that supports authentication by various input devices, there is a problem in that the waste in terms of cost and time.

Accordingly, an object of the present invention is to provide an access control system having improved security and access control capability by applying encryption and key distribution security technology in communication between an electronic key and an input device and communication between an input device and a control device.

In addition, another object of the present invention is to provide an access control system with improved scalability and adaptability to enable the addition / removal of various authentication devices and access control according to authentication data from various authentication devices.

In addition, another object of the present invention is to provide an access control system with improved controllability through the addition of fine and unique control policies by enabling the setting of control means.

In order to achieve the above object, the access control system according to the present invention, in the access control system for controlling the entry and exit of the entrance by controlling the locking / unlocking of the door for the access restriction, authentication information for determining the access permission of the accessor A sensor key which is recorded in advance and stored, or writes the authentication information using the body information of the visitor; An access control device for establishing a communication channel with the sensor key and receiving the authentication information to perform access authentication of the accessor; A door control device having a drive device for locking / unlocking and opening / closing the door and controlling driving of the drive device according to a control command provided from the access control device according to the access authentication; And an access control server for establishing a communication channel with the access control device, transferring an access control policy input from the outside to the access control device, or receiving and managing the access control policy input to the access control device. The access control device comprises: an input / output unit having a scanner for receiving the authentication information from the sensor key or a keypad for inputting authentication information of the person; And a control unit that reflects the access control policy in the access authentication and the access authentication process by the authentication information, and comprises a network formed between the sensor key and the access control device or the access control server. A network resource including at least one of a node, a sensor, a hardware configuration, and a sensing value, a protocol that can be processed by a device included in the network, a query processing function of a device included in the network, a security function of a network, and the sensor key. The operation of the sensor key or the communication with the sensor key is controlled by metadata including at least one of data structures of the data created by the data.

Communication between the sensor key, the access control device, the access control device and the access control server is performed by an encryption / decryption communication method applied to the access control device. The access control device may include an input / output unit having a scanner for receiving the authentication information from the sensor key or a keypad for inputting authentication information of the accessor; And a control unit that reflects the access control policy in the access authentication and the access authentication process by the authentication information, and comprises a network formed between the sensor key and the access control device or the access control server. A network resource including at least one of a node, a sensor, a hardware configuration, and a sensing value, a protocol that can be processed by a device included in the network, a query processing function of a device included in the network, a security function of a network, and the sensor key. Controlling the operation of the sensor key or the communication with the sensor key by metadata including at least one of a data structure of data created by

The control unit includes a host connection unit for receiving a request signal from the sensor key or the input unit; A query processing unit processing a request for operation and control of the sensor key, the input / output unit, and the access control unit based on the metadata of the sensor key, the input / output unit, and the access control unit; A metadata management unit for managing and providing metadata which is configuration and state information of the sensor key, the input / output unit, and the access control device; A service interface which integrates and provides a service provided by the query processor and the metadata manager, and analyzes the request signal from the host connector and transmits the request signal to the query processor or the metadata manager; A protocol processing unit converting the request transmitted from the query processing unit to the sensor key, the input / output unit and the access control device into a protocol that can be processed by the sensor key, the input / output unit and the access control device; Security management unit for providing a security service using the security processing unit in response to a request of the protocol processing unit; Network interface for providing an interface for access and communication to the network; And a wired / wireless connection unit configured to perform wired or wireless data communication with the network interface.

The access control device includes a terminal communication unit for communication with the sensor key; A communication unit for communicating with the access control device or the access control server; And a security processing unit for the encryption / decryption communication. It is configured to include.

In the access control system according to the present invention, in communication between the electronic key and the input device, communication between the input device and the control device, encryption and key distribution security technology can be applied to improve security and access control capability.

In addition, the access control system according to the present invention can improve the expandability and adaptability to enable the access control according to the addition / removal of various authentication devices and the authentication data from the various authentication devices.

In addition, the access control system according to the present invention can be set by the control means can improve the control ability through the addition of a fine and unique control policy.

1 is an exemplary configuration showing an access control system according to the present invention.
2 is a diagram illustrating the configuration of the controller of FIG. 1 in more detail.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described to be easily carried out by those skilled in the art. In the accompanying drawings, it should be noted that the same reference numerals are used in the drawings to designate the same configuration in other drawings as much as possible. In addition, in describing the present invention, when it is determined that a detailed description of a related known function or known configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. And certain features shown in the drawings are enlarged or reduced or simplified for ease of description, the drawings and their components are not necessarily drawn to scale. However, those skilled in the art will readily understand these details.

