KR20100116994A - Entry device, entry management server and entry management system - Google Patents

Abstract

PURPOSE: An entry management device, an entry management server and an entry management system are provided to approve an entry by smart card of a user terminal. CONSTITUTION: A door lock device(30) approves an entry of a user. A smart card(20) transmits identification information to the door lock device. The smart card receives an entry and exit approval result. A user mobile terminal(10) transmits entry and exit approval result through a mobile radio communication network. An entry approval processing server(40) transmit entry result message to a mobile terminal of a group member using the entry approval result received from the user mobile terminal.

Description

ENTRY DEVICE, ENTRY MANAGEMENT SERVER AND ENTRY MANAGEMENT SYSTEM}

The present invention relates to access management, and more particularly, to a system for managing access using a mobile communication terminal.

In general, the access management system is installed at the doors of houses, officetels, and offices to control the access of outsiders, and it provides a preliminary blocking effect to outsiders and safeguards key facilities, personnel, and documents from outside intrusion or destruction. System.

Due to the recent economic recession, theft and violent crimes against apartments and luxury villas are increasing, and the demand for access control systems with improved security functions is increasing as the technique becomes violent and intelligent.

Accordingly, the existing mechanical access management system has been in the spotlight for the digital access management system which greatly improves convenience and security by incorporating various electronic technologies.

Unlike the existing access management system, the digital access management system does not have a key hole and can not be opened from the outside arbitrarily, and can be opened and closed only by entering a password or using a pre-registered key or card. It can be opened and closed by using the electronic keys of or using advanced digital functions such as voice recognition, fingerprint recognition, image recognition, iris recognition and vein recognition on the back of the hand.

However, the digital access management system can solve the problem of mechanical access management system such as copying and losing keys, which is easy to use and improves security, but it is more difficult to manufacture than the mechanical access management system, and locks or unlocks biometric information. When applied by means, there was a problem that the manufacturing cost is too high.

In addition, crimes such as assaults and kidnappings that frequently occur in recent years, such as infants, the elderly, and women, frequently occur. Accordingly, the guardian outside wants to confirm that the guardian has returned home safely. In the conventional case, the guardian could check whether the guardian arrived at home safely by contacting the guardian through a mobile terminal or a landline telephone. Therefore, if the guardian did not contact the custodian directly, it could not be confirmed that the custodian returned safely.

The present invention provides an accessor authentication apparatus, an access authentication processing server, and an access management system capable of authenticating access using a smart card of a user mobile terminal.

In addition, the present invention provides an accessor authentication apparatus, an access authentication processing server, and an access management system that can notify an access result to a group member corresponding to a mobile terminal possessed by an accessing user when accessing a door.

According to an aspect of the present invention, in the access management system for notifying the previously registered group member mobile terminal of the access information of the user who enters the place where the door lock device having no communication function is installed, the door lock for authenticating the user's entrance Device; A smart card that transmits an accessor identification information to the door lock device and receives an access authentication result in response thereto; A user mobile terminal for transmitting the access authentication result through a mobile communication network; And an access authentication processing server for transmitting an access result message generated using the access authentication result received from the user mobile terminal to the group member mobile terminal.

On the other hand, according to another aspect of the present invention, in the person authentication device for notifying the previously registered group member mobile terminal of the access information of the user entering and exiting the place where the door lock device having no communication function is installed, the accessor identification information A smart card for transmitting to the door lock device and receiving an access authentication result in response thereto; And a user mobile terminal for transmitting the access authentication result to the access authentication processing server through the mobile communication network.

Further, according to another aspect of the present invention, in the access authentication processing server for notifying the previously registered group member mobile terminal of the access information of the user entering and exiting the place where the door lock device having no communication function is installed, the accessor identification information, A transmission unit for receiving a random number value and a card authentication token generated by the random number value from the mobile terminal of the user; An authentication token processor that verifies the card authentication token using a server authentication token generated by the random number; And a message setting unit configured to generate an access result message to be transmitted to the group member mobile terminal using the verification result.

The accessor authentication apparatus, the access authentication processing server, and the access management system according to the present invention have an effect of authenticating access using a smart card of a user mobile terminal.

In addition, the accessor authentication device, access authentication processing server and access management system according to the present invention has the effect of notifying the entrance result to the group member corresponding to the user mobile terminal when the user having a user mobile terminal enters the door do.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

If a mobile terminal according to an embodiment of the present invention is a terminal capable of performing a specific application such as being able to access a smart card, the type is irrelevant, for example, PDC (Personal Digital Cellular), PCS (Personal Communication Service), Personal Handyphone System (PHS), CDMA △ 2000 (1X, 3X) phones, Wideband CDMA (WCDMA) phones, Dual Band / Dual Mode phones, Global Standard for Mobile (GSM) phones, MBS (Mobile) It may be a mobile communication terminal that may include communication functions such as a Broadband System (DMB) phone, a Digital Multimedia Broadcasting (DMB) phone, and a Smart phone.

