KR101795451B1 - Method and apparatus for controling security of target device using security tunnel - Google Patents

Method and apparatus for controling security of target device using security tunnel Download PDF

Info

Publication number
KR101795451B1
KR101795451B1 KR1020160155150A KR20160155150A KR101795451B1 KR 101795451 B1 KR101795451 B1 KR 101795451B1 KR 1020160155150 A KR1020160155150 A KR 1020160155150A KR 20160155150 A KR20160155150 A KR 20160155150A KR 101795451 B1 KR101795451 B1 KR 101795451B1
Authority
KR
South Korea
Prior art keywords
target device
user terminal
security
secure
identifier
Prior art date
Application number
KR1020160155150A
Other languages
Korean (ko)
Other versions
KR20170059426A (en
Inventor
서원일
Original Assignee
(주)엔에스비욘드
서원일
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by (주)엔에스비욘드, 서원일 filed Critical (주)엔에스비욘드
Publication of KR20170059426A publication Critical patent/KR20170059426A/en
Application granted granted Critical
Publication of KR101795451B1 publication Critical patent/KR101795451B1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/36—User authentication by graphic or iconic representation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • G06Q20/40145—Biometric identity checks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

A method and apparatus for controlling security of a target device using a secure tunnel is disclosed. A method of operating a user terminal according to an exemplary embodiment includes receiving an identifier of the target device via local communication with a target device, establishing a secure tunnel between the target device and an authentication server, Receiving the first OTP information generated by the authentication server through the secure tunnel based on the identifier of the target device, transmitting the first OTP information to the authentication server through the secure tunnel, Wherein the security of the target device is released based on the first OTP information and the second OTP information generated based on the identifier of the target device in the target device, do.

Figure R1020160155150

Description

TECHNICAL FIELD [0001] The present invention relates to a method and apparatus for controlling security of a target device using a secure tunnel,

The following embodiments relate to a method and apparatus for controlling security of a target device using a secure tunnel.

Due to the development of online services, various authentication methods exist for authenticating users in Internet banking, card payment, and public service. Existing authentication methods are vulnerable to deception and forgery of authentication information and remote deception of authentication terminal. And a new authentication method is required to improve this. Data can be passed through circuit switching or packet switching. Circuit switching refers to a method of creating a network path between two devices and transferring data between the two devices only through that path. Packet switching refers to a method in which data is divided into packets and transmitted without a predetermined path. Circuit networks have low transmission efficiency but strong data security. Packet communication has high transmission efficiency, but data security is weak. When the circuit switching method is appropriately applied to the packet switching method, data security can be improved while maintaining a high transmission efficiency.
A related prior art is disclosed in Patent Publication No. 10-2013-0008504.

The embodiments described below are intended to provide a technique for securely controlling security of a target device using a user terminal.

According to one embodiment, a method of operating a user terminal includes receiving an identifier of the target device via close range communication with the target device; Establishing a secure tunnel with the authentication server; Transmitting an identifier of the target device to the authentication server through the secure tunnel; Receiving, via the secure tunnel, first OTP information generated by the authentication server based on an identifier of the target device; And transmitting the first OTP information to the target device via the short distance communication, wherein the security of the target device is determined based on the first OTP information and the target device identifier 2 < / RTI > OTP information.

Each of the first OTP information and the second OTP information may be generated based on the identifier of the target device and the current time. The identifier of the target device may be transmitted by the target device if the user terminal is registered with the target device. The first OTP information may be transmitted by the authentication server if a user terminal is registered with the target device.

The first OTP information and the second OTP information are the same and can be released when the distance between the user terminal and the target apparatus is closer to a predetermined threshold value. The method of operation of the user terminal may further include receiving internal information of the target apparatus through the short distance communication as the security of the target apparatus is released. As the security of the target device is released, a user of the user terminal may be logged into the target device.

While the secure tunnel is present, traffic transmission through the remaining routes except for the short distance communication and the secure tunnel may be blocked. The secure tunnel may connect a user terminal, a first gateway connected to the user terminal, and a second gateway connected to the first gateway. The target device may be any one of a door lock, a vehicle, a measuring device, and a computer.

According to one embodiment, a method of operating a target device comprises: transmitting an identifier of the target device via short-range communication with the user terminal; Generating second OTP information based on the identifier of the target device; Receiving first OTP information generated by the authentication server based on an identifier of the target device from the user terminal via the short distance communication; And releasing the security of the target device based on the first OTP information and the second OTP information, wherein the identifier of the target device is transmitted to the user terminal through the secure tunnel between the user terminal and the authentication server, To the authentication server, and the first OTP information is transmitted from the authentication server to the user terminal through the secure tunnel.

Each of the first OTP information and the second OTP information may be generated based on the identifier of the target device and the current time. Wherein the transmitting the identifier of the target device comprises: determining whether the user terminal is registered with the target device; And transmitting an identifier of the target device to the user terminal when the target device is registered in the target device.

The step of releasing the security of the target device may include releasing the security of the target device if the first OTP information and the second OTP information are the same and the distance between the user terminal and the target device is less than a predetermined threshold. . The method of operation of the target device may further include transmitting the internal information of the target device to the user terminal via the local area communication as the security of the target device is released. As the security of the target device is released, a user of the user terminal may be logged into the target device.

