KR20110094928A - Unified security management system - Google Patents

Abstract

PURPOSE: A system for enterprise security management is provided to reduces costs for constructing the integrated security of an enterprise by simultaneously supporting not only a physical security mainly with an access control but also a logical security environment to protect information based on IT(Information Technology) system. CONSTITUTION: A main device stores access management information by controlling access. The main device transmits a warning and a clearing signal to a control center. The main device gives authentication and access privilege for request which authenticates a login from a client PC(Personal Computer). Database is connected to the main device to store the access management information. A fingerprint and RF(Radio Frequency) card authentication part is connected to the main device. The client PC is connected to the main device. The integrated security program requesting the login authentication in the main device is installed in the client PC.

Description

Unified Security Management System {UNIFIED SECURITY MANAGEMENT SYSTEM}

The present invention relates to an integrated security management system, and more specifically, by simultaneously supporting a logical security environment that protects information based on access control-oriented physical security and IT systems, reducing the enterprise's integrated security construction cost and efficiency of operation. An integrated security management system capable of realizing

 In general, a security system is divided into a physical security system and a logical security system. Here, physical security refers to physical protection of information, people, and facilities, and security of all physical threats such as access control of authorized or unauthorized persons, protection of facilities from natural disasters, and security management. On the other hand, logical security refers to security that logically protects and controls software information related to files and databases, application servers, networks, etc., which are processed by computers and managed as useful results.

Most companies now build and operate independent systems to achieve physical and logical security.

As shown in FIG. 1, the security management system for physical security of a company currently manages the access of a person who passes through a security gate installed at the entrance of a building separately from the access control department, and the building through CCTV Internal and external security monitoring is managed by a separate department.

 In addition, the security management system for the logical security of the enterprise is managed in the same manner as the physical security management system. That is, security management related to personal computer (PC) is managed by personal computer (PC) security department, system security management such as work system is managed by system security department, and network security management is independent from network department It is managed separately.

In particular, when the locations of the workplaces are physically in the same location, the departments or people who manage the physical and logical security are managed differently, and thus structural problems cannot be promptly taken and responded to in the event of corporate security threats and breaches. Have

In addition, in the case of a company operating a number of branch offices or dealerships with different physical locations, the problem of having to match the logical security system of each branch office or dealership with each other when managing the security management from the head office to the Internet network is different from the physical system and the logical system. Various problems may occur, such as differences in protocols and lack of system interface compatibility.

Therefore, the present invention is equipped to solve the above problems, for example, by simultaneously supporting a logical security environment that protects information based on access control-oriented physical security and IT systems, to establish a corporate integrated security The purpose is to provide an integrated security management system that can realize cost reduction and efficient operation.

Another object of the present invention is to provide an integrated security management system for providing an unmanned crime prevention stand-alone service in a single workplace.

Another object of the present invention is to apply to a wide-area business site having a corporate headquarters and branch office structure, to provide an integrated security management system for providing unmanned security independent service in the workplace connected to the VPN network.

Another object of the present invention is to apply to a wide-area business site having a headquarters and branch office structure, to provide an integrated security management system for providing unmanned security independent service in the workplace where the head office and the branch is connected to the public network.

In the integrated security management system according to the present invention for achieving the above object, in the integrated security management system consisting of a control center connected to the workplace alone system and the Internet, the workplace alone system, access control by access control A main device storing management information, transmitting a light / release signal to the control center, granting authentication and access rights for a login authentication request from a client PC, a database connected with the main device to store access management information, and Fingerprint and RF card authentication unit connected to the main device, and the client PC is installed with an integrated security program connected to the main device requesting login authentication to the main device.

The present invention provides an integrated security management system in which a corporate headquarters system, a branch office system, and a control center are connected through a VPN network, wherein the branch office system controls access and stores access management information, and signals a control signal to the control center. A main device for transmitting the authentication result to the head office system, a database for storing access management information connected to the main device, and storing the access management information from the client PC; A fingerprint PC and an RF card authentication unit connected to the main unit, and a client PC installed with an integrated security program connected to the main unit to request login authentication to the main unit, wherein the main office system includes an integrated database of authentication results transmitted from the branch system; Store and manage, and remotely change the setting information of the main device. It includes an integrated secure server.

The present invention provides an integrated security management system in which a corporate headquarters system, a branch office system, and a control center are connected through a public network. The branch office system controls access and stores access management information, and signals a control signal to the control center. A main device for transmitting the authentication result to the head office system, a database for storing access management information connected to the main device, and storing the access management information from the client PC; A fingerprint PC and an RF card authentication unit connected to the main unit, and a client PC installed with an integrated security program connected to the main unit to request login authentication to the main unit, wherein the main office system includes an integrated database of authentication results transmitted from the branch system; Store and manage the configuration information of the main unit remotely. Integrated security server involves.

