KR20170078316A - Security management system using user mobile terminal and method thereof - Google Patents

Abstract

The present invention relates to a security management system using a user mobile terminal and a method thereof, in which user authentication information and a security policy request message for accessing a preset security area are transmitted, and a user security policy transmitted from a security management server A user mobile terminal for generating a user specific authentication data signal for accessing the secure area according to the security level of the mobile terminal; and a user terminal for receiving the user authentication information and the security policy request message transmitted from the user mobile terminal, A security management server for generating a user security policy for accessing a user area or a user security policy for accessing the user area or transmitting a user security policy to the user mobile terminal; Signal, A security zone monitoring apparatus for performing a user authentication procedure for entering the security zone by transmitting the user authentication data signal to an authentication server to be described later and a security zone monitoring unit for receiving a user specific authentication data signal transmitted from the security zone monitoring apparatus, And an authentication server that determines whether or not the user can access the security area by interlocking with the security zone and transmits the result to the security zone monitoring device. Thus, the user can easily access the security zone with the user mobile device to which the security policy is applied have.

Description

TECHNICAL FIELD [0001] The present invention relates to a security management system using a user mobile terminal and a security management system using the same,

The present invention relates to a security management system and method for easily accessing a specified place or security area using a user mobile terminal.

In general, a security control system is installed in a specific area or place such as a corporate research institute to monitor or control the movement of a visitor who installs a video camera device or an electronic switching device at a door to enter and exit the area.

An example of such a security control system is an access control system. The access control system is installed at a door of a house, an office building, an office, etc. to control the access of outsiders, It is used to safeguard personnel and documents from external intrusion or destruction.

In recent years, a digital access management system, which improves convenience and security by combining various electronic technologies with the existing mechanical access control system, has been developed and used.

Unlike the existing access management system, the conventional digital access management system does not have a keyhole and can not be opened from the outside. It can not be opened only by inputting a password or using a pre-registered key or a card It can be opened and closed by using various kinds of electronic keys instead of a general mechanical key or by using a biometric method such as voice recognition, fingerprint recognition, image recognition, retina recognition, iris recognition, face recognition and blood vessel recognition Excellent security and convenience.

A brief description of each of the biometric methods as described above and its problems will be described as follows.

The first is a technique for detecting fingerprints of a person using the fingerprint recognition method, which is the first developed method. This fingerprint recognition method is evaluated as a future type security device because it is excellent in safety and convenience in comparing the fingerprint of the user with the previously input data and discriminating whether or not the user is the fingerprint. The fingerprint is the simplest But it is also cheaper. The fingerprint recognition method is divided into an optical method and a semiconductor method. The optical method is bulky, and the semiconductor method has a disadvantage in that external shock, for example, static electricity is weak.

Second, the retina recognition technology utilizes the fact that the configuration of the capillary vessels located on the back of the user's eyeball has characteristics of prolonged invariance like human fingerprints. To read the pattern of the retina, a pencil-like red light with a weak intensity penetrates the eyeball and measures the backlight reflected on the capillaries in the retina. However, there is a problem in that it is inconvenient for the general public to use it because of causing inconvenience and fear to take off the glasses and get on the search machine.

Third, since the image obtained in a natural state is used as the iris recognition method, there is no inconvenience and fear as in retinal recognition, and it is expected to be applied to many fields. However, There is a discomfort and a denial reaction to open and close the eyes for about 5 seconds, which is expensive.

Fourth, the face area extraction is one of the most important and difficult problems in the field of face recognition. Although efforts are being made to extract using various techniques, there are many things to be improved such as considering the characteristic that the expression changes according to the user's mood and situation, and being affected by the ambient lighting.

Fifth, a method of recognizing the shape of the blood vessel of the back of the hand or the wrist by the above-mentioned blood vessel recognition method. Such a blood vessel recognition method is a method of confirming the identity of the blood vessel by using the infrared rays after the blood vessel is viewed, and it has a problem that the hardware configuration is complicated, the capacity is large, and the overall system cost is very high Have.