According to one embodiment, a method of operating an authentication server includes establishing a secure tunnel with a user terminal; Receiving an identifier of the target device from the user terminal via the secure tunnel; Generating first OTP information based on the identifier of the target device; And transmitting the first OTP information to the user terminal via the secure tunnel, wherein the identifier of the target device is transmitted from the target device to the user terminal via short-range communication between the user terminal and the target device Wherein the first OTP information is transmitted from the user terminal to the target device via the short distance communication and security of the target device is generated based on the first OTP information and the identifier of the target device at the target device And is released based on the second OTP information.

According to the embodiments described below, the security of the target device can be securely controlled using the terminal.

1 illustrates a security system in accordance with one embodiment.
2 is a diagram for explaining a process of creating a secure tunnel according to an exemplary embodiment;
3 is a diagram illustrating a security process of a door lock according to an embodiment;
4 is a diagram illustrating a security process of a computer according to an embodiment;
5 is a diagram illustrating a security process of a measurement apparatus according to an embodiment;
6 is a diagram illustrating a traffic blocking operation according to an embodiment;
7 is an operational flow diagram illustrating a method of operating a user terminal according to an embodiment.
8 is an operational flow diagram illustrating a method of operating a target device in accordance with one embodiment.
9 is a flowchart illustrating an operation method of an authentication server according to an embodiment.

It is to be understood that the specific structural or functional descriptions of embodiments of the present invention disclosed herein are presented for the purpose of describing embodiments only in accordance with the concepts of the present invention, May be embodied in various forms and are not limited to the embodiments described herein.

Embodiments in accordance with the concepts of the present invention are capable of various modifications and may take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. However, it is not intended to limit the embodiments according to the concepts of the present invention to the specific disclosure forms, but includes changes, equivalents, or alternatives falling within the spirit and scope of the present invention.

The terms first, second, or the like may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example without departing from the scope of the right according to the concept of the present invention, the first element being referred to as the second element, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Expressions that describe the relationship between components, for example, "between" and "immediately" or "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms " comprises ", or " having ", and the like, are used to specify one or more of the features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the patent application is not limited or limited by these embodiments. Like reference symbols in the drawings denote like elements.

1 illustrates a security system in accordance with one embodiment. Referring to FIG. 1, a security system includes a target device 110, a user terminal 120, and an authentication server 130.

The user may use the user terminal 120 to unlock the target device 110. The target device 110 may be any one of a door lock, a vehicle, a measuring device, and a computer. For example, if the target device 110 is a door lock, the door lock can be unlocked as the user has the user terminal 120 and approaches the door lock. In addition, when the target device 110 is a vehicle, the vehicle can be unlocked as it has the user terminal 120 and approaches the vehicle, or internal information of the vehicle can be transmitted to the user terminal 120.

The user terminal 120 may include a mobile device or a wearable device such as a smart phone, a smart watch, smart glasses, a tablet PC, a notebook, and a PDA. Smart phones and the like are very common, the user can easily release the security of the target device 110 through the smartphone or the like, or easily receive the inside information of the target device 110. [ The internal information may be information stored in the target device 110 and may include information obtained according to the self-operation of the target device 110 and information obtained from the external device by the target device 110. [ For example, if the target device 110 is a door lock, the internal information may include a record of the time the door lock was unlocked, and if the target device 110 is a gas meter, Of the total amount of gas.

According to the embodiment, the user can be released from memorizing the password for unlocking the target device 110, and the password can be prevented from being exposed in the process of inputting the password or the like to the target device 110 have. In the case of biometric authentication, a problem of recognition rate may occur depending on the state of the fingerprint and the iris, which are the medium of authentication. According to the embodiment, the biometric authentication can be free from the problem of the recognition rate. Also, according to the embodiment, since communication is performed between the user terminal 120 and the authentication server 130 through the security tunnel, the user terminal 120 and the authentication server 130 can be robust against security issues.

The target device 110 and the user terminal 120 may exchange information via close range communication. Near field communication may include Bluetooth, near field communication (NFC), beacon based communication, zigbee, infrared communication, and visible light communication. A local network for short range communication between the target device 110 and the user terminal 120 may be established as the user terminal 120 approaches the target device 110. The distance between the target device 110 and the user terminal 120 may be determined based on the strength of the signal for short-range communication. For example, the target device 110 may request the user terminal 120 to establish a local network as the strength of the signal received from the user terminal 120 exceeds a predetermined threshold. In this case, a request to establish a local network may be sent from the user terminal 120 to the target device 110.

An authentication application 121 may be installed in the user terminal 120. The authentication application 121 may be executed according to a user input or may reside in the memory of the user terminal 120 without a separate input from the user. Depending on the embodiment, at least some of the operations of the user terminal 120 described below may be performed by the authentication application 121. The authentication application 121 can support the lock function and the lock function of the authentication application 121 can be released through the password, biometric information, pattern, and the like. Thus, the security of the target device 110 can be maintained even when the user terminal 120 is lost.

The user terminal 120 may request the identifier of the target device 110 to the target device 110 as short-range communication is established between the target device 110 and the user terminal 120 and the authentication application 121 is executed . The identifier of the target device 110 may include a unique ID of the target device 110 or a unique token of the target device 110, The target device 110 may send an identifier of the target device 110 to the user terminal 120 at the request of the user terminal 120. At this time, the target device 110 may determine whether the user terminal 120 is a terminal registered with the target device 110. The user terminal 120 may be pre-registered with the target device 110 under a separate security scheme. For example, if the target device 110 is a door lock, the door lock may include a USB terminal or a registration button toward the room. The user terminal 120 can be registered in the target device 110 through the corresponding USB terminal or a corresponding registration button.

