KR102306466B1 - System for non-replicable authentication and location estimation and operation method thereof - Google Patents

Abstract

The present disclosure relates to a non-replicable authentication and positioning system and an operating method thereof, and the method of operating a server for performing non-replicable authentication and positioning according to an embodiment includes: receiving an authentication request from a user terminal - the authentication the request includes information regarding a hardware address and network name of at least one wireless communication device; verifying the validity of the network name for each of the wireless communication devices; if the network name corresponding to the wireless communication device is valid, locating the location of the user terminal based on the hardware address; and performing authentication for the user of the user terminal based on the result of the positioning, wherein the network name corresponding to each of the wireless communication devices is updated at a predetermined time interval according to a predetermined generation rule. can

Description

SYSTEM FOR NON-REPLICABLE AUTHENTICATION AND LOCATION ESTIMATION AND OPERATION METHOD THEREOF

The present disclosure relates to a non-replicable authentication and positioning system and an operating method thereof, and more particularly, by periodically updating a network name (SSID) of a wireless communication device so that the duplicated network name cannot be used for authentication, security performance This improved non-replicable authentication and positioning system and method of operation are provided.

Security authentication technology is widely used for user authentication in the process of providing a specific service requiring security. Among them, secondary authentication technologies mainly used include public certificates, security cards, and OTP. However, since the number of copies and leaks is increasing every year, and advanced hacking technologies that neutralize authentication systems such as memory hacking are emerging, the development of security authentication technology that enhances security and provides user convenience is required.

Accordingly, as one technique for further strengthening security, a technique for locating a user's location indoors based on wireless communication such as Wifi and using it for an authentication procedure has been introduced.

For example, Korea Patent Registration No. 10-1703357 (Jan. 31, 2017) relates to an actual location authentication system for a terminal and a method thereof, and an IP address pool managed by the access device by the location authentication device and the access device storing and managing the installed location information in a location information database (DB); The location authentication device searches the IP address pool and location information stored in the location information database (DB) using the IP address and location information received when the terminal's actual location authentication request is made from the application service server. step; and a location authentication step in which the location authentication device authenticates the actual location of the terminal according to the search result, and transmits the authentication result and distance information to the application service server.

However, this conventional technique uses a MAC address and/or a network name (SSID) of the access device to identify the access device, etc. had a problem

Accordingly, the present disclosure describes a non-replicable authentication and positioning system in which security performance is improved by making a duplicated MAC address and/or network name (SSID) unavailable for authentication in order to improve the security level.

The present disclosure provides a non-replicable authentication and positioning system capable of improving security performance by periodically updating a network name (SSID) of a wireless communication device so that a duplicated network name cannot be used for authentication, and an operating method thereof .

The method of operating a server for performing non-replicable authentication and location positioning according to an embodiment comprises the steps of receiving an authentication request from a user terminal, wherein the authentication request includes information about a hardware address and network name of at least one wireless communication device. Included ― ; verifying the validity of the network name for each of the wireless communication devices; if the network name corresponding to the wireless communication device is valid, locating the location of the user terminal based on the hardware address; and performing authentication for the user of the user terminal based on the result of the positioning, wherein the network name corresponding to each of the wireless communication devices is updated at a predetermined time interval according to a predetermined generation rule. can

According to one embodiment, there is provided a server for performing non-replicable authentication and positioning, comprising: at least one memory for storing a program for non-replicable authentication and positioning; and by executing the program, receiving an authentication request including information about a hardware address and network name of at least one wireless communication device from a user terminal, and verifying the validity of the network name for each of the wireless communication devices, If the network name corresponding to the wireless communication device is valid, positioning the location of the user terminal based on the hardware address, and controlling to perform authentication of the user of the user terminal based on the result of the positioning The network name may include at least one processor, and the network name corresponding to each of the wireless communication devices may be updated at a predetermined time interval according to a predetermined generation rule.

A computer program product including a recording medium storing a program according to an embodiment may execute a method of operating a server for performing authentication and positioning that cannot be copied.

