KR101626716B1 - System for location-based authentication using bluetooth low energy beacon - Google Patents

Abstract

The present invention provides a location-based authentication system using a beacon, comprising: the beacon installed in a predetermined position or place to broadcast/advertise a Bluetooth low energy (BLE) communication-based beacon signal; a client, which is a terminal used by a user, receiving the beacon signal from the beacon and attempting to access resources including access limited content; an authentication server carrying out an authentication procedure for the client trying to access the resources including the access limited content and issuing an access code for accessing the resources including the access limited content to the client succeeding in authentication; a database storing all data needed for the authentication procedure and data about the resource including content; and a resource server checking validity of the corresponding access code when receiving the access code from the client, and providing the corresponding client with the resource including the access limited content when the access code is valid. According to the present invention, a location based authentication technology using the beacon is suggested, and thus an attempt to access a service by temporarily modifying an Internet protocol (IP) address, a media access control (MAC) address and so on can be prevented.

Description

[0001] The present invention relates to a location-based authentication system using a beacon,

The present invention relates to a location based authentication system, and more particularly, to a location based authentication system using a beacon.

Certain Internet services are designed to be accessible only to a limited location or to a designated institution's computer, depending on their nature. Therefore, generally, an IP based filtering method is used to limit the provision of a corresponding service based on an IP (Internet Protocol) address connected to the service.

The problems of the existing IP filtering based authentication method are as follows.

The problem with the authentication method based on the IP address or the MAC address is that a variety of hacking tools have recently been developed and distributed so that their IP address can be temporarily modulated or changed to access the server. Accordingly, even when an attempt is made to provide an online content service only to a specific organization or a user existing in a specific location based on an IP address, such a situation often becomes impossible to achieve the purpose.

Also, if an unauthorized user directly visits a specific organization or a specific location, and the IP of the organization is allocated to the user's PC or smart terminal through a wireless LAN, even if the user does not tamper with the IP, have. That is, there is a problem that the IP address can be easily modulated, and authentication for the user is required instead of authentication for the terminal having the IP address.

Meanwhile, there are two existing location-information positioning technologies, which can be classified into satellite navigation system and indoor wireless positioning technology.

First, the satellite navigation system is a system in which a user's device receives satellite signals. GPS, Galileo, GLONASS-K, COMPASS, and QZSS are available. In this case, a RF fingerprint technique or a triangulation technique is used by using radio signals such as infrared rays, ultrasonic waves, UWB (Ultra Wide Bands), and RF (Radio Frequency).

WPS (Wifi Positioning System) using wireless AP is typically used for indoor wireless positioning technology. WPS (Wifi Positioning System) has a limitation that service delay and unavailability can occur when a user access that exceeds the bandwidth of the wireless AP occurs.

The location-based authentication technique utilizes the user's physical location information in the authentication procedure for accessing a specific service. As a supplement to the vulnerable network attack technique in the existing authentication system, the location- do.

A beacon means a device that generates a promised signal at a predetermined period and transmits position and direction information. In the dictionary meaning, it was used as a radio transmission station such as a traffic light and a lighthouse. However, as the concept of IoT (Internet of Things) has been established and related technologies have been developed, the IT field refers to a signal generator based on the Bluetooth protocol The term is commonly used.

Bluetooth 4.0, which was adopted by the Bluetooth SIG in June 2010, has implemented technologies such as low power operation, unlimited synchronization, high-speed transmission, device availability enhancement, and location identification, And to accelerate the research and development of the. The current beacon is a term for BLE (Bluetooth Low Energy) based signal transmission technology and equipment. In 2013, Apple announced iBeacon communication standard and commercialized it.

However, existing authentication schemes are not suitable for unspecified number of unspecified users and are vulnerable to excessive server load because they use a wireless AP (Access Point) of a service provider.