For convenience of understanding and explanation of the present invention, the mobile terminal can be described assuming that it is a mobile communication terminal. However, it will be apparent to those skilled in the art that the mobile terminal to which the present invention is applied is not limited thereto.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, in the following description with reference to the accompanying drawings, the same or corresponding components will be given the same reference numerals and duplicate description thereof will be omitted. do.

1 is a configuration diagram schematically showing an access management system according to an embodiment of the present invention.

Referring to FIG. 1, the access management system 100 may include a user mobile terminal 10 coupled with a smart card 20, a door lock device 30, an access authentication processing server 40, and a group member mobile terminal 80. Include. The user mobile terminal 10 and the group member mobile terminal 80 may include a base station 50, a base station controller 63, a data core network 67, a mobile communication switching center 65, a message service center 70, and an internet network ( Communicate with the access authentication processing server 40 through a mobile communication network composed of (75). The user mobile terminal 10 combined with the smart card 20 is used as an accessor authentication device. Hereinafter, for convenience of description, the mobile terminal 10 and the smart card 20 will be described separately.

The user mobile terminal 10 transmits a result of the user access authentication (hereinafter referred to as an access authentication result) to the access authentication processing server 40. User access authentication is performed based on short-range wireless communication between the smart card 20 and the door lock device 30 electrically connected to the user mobile terminal 10.

The smart card 20 stores accessor identification information required for user access authentication. The person identification information is sufficient if it is a unique identifier which can identify the smart card 20 subscribed to the access management service. As the accessor identification information, for example, an identifier such as a mobile terminal unique serial number, MDN, MSISDN, IMSI or smart card unique serial number, which is pre-assigned to identify the mobile terminal or smart card, may be used. An identifier generated by the processing server 40 may be used.

The smart card 20 includes a Subscriber Identity Module (SIM), a User Identify Module (UIM), a Universal Subscriber Identity Module (USIM), and a Universal Integrated Circuit Card. : UICC). In addition, the smart card 20 has a near field communication function. The person identification information stored in the smart card 20 is transmitted to the door lock device 30 by near field communication.

When the user access authentication is normally performed, the smart card 20 receives a random number value and a card authentication token generated using the random number value from the door lock device 30. The received random number value and the card authentication token and the accessor identification information are transmitted to the access authentication processing server 40 by the user mobile terminal 10 as the access authentication result. To this end, a communication scheme such as a smart card web server (SCWS) may be used. On the other hand, the smart card 20 may further include a phone number of the group member mobile terminal to transmit the access information of the user. The telephone number of the group member mobile terminal may be transmitted to the access authentication processing server 40 together with the access authentication result.

The door lock device 30 performs user access authentication and opens a door to allow an authenticated user to enter and exit. Access authentication information for authenticating the smart card 20 is stored in the door lock device 30 in a preset step. The access authentication information includes a seed identification information and a seed for generating a card authentication token. The access authentication information is manually inputted when (1) the door lock device 30 does not include a communication function such as a mobile terminal, and (2) when there is a communication function such as a mobile terminal, the access authentication processing server 40. (3) When there is a communication port capable of data communication with a separate external device, for example, a USB terminal or a smart card connection terminal, a storage medium storing access authentication information, for example, It can be input by connecting a USB memory or USIM card to the communication port. On the other hand, (4) the access authentication processing server 40 may temporarily store the access authentication information in the smart card mounted on the mobile terminal, and may be delivered to the door lock device 30 through short-range wireless communication.

When the user mobile terminal 10 electrically coupled to the smart card 20 is located at a predetermined distance from the door lock device 30, the door lock device 30 requests and receives accessor identification information from the smart card 20. . The door lock device 30 authenticates the smart card 20 by using the received person identification information and previously stored person identification information. The door lock device 30 generates a random number value for generating a card authentication token, and generates a card authentication token using the stored seed value and the generated random number value. The authentication function for generating the card authentication token using the seed value and the random number may vary depending on the model and / or the manufacturer of the door lock device 30. The random value and the card authentication token are transmitted to the smart card 20 using near field communication.

The access authentication processing server 40 verifies the card authentication token received from the user mobile terminal 10 and transmits the user access information to the group member mobile terminal 80. The seed value required for the door lock device 30 to generate the card authentication token is generated by the access authentication processing server 40 in a preset step. When a user or a group member joins the access management service, the access authentication processing server 40 generates a seed value, and the generated seed value is stored in the door lock device 30. The accessor identification information stored in the smart card 20, the door lock device 30 and the access authentication processing server 40 should be identical. The access authentication processing server 40 allows the accessor identification information to be stored in the smart card 20 via the user mobile terminal 10. In another embodiment, accessor identification information may be manually entered into the user mobile terminal 10.

The verification of the card authentication token is performed by the server authentication token generated using the received random number value and the seed value generated in the preset step and stored in the access authentication processing server 40 and the card authentication token received from the user mobile terminal 10. By judging whether it is the same. After verification, the access authentication processing server 40 transmits user access information to the group member mobile terminal 80. The telephone number of the group member mobile terminal to which the user access information is to be transmitted is received from the user mobile terminal 10. The user access information is included in the access result message in the form of a short message or a multimedia message and transmitted. On the other hand, the phone number of the group member mobile terminal may be stored in the access authentication processing server 40.