Finally, the speech recognition method has the merit that the identification can be performed by using a telephone even in a remote place, the education is not necessary, and the system price is low. However, such a voice recognition method may cause errors when the voice of the user is relaxed, or when the voice is imitated by intentionally recording or intentionally, and a strong noise problem in the use environment is a great weakness.

Accordingly, it is necessary to provide a method for supplementing existing problems by using a mobile terminal (for example, a smart phone) which is recognized as a necessity in society at present.

Korean Patent Registration No. 10-1466624

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problems, and it is an object of the present invention to apply a security policy to a user mobile terminal device accessing a specified specific place or a security area, The present invention provides a security management system and a method thereof using a user mobile terminal that can easily access a security area to a user mobile device to which a security policy is applied.

In order to achieve the above object, a first aspect of the present invention is a security management method for a security management system, comprising: transmitting user authentication information and a security policy request message for accessing a predetermined security zone; At least one user mobile terminal for generating a user specific authentication data signal for area access; A user security policy for accessing the security area according to a security level of the user based on the received user authentication information and the security policy request message transmitted from the user mobile terminal, A security management server for transmitting to the terminal; A security area monitoring unit installed at a specific location of the security area and receiving a user specific authentication data signal generated from the user mobile terminal and transmitting the user specific authentication data signal to an authentication server to be described later to perform a user authentication procedure for entering the security area, Device; And receiving a user specific authentication data signal transmitted from the security zone monitoring device, determining whether to allow the user to access the security zone based on the received user specific authentication data signal, and transmitting the result to the security zone monitoring device And a security management system using a user mobile terminal including an authentication server.

Here, the user authentication information transmitted from the user mobile terminal may include unique identification information of the corresponding user or device identification information of the corresponding user mobile terminal.

Preferably, the unique identification information of the user includes at least one of a user ID / password (ID / PW), a resident number, a telephone number, biometric feature information, an OTP (One Time Password), a PKI And the like.

Preferably, the device identification information of the user mobile terminal includes at least one of a name of the device, a password of the device, a serial number of the device, a type of the device, a manufacturer of the device, a MAC address of the device, Internet Protocol) address, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key.

Preferably, the user specific authentication data signal generated from the user mobile terminal may include security unique identification information according to a user security policy transmitted from the security management server.

Preferably, the user specific authentication data signal generated from the user mobile terminal includes at least one of a bar code, a QR (Quick Response Code) code, a NFC (Near Field Communication), a Wi-Fi (Direct Fidelity) , Beacon (Beacon), and sound (Sound).

Preferably, the security management server receives the user authentication information and the security policy request message transmitted from the user mobile terminal and compares the received user authentication information and the security policy request message with predetermined user security level information to generate a user security policy corresponding to the user authentication information, And transmit the set user security policy to the user mobile terminal in real time.

Preferably, the authentication server receives a user specific authentication data signal having security unique identification information according to a user security policy transmitted from the security zone monitoring apparatus, compares the received user specific authentication data signal with information of a user security policy generated in the security management server If there is a user security policy corresponding to the security unique identification information of the user specific authentication data signal, authentication success information data allowing the user to access the security area can be transmitted to the secure area monitoring device.

The user mobile terminal may control the operation of hardware or software that transmits data to the outside in order to prevent data leakage to the outside according to a user security policy transmitted from the security management server.

Preferably, the user mobile terminal may be a mobile terminal device of at least one of a smart phone, a smart pad, and a smart note.

