KR20080094228A - System and method for controlling coming and going using smart card - Google Patents

Abstract

An admission control system and method using a smart card are provided to judge whether a user having an admission card enters an entrance door only by using the admission card and an authentication SAM(Sequential Access Method) to operate a security system stably irrespective of network failure. An admission control system includes an admission card(10), a card reader(20), a relay(30), a management server(40), an operating SAM(60), and a dummy reader(50). The admission card stores fundamental information and identification information of a user and gives admission to the user. The card reader includes an authentication SAM(21) having general information and admission policy and an entrance door opening/closing controller(22), RF-communicates with the admission card and communicates with the management server through the relay. The relay relays communication between the card reader and the management server. The management server has a database(41) and manages users, the authentication SAM and admission. The operating SAM has the authority to operate the management server and restricts functions of the management server. The dummy reader functions as a medium for communication between the management server and the operating SAM.

Description

Access control system and method using smart card {System and method for controlling coming and going using smart card}

1 is a system configuration diagram illustrating an embodiment of the present invention;

2 is a flowchart illustrating an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

10: access card

20: card reader

21: Certification Fountain

22: door opening and closing controller

30: repeater

40: management server

41: database

50: dummy reader

60: operating fountain

The present invention relates to an access control system and a method using a smart card, and more particularly, using a smart card that grants access to a smart card and controls access by an authentication fountain of a smart card reader in which an access policy is set. An access control system and method thereof are provided.

Recently, as the importance of security is highlighted, it is a common trend to install an access control system in a company or a factory, and a universal access control system stores a list of user cards that can be accessed in a card reader mounted at a security door. It is a system configured to open a security door by checking whether a card presenting is on the list.

Therefore, the user card of the access control system as described above is a simple ID card. In order to apply an additional access control method such as anti-passback, which can be exited only through the entrance time limit and the entrance door, the security door is managed through the network at the management server. Or the card reader must be controlled.

This method is designed to operate the access control system depending on the stable operation of the network, and the encryption method used for communication is to be performed in the card reader and the management server. Therefore, the access control system cannot be operated when communication is interrupted due to network failure, and when the encryption method used for communication is exposed to the outside, security doors or card readers can be manipulated arbitrarily. There is a problem that the control system can no longer be maintained.

The access control system provides various functions such as access status management and report function in addition to access authentication, but the most important part of the characteristics of the security system is that the system must be operated stably. Nevertheless, the existing access control system is highly dependent on the uncertain network, making it difficult to operate a stable system. The access control system, which is less dependent on the network, can support high level access control functions such as time limit and anti-passback. There is a problem that can not be.

The present invention has been made in view of the above-described problems, and its object is uncertain because the network is used only when the access policy of the access log and the authentication sequential access method (SAM) generated when the user accesses the security door is used. It lowers the dependence on the network and secures the stability of the system. When accessing a user using a smart card user access card and authentication certificate, only the card reader equipped with the access card and authentication certificate can be used without user intervention through the network. It is to provide an access control system and a method using a smart card to apply access control methods such as user authentication, time limit and anti-passback.

Features of the present invention for achieving the above object, the smart card and the access card having a user's basic information, access authority and personal identification information; An authentication fountain 21 having a general information and an access policy and a door opening / closing controller 22 are mounted, the card communicates with the management card 40 through the repeater 30 by RF communication with the access card 10 and the repeater 30. A reader 20; A repeater 30 connected to a network with the management server 40 and at least one card reader 20 connected to a network to relay communication between the management server 40 and the card reader 20, and a database 41. A management server 40 for managing a user, managing an authentication fountain 21, managing access status, and communicating with the card reader 20 through the repeater 30; An operating spring 60 having authority information for driving the management server 40 and for limiting the function of the management server 40 according to authority; Connected to the management server 40 by USB, by the access control system using a smart card, characterized in that consisting of a dummy reader 50, which serves as a medium for communicating with the management server 40 and the operating fountain (60) It can be achieved.

Hereinafter, described in detail by the accompanying drawings a preferred embodiment for achieving the above object is as follows.