The base station 50, the base station controller 63, the mobile communication switching center 65, the data core network 67, the message service center 70, and the internet network 75 are the access authentication processing server 40 and the user mobile terminal ( 10) is a configuration for performing data transmission and reception. Since this configuration corresponds to a known technique, detailed description thereof will be omitted.

The group member mobile terminal 80 receives and outputs user access information from the access authentication processing server 40. The group member mobile terminal 80 receives an access result message indicating that the user of the user mobile terminal 10 safely enters or leaves a place such as a home or an office from the access authentication processing server 40.

In the above-described access management system, through the preset step, the accessor identification information and the access authentication information are stored in the smart card 20 and the door lock device 30, respectively. When the preset step is normally performed, an access management step of controlling access of the user and notifying the group member mobile terminal 80 of the user access information is performed. In the access control phase, (1) normal access authentication and (2) abnormal access detection are performed at the same time. The preset step is described with reference to FIGS. 5 and 6, the authentication of normal access during the access management step is described with reference to FIGS. 7 and 8, and the detection of abnormal access is described with reference to FIGS. 9 through 11.

2 is a block diagram showing a smart card of the access management system according to an embodiment of the present invention. Referring to FIG. 2, the smart card 20 includes a mobile terminal interface 210, a card controller 220, a setting unit 230, a card storage unit 240, and a near field communication unit 250.

The mobile terminal interface 210 is electrically connected to a card interface (not shown) of the user mobile terminal 10. The mobile terminal interface 210 transmits the accessor identification information, the card authentication token, and the random number value to the user mobile terminal 10 for transmission to the access authentication processing server 40. The mobile terminal interface 210 receives the user identification information input by the user manually or received from the access authentication processing server 40 from the user mobile terminal 10.

The short range communication unit 250 transmits / receives data required for the door lock device 30 and the access management service through short range wireless communication. The short range communication unit 250 receives a card authentication token and a random number from the door lock device 30. The short range communication unit 250 transmits the person identification information to the door lock device 30. Near field communication may be, for example, RF communication. In addition, various short-range wireless communication schemes, such as infrared (IR), Bluetooth or Zigbee, may be used.

The card controller 220 controls the overall operation of the smart card 20 required to perform the access management service. When the accessor identification information of the smart card 20 is requested from the door lock device 30 located at a certain distance, the card controller 220 controls the short range communication unit 250 to transmit the accessor identification information to the door lock device 30. . In addition, the card controller 220 controls the short range communication unit 250 and the mobile terminal interface 210 to receive the random number value and the card authentication token in response and transmit the same to the user mobile terminal 10. The accessor identification information may be received from the door lock device 30, or the accessor identification information stored in the smart card 20 may be transmitted to the user mobile terminal 10.

On the other hand, the card control unit 220 may transmit time information together when transmitting the accessor identification information, the card authentication token and the random number to the access authentication processing server 40. The time information may be a time for transmitting the person identification information to the door lock device 30 or a time for transmitting the person identification information, the card authentication token, and the random number value to the access authentication processing server 40.

The setting unit 230 receives the group information from the user and matches the group information with the accessor identification information. The setting unit 230 may further match the access pattern information to the accessor identification information. The group information is a phone number of a group member mobile terminal to receive user access information, and the access pattern information is information about one or more time zones set by the user, for example, a time zone allowing access or normal / abnormal access. Time zone to do Group information and access pattern information is set and stored in the user mobile terminal 10. Specifically, the setting unit 230 provides a user interface (UI) to the display unit of the user mobile terminal 10 to receive group information and access pattern information from the user. If the setting unit 230 receives the group information and the access pattern information from the user through the input unit of the user mobile terminal 10, the setting unit 230 matches the group information and / or the access pattern information with the telephone number of the user mobile terminal 10. Set up subscriber tables. In another embodiment, group information and / or access pattern information is set and stored in the access authentication processing server 40. To this end, the access authentication processing server 40 provides a user interface for inputting group information and / or access pattern information to a mobile terminal or a wired terminal connected through the Internet. On the other hand, the group information and / or access pattern information newly registered in the mobile terminal, or if a change occurs, the mobile terminal may be implemented to transmit it to the access authentication processing server 40, of course. Herein, an example in which a user of the user mobile terminal 10 sets group information and access pattern information is described as an example, but is not limited thereto. Can be set.

Card storage unit 240, the card storage unit 240 stores the accessor identification information. In addition, the card authentication token and the random number received from the door lock device 30 can be temporarily stored. The accessor identification information may be received from the access authentication processing server 40 or manually input by the user. The card storage unit 240 stores the subscriber table set by the setting unit 230 or the subscriber table received from the access authentication processing server 40.

Figure 3 is a block diagram showing a door lock device of the access management system according to an embodiment of the present invention. Referring to FIG. 3, the door lock device 30 may include a transceiver 310, a device controller 320, an authentication processor 330, an authentication token generator 340, a device storage 350, and an input 360. Include.

The transceiver 410 receives near field communication information from the smart card 20 by performing near field communication. In addition, the transceiver 410 transmits a card authentication token and a random number to the smart card 20.