According to a second aspect of the present invention, there is provided a security management method for accessing a predetermined security area using at least one user mobile terminal, the security management method comprising the steps of: (a) Transmitting an information and security policy request message; (b) generating a user security policy for accessing the security zone according to a security level of the user based on the user authentication information and the security policy request message transmitted in the step (a) through the security management server, Transmitting a security policy; (c) generating a user specific authentication data signal for the secure area access according to the user security policy transmitted in the step (b) through the user mobile terminal; (d) transmitting a user specific authentication data signal generated in the step (c) through the security area monitoring device to an authentication server to perform a user authentication procedure for entering the security area; And (e) determining whether or not the security area access permission of the corresponding user is allowed in cooperation with the security management server based on the user specific authentication data signal transmitted in the step (d) through the authentication server, And transferring the security management information to the monitoring device.

Here, in the step (a), the user authentication information may include unique identification information of the corresponding user or device identification information of the corresponding user mobile terminal.

Preferably, the unique identification information of the user includes at least one of a user ID / password (ID / PW), a resident number, a telephone number, biometric feature information, an OTP (One Time Password), a PKI And the like.

Preferably, the device identification information of the user mobile terminal includes at least one of a name of the device, a password of the device, a serial number of the device, a type of the device, a manufacturer of the device, a MAC address of the device, Internet Protocol) address, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key.

Preferably, in the step (c), the user specific authentication data signal may include security unique identification information according to the user security policy transmitted in the step (b).

Preferably, in step (c), the user specific authentication data signal is a bar code, a QR (Quick Response Code) code, a NFC (Near Filed Communication), a Wi-Fi (Wireless Fidelity) ), A beacon (Beacon), and a sound (Sound).

Preferably, in the step (b), the security management server compares the received user authentication information and the security policy request message transmitted in the step (a) with predetermined user security level information, The user security policy may be generated or transmitted to the user mobile terminal in real time.

Preferably, in the step (e), the authentication server receives a user specific authentication data signal having security unique identification information according to the user security policy transmitted in the step (d) When there is a user security policy corresponding to the security unique identification information of the user specific authentication data signal as compared with the information of the user security policy, the authentication acceptance information data permitting access to the security area of the user is transmitted to the secure area monitoring device .

Preferably, in the step (c), the user mobile terminal restricts the operation of hardware or software that transmits data to the outside in order to prevent data leakage to the outside according to the user security policy transmitted in the step (b) can do.

A third aspect of the present invention provides a computer-readable recording medium on which a program capable of executing the security management method using the user mobile terminal described above is recorded.

The security management method using the user mobile terminal according to the present invention can be implemented as a computer readable code on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

For example, the computer-readable recording medium includes a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory, , And optical data storage devices.

According to the security management system and the method using the user mobile terminal of the present invention as described above, a security policy is applied to a user mobile terminal device accessing a specified specific place or a security area, And generating a user specific authentication data signal accessible to the security area, thereby making it possible to easily access the security area to the user mobile device to which the security policy is applied.

1 is a block diagram illustrating a security management system using a user mobile terminal according to an exemplary embodiment of the present invention.
FIG. 2 is a flowchart illustrating a security management method using a user mobile terminal according to an exemplary embodiment of the present invention. Referring to FIG.

The above and other objects, features, and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings, which are not intended to limit the scope of the present invention. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Terms including ordinals, such as first, second, etc., may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention.

When an element is referred to as "including" an element throughout the specification, it is to be understood that the element may include other elements, without departing from the spirit or scope of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following embodiments of the present invention may be modified into various other forms, and the scope of the present invention is not limited to the embodiments described below. The embodiments of the present invention are provided to enable those skilled in the art to more fully understand the present invention.

Each block of the accompanying block diagrams and combinations of steps of the flowcharts may be performed by computer program instructions (execution engines), which may be stored in a general-purpose computer, special purpose computer, or other processor of a programmable data processing apparatus The instructions that are executed through the processor of the computer or other programmable data processing equipment will generate means for performing the functions described in each block or flowchart of the block diagram. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of the flowchart.