1 is a configuration example showing an access control system according to the present invention.

Referring to FIG. 1, the access control system 10 according to the present invention includes a sensor key 100, an access control device 200, an access control server 300, and an access problem device 350.

The sensor key 100 is used as a means for the access control device 200 to determine whether or not the access person. The sensor key 100 transmits the authentication information for the access of the doorway in which the access control device 200 is installed, to the access control device 200. The sensor key 100 may be an information carrier on which the authenticated information is stored, or may be a sensing means for detecting an accessor or a situation around an entrance. Specifically, the sensor key 100 includes a key device 110 and a sensor device 120. The key device 110 may be a contact or contactless electronic key, a pattern used for a general door, and a grooved key. The key device 110 is possessed by the accessor, the electronic key is stored in the authentication information and to provide the authentication information to the access control device 200 by wireless communication. The electronic key is a device capable of storing and providing authentication information such as a smart card key, IC card key, magnetic key, and RFID (Radion Frequency Identification) key, or a Bluetooth terminal, a Zigbee terminal, and an infrared communication (IrDa). The terminal may be a wireless communication terminal such as a terminal, but the present invention is not limited thereto. The sensor device 120 may be used as a means for authenticating the accessor's access, or may be used as an auxiliary means for detecting a situation around the entrance. The sensor device 120 includes various devices such as an iris recognition device, a fingerprint recognition device, a thermal sensor, a temperature sensor, an infrared sensor, an ultrasonic sensor, an illuminance sensor, a weight sensor, an acoustic sensor, and a microphone. Among them, the sensor device 120 such as an iris recognition device, a fingerprint recognition device, and a thermal sensor may be used as a device for direct access authentication, such as a key device 110, and a temperature sensor and an infrared sensor may be used for entrance and exit policies. It can be used as an auxiliary means for checking the status of the application or the entrance. The sensor device 120 may be used in various combinations with the key device 110. The sensor device 120 generates authentication information or auxiliary authentication information according to the detection result, and performs the communication with the access control device 200 by wired or wireless communication. ). Here, the authentication information is information used directly for authentication as in the key device 110, and the auxiliary authentication information is information such as a detection result of a surrounding situation, a recorded image, and a recorded sound. It may be various information reflected in the policy. The sensor key 100 transmits the authentication information or the auxiliary authentication information encrypted by the wireless communication encryption / decryption means applied to the access control device 200 to the access control device 200. In particular, in the present invention, it is possible to add or exclude various types of sensor keys 100 even after installation of the access control device 200, and the wired / wireless connection unit 218 for communication with the sensor keys 100 is shown. It is possible to easily change the number and type of the sensor key 100 by adding or removing.

The access control device 200 controls the door control device 350 to control the accessor authentication and authentication by the sensor key 100 to control the access of the accessor. To this end, the access control device 200 is connected to the sensor key 100 and the door control device 350 by wired / wireless communication. As described above, the access control apparatus 200 performs authentication of the accessor using the authentication information transmitted from the sensor key 100, and controls the door control device 350 to open the door when the accessor is the permittor. . In particular, the access control device 200 is to control the entry and exit of the person in detail by comparing the auxiliary authentication information transmitted from the sensor device 120 of the sensor key 100 to the previously entered access control policy. For example, when the illuminance sensor is installed as the sensor device 120, and the access control policy is set to prohibit sunset after sunset, the access control device 200 when the sunset is confirmed by auxiliary authentication information provided by the illuminance sensor. Even the person who provided normal authentication information can restrict access. Such an access control policy may be specifically set and applied and operated by various factors such as the type and quantity of sensor keys 100 configured and an operation method of an area in which the access control device 200 is installed. In addition, the access control device 200 can receive and store such an access control policy directly from the operator, and can be applied to the access control, and can transmit the contents of the updated access control policy to the access control server 300. In addition, the access control device 200 may be applied to the access control by receiving the access control policy from the access control server 300. To this end, the access control device 200 is connected to the access control server 300 by wired / wireless communication. The access control device 9200 is configured to include a control unit 210, input / output unit 220, terminal communication unit 230, security processing unit 240 and communication unit 250.