The device controller 320 controls the transceiver 410, the authentication processor 330, the authentication token generator 340, the device storage 350, and the input 360 to perform the access management service. When the user mobile terminal 10 electrically connected to the smart card 20 is connected to a certain distance, the device controller 320 requests the smart card 20 for accessor identification information.

The device controller 320 stores accessor identification information of the plurality of user mobile terminals 10 subscribed to the access management service in the device storage 350. If the authentication result provided from the authentication processor 330 succeeds in authenticating the smart card 20, the device controller 320 releases access control of the door connected to the door lock device 30. In this case, the device controller 320 may open the door of the door and release the lock of the door lock device 30.

The authentication processor 330 authenticates the smart card 20 using the accessor identification information received from the smart card 20 and the accessor identification information stored in the device storage 350 in advance. The authentication process is basically performed by determining the identity of the person identification information. In addition to determining the identity of the accessor identification information, when the user further inputs a password for opening the door, the user may further perform the same determination with the password previously stored in the door lock device 30.

The authentication token generating unit 340 generates a card authentication token using an authentication function when the authentication result of the authentication processing unit 330 is identical to both accessor identification information. The hash function may be used as the authentication function. In detail, the authentication token generator 340 generates a random number to be input to the hash function. In this case, the authentication token generator 340 may randomly generate or generate a random number using a predetermined algorithm (for example, a program). The authentication token generator 340 generates a card authentication token by inputting a seed value and a random number value received from the access authentication processing server 40 into a hash function.

The device storage unit 350 may store the accessor identification information and the seed value, which are the access authentication information, and further store the generated random number value and the card authentication token.

The input unit 360 is a means for allowing a user to input a series of numbers or letters. For example, the input unit 360 may be a numeric keypad. In the presetting step, the user may input the accessor identification information and the seed value through the input unit 360.

In addition, the door lock device 30 may further include a mobile communication unit (not shown) capable of communicating with the mobile communication network. The person identification information and the seed value can be directly received from the access authentication processing server 40 through the mobile communication unit.

In addition, the door lock device 30 may further include a communication port capable of data communication with a separate external device. The communication port may be a USB terminal or a smart card connection terminal. Access authentication information stored in the USB memory or the USIM card can be input through the communication port.

4 is a block diagram illustrating an access authentication processing server of an access management system according to an exemplary embodiment of the present invention.

Referring to FIG. 4, the access authentication processing server 40 includes a transmission unit 410, a server control unit 420, an authentication token processing unit 430, a message setting unit 440, and a server storage unit 450.

The transmitter 410 receives an access authentication result from the user mobile terminal 10 coupled with the smart card 20. In addition, the transmitter 410 may further receive a phone number of the group member mobile terminal. In the preset step, the transmitter 410 may transmit the accessor identification information to the user mobile terminal 10 and may transmit a seed value to be input to the door lock device 30. When the door lock device 30 further includes a mobile communication unit, the door lock device 30 transmits the accessor identification information and the seed value to the door lock device 30. The transmitter 410 transmits an access result message to the message service center 70.

The server controller 420 controls the overall functions of the access authentication processing server 40 to perform the access management service. In other words, the server controller 420 controls the transmission unit 410, the authentication token processing unit 340, the message setting unit 440, and the server storage unit 450 of the access authentication processing server 40.

When the user subscribes to the access management service, the server controller 420 sets accessor identification information associated with each smart card 20 to distinguish the smart card 20, and generates a seed value. The server controller 420 may randomly set or generate a seed value using a predetermined algorithm.

If the server controller 420 does not receive time information from the user mobile terminal 10, the server controller 420 may set time information using a time when the phone number and card authentication token information are received from the user mobile terminal 10. The server controller 420 generates a comparison result by comparing the message extracted from the message transmission result signal with the access result message set by the message setting unit 440.

In another embodiment, the server control unit 420 registers the group member mobile terminal included in the group information set in the subscriber table in an apparatus for managing additional service subscription information of a mobile communication subscriber, for example, a home subscriber register (HLR). do. By registering that not only the user mobile terminal but also the group member mobile terminal have subscribed to the access management service, it is possible to detect abnormal access. This will be described with reference to FIG. 9.

The authentication token processing unit 430 verifies the card authentication token using the card authentication token and the server authentication token. In detail, the authentication token processor 430 generates a server authentication token by inputting a random value received from the user mobile terminal 10 and a seed value generated in the server controller 420 into a hash function. The authentication token processing unit 430 generates a verification result by comparing the card authentication token received from the user mobile terminal 10 with the server authentication token. Here, the door lock device 30 and the access authentication processing server 40 should use the same authentication function. However, since the authentication function may vary depending on the model or manufacturer of the door lock device 30, the access authentication processing server 40 should be able to identify the authentication function used for each model or manufacturer of the door lock device 30. To this end, in the preset step, the user may input information regarding the model and / or manufacturer of the door lock device 30 to the access authentication processing server 40. The appropriate authentication function is determined based on the input information.

If the access pattern information is set, the authentication token processing unit 430 further determines whether the user's access is included in the set time zone. In another embodiment, the authentication token processing unit 430 may further determine whether the message received from the message service center 70 includes the card authentication token, and if it is not included, the verification of the card authentication token has failed. do. This will be described in detail with reference to FIG. 9.