Korean Patent Publication No. 10-2013-0064373

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems and provides a location based authentication method and system for performing an authentication procedure using a device using BLE (Bluetooth Low Energy) communication, that is, a beacon, There is a purpose.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

In order to accomplish the above object, the present invention provides a beacon for broadcasting / advertising a beacon signal based on a Bluetooth low energy (BLE) communication installed at a predetermined location or place, A client for receiving a beacon signal received from the beacon and attempting to access a resource including content restricted in access, a client for accessing a resource including restricted content, An authentication server for issuing an access code for accessing a resource including content whose access is restricted to a client that has succeeded in authentication, A database storing data on resources including the resource, And a resource server (resource server) that receives the root code and checks the validity of the access code and, if valid, provides the client with the resource including the restricted access.

The beacon broadcasts a signal based on a BLE GAP (Generic Access Profile) profile, including a universally unique identity (UUID), to enable other devices to recognize the beacon. The client includes a UUID, And transmits the user information to the authentication server using the user information for identification, wherein the user information may include a UUID and an OTP (One Time Password).

The authentication server issues an authentication procedure using the UUID signal and the OTP received from the client and issues a token including an access code for accessing the protected resource if the authentication is successful, The access code having an expiration date which is a period for limiting the validity of the access code in order to control the access of the user, and the user information including the validity of the received UUID value and the validity period of the OTP Validation can be checked and the received access code can be checked and verified using a valid public key cryptosystem (Public Key Infrastructure) and MD5 hash, and it can be checked by email or short message service And the validity period was checked by checking the record of issuing the access code and the validity period of the access code, If the information received from the agent is not available, the response message can not be authenticated does not authenticate to the client, and if the information can be received from the client is valid, the response to the client that this certification.

The client having received the access code can input the access code to access the service provided by the resource server and request a service for the resource.

One or more of the beacons may be installed in a predetermined location or place, and the authentication server may store UUID information of all beacons, and the authentication server may determine whether the UUID signal transmitted from the client matches the previously stored UUID information Determines from which location the access is made, and issues an access code after processing from the authentication server.

The beacon may be equipped with a sensor for sensing a surrounding environment, and the beacon transmits a beacon signal and a sensor signal sensed by the sensor to a client according to a GATT (Generic Attribute Profile) profile, The beacon signal and the sensor data output by the sensor are transmitted to the authentication server together, and the authentication server can proceed with the authentication process including the beacon signal and the sensor data.

The sensor may be attached to the beacon including a temperature sensor, a humidity sensor, an acceleration sensor, a gyro sensor, a pressure sensor, and a geomagnetic sensor, and at least one sensor may be attached to the beacon.

According to the present invention, there is an advantage of being able to prevent an attempt to access a service by temporarily modulating an IP address or a MAC address by using a beacon based location authentication technique.

The location-based authentication method proposed by the present invention is a method of providing a low power and low cost terminal for broadcasting a BLE beacon signal at a specific institution or a specific location without depending on an IP address, There is an advantage that can be utilized for authentication.

In addition, the method proposed by the present invention can not only authenticate the terminal but also authenticate the user. To this end, the present invention utilizes not only the UUID of the beacon signal but also the e-mail and the OTP in order to authenticate the user. Thus, the distinction can be made to the user and the content can be restricted to the user only for a specified time.

The present invention can be applied to various related fields such as online contents, various kinds of contents, e-books, coupons, and commodities.

1 is a block diagram illustrating a configuration of a location based authentication system using a beacon according to an embodiment of the present invention.
2 is a flowchart illustrating a location-based authentication method using a beacon according to an embodiment of the present invention.
3 is an exemplary model in which the location-based authentication system using the beacon proposed in the present invention is applied to an online papers browsing service.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted in an ideal or overly formal sense unless expressly defined in the present application Do not.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

The present invention proposes a method of controlling service access based on physical location information instead of determining location information or agency information of a user based on an IP (Internet Protocol) address.

1 is a block diagram illustrating a configuration of a location based authentication system using a beacon according to an embodiment of the present invention.

Referring to FIG. 1, a location based authentication system using a beacon includes a beacon 110, a client 120, an authentication server 130, a database 140, (Resource Server) 150.

The beacon 110 plays a role of broadcasting / advertising a beacon signal. In the present invention, the beacon 110 is installed at a predetermined location or place, and broadcasts a beacon signal based on a Bluetooth low energy (BLE) communication.

The beacon 110 broadcasts a signal based on a BLE Generic Access Profile (GAP) profile, including a universally unique identity (UUID), thereby allowing other devices to recognize the beacon.