Computer program instructions may also be loaded onto a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the data processing equipment are capable of providing the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or step may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical functions, and in some alternative embodiments, It should be noted that functions may occur out of order. For example, two successive blocks or steps may actually be performed substantially concurrently, and it is also possible that the blocks or steps are performed in the reverse order of the function as needed.

1 is a block diagram illustrating a security management system using a user mobile terminal according to an exemplary embodiment of the present invention.

Referring to FIG. 1, a security management system using a user mobile terminal according to an exemplary embodiment of the present invention includes at least one user mobile terminal 100-1 to 100-N, a security management server 200, A monitoring apparatus 300, an authentication server 400, and the like.

Here, each of the user mobile terminals 100-1 to 100-N is connected to the security management server 200 through the communication network 10, and the communication network 10 is a large communication network capable of providing large capacity, long- And may be a next generation wireless network including a WiFi, a WiBro, a WiMAX, etc. for providing Internet or high-speed multimedia service.

The Internet includes a plurality of services such as HTTP (Hyper Text Transfer Protocol), Telnet, File Transfer Protocol (FTP), Domain Name System (DNS), Simple Mail Transfer Protocol (SMTP) Refers to a worldwide open computer network structure providing Simple Network Management Protocol (SNMP), Network File Service (NFS), Network Information Service (NIS), and the like. Each user mobile terminal 100-1 to 100- And to be connected to the management server 200. [ Meanwhile, the Internet may be a wired or wireless Internet, or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet.

If the communication network 10 is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. As an example of the asynchronous mobile communication network, a WCDMA (Wideband Code Division Multiple Access) communication network is exemplified. In this case, although not shown in the drawing, the mobile communication network may include, for example, a radio network controller (RNC). Meanwhile, although the WCDMA network is described as an example, it may be a next generation communication network such as a 3G LTE network, a 4G network, and a 5G network, or an IP network based on other IPs. The communication network 10 transfers signals and data between the user mobile terminals 100-1 to 100-N and the security management server 200. [

Also, each of the user mobile terminals 100-1 to 100-N performs a function of transmitting user authentication information and a security policy request message for accessing a designated specific place or predetermined security area to the security management server 200 .

At this time, the user authentication information transmitted from each of the user mobile terminals 100-1 to 100-N may be, for example, unique identification information of the predetermined user and / It is preferable to include identification information.

The unique identification information of the user includes at least one of a user ID / password (ID / PW), a resident number, a telephone number, biometric feature information, an OTP (One Time Password), a PKI It is preferable to include any one of the information, but it may include unique identification information of all users who can distinguish a specific user.

At this time, the biometric characteristic information is an element for which forgery and falsification is impossible. For example, fingerprint, iris, face, blood vessel, gated statement, signature, voice, retina, palm. Only the fingerprint or iris may be registered, and if necessary, various types may be registered and utilized as biometric information.

The device identification information of each user mobile terminal 100-1 to 100-N includes, for example, the name of the device, the password of the device, the serial number of the device, the type of the device, the manufacturer of the device, Control address, a unique IP (Internet Protocol) address of the device, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key But is not limited to, all device identification information that can identify the device.

Each of the user mobile terminals 100-1 to 100-N has a function of generating a user specific authentication data signal for accessing a specific place or a predetermined security area designated according to the user security policy transmitted from the security management server 200 .

At this time, the user specific authentication data signal generated from each of the user mobile terminals 100-1 to 100-N is transmitted to the security management server 200 through security unique identification information (for example, ID, etc.).

The user specific authentication data signal generated from each of the user mobile terminals 100-1 to 100-N may be a bar code, a Quick Response Code (QR) code, a Near Filed Communication (NFC), a Wireless Fidelity (WiFi) It is preferable that the signal is in the form of at least one of direct, bluetooth, beacon and sound.

In addition, each of the user mobile terminals 100-1 to 100-N may perform an operation of hardware or software that transmits data to the outside in order to prevent data leakage to the outside according to the user security policy transmitted from the security management server 200 For example, a camera, a Wi-Fi, a Bluetooth, etc.).