For example, the target device 110 may transmit the user terminal 120 to the target device 110 when the user terminal 120 is connected to the USB terminal and passes a separate security scheme, such as inputting a door lock password, . In addition, the user terminal 120 may be registered with the target device 110 through a hub in the house, or may be registered with the target device 110 through an apartment management office or a company management room. The target device 110 may include an initialization button for initiating registration. The target device 110 may initialize at least some of the user terminals registered with the target device 110 as the initialization button is pressed.

If the user terminal 120 is identified as a terminal registered with the target device 110, the target device 110 may transmit the identifier of the target device 110 to the user terminal 120 via the near field communication. The user terminal 120 may send an identifier of the target device 110 to the authentication server 130. The user terminal 120 and the authentication server 130 establish a security tunnel 160 between the user terminal 120 and the authentication server 130 and exchange information through the security tunnel 160. [ The secure tunnel 160 is a dedicated path for the secure network between the user terminal 120 and the authentication server 130 and may be an inaccessible network path at the external device 150. [

The user terminal 120 may request the authentication server 130 to establish the secure tunnel 160 and the authentication server 130 may request the authentication of the user terminal 120 and the authentication server 130, The security tunnel 160 can be established. Once the secure tunnel 160 is established, the authentication server 130 may inform the user terminal 120 of information about the secure tunnel 160. The information about the secure tunnel 160 may include information about the access point assigned to the user terminal 120. [

When the user terminal 120 accesses the wireless communication network 170 via TCP / IP or the like, the user terminal 120 may block routes other than the secure tunnel 160. For example, the user terminal 120 may be controlled to access only the access point of the first gateway, which will be described below, when accessing the wireless communication network 170. [ In this case, a route for short-range communication may be allowed. Thus, during the existence of the secure tunnel 160, the user terminal 120 may be prevented from communicating with the target device 110 and transmitting traffic through the remaining routes except the secure tunnel 160. According to an embodiment, the authentication application 121 may itself inspect whether its original code has been tampered with, and forcibly release the secure tunnel 160 if it determines that its original code has been tampered with. Accordingly, an operation of blocking traffic from flowing to a path other than the secure tunnel 160 can be securely guaranteed.

The authentication server 130 may include a security gateway 131 and an authentication device 132. As will be described in greater detail below, the security gateway 131 may include a first gateway coupled to the user terminal 120 and a second gateway coupled to the authentication device 132. The first gateway and the terminal 120 may be connected through a wireless communication network 170 such as 3G, LTE or WiFi and the second gateway and the authentication apparatus 132 may be connected to the wireless communication network 170 through an intranet have. The security gateway 131 may connect any one of the plurality of points provided by the first gateway and the plurality of points provided by the second gateway to create a virtual private A virtual private tunnel (VPT) can be created. The authentication server 130 may create the secure tunnel 160 based on the virtual private tunnel. The security tunnel 160 will be described later in more detail.

The authentication device 132 may generate OTP (One Time Password) information. The authentication device 132 may generate OTP information based on the identifier of the target device 110 and the current time. The OTP may be generated by the OTP generation server outside the authentication server 130 and transmitted to the authentication device 132 without being generated in the authentication device 132. [ The authentication device 132 may generate OTP information when it receives a request for establishment of the secure tunnel 160 from the user terminal 120 or when the secure tunnel 160 is established. The authentication device 132 may transmit the OTP information to the user terminal 120 through the security tunnel 160. [

The user may provide information about the target device 110 and the user terminal 120 to the authentication device 132 to utilize the service according to the embodiment. For example, the information about the target device 110 may include information about the identifiers of the target device 110 and the user terminals registered with the target device 110, (S) 120 may be included. In this case, the user terminal 120 may provide the authentication device 132 with an identifier of the user terminal 120 along with the identifier of the target device 110. [

The authentication device 132 confirms that the user terminal 120 is registered in the target device 110 based on the identifier of the target device 110 and the identifier of the user terminal 120, (120). For example, the authentication device 132 may include a database in which target devices and user terminals registered in each of the target devices are mapped. The authentication device 132 may determine whether the user terminal 120 is registered with the target device 110 based on the database and send the OTP information to the user terminal 120 when the user terminal 120 is registered with the target device 110 120). If an unregistered terminal requests the creation of a secure tunnel or transmits an identifier of the target device 110, the authentication device 132 may notify the access of the terminal not registered in the user terminal 120. [

The security level can be improved by using the OTP information while being blocked from the outside through the security tunnel 160. [ For example, OTP information can not be transmitted to the external device 150 by using the security tunnel 160, and after the security tunnel 160 is released, the information property of the OTP information is lost, There is no fear of being abused by the user's authentication even if it flows out to the external device 150 through the network. The authentication application 121 installed in the user terminal 120 can perform the operation for enhancing security.

The user terminal 120 may transmit the OTP information generated by the authentication device 132 to the target device 110 via short-range communication. The target device 110 may generate OTP information. The OTP generated by the authentication device 132 below may be referred to as the first OTP information and the OTP generated by the target device 110 may be referred to as the second OTP information. The target device 110 may generate the second OTP information based on the identifier of the target device 110 and the current time. The target device 110 may generate the second OTP information when it transmits the identifier of the target device 110 to the user terminal 120 or when it receives the first OTP information from the target device 110. [ The target device 110 may generate OTP information based on the identifier of the target device 110 and the current time.