1 is a view for explaining a non-replicable authentication and positioning system according to an embodiment.
2 is a flowchart illustrating a non-replicable authentication and positioning method according to an embodiment.
3 is a diagram exemplarily illustrating a process of renewing a network name in a wireless communication device in a non-replicable authentication and positioning system according to an embodiment.
4 is a flowchart illustrating a method of operating a server for performing non-replicable authentication and positioning according to an embodiment.
5 is a flowchart illustrating an embodiment of step 320 of FIG. 4 .
6 is a block diagram illustrating a configuration of a server that performs non-replicable authentication and positioning according to an embodiment.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this case, it should be noted that in the accompanying drawings, the same components are denoted by the same reference numerals as much as possible. In addition, detailed descriptions of well-known functions and configurations that may obscure the gist of the present invention will be omitted.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented in various numbers of hardware and/or software configurations that perform specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors, or may be implemented by circuit configurations for a predetermined function. Also, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. The functional blocks may be implemented as an algorithm running on one or more processors. Also, the present disclosure may employ prior art for electronic configuration, signal processing, and/or data processing, and the like.

In addition, terms such as "...unit" and "module" described in this specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software. have. “Part” and “module” are stored in an addressable storage medium and may be implemented by a program that can be executed by a processor.

For example, “part” and “module” refer to components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, and programs. It may be implemented by procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, database, data structures, tables, arrays and variables.

Throughout the specification, when a part is "connected" to another part, it includes not only a case in which it is "directly connected" but also a case in which it is "indirectly connected" with a device interposed therebetween. Throughout the specification, when a part "includes" a certain element, it means that other elements may be further included, rather than excluding other elements, unless otherwise stated.

In addition, the connecting lines or connecting members between the components shown in the drawings only exemplify functional connections and/or physical or circuit connections. In an actual device, a connection between components may be represented by various functional connections, physical connections, or circuit connections that are replaceable or added.

The terms used in the present invention are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present invention, terms such as "comprises" or "have" are intended to designate that the features, numbers, steps, operations, components, parts, or combinations thereof described in the specification exist, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof. That is, the description of “including” a specific configuration in the present invention does not exclude configurations other than the corresponding configuration, and it means that additional configurations may be included in the practice of the present invention or the scope of the technical spirit of the present invention.

Some components of the present invention are not essential components for performing essential functions in the present invention, but may be optional components for merely improving performance. The present invention can be implemented by including only essential components to implement the essence of the present invention, except for components used for performance improvement, and a structure including only essential components excluding optional components used for performance improvement Also included in the scope of the present invention.

1 is a view for explaining a non-replicable authentication and positioning system according to an embodiment.

Referring to FIG. 1 , the non-replicable authentication and positioning system according to an embodiment includes a user terminal 20 , a server 30 , and a network 40 .

The wireless communication device 10 may include any device capable of supporting or relaying wireless communication. For example, the wireless communication device 10 may include at least one of an access point (AP) and a beacon. In an embodiment, the wireless communication device 10 may update its own network name at a predetermined time interval and transmit the updated network name and hardware address to the user terminal 20 .

The user terminal 20 may include any device capable of accessing the network 40 . For example, the user terminal 20 may include a smart phone, a tablet, a PC, a notebook computer, a home appliance device, a medical device, a camera, and a wearable device. In an embodiment, the user terminal 20 may receive a service from the server 30 , and may perform authentication and positioning through the server 30 . In one embodiment, the user terminal 20 transmits an authentication request including information about the hardware address, network name, wireless signal strength, etc. of the wireless communication device 10 connected through wireless communication to the server 30 . to perform positioning and authentication.

The server 30 provides computing resources, storage resources, and the like to provide services to clients through the network 40 . For example, the server 30 may provide various services to the user terminal 20 by executing various applications. In an embodiment, the service may include services that must exchange information that should not be leaked to the outside, such as personal information, trade secrets, confidential information, and internal system information. For example, the service may include services such as access, device use/access authorization, member registration, log-in, financial transaction, certificate issuance, administrative processing, and the like. Here, the client may include the user terminal 20 . In one embodiment, the server 30 may include various types of servers, such as an application server, a control server, a data storage server, and a server for providing a specific function. In addition, the server 30 may process the process alone, or a plurality of servers may process the process. In an embodiment, the server 30 may provide a service to the user terminal 20 and may perform non-replicable authentication and positioning.