As shown in FIG. 1 or FIG. 2, the present invention provides an access card 10 composed of a smart card, a card reader 20 equipped with an authentication fountain 21, a management server 40, and one or more card readers 20. Repeater 30 relaying the communication of the management server 40, the management server 40 having a database 41, the operating fountain 60 having the authority information for driving the management server 40 and the management server 40 and the operating fountain It consists of a dummy reader 50 which serves as a medium for communicating with the 60.

The access card 10 is composed of a smart card, and has the user's basic information, access authority and personal identification information. The basic information refers to general information necessary for the user management of the system such as the issuer code, the workplace code, the company number, the department, the position, and the workplace code of the access card 10 and the issuer code are the workplace code, issuer code and It can be used only if it is the same, and the access authority refers to the access ID list that can be accessed in general and the overtime access ID list that can be used for overtime access. The access ID list stores the access ID of the authentication fountain 21 acquired by the user in the form of a list. It is information, and the overtime access ID list is information stored in the form of a list of the overtime access ID of the authentication fountain 21 obtained by the user, the personal identification information is information for identifying the owner to prevent illegal use of the access card Information such as password, fingerprint recognition, and vein recognition are inputted.

The authentication fountain 21 has general information and access policy. Here, general information refers to general information necessary for the system to manage the authentication fountain, such as ID, location information, business code, and issuer code, and access policy refers to information such as access ID, overtime access ID, and anti-passback ID. The authentication fountain 21 has the information of the access allowance time and the access allowance expiration time for general access, and whether the general access is allowed by comparing the time information for requesting authentication with the access allowance time and access allowance expiration time stored therein If the access card 10 has a time-out access ID for the authentication fountain 21, the access time is not compared.

Here, the access ID is an ID value for the general access policy, and the authentication fountain 21 may have only one ID, and the access card 10 may have multiple IDs, and the access ID that the authentication fountain 21 has. The access card 10 must have a general access right to the authentication fountain (21).

In addition, the time-out access ID is a policy for a user who can access the time-out, the authentication fountain 21 has only one ID, the access card 10 may have a plurality of IDs, the authentication fountain 21 has an overtime The access card 21 must have an access ID to have the time-out access right to the authentication fountain 21.

On the other hand, the anti-passback ID is an ID value for anti-passback that must be discharged to the entrance door, and the authentication fountain 21 is an electronic ticket including the anti-passback ID in the access card 10 having access authority. This is used to store the entrance authentication and check the integrity of the electronic ticket stored in the access card (10) at the time of exit authentication and to verify the anti-passback ID stored in the electronic ticket to proceed with the exit authentication.

The card reader 20 is equipped with the authentication fountain 21 therein, the door opening and closing controller 22 is mounted to open and close the door, the authentication fountain through communication with the management server 40 through the repeater 30 The communication with the 21 is relayed, and the communication between the access card 10 and the authentication fountain 21 is relayed through RF communication with the access card 10. In addition, the card reader 20 controls the door according to the access authentication result of the access card 10 and the authentication spring 21, and transmits the generated access situation to the management server 40 through the repeater 30.

The repeater 30 is connected to the management server 40 in a network, and is connected to at least one card reader 20 in a network, and plays a role of relaying communication between the management server 40 and the card reader 20. do.

The management server 40 has a database 41, and manages the registration, modification, deletion and access card issuance of the user. Here, issuance of an access card refers to granting basic information and authority to an access card.

In addition, the management server 40 manages the authentication fountain 21, such as issuing an authentication fountain and changing an access policy. Here, the certification fountain is issued to grant basic information and access policy to the certification fountain (21).

The management server 40 collects the access status of the user, and manages the access status of the user's attendance, real-time access management, and the like. In addition, the present invention has been described as the database 41 is configured in the management server 40, it is also possible to use an external database server.

The operating fountain 60 has the authority information for driving the management server 40, the function of the management server 40 can be limited according to the authority of the operating fountain (60).