The target device 110 may unlock the target device 110 based on the first OTP information and the second OTP information. For example, if the first OTP information and the second OTP information are the same and the distance between the target device 110 and the user terminal 120 is less than a predetermined threshold, Security can be turned off. Thus, if the first OTP information is different from the second OTP information or if the distance between the target device 110 and the user terminal 120 is greater than a predetermined threshold, Lt; / RTI >

The target device 110 and the authentication server 130 may generate OTP information using the same algorithm. The OTP generation algorithm can generate OTP information based on the identifier and the current time, and can generate the same OTP information with respect to the same identifier within a predetermined change period. Accordingly, when the first OTP information and the second OTP information are generated at a similar time, the first OTP information and the second OTP information may be the same. In this case, the security of the target device 110 may be released according to the first OTP information and the second OTP information.

In the case where the establishment of the secure tunnel 160 is delayed or the short-range communication is interrupted, the generation time of the OTP is delayed, so that the first OTP information and the second OTP information may be different. If the first OTP information differs from the second OTP information, the target device 110 may repeat the security procedure described above a predetermined number of times. For example, if the first OTP information and the second OTP information are different, the target device 110 may request the user terminal 120 to regenerate the first OTP information, and the user terminal 120 may secure the request To the authentication device 132 via the tunnel 160. The authentication device may generate and transmit the first OTP information to the user terminal 120 according to the request, and the user terminal 120 may transmit the first OTP information to the target device 110. The target device 110 may generate the second OTP information when requesting the regeneration of the first OTP information or when receiving the regenerated first OTP information. The target device 110 may unlock the target device 110 based on the regenerated first OTP information and the regenerated second OTP information.

FIG. 2 is a diagram for explaining a process of creating a secure tunnel according to an embodiment. Referring to FIG. 2, the user terminal 210 may communicate with the authentication device 230 through the security gateway 220. The security gateway 220, the authentication device 230, and the management device 240 may constitute an authentication server. The management device 240 may manage the entire process for creating a secure tunnel.

The security gateway 220 may include a first gateway 221 connected to the user terminal 210 and a second gateway 222 connected to the authentication device 230. The user terminal 210 and the first gateway 221 may be connected through a public network and the authentication device 230 and the second gateway 222 may be connected through a private network. The first gateway 221 and the second gateway 222 may be connected to the control path 20 and the security paths 30 to 60.

The control path 20 is an externally accessible path. The control path 20 may be a VPT connecting between a point 21 provided by the first gateway 221 and a point 22 provided by the second gateway 222. [ The management device 240 may be connected to the outside through the control path 20. [

The security paths 30, 40, and 50 are paths for which access from outside is limited. The secure paths 30,40 and 50 are connected to the points 31,41 and 51 provided by the first gateway 221 and the points 32,42 and 52 provided by the second gateway 222, Lt; RTI ID = 0.0 > VPTs < / RTI > The security paths 30, 40 and 50 may be created or released under the control of the management device 240. [

The first gateway 221 determines whether the type of the packet received from the outside is a tunnel type, and drops the packet if the type of the received packet is not a tunnel type. If the type of the received packet is a tunnel type, the packet can be transmitted to the authentication device 230 through the secure path corresponding to the packet.

If the type of the received packet is not the tunnel type but the first gateway 221 determines that the received packet is an authentication packet transmitted from a terminal registered in the whitelist, the first gateway 221 transmits an authentication packet to the management device 240 ). ≪ / RTI > The authentication packet may be a packet requesting the generation of the secure tunnel.

The management apparatus 240 can receive a request for generating a secure tunnel from the user terminal 210, and can generate a secure tunnel according to the request. The management device 240 may send information about the generated secure tunnel to the user terminal 210. For example, the management device 240 may create a security tunnel 40 connecting between a point 41 provided by the first gateway 221 and a point 42 provided by the second gateway 222, And may transmit information regarding the secure tunnel 40 to the user terminal 210. A secure tunnel 60 may be formed that connects the endpoints (e.g., points 42) of the secure tunnel 40 with the user terminal 210 based on the secure tunnel 40. [ The authentication application installed in the user terminal 210 and the authentication device 232 can communicate with each other through the security tunnel 60. [

The security tunnel 40 is isolated from the other security tunnels 30 and 50 so that even when the information about the secure tunnel 40 is leaked, the authentication devices 231 , 233) can be maintained. The secure tunnel 40 may be created at an appropriate time. For example, the management apparatus 240 may generate the security tunnel 40 in response to receiving the request for creation of the secure tunnel from the user terminal 210, or may generate the secure tunnel 40 in response to receiving the execution information of the authentication application can do.

The authentication device 232 may generate the OTP information and may transmit the OTP information to the user terminal 210 via the secure tunnel 40 after the creation of the secure tunnel 40. [ Also, the target device may generate OTP information, compare the OTP information generated by the authentication device 232 with the OTP information generated by the target device, and release the security. Accordingly, the user can easily release the security of the target device without recording or memorizing information such as a password. The target device can notify the user terminal 210 of the security release result or security maintenance result when the security release based on the OTP information or the security maintenance is determined and the user terminal 210 can notify the management server 240 of the security release result It can be notified that it has been completed. The management server 240 can release the security tunnel 40 as the security procedure is completed.