In one embodiment, in order to prevent the information (hardware address, network name, etc.) of the duplicated wireless communication device 10 from being illegally used for authentication, the server 30 is configured to prevent the user terminal ( The validity of the network name of the wireless communication device 10 received from 20) is verified, and only when it is determined to be valid, the location of the user terminal 20 and user authentication based thereon can be performed.

The network 40 includes a user terminal 20 and a server such as the Internet, an intranet, an extranet, a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN). 30) can include all networks that can be accessed.

2 is a flowchart illustrating a method of performing non-replicable authentication and positioning according to an embodiment.

Referring to FIG. 2 , in step 210 , the wireless communication device 10 may transmit information about its own hardware address and network name to the user terminal 20 connected through wireless communication.

Here, the hardware address is a physical address or a unique number assigned to a LAN card of the wireless communication device 10 , and is a MAC address (Media Access Control Address or MAC Address) or BSSID (Basic Service Set Identifier) of the wireless communication device 10 . can refer to The network name is an identifier (or name) set to inform a service set (network) to be connected by the wireless networking standard, and may refer to a Service Set Identifier (SSID) set in each of the wireless communication devices 10 .

In an embodiment, the network name of the wireless communication device 10 may be updated periodically at a predetermined time period. For example, the wireless communication device 10 may update its own network name by newly generating a network name according to a predetermined generation rule at time intervals such as 5 minutes or 10 minutes. The process of updating (or generating) the network name will be described in detail below with reference to FIG. 3 .

In step 220 , the user terminal 20 may transmit an authentication request to the server 30 . Here, the authentication request is for verifying the qualification to receive a predetermined service from the server 30 , and may include information about a hardware address and network name received from at least one wireless communication device 10 .

In step 230 , the server 30 may validate the network name of the wireless communication device 10 based on the information about the hardware address and network name received in step 220 . In one embodiment, the server 30 generates a second network name by transforming the received hardware address and embedded time information using the same generation rules, encryption and encoding scheme applied in the wireless communication device 10, and , by comparing it with the received network name, validation can be performed.

In step 240 , if the network name is valid according to step 230 , the server 30 may locate the location of the user terminal 20 based on the hardware address. Step 240 may be performed by applying various positioning methods known in the art.

In step 250 , the server 30 may authenticate the user terminal 20 based on the positioning result. For example, the server 30 may check whether the user is located in at least one location range set in response to at least one service through the positioning result, and may perform authentication based on this.

When authentication is successful, the server 30 may provide a predetermined service to the user terminal 20 .

In FIG. 2 , one server 30 communicates with the user terminal 20 and performs authentication and positioning that cannot be replicated, but is not limited thereto, and the server 30 may be a plurality of servers, at this time , it communicates between a plurality of servers, and can also perform non-replicable authentication and positioning.

Hereinafter, the operation of the server 30 will be described in more detail.

3 is a diagram exemplarily illustrating a process of renewing a network name in a wireless communication device in a non-replicable authentication and positioning system according to an embodiment.

Referring to FIG. 3 , the wireless communication device 10 may use its own hardware address and built-in time information to update the network name according to a predetermined generation rule. Here, the built-in time of the wireless communication device 10 may be a UnixTimestamp or Timestamp value.

In an embodiment, first, the wireless communication device 10 may merge its MAC Address and Timestamp, use it as an input value, and apply a predetermined method to encrypt and/or encode the same. Encryption, for example, AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3-DES (Triple Data Encryption Standard), SEED, ARIA, LEA (Lightweight Encryption Algorithm), HIGHT, such as various encryption known in the art It may be performed by applying a method, and encoding may also be performed by applying various encoding methods known in the art, such as ASCII , URL , HTML , Base64 , MS Script, and the like.