The control unit 210 controls the respective components of the access control device 200, performs authentication by processing the authentication information provided from the sensor key 100, access control directly input or transmitted from the access control server 300 Applies to policy processing and certification. To this end, the controller 210 controls the integrated gateway, network operation, and flow based on metadata in order to perform authentication and access control policy processing by the authentication information transmitted from the sensor key 100. Here, the metadata is distinguished from the authentication information and the auxiliary authentication information, the inside of the access control device 200, the access control device for the processing of processes such as transmission and reception, encryption, authentication of the authentication information, auxiliary authentication information and access control policy. It is data for communication and wired / wireless network communication and command between the sensor 200 and the sensor key 100 or the access control device 200 and the access control server 300. The control unit 210 may determine and select a communication method during wired and wireless communication according to metadata, and transmit a command to any of the internal configuration of the sensor key 100 or the access control device 200, and the data from any configuration. It will determine whether to receive. The control unit 210 will be described in more detail with reference to FIG. 2.

The input / output unit 220 receives the authentication information by the sensor key 100 and the access control policy directly input, and transmits it to the control unit 210. To this end, the input / output unit 220 is configured by adding devices such as a keypad, a microphone, a speaker, and a sensor key 100 scanner among the sensor keys 100, and the operator can directly set an access control policy through the keypad. . The input / output unit 220 may be installed to be exposed to the outside in the form of a wall pad, thereby not limiting the present invention. In addition, it is convenient to serve as an access point (AP) for communication between the input / output unit 220 and the access control device 200 and the sensor key 100, but this does not limit the present invention. Here, although additional devices such as a keypad, a microphone, and a speaker included in the input / output unit 220 correspond to the sensor key 100, the present invention is assumed to be added to the input / output unit 220 for user convenience. Shall be.

The terminal communication unit 230 forms a communication channel with the sensor key 100 and transmits and receives authentication information and auxiliary authentication information based on the access control policy and metadata. Here, the terminal communication unit 230 forms a communication channel with the sensor key 100, receives the authentication information and auxiliary authentication information provided from the sensor key 100, and receives the authentication information updated in the access control policy or encryption process. Transfer to the sensor key 100. In addition, the terminal communication unit 230 receives the auxiliary authentication information written in the sensor key 100 and transmits it to the control unit 210, and corresponds to a command provided from the control unit 210 to control the operation of the sensor key 100. Transfer to the sensor key 100.

The security processing unit 240 performs a security function by applying a decryption or key distribution security technology according to the metadata provided by the control unit 210 based on the security function use capability and the security policy. Here, the security processing unit 240 may be installed in a detachable, detachable, thereby not limiting the present invention.

The communication unit 250 forms a communication channel with the access control server 300 or the access control device 350, and performs communication between the access control device 200 and these. The communication unit 250 transmits the access control policy input through the input / output unit 220 to the access control server 300, or provides the access control policy provided from the access control server 300 to the control unit 210. . In addition, the control unit 210 transmits a control command generated according to the authentication result to the access control device 350, receives the operation result information and status information from the access control device 350 to control the control unit 210 or access control Transfer to the server 300. The communication unit 250 may be implemented by any one or more of wired communication or wireless communication.

The access control server 300 controls the operation of the access control device 200, and adjusts the access control policy set by the operator to the access control device 200 to provide to the access control device 220. In addition, when the access control policy is directly set in the access control device 200, the access control server 300 is provided from the access control device 200 to manage and maintain. In addition, the access control server 300 stores the auxiliary authentication information transmitted through the access control device 200 according to the access control device 200 or according to a predetermined classification, and provides according to the operator's command. The access control server 300 collects and manages various types of information such as the operation status and accessor status of the independently operated access control apparatus 200, and controls a high priority such as stopping and returning a plurality of access control apparatus in case of emergency. Commands are provided to each access control device to control the overall operation of the access control system 10.

The access problem apparatus 350 performs opening / closing and locking / unlocking of the door according to a control command transmitted according to the authentication result, thereby enabling or restricting entry and exit of the door. To this end, the entrance control device 350 may include a door and a variety of driving device for driving the door, the communication device for communication with the access control device and the like.