The message setting unit 440 generates an access result message when the verification of the card authentication token succeeds. For example, the message setting unit 440 may generate an access result message including "a user of 010-****-**** has entered the home."

On the other hand, if the verification of the card authentication token is successful, but the access time is not included in the time zone set in the access pattern information, the message setting unit 440 may generate an access result message including a warning phrase. For example, the message setting unit 440 enters the home at "13:48" at "010-****-****" Please confirm. "

In addition, if verification of the card authentication token fails, a warning notification message may be generated. For example, the message setting unit 440 "Please check the access result message has been sent from 010-****-****." The alert notification message may be generated.

The message setting unit 440 sets the receiver of the access result message and the warning notification message to the group member mobile terminal 80 included in the group information of the subscriber table.

The server storage unit 450 stores the seed value and the accessor identification information set by the server control unit 420, and the subscriber table and time in which the group information and the access pattern information match the telephone number received from the user mobile terminal 10. Save the information. The server storage unit 450 may store the result phrase and warning phrase included in the access result message and the phrase to be included in the warning notification message.

5 is a flowchart illustrating a preset step of the access control step according to an embodiment of the present invention.

Referring to FIG. 5, the access authentication processing server 40 sets seed values and accessor identification information (S211). Meanwhile, the access authentication processing server 40 may determine an authentication function based on the model or manufacturer information of the door lock device 30 received.

The set seed value and accessor identification information are stored in the door lock device 30 (S213). The seed value and the accessor identification information are transmitted to the user mobile terminal 10 or the wired terminal, and may be manually input to the door lock device 30 by the user. In addition, the seed value and the person identification information may be input to the door lock device 30 by various methods.

The access authentication processing server 40 transmits the accessor identification information to the user mobile terminal 10 coupled with the smart card 20 (S215).

Group information and access pattern information are set (S217). The card control unit 220 of the smart card 20 controls the setting unit 230 to set the group information and the access pattern information upon receiving the accessor identification information. The setting unit 230 provides a user interface to the display unit of the user mobile terminal 10 to receive group information and access pattern information. When the user inputs the time zone and the telephone number of the group member mobile terminal 80, the setting unit 230 sets the time zone input by the user as access pattern information, and sets the telephone number of the group member mobile terminal 80 to the group. Set the information. The setting unit 230 generates a subscriber table by matching access pattern information and group information with accessor identification information of the user mobile terminal 10.

The group information and the access pattern information are transmitted to the access authentication processing server 40 (S219). The mobile terminal interface 210 of the smart card 20 provides group information and access pattern information to be transmitted to the access authentication processing server 40 to the user mobile terminal 10.

6 is an exemplary diagram illustrating accessor identification information, access pattern information, and group information set in a preset step according to an embodiment of the present invention.

Referring to FIG. 6, the smart card 20 receives an access time zone and a phone number of the group member mobile terminal 80 from the user, and access pattern information 153 and group information 155 to the accessor identification information 151. Match to create a subscriber table. It is assumed here that the telephone number of the user mobile terminal 10 is used as the accessor identification information. For example, the setting unit 230 of the smart card 20 electrically coupled to the user mobile terminal 10 of the accessor identification information 151 010-1234-1234 may provide the user with group information 153 and access pattern information. The interface is provided to the display unit of the user mobile terminal 10 to receive the input. When the user enters and exits between 13:00 and 14:00 through the input unit of the user mobile terminal 10 and enters between 18:00 and 19:30, the setting unit 230 uses the same to enter and exit pattern information 153. ) 13:00 ~ 14:00, 2. 18:00 ~ 19:30. Then, when the user inputs the group member mobile terminal 80 telephone number of 010-3333-4444, 010-5555-1111, 010-3010-7777 through the input unit, the setting unit 230 uses the group information ( 155) 010-3333-4444, 010-5555-1111 and 010-3010-7777 are set. The setting unit 230 is configured to access pattern information 153 1. 13:00 ~ 14:00, 2. 18:00 ~ 19:30 and group information in the accessor identification information 010-1234-1234 of the user mobile terminal 10. (155) The subscriber table 160 is generated by matching 010-3333-4444, 010-5555-1111, and 010-3010-7777.

7 is a flowchart illustrating in detail the authentication of normal access during the access management step according to an embodiment of the present invention.

Referring to FIG. 7, the smart card 20 transmits the accessor identification information to the door lock device 30 using short-range wireless communication (S311). The transmitter / receiver 310 of the door lock device 30 receives an accessor identification information request signal of the smart card 20 to request accessor identification information when the smart card 20 approaches a certain distance under the control of the device controller 320. The local area communication unit 250 transmits. The card controller 220 determines an accessor identification information request signal received through the near field communication unit 250, and transmits the accessor identification information to the transceiver 310 of the door lock device 30 through the near field communication unit 250.

The door lock device 30 authenticates the smart card 20 using the received accessor identification information and the stored accessor identification information (S313). If the device control unit 320 of the door lock device 30 does not have the same authentication result, the device control unit 320 does not allow the user to enter or exit the device (S315).