3 is a view for explaining a security process of a door lock according to an embodiment. Referring to FIG. 3, the door lock 310 includes an OTP generator 311. The OTP generator 311 may generate the second OTP information based on the identifier of the door lock 310 and the current time. The door lock 310 may transmit the identifier of the door lock 310 to the user terminal 320 at the request of the user terminal 320. The user terminal 320 may request the service server 330 to establish a secure tunnel and may transmit the identifier of the door lock 310 to the service server 330 through the secure tunnel.

The authentication server 330 may include a gateway 331, an authentication device 332, and an OTP server 330. The gateway 331, the authentication device 332, and the OTP server 330 may be connected to a network that is not exposed to the outside, such as an intranet. The secure tunnel can be established based on the gateway 331. [ The OTP server 333 may generate a second OTP based on the identifier of the door lock 310 and the current time and transmit the second OTP to the authentication server 332. [ 3, the OTP server 333 may be located outside the authentication server 330, and the second OTP information may be generated by the authentication server 332. [

The second OTP information may be transmitted to the door lock 310 through a secure tunnel between the user terminal 320 and the authentication server 330 and a local communication between the user terminal 320 and the door lock 310. The door lock 310 can release the lock based on the first OTP information and the second OTP information. For example, the door lock 310 may release the lock if the first OTP information and the second OTP information are the same and the distance between the user terminal 320 and the door lock 310 is less than a predetermined threshold . Accordingly, when the user has access to the door lock 310 with the user terminal 320, the door lock 310 can be unlocked without taking any other action.

4 is a diagram illustrating a security process of a computer according to an embodiment. Referring to FIG. 4, the computer 410 includes an OTP generator 411. The OTP generator 411 may generate the second OTP information based on the identifier of the computer 410 and the current time. The computer 410 may transmit the identifier of the computer 410 to the user terminal 320 at the request of the user terminal 320. The user terminal 320 may request the service server 330 to establish a secure tunnel and may transmit the identifier of the computer 410 to the service server 330 through the secure tunnel.

The authentication server 430 may include a gateway 431, an authentication device 432, and an OTP server 430. The gateway 431, the authentication device 432, and the OTP server 430 may be connected to a network that is not exposed to the outside, such as an intranet. The secure tunnel may be established based on the gateway 431. The OTP server 433 may generate and send a second OTP to the authentication server 432 based on the identifier of the computer 410 and the current time. The second OTP information may be transmitted to the computer 410 via a secure tunnel between the user terminal 420 and the authentication server 430 and a local communication between the user terminal 420 and the computer 410. The computer 410 may unlock the security based on the first OTP information and the second OTP information. For example, the computer 410 may release the lock if the first OTP information and the second OTP information are the same and the distance between the user terminal 320 and the computer 410 is less than a predetermined threshold. Thus, when a user has access to the computer 410 with the user terminal 320, the computer 410 can be unlocked without taking any further action. Also, when the computer 410 is unlocked, the user may be logged into the computer 410 based on the user information. When the user moves away from the computer 410, the locking of the computer 410 may be activated or the user may be logged out of the computer 410.

5 is a view for explaining a security process of a measuring apparatus according to an embodiment. Referring to FIG. 5, the measurement apparatus 510 includes an OTP generator 511. The OTP generator 511 may generate the second OTP information based on the identifier of the measuring device 510 and the current time. The metering device 510 may obtain information from the target system. For example, the measuring device 510 may include an electric meter, a gas meter, a vehicle running recorder, and the like. The measurement apparatus 510 can release the security of the measurement apparatus 510 based on the second OTP information and the first OTP information generated by the authentication apparatus 532 and can transmit the measurement information stored in the measurement apparatus 510 to the user And provides it to the terminal 520.

The security of the measuring apparatus 510 can be released according to the above-described procedure. Specifically, the measuring device 510 may transmit the identifier of the measuring device 510 to the user terminal 520 at the request of the user terminal 520. The user terminal 520 may request the service server 330 to establish the secure tunnel and may transmit the identifier of the measurement device 510 to the service server 330 through the secure tunnel.

The authentication server 530 may include a gateway 531, an authentication device 532, an OTP server 533, and a meter reading server 534. The gateway 531, the authentication device 532, the OTP server 533, and the meter reading server 534 may be connected to a network that is not exposed to the outside, such as an intranet. The secure tunnel may be established based on the gateway 531. [ The OTP server 533 may generate a second OTP based on the identifier of the measuring device 510 and the current time and transmit the second OTP to the authentication server 532. [

The authentication device 532 may transmit the second OTP information to the user terminal 520 by confirming that the user terminal 520 is registered with the measurement device 510. [ For example, the metering server 532 may include a database to which metering devices and user terminals registered in the respective metering devices are mapped. The user terminal 520 may provide the identifier of the user terminal 520 along with the identifier of the metering device 510 to the authentication device 532 via the secure tunnel and the authentication device 532 may provide And may transmit the identifier and the identifier of the user terminal 520 to the meter server 532. The meter reading server 532 can check whether the user terminal 520 is registered in the measuring device 510 based on the database and provide the checking result to the authentication device 532. [ The authentication server 530 may provide the second OTP to the user terminal 520 based on the confirmation result.

The second OTP information may be transmitted to the metering device 510 via a secure tunnel between the user terminal 520 and the authentication server 530 and a local communication between the user terminal 520 and the metering device 510. The measurement apparatus 510 can release the security based on the first OTP information and the second OTP information. For example, the metering device 510 may release the lock if the first OTP information and the second OTP information are the same and the distance between the user terminal 520 and the metering device 510 is below a predetermined threshold .