2 is a diagram illustrating the configuration of the controller of FIG. 1 in more detail.

Referring to FIG. 2, the controller 210 includes a host connector 211, a service interface 212, a query processor 213, a metadata manager 214, a protocol processor 215, a security manager 216, and a network interface. 217 and a wired / wireless connection 218.

The host connection unit 211 receives a request signal of the sensor key 100 or the input / output unit 220 from the terminal communication unit 230 of the access control device 200, and sends them to the sensor key 100 or the input / output unit 220. Delivers a control command to control the operation.

The service interface 212 integrates and provides a service provided by the query processor 213 and the metadata manager 214. For this purpose, the service interface 212 analyzes a request received from the host connector 211 and processes a query. The query processing unit transmits a request for managing the metadata to the metadata management unit 214, receives the request processing result from them, and delivers the result to the host connection unit 211.

The query processing unit 213 processes a request for their operation and control based on metadata for the sensor key 100, the input / output unit 220, and the access control device 350 connected to the access control device 200. . Here, the query processing unit 213 is used for the operation or control from the sensor key 100 connected to the access control device 200, input / output unit 222, device type and communication method of the access control device 350, regardless of the device type and communication method. Create and execute a set of commands to be delivered based on metadata about them so that they can receive and process a consistent request. For example, the sensor key 100 is a device capable of performing a command to deliver a value repeatedly sensed for a specific time to the access control device 200 according to the type, and sensing at a specific time period irrespective of the command. One data may be classified into a device having only a function of keeping the central control device 200. When such a different type of sensor key 100 is connected to the access control device 200, when the sensing value needs to be transmitted to the access control device 200 at one minute intervals for five minutes, the query processing unit may process a complicated command. The sensor key 100 can be sent a command to deliver the sensing value at intervals of 1 minute for 5 minutes, and for the sensor key 100 that cannot process a complex command, the command to transmit the current sensing value at 1 minute intervals. 5 times in 5 minutes. In this way, the query processing unit 213 grasps characteristics of devices such as the sensor key 100 based on metadata, and generates or combines the commands based on the metadata when the specific command occurs, and transmits the command to each device that performs the command. It sends the appropriate command, receives the result, and delivers it to the device that generated the command.

The metadata manager 214 manages metadata, which is the configuration and status information of the sensor key 100, the input / output unit 210, and the access control device 350, and provides metadata to the requesting component. Specifically, the metadata includes resources (network, nodes, sensors, hardware configurations, sensing values, etc.) for the network, functions provided by the network, protocols that the network can process, network query processing capability, data structure of the sensing data, and network. Contains various data such as security functions that can be processed by.

The protocol processing unit 215 converts and transmits the request that the query processing unit 213 sends to the sensor key 100, the input / output unit 220, and the door control device 350 into a protocol that can be processed by these devices. In detail, the protocol processor 215 uses information such as resources, functions, protocols, capabilities, and data structures of the sensor key 100, the input / output unit 220, and the door control device 350 provided through metadata. Send the message by converting it to the appropriate protocol for each device.

The security management unit 216 of the protocol processing unit 215 is based on the security policies and techniques of the sensor key 100, the input / output unit 220, and the door control device 350 managed by the metadata management unit 214 as metadata. According to the request, a security service is provided using the security processor 240. Specifically, the security management unit 216 transmits data to the sensor key 100, input / output unit 220, access control device 350, and confirms the encryption algorithm used to receive the data from the corresponding algorithm, Encrypt data using or decrypt received data.

The network interface 217 provides a consistent interface for access and communication with the sensor key 100, the input / output unit 220, and the door control device 350.

The wire / wireless connection unit 218 is a consistent interface provided by the network interface 217 and the sensor key 100, the access control server 300, and the door control device 350 through the terminal communication unit 230 and the communication unit 250. Perform communication. In particular, the wired / wireless connection unit 218 is used for communication with the sensor key 100, the input / output unit 220, the access control device 350, and the access control server 300 having different types of communication methods. . The wired / wireless connection unit 218 is configured to include various types of communication modules so that communication can be made according to the method of the sensor key 100 connected to the access control device 200. In particular, the wired / wireless connection unit 218 adds a new sensor key 100 by adding a corresponding communication module when a sensor key 100 that performs a different method of communication with an existing sensor key 100 is added. It is possible to add or change the existing sensor key 100 to another kind of sensor key 100.