Each of the user mobile terminals 100-1 to 100-N configured as described above may be a mobile terminal device of at least one of a smart phone, a smart pad, or a smart note, for example. But it is not limited to this. For example, security management such as a Palm PC, a mobile play-station, a Digital Multimedia Broadcasting (DMB) phone having a communication function, a tablet PC, an iPad, And may include all wired and wireless home appliances / communication devices having a user interface for connecting to the server 200.

In particular, when each of the user mobile terminals 100-1 to 100-N is implemented as a normal smart phone, the smart phone may have a variety of applications (application ) This phone is based on an open operating system that can be freely used and deleted by downloading the program. It can be used for all mobile phones with mobile office function as well as voice / video call, Or a communication device that does not have a voice call function but includes all Internet phones or Tablet PCs that can be connected to the Internet.

Such an open-type operating system may include, for example, Symbian of NOKIA, BlackBerry of RIMS, iPhone of Apple, Microsoft's Windows Mobile, Google's Google Android, and Samsung's ocean.

As described above, since the smartphone uses an open operating system, a user can arbitrarily install and manage various application programs, unlike a mobile phone having a closed operating system.

That is, the smartphone basically includes a control unit, a memory unit, a screen output unit, a key input unit, a sound output unit, a sound input unit, a camera unit, a wireless network communication module, a near field wireless communication module, and a battery for power supply.

The controller is a generic term for controlling the operation of the smartphone, and includes at least one processor and an execution memory, and is connected to each functional unit provided in the smart phone through a bus.

The controller controls the operation of the smartphone by loading at least one program code included in the smartphone into the execution memory through the processor and calculating the result by transferring the result to at least one functional unit through the bus .

The memory unit is a general term of a non-volatile memory included in a smart phone, and stores and maintains at least one program code executed through the control unit and at least one data set in which the program code is used. The memory unit basically stores a system program code and a system data set corresponding to an operating system of a smartphone, a communication program code and a communication data set for processing a wireless communication connection of the smartphone, at least one application program code and an application data set , And the program code and data set for implementing the present invention are also stored in the memory unit.

The screen output unit is composed of a screen output device (e.g., an LCD, an LED device) and an output module for driving the screen output device. The screen output unit is connected to the control unit through a bus, And outputs it to the device.

The key input unit is composed of a key input device having at least one key button (or a touch screen device interlocked with the screen output unit) and an input module for driving the key input unit. The control unit is connected to the control unit via a bus, Or inputs data necessary for the operation of the control unit.

The sound output unit includes a speaker for outputting a sound signal and a sound module for driving the speaker. The sound output unit is connected to the control unit through a bus, and outputs a result of operation corresponding to the sound output from the various operation results of the control unit through the speaker . The sound module decodes sound data to be output through the speaker and converts the sound data into a sound signal.

The sound input unit includes a microphone for receiving a sound signal and a sound module for driving the microphone, and transmits the sound data input through the microphone to the control unit. The sound module encodes and encodes a sound signal input through the microphone.

The camera unit includes an optical unit, a CCD (Charge Coupled Device) and a camera module for driving the CCD unit, and obtains bitmap data input to the CCD through the optical unit. The bitmap data may include both still image data and moving image data.

The wireless network communication module is a collective term for communicating wireless communication and includes at least one antenna, an RF module, a baseband module, and a signal processing module for transmitting and receiving a radio frequency signal of a specific frequency band. And transmits the calculation result corresponding to the wireless communication among the various calculation results of the control unit through the wireless communication or receives the data through the wireless communication and transmits the data to the control unit, , Communication, and handoff procedures.

Also, the wireless network communication module includes a mobile communication structure for performing at least one of connection, location registration, call processing, call connection, data communication, and handoff to a mobile communication network according to the CDMA / WCDMA standard. Meanwhile, according to the intention of those skilled in the art, the wireless network communication module may further include a portable Internet communication structure for performing at least one of connection to the portable Internet, location registration, data communication, and handoff according to the IEEE 802.16 standard, It is evident that the present invention is not limited by the wireless communication configuration provided by the communication module.