When the measurement apparatus 510 is unlocked, the measurement apparatus 510 can transmit the measurement information of the measurement apparatus 510 to the user terminal 520. [ For example, the measurement information may include electricity usage, gas consumption, and vehicle driving record. The user terminal 520 can transmit the measurement information to the meter reading server 534 through the security tunnel and the meter reading server 534 can manage the record of the target system through the measurement information. For example, the measurement information can be used to charge utility bills to the home, or to manage the driving record of the vehicle.

According to the embodiment, the user can easily obtain the measurement information from the measurement device 510 while keeping the security of the measurement device 510 at a high level. For example, the gas meter reading may be aware of the gas usage of the target system by accessing the metering device 510 with the user terminal 520, 510) so as to recognize the driving record of the vehicle.

6 is a view for explaining a traffic blocking operation according to an embodiment. 6, a user terminal 600 includes a plurality of processes 611, 612, 613 and 614, a TCP / IP protocol stack 620, a virtual private network interface 640, an authentication application 630, And may be implemented as a network interface 650.

Output packets transmitted from the process 611, 612, 613, or 614 to the outside and input packets received from the outside to the process 611, 612, 613, or 614 can all be controlled through the authentication application 630.

The authentication application 630 may temporarily block all data traffic except the packet for authentication, thereby blocking data transmission by a malicious program such as a remote computing service (RCS). The authentication application 630 may determine whether to transmit according to the type of packet. For example, the authentication application 630 may drop all packets except the authentication packet.

7 is a flowchart illustrating an operation method of a user terminal according to an exemplary embodiment of the present invention. Referring to FIG. 7, in step 710, a user terminal receives an identifier of a target device via close range communication with the target device. At step 720, the user terminal establishes a secure tunnel with the authentication server. In step 730, the user terminal transmits the identifier of the target device to the authentication server via the secure tunnel. In step 740, the user terminal receives the first OTP information generated by the authentication server based on the identifier of the target device via the secure tunnel. At step 750, the user terminal transmits the first OTP information to the target device via near field communication. At this time, the security of the target device is released based on the first OTP information and the second OTP information generated based on the identifier of the target device in the target device. In addition, the above description can be applied to the operation of the user terminal, and a detailed description thereof will be omitted.

8 is a flowchart illustrating an operation method of a target apparatus according to an embodiment. Referring to FIG. 8, in step 810, the target device transmits an identifier of the target device through short-distance communication with the terminal. In step 820, the target device generates second OTP information based on the identifier of the target device. In step 830, the target device receives the first OTP information generated by the authentication server based on the identifier of the target device from the terminal via close range communication. At step 840, the target device releases the security of the target device based on the first OTP information and the second OTP information. At this time, the identifier of the target device is transmitted from the user terminal to the authentication server through the secure tunnel between the user terminal and the authentication server, and the first OTP information is transmitted from the authentication server to the user terminal through the secure tunnel. In addition, the above description may be applied to the operation of the target device, and a detailed description thereof will be omitted.

9 is a flowchart illustrating an operation method of an authentication server according to an exemplary embodiment of the present invention. Referring to FIG. 9, in step 910, the authentication server establishes a secure tunnel with the terminal. In step 920, the authentication server receives the identifier of the target device from the terminal via the secure tunnel. In step 930, the authentication server generates the first OTP information based on the identifier of the target device. In step 940, the authentication server transmits the first OTP information to the terminal through the secure tunnel. At this time, the identifier of the target device is transmitted from the target device to the user terminal through short-distance communication between the user terminal and the target device, the first OTP information is transmitted from the user terminal to the target device via short- Is released based on the first OTP information and the second OTP information generated based on the identifier of the target device in the target device. In addition, the above description may be applied to the operation of the authentication server, and a detailed description thereof will be omitted.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented as a computer-readable recording medium, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (18)