Then, the wireless communication device 10 may reduce the length of the encrypted and/or encoded result value according to a predetermined rule. That is, according to the communication standard, since the length of the network name that can be set according to the type of the wireless communication device 10 is determined (eg, 32 bytes in the case of an access point, etc.), the finally generated network name is You can adjust the length to fit.

Then, the wireless communication device 10 may finally generate a network name by adding additional information to the length-adjusted result value. Such additional information may include an identifier indicating an encryption and encoding method used when generating a network name and a Timestamp value. For example, when the network name is updated (or generated), the wireless communication device 10 may use different encryption and encoding methods for each time interval, and generate at least one identifier for indicating the encryption and encoding methods used. You can include it in your network name.

As described in detail below, through this identifier, the server 30 can identify the encryption and encoding method used in the wireless communication device 10, and apply the same method to obtain a second network name for network name verification. be able to create

4 is a flowchart illustrating a method of operating a server for performing non-replicable authentication and positioning according to an embodiment. 5 is a flowchart illustrating an embodiment of step 320 of FIG. 4 .

In step 410 , the server 30 may receive an authentication request from the user terminal 20 . Here, the authentication request is a request for verifying the qualification for receiving a predetermined service from the server 30 , and the authentication request is the wireless communication device 10 received by the user terminal 20 from at least one wireless communication device 10 . ) may include information about each hardware address and network name.

For example, when the user enters the coverage area of the at least one wireless communication device 10 while carrying the user terminal 20 , the user terminal 20 is connected to the wireless communication device 10 through wireless communication therewith. ), collects information about the hardware address and network name, and may transmit it to the server 30 by including it in the authentication request.

As described above, the wireless communication device 10 may update its own network name periodically for a predetermined time. The user terminal 20 collects the network name that changes at time intervals along with the unique hardware address of the wireless communication device 10 that does not change, and transmits it to the server 30 to illegally copy the wireless communication device 10 It can be prevented from being used for authentication.

In step 420 , the server 30 may verify the validity of the network name received from the user terminal 20 . Step 420 may be performed based on the received hardware address such as a network name and information about the built-in time of the server 30 . In this case, the built-in time of the server 30 may be in UnixTimestamp or Timestamp format as in the wireless communication device 10 .

In one embodiment, step 420 may include steps 422 and 424 , as shown in FIG. 5 .

In step 422 , the server 30 may generate a second network name for verification based on the received hardware address and the built-in time of the server. This second network name may be generated according to the same generation rule as the generation rule used to update the network name in the wireless communication device 10 .

For example, the server 30 merges the received hardware address and time information built into the server 30 according to the same generation rule as that used in the wireless communication device 10, and then uses it in a predetermined method. The second network name may be generated through processes such as encryption and/or encoding, and adjusting the length thereof.

In an embodiment, the network name received from the user terminal 20 may include at least one identifier indicating an encryption and encoding method for at least one of a hardware address and a built-in time of the wireless communication device 10 . These identifiers may consist of numbers or letters.

Accordingly, in step 422, the second network name may be generated according to the encryption and encoding method corresponding to the identifier and the generation rule. That is, the server 30 can identify the encryption and encoding method applied at a predetermined time interval in the wireless communication device 10 through the identifier, and generate a second network name by applying the identified encryption and encoding method. do.

Subsequently, in step 424 , the server 30 may verify validity by comparing the network name received from the user terminal 20 with the second network name. That is, when the network name received from the user terminal 20 is the same as the second network name generated according to the same generation rule and encryption and encoding method, the server 30 is a valid network name in which the received network name is not duplicated. can be judged as

In one embodiment, before step 422, the method may further include the step of first verifying the validity of the network name based on the time information included in the received network name. For example, as described above with reference to FIG. 3 , the network name updated (or generated) in the wireless communication device 10 includes information about the built-in time (ie, Timestamp value) of the wireless communication device 10 . In addition, the server 30 may be implemented to perform primary verification of the validity of the network name by identifying the built-in time from the received network name and comparing it with information about its own built-in time.