The short-range wireless communication module is composed of a short-range wireless communication module that connects a communication session using a radio frequency signal as a communication medium within a predetermined distance. Preferably, the short-range wireless communication module includes RFID communication, Bluetooth communication, Wi- And wireless communication. The short-range wireless communication module may be integrated with the wireless network communication module.

The security management server 200 is connected to each of the user mobile terminals 100-1 to 100-N and the authentication server 400 through the communication network 10 and is connected to each of the user mobile terminals 100-1 to 100- -N) and generates a user security policy for accessing a specific place or a predetermined security area designated according to the security level of the predetermined user based on the user authentication information and the security policy request message transmitted from the user And transmits the security policy to the corresponding user mobile terminals 100-1 to 100-N.

That is, the security management server 200 receives the user authentication information and the security policy request message transmitted from each of the user mobile terminals 100-1 to 100-N, compares the user authentication information and the security policy request message with predetermined user security level information, The corresponding user security policy can be generated or the preset user security policy can be transmitted to the corresponding user mobile terminals 100-1 to 100-N in real time.

The security area monitoring device 300 is installed at a specified location or at a specific location of a predetermined security area and is connected to the authentication server 400 through the communication network 10 and is connected to each of the user mobile terminals 100-1 to 100- -N), and transmits the user specific authentication data signal to the authentication server 400 to perform a user authentication procedure for entering a specified specific place or a predetermined security area.

The security zone monitoring apparatus 300 may include a video camera device or an electronic switching device (not shown) installed in a door.

The authentication server 400 is connected to the security management server 200 and the security zone monitoring device 300 through the communication network 10 and receives the user's own authentication data signal transmitted from the security zone monitoring device 300 Determines whether or not the user is allowed to access the security area by interlocking with the security management server 200, and transmits the result to the security area monitoring device 300.

That is, the authentication server 400 receives the user specific authentication data signal having the security unique identification information according to the user security policy transmitted from the security area monitoring apparatus 300, and transmits the user authentication data signal generated by the security management server 200, If there is a user security policy corresponding to the security unique identification information of the user specific authentication data signal as compared with the information of the policy, the authentication acceptance information data permitting access to the security area of the user is transmitted to the secure area monitoring device 300 .

Hereinafter, a security management method using a user mobile terminal according to an embodiment of the present invention will be described in detail.

FIG. 2 is a flowchart illustrating a security management method using a user mobile terminal according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIGS. 1 and 2, a security management method using a user mobile terminal according to an embodiment of the present invention includes: first, The security management server 200 transmits the user authentication information and the security policy request message for accessing the security area to the security management server 200 (S100).

At this time, in step S100, the user authentication information may include, for example, unique identification information of a predetermined user or device identification information of the user mobile terminals 100-1 to 100-N, The identification information includes at least any one of information of a user's member ID / password (ID / PW), a resident number, a telephone number, biometrics characteristic information, OTP (One Time Password), PKI (Public Key Infrastructure) .

The device identification information of each user mobile terminal 100-1 to 100-N includes, for example, the name of the device, the password of the device, the serial number of the device, the type of the device, the manufacturer of the device, Control address, a unique IP (Internet Protocol) address of the device, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key desirable.

Thereafter, based on the user authentication information and the security policy request message transmitted in step S100 through the security management server 200, a user security policy for accessing a specific place or a predetermined security zone designated according to the security level of the user Or transmits a predetermined user security policy to the corresponding user mobile terminals 100-1 to 100-N (S200).

At this time, in step S200, the security management server 200 receives the user authentication information and the security policy request message transmitted in step S100, compares the user authentication information and the security policy request message with predetermined user security level information, Or transmit the preset user security policy to the corresponding user mobile terminals 100-1 to 100-N in real time.