The client 120 attempts to access a protected resource based on the beacon signal and the access code received from the beacon 110 as a terminal used by the user.

The authentication server 130 is a server for carrying out an authentication procedure with respect to the client 120 requesting contents or resources and issuing an access code for accessing the protected contents or resources.

In the present invention, the authentication server 130 carries out an authentication procedure for a client attempting to access a resource including restricted content, and accesses a resource including content whose access is restricted to a client that has succeeded in authentication And issues an access code to do so.

The authentication server 130 proceeds with the authentication process using the UUID signal and the OTP received from the client 120. If the authentication is successful, the authentication server 130 issues a token including an access code for accessing the protected resource Or permits the client 120 to access.

The authentication server 130 grants an access code having a valid period, which is a period for limiting the effect of the access code in order to control the access of the user.

The authentication server 130 can check the validity of the user information including the consistency of the received UUID value and the validity period of the OTP. If the received access code is a valid access code, the public key cryptosystem (Public Key Infrastructure) and MD5 It can be checked and verified by using a hash, and validity is checked by inquiring the record of the access code issued by using an e-mail or a text message (Short Message Service) and its validity period.

The database 140 stores data and content and resource data required for the authentication procedure.

The resource server 150 is a server for checking the validity of an access code and providing protected contents or resources.

In the present invention, upon receipt of an access code from a client, the resource server 150 checks the validity of the access code, and if available, provides the resource including the restricted access to the client.

In the present invention, the authentication server 130 checks the validity of the user information including the consistency of the received UUID signal and the validity period of the OTP, inquires the record of the access code issued by using the e-mail, Inspect.

If the information received from the client is valid as a result of checking the validity, the authentication server 130 can transmit the access code through the e-mail of the corresponding client. At this time, the authentication server 130 has issued the access code through the e-mail of the client, and if there is no access code remaining after the validity period, the authentication server 130 can generate a new access code and transmit the new access code through the client's e-mail.

The client having received the access code inputs an access code in a service access environment supported by the resource server 150 and requests service provision for the resource.

In one embodiment of the present invention, more than one beacon 110 may be installed at a predetermined location or location. At this time, the authentication server 130 stores UUID information of all beacons, checks whether the UUID signal transmitted from the client 120 matches the previously stored UUID information, and if there is a match, .

In order to apply a location-based authentication system to a particular Internet service, a beacon 110 must be installed and broadcast in a physical location that allows access to the service. This allows the user to access the beacon 110, This is because an authentication procedure can be performed only when an access code is received from a beacon 110 in a personal device such as a laptop computer.

In the present invention, since the user's device, which is a kind of the client 120, merely receives the broadcast data of the beacon 110 unilaterally, the delay wait does not occur even if the user who intends to perform the authentication procedure increases sharply. If the user is close to the physical service allowance position defined by the service provider, the user can perform the authentication process and access the restricted service in order to use the limited service. An example of the procedure is as follows.

1) A user tries to use a service (protected resource) through a client 120, including a smart terminal or a laptop computer.

2) The client 120 authenticates the authentication server 130 by using a universally unique identity (UUID) received from the beacon 110, an email for identifying the user, an OTP (One Time Password) To request authentication procedures for service access.

3) The authentication server 130 checks the validity by using the UUID, e-mail, OTP, etc. received from the client 120, issues an access code (Access_code) with validity, and transmits the access code to the client 120.

4) The client 120 issues an access code (Access_code) from the authentication server 130 and completes the authentication procedure.

5) The user enters an access code (Access_code) through a service access environment supported by the resource server 150 and requests service provision.

6) The resource server 150 checks the validity of the access code (Access_code) input by the user and provides services such as contents or resources.

2 is a flowchart illustrating a location-based authentication method using a beacon according to an embodiment of the present invention.

Referring to FIG. 2, when the client 120 activates BLE (Bluetooth Low Energy) to start detection, the UUID is received from the beacon 110 (S201, S203).

The user sends a service access request to the authentication server 130 through the client 120, and transmits UUID, e-mail, OTP, or the like with parameters (S205).