A method of operating a user terminal,
Receiving an identifier of the target device through short-range communication with the target device;
Establishing a secure tunnel with the authentication server;
Receiving information about the secure tunnel from the authentication server;
Transmitting an identifier of the target device to the authentication server through the secure tunnel;
Receiving, via the secure tunnel, first OTP information generated by the authentication server based on an identifier of the target device; And
Transmitting the first OTP information to the target device via the short distance communication
Lt; / RTI >
Wherein the secure tunnel comprises:
Generating a control path between a first control point provided by a first gateway connected to the user terminal and a second control point provided by a second gateway connected to an authentication device generating the first OTP information;
Selecting any one of a plurality of first security points provided by the first gateway and a plurality of second security points provided by the second gateway;
Forming a secure path between the selected first secure point and the second secure point; And
Establishing the secure tunnel to include the secure path
Lt; / RTI >
The step of receiving information about the secure tunnel
And receiving information about the selected first security point from the authentication server via the control path,
Wherein the packet transmitted to the authentication server is transmitted by the authentication server
Confirming that the type of the packet received by the first gateway is a tunnel type;
Dropping the received packet if the type of the received packet is not a tunnel type; And
And forwarding the received packet to the authentication device via the secure path if the type of the received packet is a tunnel type
Lt; / RTI >
Wherein the identifier of the target device is transmitted by the target device when the user terminal is registered with the target device,
Wherein the security of the target device is released based on the first OTP information and the second OTP information generated based on the identifier of the target device in the target device. The method according to claim 1,
Wherein each of the first OTP information and the second OTP information is generated based on an identifier of the target device and a current time. delete The method according to claim 1,
Wherein the first OTP information is transmitted by the authentication server when the user terminal is registered with the target device. The method according to claim 1,
The security of the target device
Wherein the first OTP information and the second OTP information are released when the distance between the user terminal and the target device is less than a predetermined threshold. The method according to claim 1,
Further comprising receiving internal information of the target device over the short-range communication as the security of the target device is released. The method according to claim 1,
The user of the user terminal is logged into the target device as the security of the target device is released. The method according to claim 1,
Wherein during the existence of the secure tunnel, traffic transmission over the remaining routes except for the short-range communication and the secure tunnel is blocked. delete The method according to claim 1,
Wherein the target device is one of a door lock, a vehicle, a metering device, and a computer. Transmitting an identifier of the target device through short-range communication with the user terminal;
Generating second OTP information based on the identifier of the target device;
Receiving first OTP information generated by an authentication server based on an identifier of the target device from the user terminal via the short distance communication; And
Releasing the security of the target device based on the first OTP information and the second OTP information
Lt; / RTI >
Wherein the identifier of the target device is transmitted from the user terminal to the authentication server via a secure tunnel,
Wherein the secure tunnel comprises:
Generating a control path between a first control point provided by a first gateway connected to the user terminal and a second control point provided by a second gateway connected to an authentication device generating the first OTP information;
Selecting any one of a plurality of first security points provided by the first gateway and a plurality of second security points provided by the second gateway;
Forming a secure path between the selected first secure point and the second secure point; And
Establishing the secure tunnel to include the secure path
Lt; / RTI >
Wherein the user terminal receives information about the selected first security point from the authentication server via the control path and accesses the secure tunnel,
Wherein the packet transmitted to the authentication server is transmitted by the authentication server
Confirming that the type of the packet received by the first gateway is a tunnel type;
Dropping the received packet if the type of the received packet is not a tunnel type; And
And forwarding the received packet to the authentication device via the secure path if the type of the received packet is a tunnel type
Lt; / RTI >
Wherein the identifier of the target device is transmitted to the user terminal when the user terminal is registered with the target device,
Wherein the identifier of the target device is transmitted from the user terminal to the authentication server through a secure tunnel between the user terminal and the authentication server,
Wherein the first OTP information is transmitted from the authentication server to the user terminal via the secure tunnel. 12. The method of claim 11,
Wherein each of the first OTP information and the second OTP information is generated based on an identifier of the target device and a current time. delete 12. The method of claim 11,
The step of unlocking the target device
And releasing security of the target device if the first OTP information and the second OTP information are the same and the distance between the user terminal and the target device is less than a predetermined threshold. Way. 12. The method of claim 11,
Further comprising transmitting the internal information of the target device to the user terminal via the near field communication as the security of the target device is released. 12. The method of claim 11,
The user of the user terminal is logged into the target device as the security of the target device is released. Establishing a secure tunnel with a user terminal;
Transmitting information about the secure tunnel to the user terminal so that the user terminal can access the secure tunnel;
Receiving an identifier of the target device from the user terminal via the secure tunnel;
Generating first OTP information based on the identifier of the target device; And
Transmitting the first OTP information to the user terminal through the secure tunnel
Lt; / RTI >
The step of establishing the secure tunnel
Generating a control path between a first control point provided by a first gateway connected to the user terminal and a second control point provided by a second gateway connected to an authentication device generating the first OTP information;
Selecting any one of a plurality of first security points provided by the first gateway and a plurality of second security points provided by the second gateway;
Forming a secure path between the selected first secure point and the second secure point; And
Establishing the secure tunnel to include the secure path
Lt; / RTI >
Wherein the step of transmitting information regarding the secure tunnel comprises:
And transmitting information on the selected first security point to the user terminal via the control path,
The step of receiving an identifier of the target device
Confirming that the type of the packet received by the first gateway is a tunnel type;
Dropping the received packet if the type of the received packet is not a tunnel type; And
And forwarding the received packet to the authentication device via the secure path if the type of the received packet is a tunnel type
Lt; / RTI >
Wherein the identifier of the target device is transmitted from the target device to the user terminal through short-range communication between the user terminal and the target device when the user terminal is registered with the target device,
Wherein the first OTP information is transmitted from the user terminal to the target device via the short-
Wherein the security of the target device is released based on the first OTP information and the second OTP information generated based on the identifier of the target device in the target device. A computer program product stored in the medium for executing the method of any one of claims 1, 2, 4 to 8, 10 to 12, and 14 to 17, .
KR1020160155150A 2015-11-20 2016-11-21 Method and apparatus for controling security of target device using security tunnel KR101795451B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR1020150163551 2015-11-20
KR20150163551 2015-11-20

Related Child Applications (1)

Application Number Title Priority Date Filing Date
KR1020170143917A Division KR101969752B1 (en) 2015-11-20 2017-10-31 Method and apparatus for controling security of target device using security tunnel

Publications (2)

Publication Number Publication Date
KR20170059426A KR20170059426A (en) 2017-05-30
KR101795451B1 true KR101795451B1 (en) 2017-11-09

Family

ID=58717537

Family Applications (4)

Application Number Title Priority Date Filing Date
KR1020160022042A KR101795450B1 (en) 2015-11-20 2016-02-24 Verification mehod and appratus based on security tunnel
KR1020160155150A KR101795451B1 (en) 2015-11-20 2016-11-21 Method and apparatus for controling security of target device using security tunnel
KR1020170143662A KR102011763B1 (en) 2015-11-20 2017-10-31 Verification mehod and appratus based on security tunnel
KR1020170143917A KR101969752B1 (en) 2015-11-20 2017-10-31 Method and apparatus for controling security of target device using security tunnel