Then, a user specific authentication data signal for accessing a specific place or a predetermined security area designated according to the user security policy transmitted in step S200 is generated through each user mobile terminal 100-1 to 100-N (S300 ).

At this time, in step S300, the user specific authentication data signal may include security unique identification information (e.g., a unique ID of the user security policy) according to the user security policy transmitted in step S200.

In step S300, the user specific authentication data signal may be a bar code, a QR (Quick Response Code) code, a NFC (Near Field Communication), a Wi-Fi (Direct Fidelity) Beacon (Beacon) and / or sound (Sound).

In step S300, each of the user mobile terminals 100-1 to 100-N transmits the data to the outside in accordance with the user security policy transmitted in step S200. The operation can be restricted.

Next, the user authentication data signal generated in step S300 is transmitted to the authentication server 400 through the security area monitoring device 300 to perform a user authentication procedure for entering a specified specific place or a predetermined security area (S400).

Then, based on the user specific authentication data signal transmitted in step S400 through the authentication server 400, the security management server 200 determines whether or not the security area access permission of the user is permitted based on the user specific authentication data signal transmitted in step S400, To the monitoring apparatus 300 (S500).

At this time, in step S500, the authentication server 400 receives the user specific authentication data signal having the security unique identification information according to the user security policy transmitted in step S400, and receives the user security policy information generated in step S200 If there is a user security policy corresponding to the security unique identification information of the user specific authentication data signal, the authentication acceptance information data for allowing the user to access the security area is transmitted to the secure area monitoring device 300 .

Meanwhile, the security management method using a user mobile terminal according to an embodiment of the present invention can also be implemented as a computer readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

For example, the computer-readable recording medium includes a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory, , And optical data storage devices.

In addition, the computer readable recording medium may be distributed and executed in a computer system connected to a computer communication network, and may be stored and executed as a code readable in a distributed manner.

Although the preferred embodiments of the security management system and the method using the user mobile terminal according to the present invention have been described above, the present invention is not limited thereto. It is possible to carry out various modifications and the present invention also belongs to the present invention.

100-1 to 100-N: a user mobile terminal,
200: security management server,
300: security zone monitoring device,
400: authentication server

Claims (20)