If the network name received from the user terminal 20 is valid, proceeding to step 430 , the server 30 may locate the location of the user terminal 20 based on the hardware address of the wireless communication device 10 .

Positioning of the user terminal 20, for example, the absolute and / or relative installation position of the at least one wireless communication device 10 corresponding to the hardware address, radio signal strength (RSSI, Received Signal Strength Indicator), etc. It may be performed by applying a method of using a method, in addition to a method using fingerprinting (Fingerprinting), etc., but this is exemplary and not limited thereto, and may be performed by various methods known in the art .

Meanwhile, in an embodiment, when the network name received from the user terminal 20 is invalid, the server 30 may transmit a notification indicating that the network name is invalid to the user terminal 20 requesting authentication.

Subsequently, in step 440 , the server 30 may authenticate the user of the user terminal 20 based on the positioning result. For example, the server 30 may check whether the user is located in at least one location range set in response to at least one service through the positioning result, and may perform authentication based on this.

Meanwhile, although not shown, the operation method 400 may further include the step of the server 30 providing a service to the user terminal 20 when authentication is successful through step 440 . In an embodiment, the service may include services that require exchanging information that should not be leaked to the outside, such as personal information, trade secrets, confidential information, and internal system information. For example, the service may include services such as membership registration, login, financial transaction, certificate issuance, administrative processing, and the like.

According to the method of operation of the server 30 for performing authentication and positioning that cannot be duplicated according to an embodiment, the network name of the wireless communication device 10 is updated at predetermined time intervals, so that the duplicated hardware address and network name are By not being used for authentication, the security level can be further improved.

6 is a block diagram illustrating a configuration of a server that performs non-replicable authentication and positioning according to an embodiment.

As shown in FIG. 6 , the server 600 for performing authentication and positioning that cannot be copied according to an embodiment may include a communication unit 610 , a memory 620 , and a processor 630 . However, the components of the server 600 are not limited to the above-described example. For example, the server 600 may include more or fewer components than the aforementioned components. In addition, the communication unit 610 , the memory 620 , and the processor 630 may be implemented in the form of a single chip. In addition, as described above, the server 600 may be a plurality of servers, and in this case, communication between the plurality of servers may be performed and authentication and positioning that cannot be replicated may be performed, and each server may be configured as a communication unit 610, memory 620 and a processor 630 may be included.

The communication unit 610 may transmit/receive a signal to/from an external device. A signal transmitted and received with an external device may include control information and data. In this case, the external device may include the user terminal 20 for performing authentication and positioning that cannot be copied. The communication unit 610 may include both wired and wireless communication units. In addition, the communication unit 610 may receive a signal through a wired/wireless channel and output it to the processor 630 , and transmit the signal output from the processor 630 through a wired/wireless channel.

The memory 620 may store programs and data necessary for the operation of the server 600 to perform non-replicable authentication and positioning. In an embodiment, the memory 620 may store control information or data included in a signal transmitted and received by the server 600 that performs authentication and positioning that cannot be copied. The memory 620 may be configured as a storage medium or a combination of storage media such as ROM, RAM, hard disk, CD-ROM, and DVD. Also, the number of memories 620 may be plural. According to an embodiment, the memory 620 may store a program for performing operations that are the above-described embodiments of the present disclosure.

The processor 630 may control a series of processes in which the server 600 that performs non-replicable authentication and positioning according to an embodiment of the present disclosure operates. For example, it is possible to control components of the server 600 that perform non-replicable authentication and positioning to perform the operation of the server 600 according to an embodiment. There may be a plurality of processors 630 , and the processor 630 may perform an operation of the server 600 for performing authentication and positioning that cannot be duplicated by executing a program stored in the memory 620 .

In one embodiment, the processor 630 receives an authentication request including information about a hardware address and network name of at least one wireless communication device 10 from the user terminal 20, and each of the wireless communication devices 10 to verify the validity of the network name, and if the network name corresponding to the wireless communication device 10 is valid, the location of the user terminal 20 is located based on the hardware address, and based on the result of the positioning, the user terminal (20) can be controlled to perform authentication for the user.