In addition, the operation fountain 60 ensures the integrity of the command to control the authentication fountain 21 and the card reader 20 using the network, the management server 40 in the management of the authentication fountain 21 in the network through the management command In order to guarantee the integrity, the digital signature is generated through the operation fountain 60 to transmit a management command including the digital signature to the authentication fountain 21, and the authentication fountain 21 is managed by verifying the electronic signature included in the command. Check the integrity of the command.

The dummy reader 50 is connected to the management server 40 by USB, and is a medium for communicating with the management server 40 and the operation fountain 60.

Referring to the access control method using the smart card of the present invention as described above is as follows.

Recognizing step (S10) that the card reader 20 recognizes the access card (10); Request step (S20) that the card reader 20 requests authentication for the access card 10 to the authentication fountain (21); The authentication fountain 21 is an information request step (S30) for requesting the access card information to the access card 10 through the card reader 20; Confirmation request step (S40) that the access card 10 makes a basic information confirmation request to the authentication fountain 21 through the card reader 20; The authentication fountain is an information update step (S50) of updating the information of the access card 10 to the access card 10 through the card reader 20; Access card 10 is an authentication request step (S60) for requesting authentication of the access card to the authentication fountain 21 through the card reader 20; The authentication fountain 21 is composed of an authentication step (S70) for sending an authentication log to the card reader 20.

First, the access card 10 is authenticated by the access control method, and the access control method will be described in detail as follows.

When the user contacts the access card 10 to the card reader 20 to pass through the door, the card reader 20 recognizes the contact of the access card 10 through RF communication with the access card 10 (S10). ).

In this case, the card reader 20 is always in a standby state, and when the access card 10 is in contact with the authentication mode, and when communicating with the management server 40 is divided into a management mode and operates. In the management mode, the management server 40 is a mode used to change the policy of the authentication spring 21. In the management mode, only the management server does not perform authentication, sensor recognition, etc. of the access card 10. Perform only communication. At this time, the card reader 20 checks the abnormality of the authentication spring 21, the door opening / closing controller 22 and the peripheral sensors, and when the operation of the authentication spring 21, the door opening / closing controller 22 and the peripheral sensors is abnormal. By transmitting the error log including the information of the device to the management server 40 through the repeater 30, the normality of the authentication fountain 21 is determined by the card reader 20 to send information to the authentication fountain 21. Request, and the authentication fountain 21, if there is a request for information from the card reader 20, and responds to the information including the unique number, status code, operation identification code, the unique number of the card reader 20, etc. The card reader 20 receives the response and transmits a driving log including the response of the authentication fountain 21 to the management server 40 through the repeater 30, and the authentication fountain 21 does not have a response to the information request. If the card reader 20 is an error log through the repeater 30, the management server 40 It transmits.

And in the authentication mode, the access authentication for the access card 10, external sensor recognition, the log transmission to the management server 40 through the repeater 30, and performs operations such as command processing of the management server 40.

On the other hand, the management server 40 reads the operation information stored in the operating fountain 60 through the dummy reader 50 connected by USB to the management server 40 with a limited function in accordance with the operation information of the operating fountain 60 In operation, to read the operation information of the operating fountain 60, the authentication process through a password input, and if the authentication with the operating fountain 60 fails, the operation of the management server 40 is stopped.

The main functions of the management server 40 can be divided into user management, door management, log management, access status management, to limit the use of the corresponding function according to the information of the operating fountain 60, to the database 41 Read stored user information, door information, log, and information related to access status and display them on the screen, and input menus such as user addition, deletion, change, addition, deletion, change, log report output and real time access status management of users. And the log of the card reader 20 such as an access authentication log, an alarm according to an operation error of the card reader 20, a response by a command of the management server 40, and the like.

In the user registration of the access card 10, the administrator inserts the access card 10 to be used by the registered user into the dummy reader 50 connected to the management server 40 by USB and performs the user management function of the management server 40. When the user's information is input through the management server 40 stores the input user information in the database 41, and transmits and stores the user information and access authority to the access card 10 inserted in the dummy reader 50. .