The door lock device 30 generates a card authentication token (S317). The device controller 320 of the door lock device 30 controls the authentication token generator 340 to generate a card authentication token when the received accessor identification information and the stored accessor identification information are the same. The authentication token generator 340 generates a card authentication token by inputting a random value and a seed value into the hash function.

The door lock device 30 transmits a card authentication token and a random number value to the smart card 20 (S319).

The smart card 20 transmits the accessor identification information, the card authentication token, and the random number value to the access authentication processing server 40 (S321). The mobile terminal interface 210 of the smart card 20 provides an accessor identification information, a card authentication token, and a random number to the user mobile terminal 10. The user mobile terminal 10 transmits the accessor identification information, the card authentication token, and the random number through the base station controller 63, the data core network 67, and the Internet network 75. To send).

The access authentication processing server 40 generates a server authentication token (S323). The server controller 420 of the access authentication processing server 40 controls the authentication token processing unit 340 to generate a server authentication token when receiving the card authentication token from the user mobile terminal 10. The authentication token processing unit 440 generates a server authentication token by inputting a random number value and a stored seed value received from the user mobile terminal 10 into a hash function.

The access authentication processing server 40 verifies the card authentication token using the server authentication token (S325). The authentication token processing unit 340 of the access authentication processing server 40 compares the card authentication token with the server authentication token to generate a verification result.

If verification fails because the card authentication token and the server authentication token are not the same, the access authentication processing server 40 generates a warning message and transmits it to the message service center 70 for transmission to the group member mobile terminal 80 ( S327). In this case, the message setting unit 440 may generate a warning message including the phrase "the user who does not match the authentication token has entered the home."

The access authentication processing server 40 generates an access result message using the verification result (S329). If the verification is successful because the card authentication token and the server authentication token are the same, the server controller 420 of the access authentication processing server 40 controls the message setting unit 440 to generate an access result message. The message setting unit 440 generates an access result message. Meanwhile, the message setting unit 440 may include a card authentication token in the access result message. Then, the message setting unit 440 matches the phone number of the group member mobile terminal 80 to the access result message so that the access result message can be transmitted to the group member mobile terminal 80 using the group information.

The transmitter 410 of the access authentication processing server 40 transmits the access result message to the message service center 70 in order to transmit the access result message to the group member mobile terminal 80 (S331). The message service center 70 extracts the telephone number of the group member mobile terminal 80 from the access result message and transmits the access result message to the group member mobile terminal 80. Therefore, since the group member of the group member mobile terminal 80 determines the entrance result message, it can be confirmed that the user of the user terminal 10 safely enters a place such as a home.

In another embodiment, when the group member mobile terminal 80 receives an access result message including a card authentication token, the group member mobile terminal 80 may display the access result message on the display through a separate dedicated application instead of the SMS, MMS, and LMS viewer. . Accordingly, the group member using the group member mobile terminal 80 may determine that the access result message is received from the access management system 100 including the access authentication processing server 40. If the access result message is not from the access authentication processing server 40, the group member mobile terminal 80 displays the access result message to the SMS viewer.

8 is a flowchart illustrating details of normal access authentication during the access management step according to another embodiment of the present invention. Since steps S311 through S331 shown in FIG. 8 are the same as steps S311 through S331 described with reference to FIG. 7, description thereof will be omitted. 8 illustrates an example of confirming whether the user of the group member mobile terminal 80 has received the access result message normally received from the access authentication processing server 40 from the access authentication processing server 40.

Referring to FIG. 8, the message service center 70 transmits an access result message to the group member mobile terminal 80 (S351). The message service center 70 extracts the phone number of the group member mobile terminal 80 from the access result message and transmits the access result message to the phone number of the group member mobile terminal 80.

The group member mobile terminal 80 transmits a confirmation request signal for determining whether the access result message is false to the access authentication processing server 40 (S353). When the group member mobile terminal 80 receives the access result message, the group member mobile terminal 80 displays the access result message on the display unit. At this time, the group member using the group member mobile terminal 80 checks the access result message displayed on the display unit, and requests a false determination of the access result message. The group member mobile terminal 80 generates a confirmation request signal to determine the requested input signal and to determine whether the access result message is false. The group member mobile terminal 80 transmits the generated confirmation request signal to the transmission unit 410 of the access authentication processing server 40.

The access authentication processing server 40 transmits the check result message that determines whether the access result message is false to the group member mobile terminal 80 (S355). The server controller 420 of the access authentication processing server 40 determines whether the access result message is transmitted from the transmitter 410 and generates a confirmation result. The message setting unit 440 generates a confirmation result message by using the confirmation result. For example, if the confirmation result is an access result message transmitted from the access authentication processing server 40, the message setting unit 440 may confirm the message including the phrase "This is an access result message set by the access management system." Create The transmitter 410 transmits the confirmation result message to the group member mobile terminal 80. At this time, the group member mobile terminal 80 displays the confirmation result message through the display unit. Therefore, the group member may determine whether the entrance result message is false by using the confirmation result message displayed on the display unit.