Family Applications Before (1)

Application Number Title Priority Date Filing Date
KR1020160022042A KR101795450B1 (en) 2015-11-20 2016-02-24 Verification mehod and appratus based on security tunnel

Family Applications After (2)

Application Number Title Priority Date Filing Date
KR1020170143662A KR102011763B1 (en) 2015-11-20 2017-10-31 Verification mehod and appratus based on security tunnel
KR1020170143917A KR101969752B1 (en) 2015-11-20 2017-10-31 Method and apparatus for controling security of target device using security tunnel

Country Status (2)

Country Link
KR (4) KR101795450B1 (en)
WO (1) WO2017086757A1 (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101976168B1 (en) * 2017-06-19 2019-05-10 (주)엔에스비욘드 Method for performing login or service use based on two channel and apparatus for performing the same
KR102027326B1 (en) * 2018-11-13 2019-11-14 주식회사 한줌 Security system and method for smart terminal device
KR102150484B1 (en) 2019-11-28 2020-09-01 주식회사 넷앤드 An access authentication system using onetime password for enhancing security
JPWO2021240755A1 (en) * 2020-05-28 2021-12-02
KR102236656B1 (en) * 2020-06-23 2021-04-07 주식회사 이노스코리아 Secured communication device providing secured connection having multiple functions and method for operating thereof

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20090013618A (en) * 2007-08-02 2009-02-05 주식회사 제이디씨텍 Door lock opening and shutting system using one time password
KR20110038563A (en) * 2009-10-08 2011-04-14 최운호 Method, vehicle terminal, biometrics card and system for controlling vehicle through authenticating driver, and method for providing passenger protecting/tracking function using biometrics card and terminal
KR101926020B1 (en) * 2011-07-11 2018-12-06 주식회사 비즈모델라인 System for Operating a Payment by using Dynamic Determined Authentication Number
KR101211477B1 (en) * 2011-08-31 2012-12-12 주식회사 아이레보 Method for mobile-key service
KR101259546B1 (en) * 2011-11-04 2013-04-30 주식회사 아이레보 Method for smart-key service
WO2014157770A1 (en) * 2013-03-26 2014-10-02 주식회사 은광시스템 Method for authenticating entrance and exit by using digital door lock and wireless communication terminal, and apparatus therefor
KR20150034147A (en) * 2015-02-16 2015-04-02 (주)엔텔스 NETWORK SYSTEM FOR PROVIDING SERVICE INFORMATION USING IPSec PROTOCOL AND TRANSMITTING METHOD OF SERVICE INFORMATION USING IPSec PROTOCOL

Also Published As

Publication number Publication date
KR20170124510A (en) 2017-11-10
KR20170059359A (en) 2017-05-30
KR101795450B1 (en) 2017-11-09
KR20170124511A (en) 2017-11-10
KR20170059426A (en) 2017-05-30
WO2017086757A1 (en) 2017-05-26
KR101969752B1 (en) 2019-04-17
KR102011763B1 (en) 2019-08-19

Similar Documents

Publication Publication Date Title
KR101969752B1 (en) Method and apparatus for controling security of target device using security tunnel
US11637746B2 (en) Object identification for groups of IoT devices
US11386420B2 (en) Contextual authentication of an electronic wallet
EP3332532B1 (en) Access control for internet of things devices
JP6821609B2 (en) Resource-driven dynamic approval framework
CN111049660B (en) Certificate distribution method, system, device and equipment, and storage medium
TWI607334B (en) Secure wireless charging
US11991527B2 (en) Communication method and communication device
US11050763B1 (en) Distributed ledger for network security management
US20200120469A1 (en) Systems and methods for updating a mobile device
US10530586B2 (en) Method, hardware and digital certificate for authentication of connected devices
CN107438230A (en) Safe wireless ranging
WO2014074721A1 (en) Policy-based resource access via nfc
US9549322B2 (en) Methods and systems for authentication of a communication device
CN105471815A (en) Internet-of-things data security method and Internet-of-things data security device based on security authentication
CN109995719A (en) A kind of unmanned plane authentication method, system, unmanned plane supervising platform and the first equipment
CN104468825B (en) Remote-authorization method and system
KR20200088901A (en) Self-authentication of devices for secure transactions
JP2018010449A (en) Smart lock authentication system and method in smart lock
WO2019173620A1 (en) Method and apparatus for facilitating frictionless two-factor authentication
KR102377045B1 (en) SYSTEMS AND METHODS FOR AUTHENTICATING IoT DEVICE THROUGH CLOUD USING HARDWARE SECURITY MODULE
Bolhuis Using an NFC-equipped mobile phone as a token in physical access control
US10536453B2 (en) Method and arrangement for authorizing an action on a self-service system
KR101757692B1 (en) Remote control system of home network device using token server authentication and method thereof
RU2709281C1 (en) Digital key carrier authorization method and system

Legal Events

Date Code Title Description
A201 Request for examination
A302 Request for accelerated examination
E902 Notification of reason for refusal
AMND Amendment
N231 Notification of change of applicant
E601 Decision to refuse application
AMND Amendment
X701 Decision to grant (after re-examination)
GRNT Written decision to grant