The access card 10 stores the user information and the access authority inside the access card and authenticates the access using the user information and the access authority stored in the access authentication with the authentication fountain 21.

When the contact card 10 is made contact with the card reader 20 in the recognition step S10, the card reader 20 notifies that the contact card 10 is made contact with the authentication fountain 21, and the contact is made. The authentication of the card 10 is requested (S20).

When the card reader 20 recognizes the access card 10, it requests the authentication fountain 21 to start authentication, and transmits information to the authentication fountain 21 and the access card 10 without being involved in the access authentication process. Only the role of the repeater, when the card reader 20 requests the authentication start to the authentication spring 21, the current time and the ID of the card reader 20 is handed over together. The current time is used to determine whether access is permitted to the access card 10 without time permission in the authentication request step 60 during the authentication process, compared to the access allowed time stored in the authentication spring 21, and the card If the ID of the reader 20 is the same as the ID of the card reader 20 granted when the authentication fountain 21 is issued (when the basic information and the access policy are set), the access card is authenticated and received. If the ID of the card reader 20 and the ID of the card reader 20 provided to the authentication fountain 21 are not the same, the access card authentication is not performed.

If there is an authentication start request to the authentication fountain 21 by the card reader 20 in the request step (S20), the authentication fountain 21 is an access card 10 to the access card 10 through the card reader 20 Request information of (S30).

Here, the authentication fountain 21 responds to an error if the recognized card is not the access card 10, and if the error is answered, the card reader 20 ends the authentication process, and the new access card 10 is recognized. Wait for it.

When the request for the information of the access card 10 from the authentication spring 21 in the information request step (S30), the access card 10 checks the basic information to the authentication spring 21 through the card reader 20 Request (S40).

When the access card 10 receives the access card information request through the card reader 20, the access card 10 requests a basic information confirmation request to the authentication fountain 21 through the card reader 20 in response.

The basic information confirmation request includes the basic information of the access card 10 and the electronic ticket information last stored among the electronic tickets previously received from the authentication fountain 21, and the electronic ticket includes the authentication fountain to ensure the integrity of the ticket. Digital signature issued by (21) is included.

When the basic information confirmation request is made in the confirmation request step (S40), the authentication fountain 21 updates the information of the access card 10 to the access card 10 through the card reader (S50).

Here, the authentication fountain 21 receives the basic information confirmation request transmitted by the access card 10 through the card reader 20 to check the basic information and the electronic ticket information of the access card 10 of the access card 10 Check for validity

The validity check of the access card 10 is performed by checking the status code, card type, business unique number, and issuer unique number from the basic information included in the basic information confirmation request command transmitted from the access card 10.

In addition, when the access policy is set so that the authentication fountain 21 operates as an anti-passback exit, the validity of the access card 10 is additionally checked by verifying the electronic signature included in the electronic ticket, and the authentication fountain 21 is checked. If the access policy is set to operate as the anti-passback entrance, the electronic ticket received from the access card 10 is not verified.

In the case of a legitimate access card 10, the authentication fountain 21 has its basic information and a new electronic ticket (anti-passback entrance authentication fountain 21 is an additional electronic ticket for the anti-passback exit authentication fountain 21 ) Transmits the access card information update to the access card 10 through the card reader 20 including the electronic signature for deletion) and the electronic signature to ensure the integrity of the data.

When the information update of the access card 10 is made in the information update step (S50), the access card 10 requests authentication of the access card 10 to the authentication fountain 21 through the card reader 20 ( S60).

Here, the access card 10 receiving the access card information update command from the authentication fountain 21 through the card reader 20 verifies the integrity of the data by verifying the digital signature included in the access card information update command, and the authentication fountain. Check the basic information of (21) to verify the legitimacy of the authentication spring (21), and check the electronic ticket contained in the access card information update command in the case of the electronic ticket for deletion, among the electronic tickets stored in the access card (10) Delete the electronic ticket corresponding to the electronic ticket for deletion, and in the case of the additional electronic ticket, the additional electronic ticket received in the access card 10, the access card 10 is the authorization information of the access card (10) Including the transmission of the access card authentication request command to the authentication fountain (21). The access card authentication request command includes an electronic signature to ensure data integrity.