9 is a flowchart illustrating in detail the detection of abnormal access during the access management step according to another embodiment of the present invention. 9 shows a user or a third party using the user mobile terminal 10 to write a message identical to the access result message generated by the access authentication processing server 40 to the group member mobile terminal 80 through the mobile terminal. The embodiment detects that.

9, the user mobile terminal 10 transmits a message to the message service center 70 (S411). The input unit of the user mobile terminal 10 determines a signal input through a touch screen or a keypad to generate a message. The user mobile terminal 10 transmits the generated message to the message service center 70 through the base station 50 and the mobile communication switching center 65.

The message service center 70 generates a message transmission result signal (S413). The message service center 70 extracts sender and / or receiver identification information (eg, a phone number) of the message and checks whether the user subscribes to the access control service using the extracted phone number. When the caller or the called party subscribes to the access management service, the message service center 70 generates a message transmission result signal including the transmitted message. The message transmission result signal may further include a telephone number of the receiver mobile terminal.

The access authentication processing server 40 compares the transmitted message with the access result message (S415). The server controller 420 of the access authentication processing server 40 determines whether the telephone number of the receiver mobile terminal is included in the group information of the user mobile terminal 10. When the group information includes the phone number of the receiver mobile terminal, the server controller 420 compares whether the message extracted from the message transmission result signal and the access result message generated by the message setting unit 440 are the same.

If the comparison result is not the same, since the general message is transmitted, the access authentication processing server 40 does not perform additional work (S417).

If the comparison result is the same, the access authentication processing server 40 may additionally determine whether the card authentication token is included in the transmitted message (S419). The server controller 420 of the access authentication processing server 40 controls the authentication token processing unit 340 to determine whether the card authentication token is included. The authentication token processing unit 340 determines whether the card authentication token is included in the transmitted message and generates an analysis result.

The access authentication processing server 40 generates a warning notification message (S421). The server controller 420 of the access authentication processing server 40 controls the message setting unit 440 to generate a warning notification message if the analysis result is the same. The message setting unit 440 generates a warning notification message including a phrase that a false message about an entry result has been transmitted. The message setting unit 440 matches the telephone number of the group member mobile terminal 80 to the warning notification message using the group information.

The access authentication processing server 40 transmits a warning notification message to the message service center 70 (S423).

10 is a flowchart showing in detail the detection of abnormal access during the access management step according to another embodiment of the present invention. FIG. 10 shows a user or a third party using the user mobile terminal 10 to write a message identical to the access result message generated by the access authentication processing server 40 to the group member mobile terminal 80 through the mobile terminal. The embodiment detects that.

Referring to FIG. 10, the user mobile terminal 10 transmits a message to the message service center 70 (S451). At this time, it will be described on the assumption that the message is the same as the phrase contained in the access result message.

The message service center 70 transmits the message to the group member mobile terminal 80 (S453).

The group member mobile terminal 80 transmits a confirmation request signal to the access authentication processing server 40 (S455). The confirmation request signal is transmitted by the preset policy. The group member mobile terminal 80 may (1) request confirmation of all access result messages or (2) request confirmation only when the sender of the access result message is not an access authentication processing server. In addition, the confirmation request signal may be automatically transmitted by the group member mobile terminal 80. That is, when the access result message is received, in the case of (1), after receiving the confirmation result message, the access result message (receives the normal access result message) or the confirmation result message (receives the false access result message) on the display unit. Output In the case of (2), if the sender is an access authentication processing server, the access result message is immediately output to the display unit. If the caller is not an access authentication processing server, the caller outputs the confirmation result message after receiving the confirmation result message.

The access authentication processing server 40 generates a confirmation result message and transmits it to the group member mobile terminal 80 through the message service center 70 (S457 and S459). Upon receiving the confirmation request signal, the server controller 420 of the access authentication processing server 40 determines whether the message requested for confirmation is transmitted from the transmission unit of the access authentication processing server. The message setting unit 440 generates a confirmation result message using the determination result and transmits the message to the group member mobile terminal 80. For example, the message setting unit 440 may generate a confirmation result message including "the message is not transmitted by the access control system" because the determination result was not transmitted from the access authentication processing server 40.

11 is a flowchart illustrating in detail the detection of abnormal access during the access management step according to another embodiment of the present invention. Since step S311 to step S319 shown in FIG. 11 are the same as step S311 to step S319 described with reference to FIG. 7, description thereof will be omitted. FIG. 11 illustrates an example of creating a message using a time when a user of the user mobile terminal 10 enters and transmits the message to the group member mobile terminal 80.

Referring to FIG. 11, the user mobile terminal 10 electrically coupled to the smart card 20 transmits accessor identification information, card authentication token, random number value, and time information to the access authentication processing server 40 (S521). . The time information is either one of the time of transmitting the person identification information to the door lock device 30 or the time of transmitting the entrance authentication result to the entrance authentication processing server 40.

The access authentication processing server 40 generates a server authentication token (S523). The authentication token processing unit 340 of the access authentication processing server 40 generates a server authentication token by inputting a random value and a seed value into the hash function.