In the case of the access control system according to the present invention, the concept of the ubiquitous sensor network is applied, as well as independent operation, it is possible to apply to a newly established or already established sensor network as it is. That is, the access control system according to the present invention can be variously applied to a service using the sensing information. For example, when the access control system according to the present invention is combined with the power system of the building, it is to control the power of the area where the access control device 200 is installed by the change of the sensor key 100 and the access control policy. This allows for the efficient use of power without building a separate system. In particular, it is possible to identify the required time and non-use time of power use so that active energy saving can be achieved without having a separate large system for controlling power use. Considering this point, it can be seen that the access control system according to the present invention can be applied to various fields such as U-city, U-port, U-manufacturing, and U-building.

In addition, the access control system according to the present invention can be easily added to a variety of application areas, such as intelligent home network solution, intelligent building management solution, intelligent complex management solution that requires access management. In addition, it is possible to apply and use it as an independent system in areas such as defense, security, and authentication where security is important in case of fine-grained access control policy and multiplexing and diversifying cryptographic replication methods.

Although illustrated and described in the specific embodiments to illustrate the technical idea of the present invention, the present invention is not limited to the same configuration and operation as the specific embodiment as described above, and various modifications do not depart from the scope of the present invention. It can be carried out within. Therefore, such modifications should also be regarded as belonging to the scope of the present invention, and the scope of the present invention should be determined by the claims below.

10: access control system 100: sensor key
110: electronic key 120: sensor device
200: access control device 210: control unit
211: host connection portion 212: service interface
213: query processing unit 214: metadata management unit
215: protocol processing unit 216: security management unit
217: network interface 218: wired / wireless connection
220: input and output unit 230: terminal communication unit
240: security processing unit 250: communication unit
300: access control server 350: door control device

Claims (4)

In the access control system that controls the entry and exit of the entrance by controlling the locking / unlocking of the door for access restriction,
A sensor key for pre-recording and storing authentication information for determining whether the person is allowed to access, or creating the authentication information using the body information of the person;
An access control device for establishing a communication channel with the sensor key and receiving the authentication information to perform access authentication of the accessor;
A door control device having a drive device for locking / unlocking and opening / closing the door and controlling driving of the drive device according to a control command provided from the access control device according to the access authentication; And
An access control server for establishing a communication channel with the access control device, transferring an access control policy input from the outside to the access control device, or receiving and managing the access control policy input to the access control device; Composed,

The access control device
An input / output unit having a scanner for receiving the authentication information from the sensor key or a keypad for inputting authentication information of the accessor; And a control unit that reflects the access control policy in the access authentication and the access authentication process by the authentication information, and comprises a network formed between the sensor key and the access control device or the access control server. A network resource including at least one of a node, a sensor, a hardware configuration, and a sensing value, a protocol that can be processed by a device included in the network, a query processing function of a device included in the network, a security function of a network, and the sensor key. Controlling the operation of the sensor key or the communication with the sensor key by metadata including at least one of a data structure of data created by

Communication between the sensor key, the access control device, the access control device and the access control server is performed by an encryption / decryption communication method applied to the access control device,

The control unit
A host connection unit for receiving a request signal from the sensor key or the input / output unit;
A query processing unit processing a request for operation and control of the sensor key, the input / output unit, and the access control unit based on the metadata of the sensor key, the input / output unit, and the access control unit;
A metadata management unit for managing and providing metadata which is configuration and state information of the sensor key, the input / output unit, and the access control device;
A service interface which integrates and provides a service provided by the query processor and the metadata manager, and analyzes the request signal from the host connector and transmits the request signal to the query processor or the metadata manager;
A protocol processing unit converting the request transmitted from the query processing unit to the sensor key, the input / output unit and the access control device into a protocol that can be processed by the sensor key, the input / output unit and the access control device;
A security manager for providing a security service using the security processor in response to a request of the protocol processor;
A network interface providing an interface for accessing and communicating with the network; And
And a wired / wireless connection unit configured to perform wired or wireless data communication with the network interface. delete The method of claim 1,
The access control device
A terminal communication unit for communicating with the sensor key;
A communication unit for communicating with the access control device or the access control server; And
A security processing unit for the encryption and decryption communication; Access control system, characterized in that configured to include. delete

Images