Here, the network name may be updated according to a predetermined generation rule based on the hardware address of the wireless communication device 10 and the built-in time of the wireless communication device 10 .

In one embodiment, the processor 630 generates a second network name according to the generation rule based on the received hardware address and the built-in time of the server 600, and compares the network name with the second network name, You can control to validate the network name.

In one embodiment, the network name includes at least one identifier indicating an encryption and encoding scheme for at least one of a hardware address of the wireless communication device 10 and a built-in time of the wireless communication device 10, and the processor 630 ) can control to generate the second network name according to the encryption and encoding method corresponding to the identifier and the generation rule.

Meanwhile, the above-described embodiment can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable medium. In addition, the structure of the data used in the above-described embodiment may be recorded in a computer-readable medium through various means. In addition, the above-described embodiment may be implemented in the form of a recording medium including instructions executable by a computer, such as a program module executed by a computer. For example, methods implemented as software modules or algorithms may be stored in a computer-readable recording medium as computer-readable codes or program instructions.

Computer-readable media may be any recording media that can be accessed by a computer, and may include volatile and nonvolatile media, removable and non-removable media. The computer-readable medium may include, but is not limited to, a magnetic storage medium, for example, a ROM, a floppy disk, a hard disk, and the like, and an optically-readable medium, for example, a storage medium such as a CD-ROM or DVD. . In addition, computer-readable media may include computer storage media and communication media.

In addition, a plurality of computer-readable recording media may be distributed in network-connected computer systems, and data stored in the distributed recording media, for example, program instructions and codes, may be executed by at least one computer. have.

The specific implementations described in this disclosure are merely exemplary and do not limit the scope of the disclosure in any way. For brevity of the specification, descriptions of conventional electronic components, control systems, software, and other functional aspects of the systems may be omitted.

Claims (7)

In the method of operation of a server that performs non-replicable authentication and positioning,
receiving an authentication request from a user terminal, wherein the authentication request includes information about a hardware address and a network name of at least one wireless communication device;
verifying the validity of the network name for each of the wireless communication devices;
if the network name corresponding to the wireless communication device is valid, locating the location of the user terminal based on the hardware address; and
Based on the result of the positioning, comprising the step of performing authentication for the user of the user terminal,
The network name corresponding to each of the wireless communication devices is updated at predetermined time intervals according to a predetermined generation rule based on the hardware address of the wireless communication device and the built-in time of the wireless communication device,
The step of verifying the validity of the network name comprises:
generating a second network name according to the generation rule based on the received hardware address and the built-in time of the server; and
and verifying validity of the network name by comparing the network name with the second network name. delete delete The method of claim 1,
The network name includes at least one identifier indicating an encryption and encoding method for at least one of a hardware address of the wireless communication device and a built-in time of the wireless communication device,
In the generating of the second network name, the second network name is generated according to an encryption and encoding method corresponding to the identifier and the generation rule. The method of claim 1,
The method of claim 1, wherein the wireless communication device is at least one of an access point (AP) and a beacon. In the server for performing non-replicable authentication and positioning,
at least one memory storing a program for non-replicable authentication and positioning; and
By executing the program, receiving an authentication request including information about a hardware address and a network name of at least one wireless communication device from a user terminal, verifying the validity of the network name for each of the wireless communication devices, and the When the network name corresponding to the wireless communication device is valid, the location of the user terminal is determined based on the hardware address, and based on the result of the positioning, at least controlling to perform authentication of the user of the user terminal contains one processor;
The network name corresponding to each of the wireless communication devices is updated at a predetermined time interval according to a predetermined generation rule based on the hardware address of the wireless communication device and the built-in time of the wireless communication device,
based on the received hardware address and the built-in time of the server, generating a second network name according to the generation rule, and verifying the validity of the network name by comparing the network name with the second network name; server. A recording medium in which a computer program for executing the method of any one of claims 1, 4 and 5 is recorded.

Images