The authentication server 130 checks the validity of information such as the consistency of the received data, the valid period of the OTP, and the like. The authentication server 130 checks the validity of the record in which the access code is issued and the validity period of the access code.

If the received information is not valid, the authentication server responds to the authentication failure message (fail_message). If the received information is valid, the authentication server replies that the authentication is completed (Access_code) (S207, S209, S211). If an access code is issued by the corresponding e-mail, but there is no remaining access code, the new access code is generated and issued to the client 120.

3 is an exemplary model in which the location-based authentication system using the beacon proposed in the present invention is applied to an online papers browsing service.

Referring to FIG. 3, the online papers browsing service system includes a beacon 310, a device 320, an authentication server 330, a database 340, and a journal web server 350.

The user can access the journal web server 360 via the web browser 360 installed in the device 320 using the access code issued from the authentication server 330 in the authentication process using the device 320. [ (350).

The journal web server 350 determines whether the service is provided by checking the validity of the matching degree and the validity period of the access codes received from the user.

As described above, in the present invention, the BLE beacon 310 is installed in a specific institution or a specific place, and the user can obtain the right to browse the contents only when the user physically approaches within a radius in which the beacon signal can be received. In this method, authentication and access procedures are performed based on beacon-based physically located in a relevant institution or a specific place without using the same method as conventional IP check / filtering, The security of the service can be improved when the validity period of the access code issued is completed by completing the authentication procedure.

In the present invention, a platform / device independent REST open API web service is used as a service invocation technique in a client-server structure to operate with such a beacon.

The location-based authentication system according to the present invention checks the validity by receiving a universal unique identity (UUID) broadcasted by a beacon in BLE, and accessing the server based on the UUID and OTP (one time password) And performs the authentication procedure.

In the present invention, when an unspecified number of user devices are approaching a physical range in which broadcast data of a beacon can be received, all the users can simultaneously use an authentication process and service, so that service scalability Very high. This is because the beacon of the present invention does not need to establish a connection between a sender and a receiver, but merely needs to receive a signal such as a UUID transmitted by a beacon from a terminal such as a user's smart device or a laptop computer.

In the present invention, a BLE beacon-based authentication system is applied as an example of a service for browsing digital contents online in a web or mobile environment. In the conventional case, a method of restricting access so that online content can be browsed using an IP or MAC address authenticated device is used. However, in the present invention, a beacon broadcasting a signal such as a UUID is installed only at a designated physical location to which access is permitted, an authentication procedure is performed for all devices capable of receiving the beacon, and digital contents You can get access rights or access codes to browse. That is, even if a terminal or a PC having a specific IP address or MAC address is not accessed, the service can be physically authenticated to a specific institution or a physically identified user in a specific location. The access code can be used as OTP (One Time Password), and the service use time can be controlled by setting the validity period of the access code according to the characteristics of the provided service.

In the present invention, the existing IP address or the MAC address is temporarily modulated by the user, so that the BLE beacon is installed at a specific location or at a specific place, thereby performing location based authentication. As a result, the UUID included in the BLE beacon signal is recognized as a valid access attempt only in the case of an incoming terminal having a token.

In the present invention, not only the authentication using the BLE beacon signal but also the period during which the user accesses the content can be limited within a certain effective period. In order to authenticate the user, the UUID of the beacon signal as well as the user's unique information such as the email of the user and the OTP value issued by the user terminal are provided together with the server. Therefore, according to the OTP value issued by the absolute time synchronized from the base station in the smartphone or the like, in case of a valid connection attempt, the user e-mail is used for identification or authentication purposes for the corresponding user in the future. Therefore, by providing an access code with a limited validity period to the user, the content can be restricted to access only for a predetermined time.

In the present invention, it is possible to transmit at least one BLE beacon signal UUID by installing at least one BLE beacon at a specific institution or at a specific location. By installing one or more BLE beacons in this manner, it is possible to transmit two or more BLE beacon UUIDs. Since the authentication server can hold a UUID list of all the BLE beacons installed in the corresponding position or institution, It is possible to further enhance the security of the location based authentication by judging whether all of the plurality of UUID information is correct.