The control center of the present invention is characterized by operating a DDNS server for IP management, and setting port forwarding to a router or a switch of the branch office system.

Access management information stored in the database of the present invention is characterized in that the next day is deleted or updated.

The integrated security management system according to the present invention configured as described above, for example, by simultaneously supporting a logical security environment that protects information based on access control-oriented physical security and IT system, reducing the cost and operation of the enterprise integrated security construction cost There is an effect that can realize the efficiency of.

The present invention is not operated by a simple access authorization method, but is designed as a user-based access control method, which enables flexible system setting and modification according to a company's work environment, organization change, and personnel movement, and conforms to the international standard ISO 14443 standard. Developed and customized for safety, it has an embedded Linux operating system, making it easy to apply a variety of new applications suitable for the user's environment and requirements, and integratedly managed by the central management system. PC usage history can be monitored in real time.

The present invention can be quickly upgraded or maintained by remote terminal control from a central location without additional specialist personnel, and has an integrated type that does not require a separate controller device, and saves about 15% of the cost of existing equipment. Businesses that use groupware have the advantage of adding access history management services or adding various new services such as book loans and payments to XID cards.

1 is a block diagram showing a conventional security management system.
Figure 2 is a block diagram showing the concept of an integrated security management system according to the present invention.
Figure 3 is a block diagram showing an integrated security management system for providing unmanned security independent service in a single workplace according to the present invention.
Figure 4 is a block diagram showing an integrated security management system for providing unmanned security independent service in the workplace connected to the VPN and the head office according to the present invention.
Figure 5 is a block diagram showing an integrated security management system for providing unmanned security stand-alone services in the workplace where the head office and branch offices connected to the public network in accordance with the present invention.

Hereinafter, preferred embodiments of the integrated security management system according to the present invention will be described in detail with reference to the accompanying drawings.

First, in the integrated security management system of the present invention, as shown in Figures 2 and 3, the control center 200 is connected to the workplace alone system 100 and the Internet is configured to be connected to the Internet.

The workplace alone system 100 includes a main unit 112, a fingerprint and RF card authentication unit 113, a database 114, and a client PC 116. The control center 200 includes a control server ( 220, the control center integrated database 240, and the control client PC (260).

The main device 112 controls access and stores access management information in the database 114 and transmits a light / release signal to the control center 200. Here, the database 114 is, for example, a flash memory, and stores the access management information output from the main device 112 in a structured query language (SQL) light, and deletes or updates the following day. (Over Write) Process.

The fingerprint and RF card authentication unit 113 is connected to the main device 112 to authenticate the personal information by recognizing the fingerprint of the person, for example by applying a temperature sensing method and a scan capture method for low power driving together It authenticates personal information, applies a Minutiae-based algorithm that can guarantee performance even in a small MCU, and shares fingerprint information in association with the main device 112.

In addition, the fingerprint and RF card authentication unit 113 recognizes an RF card to authenticate personal information, supports a contactless RF card / smart card, and supports the main device 112. Share card information by linking.

The client PC 116 is connected to the main unit 112 and a local area network (LAN), and an integrated security program is installed to request a login authentication request to the main unit 116.

The workplace alone system 100 is suitable when there is no local system related to entry and exit.

The control server 220 receives and analyzes the light / release signal transmitted from the main device 112 and the image information photographed by a surveillance camera (not shown) through the Internet, and analyzes the received information on the control center integrated database 240. In addition to the storage, the monitoring is continuously made through the control client PC (260).

The workplace alone system 100 is to provide an unmanned crime prevention independent service (Local) in a single workplace, the main device 112 is linked to the fingerprint and RF card authentication unit 113, for example all access management information In addition, the access log, the holiday access log, a specific holiday access log and the like stored in the database 114, and if the unauthorized access occurs, the control center 200 transmits the light / release signal.

The client PC 116 stores an integrated ID (SSO: Single Sing On) assigned to users entering and exiting the workplace, and requests a login authentication request from the main device 112, and the main device 112 requests the client PC. User authentication for the login signal requested from 116 is performed, and access rights of other systems that manage access to the authenticated user client PC 116 are set and managed.

4 is a block diagram illustrating an integrated security management system for providing an unmanned security independent service in a workplace where a head office and a branch office are connected to a VPN network according to the present invention, as shown in FIG. The head office system 140 and the control center 200 are connected through a VPN network.