The access authentication processing server 40 compares whether the card authentication token and the server authentication token are the same (S525). The authentication token processing unit 430 of the access authentication processing server 40 compares the card authentication token received from the user mobile terminal 10 with the server authentication token to generate a verification result.

If the verification result is not the same, the server controller 420 of the access authentication processing server 40 ends the access management service (S527).

The access authentication processing server 40 analyzes whether time information is included in the time zone set by the access pattern information (S529). The authentication token processing unit 340 of the access authentication processing server 40 determines whether time information is included in the access pattern information and generates a determination result. For example, the authentication token processing unit 430 may determine whether time information 13:48 is included in the access pattern information 13:00 to 14:00.

The access authentication processing server 40 generates an access result message (S531). As a result of the determination, when time information is included in the access pattern information, the access authentication processing server 40 controls the message setting unit 440 to generate an access result message. For example, the message setting unit 440, "The user of 010-****-**** has entered the home at 13:48." An access result message including a may be generated.

The access authentication processing server 40 generates an access result message including a warning phrase (S533). As a result of the determination, if time information is not included in the access pattern information, the access authentication processing server 40 controls the message setting unit 440 to generate an access result message. The message setting unit 440 generates an access result message including a warning phrase.

The access authentication processing server 40 transmits the access result message generated in step S531 or step S533 to the message service center 70 (S535).

The access management method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like.

The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic media such as floppy disks. Included are hardware devices specifically configured to store and execute optical-optical media and program instructions such as ROM, RAM, flash memory, and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions may include high-level language code that can be executed by a computer using an interpreter as well as machine code such as produced by a compiler.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

1 is a configuration diagram schematically showing an access management system according to an embodiment of the present invention.

2 is a block diagram showing a smart card of the access management system according to an embodiment of the present invention.

Figure 3 is a block diagram showing a door lock device of the access management system according to an embodiment of the present invention.

4 is a block diagram illustrating an access authentication processing server of an access management system according to an exemplary embodiment of the present invention.

5 is a flowchart illustrating a preset step of the access control step according to an embodiment of the present invention.

6 is an exemplary diagram illustrating accessor identification information, access pattern information, and group information set in a preset step according to an embodiment of the present invention.

7 is a flowchart illustrating in detail the authentication of normal access during the access management step according to an embodiment of the present invention.

8 is a flowchart illustrating details of normal access authentication during the access management step according to another embodiment of the present invention.

9 is a flowchart showing in detail the detection of abnormal entry and exit of the access management step according to another embodiment of the present invention.

10 is a flowchart showing in detail the detection of abnormal entry and exit during the access management step according to another embodiment of the present invention.

11 is a flowchart illustrating in detail the detection of abnormal entry and exit during the access management step according to another embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

10: user mobile terminal

20: smart card

30: door lock device

40: access authentication processing server

70: Message Service Center

80: group member mobile terminal

100: access control system

230: setting unit

330: authentication processing unit

340: authentication token generation unit

430: authentication token processing unit

440: message setting unit

Claims (12)

In the access control system for notifying the previously registered group member mobile terminal of the access information of the user who enters and exits the place where the door lock device having no communication function is installed, A door lock device for authenticating access of a user; A smart card that transmits an accessor identification information to the door lock device and receives an access authentication result in response thereto; A user mobile terminal for transmitting the access authentication result through a mobile communication network; And And an access authentication processing server for transmitting an access result message generated using the access authentication result received from the user mobile terminal to the group member mobile terminal. The method of claim 1, And the access authentication result comprises a random number value and a card authentication token generated using the random number value. The method according to claim 1 or 2, The smart card is an access management system for transmitting and receiving the person identification information and the access authentication result by short-range wireless communication. The method according to claim 1 or 2, And a message processing server for transmitting the message transmitted to the group member mobile terminal to the access authentication processing server. The method of claim 4, wherein And the access authentication processing server further determines whether the card authentication token is included in the message. The method according to claim 1 or 2, And the access authentication processing server further determines whether or not the time at which the user's access has occurred is included in a time zone during which the access is possible. In the person authentication device for notifying the previously registered group member mobile terminal of the access information of the user who enters and exits the place where the door lock device without a communication function is installed, A smart card that transmits an accessor identification information to the door lock device and receives an access authentication result in response thereto; And And a user mobile terminal for transmitting the access authentication result to an access authentication processing server through a mobile communication network. The method of claim 7, wherein And the access authentication result includes a card authentication token generated using a random number and the random number. 9. The method according to claim 7 or 8, And the smart card further includes access pattern information in which time zones are accessible. 9. The method according to claim 7 or 8, And the smart card further stores a phone number of the group member mobile terminal. An access authentication processing server for notifying a previously registered group member mobile terminal of access information of a user entering and leaving a place where a door lock device having no communication function is installed, A transmission unit which receives accessor identification information, a random number value, and a card authentication token generated by the random number value from the mobile terminal of the user; An authentication token processor that verifies the card authentication token using a server authentication token generated by the random number; And And a message setting unit configured to generate an access result message to be transmitted to the group member mobile terminal using the verification result. The method of claim 11, And the authentication token processing unit further determines whether or not the time at which the user's access has occurred is included in a time zone where the access is possible.

Images