In an embodiment of the present invention, by adding a sensor to a BLE beacon used for location-based authentication, not only information such as UUID and OTP but also information acquired from the sensor are transmitted to users located in close proximity to the BLE beacon, Authentication can be further strengthened. For example, sensors include temperature sensors, humidity sensors, acceleration sensors, and gyro sensors.

In the present invention, the sensor may be attached to the beacon 110 including a temperature sensor, a humidity sensor, an acceleration sensor, a gyro sensor, a pressure sensor, and a geomagnetic sensor. Lt; / RTI >

In an embodiment of the present invention, the beacon 110 may transmit a beacon signal and a sensor signal sensed by the sensor to the client 120 according to a GATT (Generic Attribute Profile) profile.

By keeping the used UUID value, it is possible to receive the location based authentication by sending the corresponding UUID value back to the server without visiting the place again next time. Here, the information such as the UUID value is not disclosed to the outside because the symmetric key is encrypted by a method such as AES in the transmission process through the network, but it is assumed that the value is leaked even if it is even.

In this case, the present invention uses a method of rejecting authentication, as well as a UUID value, when comparing with a value that is received and managed by the authentication server, such as a temperature, humidity, acceleration sensor value, .

While the present invention has been described with reference to several preferred embodiments, these embodiments are illustrative and not restrictive. It will be understood by those skilled in the art that various changes and modifications may be made therein without departing from the spirit of the invention and the scope of the appended claims.

110, 310 Beacon 120 Client
130, 330 authentication server 140, 340 database
150 Resource server 350 Journal Web server

Claims (7)

A beacon for broadcasting / advertising a beacon signal based on a Bluetooth low energy (BLE) communication installed at a predetermined location or place;
1. A terminal used by a user, comprising: a client which receives a beacon signal received from the beacon and attempts to access a resource including a content whose access is restricted;
An authentication server for issuing an access code for accessing a resource including content whose access is restricted to a client that has succeeded in authentication, (Authentication Server);
A database storing all data necessary for the authentication procedure and data on resources including the content; And
And a resource server for receiving the access code from the client and checking the validity of the access code and providing a resource containing the restricted access content to the client when the access code is valid,
The beacon may be equipped with a sensor for sensing the environment,
The beacon transmits a beacon signal and a sensor signal sensed by the sensor to a client according to a GATT (Generic Attribute Profile) profile,
The client transmits the beacon signal and the sensor data output by the sensor to the authentication server together,
Wherein the authentication server includes an authentication process including the beacon signal and the sensor data.
The method according to claim 1,
The beacon broadcasts a signal based on a BLE GAP (Generic Access Profile) profile, including a universally unique identity (UUID), to allow other devices to recognize the beacon,
The client transmits user information for user identification acquired from the beacon to the authentication server,
In this case, the user information includes a UUID and an OTP (One Time Password).
The method of claim 2,
The authentication server issues an authentication procedure using the UUID signal and the OTP received from the client and issues a token including an access code for accessing the protected resource if the authentication is successful, The access code having an expiration date which is a period for limiting the validity of the access code in order to control the access of the user, and the user information including the validity of the received UUID value and the validity period of the OTP Validation can be checked and the received access code can be checked and verified using a valid public key cryptosystem (Public Key Infrastructure) and MD5 hash, and it can be checked by email or short message service And the validity period was checked by checking the record of issuing the access code and the validity period of the access code, Based authentication system responds to the client if the information received from the client is not valid, and if the information received from the client is valid, responds to the client that the client is authenticated, .
The method of claim 3,
Wherein the client having received the access code inputs the access code to access a service provided by the resource server and requests a service for the resource.
The method of claim 2,
The beacon may be installed at one or more predetermined positions or locations,
The authentication server stores UUID information of all beacons,
Wherein the authentication server determines whether the UUID signal transmitted from the client matches the previously stored UUID information and determines from which location the UUID signal is accessed, and issues an access code after being processed by the authentication server. system.
delete The method according to claim 1,
Wherein the sensor is a sensor that can be attached to the beacon including a temperature sensor, a humidity sensor, an acceleration sensor, a gyro sensor, a pressure sensor, and a geomagnetic sensor, and at least one sensor is attached to the beacon. Based authentication system.

Images