When the authentication request is made by the authentication request step (S60), the authentication fountain 21 sends an authentication log to the card reader 20 to complete the authentication (S70).

Here, the authentication fountain 21 receiving the access card authentication request command from the access card 10 through the card reader 20 verifies the integrity of the access card authentication request data by verifying the electronic signature included in the command.

The authentication fountain 21 checks the access authority of the access card 10 included in the access card authentication request command to determine whether access is allowed. The authentication fountain 21 determines that the access card is a general access card if its access ID is set in the access ID list included in the access card authentication request command, and if there is no access right.

The authentication fountain 21 determines that the access card 10 having the general access authority is set as the access card 10 capable of accessing overtime if its timeout ID is set in the timeout access ID list. Compare access time and authentication request time to determine if access is possible.

The access authentication log including the information of the access card 10, the information of the authentication spring 21, and the access permission is transmitted to the card reader 20. In order to ensure the integrity of the access authentication log, the authentication fountain 21 includes an electronic signature in the access authentication log.

The card reader 21 that receives the access authentication log determines whether the door is allowed to be included in the log, determines whether to open or close the door, and opens and closes the door through the door open / close controller 22. Then, the card reader 21 receives the received access log. The access authentication log is transmitted to the management server 40 through the repeater 30.

Although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the above-described embodiments, and the present invention is not limited to the above-described embodiments without departing from the spirit of the present invention as claimed in the claims. Various modifications can be made by those skilled in the art, and such modifications are intended to fall within the scope of the appended claims.

According to the present invention as described above, when the user having the access card 10 enters and exits the door equipped with the card reader 20 with the authentication spring 21, the access is made without intervention of the management server 40. Since only the authentication between the card 10 and the authentication spring 21 determines the access, it is possible to operate the security system stably regardless of the network failure. Even if the encryption method is used, there is no problem in the security of the system, and the access authority is stored in the access card 10 and the access policy is stored in the authentication fountain 21 so that the authentication of the access server at the door of the management server 40 through the network. There is an advantage that can apply various security policies such as time limit, anti-passback, etc. without intervention, and use the log generated during access authentication to the management server 40 through the network. It provides higher security and stability because it provides access status management, real time monitoring and report function.

Claims (2)

An access card 10 comprising a smart card and having basic information, access authority, and personal identification information of the user; An authentication fountain 21 having a general information and an access policy and a door opening / closing controller 22 are mounted, the card communicates with the management card 40 through the repeater 30 by RF communication with the access card 10 and the repeater 30. A reader 20; A repeater 30 connected to a network with the management server 40 and at least one card reader 20 connected to a network to relay communication between the management server 40 and the card reader 20, and a database 41. A management server 40 for managing a user, managing an authentication fountain 21, managing access status, and communicating with the card reader 20 through the repeater 30; An operating spring 60 having authority information for driving the management server 40 and for limiting the function of the management server 40 according to authority; Connected to the management server 40 by USB, access control system using a smart card, characterized in that consisting of a dummy reader 50, which serves as a medium for communicating with the management server 40 and the operating fountain (60). Recognizing step (S10) that the card reader 20 recognizes the access card (10); Request step (S20) that the card reader 20 requests authentication for the access card 10 to the authentication fountain (21); The authentication fountain 21 is an information request step (S30) for requesting the access card information to the access card 10 through the card reader 20; Confirmation request step (S40) that the access card 10 makes a basic information confirmation request to the authentication fountain 21 through the card reader 20; The authentication fountain is an information update step (S50) of updating the information of the access card 10 to the access card 10 through the card reader 20; Access card 10 is an authentication request step (S60) for requesting authentication of the access card to the authentication fountain 21 through the card reader 20; Authentication fountain 21 is an access control method using a smart card, characterized in that the authentication step (S70) to send an authentication log to the card reader.

Images