The branch office system 130 includes a main unit 132, a fingerprint and RF card authentication unit 133, a database 134, and a client PC 136. The head office system 140 includes an integrated security server ( 142, an integrated security database 144, and an integrated security operating PC 146. The control center 200 includes a control server 220, a control center integrated database 240, and a control client PC 260. It consists of

The main device 132 controls access, stores access management information in the database 134, grants authentication and access authority, and transmits a light / release signal to the control center 200. . Here, the database 134 is, for example, a flash memory, and stores the access management information output from the main device 132 in a structured query language (SQL) light, and deletes or updates the following day. (Over Write) Process.

The fingerprint and the RF card authentication unit 133 connected to the main device 132 authenticates the user's fingerprint by recognizing the fingerprint of the accessor, for example, by applying a temperature sensing method and a scan capture method for low power driving together. It authenticates personal information, applies a Minutiae-based algorithm that can guarantee performance even in a small MCU, and shares fingerprint information in conjunction with the main device 132.

In addition, the fingerprint and RF card authentication unit 133 recognizes an RF card to authenticate personal information, supports a contactless RF card / smart card, and supports the main device 132. Share card information by linking.

The client PC 136 is connected to the host device 132 through a local area network (LAN), and an integrated security program is installed to request a login authentication request to the host device 132. At this time, the main device 132 authenticates and authorizes according to the login authentication request of the client PC 136, and transmits the authentication result to the head office system 140.

The integrated security server 142 of the head office system 140 stores and manages the authentication result transmitted from the branch system 130 in the integrated security database 144 and manages the main device 132 of the branch system 130. Change the configuration information of) remotely.

The control server 220 receives and analyzes the light / release signal transmitted from the main device 132 and the image information photographed by a surveillance camera (not shown) through the Internet, and analyzes the control center integrated database 224. In addition to the storage, the monitoring client PC 226 to be continuously monitored.

The branch system 130 is to provide an unmanned crime-free independent service (Local) at the workplace where the head office and the branch office is connected to the VPN network, the main device 132 is linked with the fingerprint and RF card authentication unit 133 For example, all access management information, such as access log, holiday access log, specific holiday access log, etc., is stored in the database 134, through which authentication and access authority are granted, and the control center 200 Send / release signal.

When the main device 132 receives a login authentication request from the client PC 136, the main device 132 stores and manages an integrated ID (SSO: Single Sing On) assigned to users entering and exiting the workplace in the database 134. Authorization and access authority for the authentication request of the client PC 136, and transmits the authentication result to the integrated security server 142 of the head office system 140 through the VPN network.

The integrated security server 142 of the head office system 140 stores and manages the authentication result transmitted from the branch system 130 in the integrated security database 144, and the main device 132 of the branch system 130. You can change the configuration information of the remote.

In addition, in the VPN network, since it is set as a private IP between the head office system 140 and the branch office system 130, there is no need to manage the IP, but the control server 220 of the control center 200 manages the IP. To operate a DDNS (Dynamic Domain Name Service), and set the photo forwarding to the router or switch of the branch office system 130.

FIG. 5 is a block diagram illustrating an integrated security management system for providing unmanned security-independent service in a workplace in which a head office and a branch office are connected to a public network according to the present invention. As shown in FIG. The head office system 160 and the control center 200 are connected through a public network.

The branch office system 150 includes a main device 152, a fingerprint and RF card authentication unit 153, a database 154, and a client PC 156. The head office system 160 includes an integrated security server ( 162, an integrated security database 164, a DDNS server 165, and an integrated security operating PC 166. The control center 200 includes a control server 220 and a control center integrated database 240. And control client PC 260.

The main device 152 controls access, stores access management information in the database 154, grants authentication and access authority, and transmits a light / release signal to the control center 200. . Here, the database 154 is, for example, a flash memory, and stores the access management information output from the main device 152 in a structured query language (SQL) light, and deletes or updates the following day. (Over Write) Process.

The fingerprint and RF card authentication unit 153 connected to the main device 152 authenticates the user's fingerprint to authenticate personal information, for example, by applying a temperature sensing method and a scan capture method for low power driving together. It authenticates personal information, applies a Minutiae-based algorithm that can guarantee performance even in a small MCU, and shares fingerprint information in association with the main device 152.

In addition, the fingerprint and RF card authentication unit 153 recognizes an RF card to authenticate personal information, supports a contactless RF card / smart card, and supports the main device 152. Share card information by linking.

The client PC 156 is connected to the host device 152 through a local area network (LAN), and when an integrated security program is installed to request a login authentication request to the host device 152, the host device 152 is connected to the client PC. Authorization and access authority for the login authentication request of (156), and transmits the authentication result to the head office system (160).

The integrated security server 162 of the head office system 160 stores and manages the authentication result transmitted from the branch system 150 in the integrated security database 164, and the main device 152 of the branch system 150. Change configuration information remotely.

The control server 220 receives and analyzes the light / release signal transmitted from the main device 152 and image information photographed by a surveillance camera (not shown) through the Internet, and analyzes the control center integrated database 224. In addition to the storage, the monitoring client PC 226 to be continuously monitored.

The branch system 150 is to provide an unmanned security independent service (Local) at a business site where the head office and the branch office is connected to the public network, the main device 152 is linked with the fingerprint and RF card authentication unit 153 All access management information, for example, an access log, a holiday access log, a specific holiday access log, etc. are stored in the database 154, through which authentication and access authority are granted, and the control center 200 is alerted. Send / release signal.

When the main device 152 receives a login authentication request from the client PC 156, the main device 152 stores and manages an integrated ID (SSO: Single Sing On) assigned to users entering and exiting the workplace in the database 154. Authorization and access authority for the authentication request of the client PC 156, and transmits the authentication result to the integrated security server 162 of the head office system 160 through the public network.

The integrated security server 162 of the head office system 160 stores and manages the authentication result transmitted from the branch system 150 in the integrated security database 164, and the main device 152 of the branch system 150. You can change the configuration information of the remote.

Here, the configuration information may include, for example, device network configuration information such as IP, port, connection method, DynaHost Configuration Protocol (DHCP), and network address translation (NAT), IO configuration information (Serial communication, etc.), user information, User authority information.

Since the head office system 160 is connected to the branch system 150 through the public network, the head office system 160 operates the DDNS server 165 for IP management, and updates the IP of the main apparatus 152.

The control server 220 of the control center 200 operates a DDNS (Dynamic Domain Name Service) for IP management, and sets port forwarding to a router or a switch of the branch office system 150.

As mentioned above, preferred embodiments of the present invention described above are disclosed for the purpose of illustration, and those skilled in the art can improve other various embodiments within the spirit and technical scope of the present invention disclosed in the appended claims below. Changes, substitutions or additions will be possible.

100: sole workplace 200: control center
130, 150 branch office system 140, 160 head office system
112, 132, 152: main device 113, 133, 153: fingerprint and RF card authentication
116, 136, 156: client PC 117, 137, 157: local control PC
220: control server 240: control center integrated database
260: control client PC 142, 162: integrated security server
144, 164: Integrated security database 146, 166: Integrated security operating PC
165: DDSN Server

Claims (5)

In the integrated security management system consisting of a control system connected to the workplace alone and the Internet,
The workplace alone system, the main device for controlling the entrance to store the access management information, transmit the light / release signal to the control center, and grant the authentication and access authority for the login authentication request from the client PC,
A database connected with the main device to store access management information;
A fingerprint and RF card authentication unit connected to the main device, and
And a client PC connected to the main device and having an integrated security program installed to request login authentication to the main device.
In the integrated security management system in which the head office system, the branch office system, and the control center of the workplace are connected through a VPN network,
The branch office system controls access and stores access management information, transmits a light / release signal to the control center, grants authentication and access authority for a login authentication request from a client PC, and provides the head office system to the head office system. A main device for transmitting authentication results,
A database connected with the main device to store access management information;
A fingerprint and RF card authentication unit connected to the main device, and
A client PC connected to the main device and having an integrated security program installed to request login authentication to the main device;
The head office system, the integrated security management system including an integrated security server for storing and managing the authentication results transmitted from the branch system in an integrated database, and remotely changing the setting information of the main device.
In the integrated security management system in which the head office system of the workplace, the branch office system and the control center are connected through the public network,
The branch office system controls access and stores access management information, transmits a light / release signal to the control center, grants authentication and access authority for a login authentication request from a client PC, and provides the head office system to the head office system. A main device for transmitting authentication results,
A database connected with the main device to store access management information;
Fingerprint and RF card authentication unit connected to the main device,
A client PC connected to the main device and having an integrated security program installed to request login authentication to the main device;
The head office system, the integrated security management system including an integrated security server for storing and managing the authentication results transmitted from the branch system in an integrated database, and remotely changing the setting information of the main device.
The method according to claim 2 or 3,
The control center, the DDNS server for IP management, integrated security management system, characterized in that for setting the port forwarding to the router or switch of the branch office system.
The method according to any one of claims 1 to 3,
Access management information stored in the database is integrated security management system, characterized in that deleted or updated the next day.

Images