At least one user authentication information and a security policy request message for accessing the predetermined security zone and for generating a user specific authentication data signal for accessing the security zone according to a user security policy transmitted from a security management server A user mobile terminal;
A user security policy for accessing the security area according to a security level of the user based on the received user authentication information and the security policy request message transmitted from the user mobile terminal, A security management server for transmitting to the terminal;
A security area monitoring unit installed at a specific location of the security area and receiving a user specific authentication data signal generated from the user mobile terminal and transmitting the user specific authentication data signal to an authentication server to be described later to perform a user authentication procedure for entering the security area, Device; And
Receiving a user specific authentication data signal transmitted from the security area monitoring device, determining whether to allow access to the security area by the user in cooperation with the security management server based on the user authentication data, and transmitting the result to the security area monitoring device A security management system using a user mobile terminal including a server.
The method according to claim 1,
Wherein the user authentication information transmitted from the user mobile terminal includes unique identification information of the corresponding user or device identification information of the corresponding user mobile terminal.
3. The method of claim 2,
The unique identification information of the user includes at least one of a user ID / password (ID / PW), a resident number, a telephone number, biometric feature information, an OTP (One Time Password), a PKI (Public Key Infrastructure) And the security management information includes one piece of information.
3. The method of claim 2,
The device identification information of the user mobile terminal includes at least one of a name of the device, a password of the device, a serial number of the device, a type of the device, a maker of the device, a Media Access Control (MAC) address of the device, An address of the device, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key.
The method according to claim 1,
Wherein the user specific authentication data signal generated from the user mobile terminal includes security unique identification information according to a user security policy transmitted from the security management server.
The method according to claim 1,
The user specific authentication data signal generated from the user mobile terminal may be a bar code, a Quick Response Code (QR) code, a Near Filled Communication (NFC), a Wireless Fidelity Direct, a Bluetooth, Beacon) and / or sound (at least one of a signal and a signal).
The method according to claim 1,
The security management server compares the received user authentication information and the security policy request message transmitted from the user mobile terminal with predetermined user security level information to generate a user security policy corresponding to the user authentication information, Policy to the user mobile terminal in real time.
The method according to claim 1,
Wherein the authentication server receives a user specific authentication data signal having security unique identification information according to a user security policy transmitted from the secure area monitoring device and compares the user specific authentication data signal with information of a user security policy generated in the security management server, And transmits the authentication acceptance information data allowing the user to access the security area if there is a user security policy corresponding to the security unique identification information of the authentication data signal. Management system.
The method according to claim 1,
Wherein the user mobile terminal controls to limit the operation of hardware or software that transmits data to the outside in order to prevent data leakage to the outside according to the user security policy transmitted from the security management server Used security management system.
The method according to claim 1,
Wherein the user mobile terminal comprises at least one mobile terminal device of a smart phone, a smart pad, or a smart note.
A method for security management to allow access to a predetermined security area using at least one user mobile terminal,
(a) transmitting user authentication information and a security policy request message for accessing the secure area through the user mobile terminal;
(b) generating a user security policy for accessing the security zone according to a security level of the user based on the user authentication information and the security policy request message transmitted in the step (a) through the security management server, Transmitting a security policy;
(c) generating a user specific authentication data signal for the secure area access according to the user security policy transmitted in the step (b) through the user mobile terminal;
(d) transmitting a user specific authentication data signal generated in the step (c) through the security area monitoring device to an authentication server to perform a user authentication procedure for entering the security area; And
(e) judging whether or not the security area access permission of the user is allowed in cooperation with the security management server based on the user specific authentication data signal transmitted in the step (d) through the authentication server, And transmitting the information to the device.
12. The method of claim 11,
Wherein the user authentication information includes unique identification information of a corresponding user or device identification information of a corresponding user mobile terminal in step (a).
13. The method of claim 12,
The unique identification information of the user includes at least one of a user ID / password (ID / PW), a resident number, a telephone number, biometric feature information, an OTP (One Time Password), a PKI (Public Key Infrastructure) Wherein the information includes at least one piece of information.
13. The method of claim 12,
The device identification information of the user mobile terminal includes at least one of a name of the device, a password of the device, a serial number of the device, a type of the device, a maker of the device, a Media Access Control (MAC) address of the device, Wherein the information includes at least one of an address, a model of the device and a version of the device, a secret key of the device, and authentication information of the device generated by the PKI-based private key.
12. The method of claim 11,
Wherein, in step (c), the user specific authentication data signal includes security unique identification information according to the user security policy transmitted in step (b).
12. The method of claim 11,
In step (c), the user specific authentication data signal may be a bar code, a QR (Quick Response Code) code, a NFC (Near Field Communication), a Wi-Fi (Wireless Fidelity) Direct, Wherein the at least one mobile terminal comprises at least one of a beacon signal and a sound signal.
12. The method of claim 11,
In the step (b), the security management server compares the received user authentication information and the security policy request message transmitted in the step (a) with predetermined user security level information, Policy or a preset user security policy to the user mobile terminal in real time.
12. The method of claim 11,
In the step (e), the authentication server receives the user specific authentication data signal having the security unique identification information according to the user security policy transmitted in the step (d) When the user security policy corresponding to the security unique identification information of the user specific authentication data signal is present, the authentication acceptance information data permitting access to the security area of the user is transmitted to the secure area monitoring device A security management method using a user mobile terminal.
12. The method of claim 11,
In the step (c), the user mobile terminal restricts the operation of hardware or software that transmits data to the outside in order to prevent data outflow according to the user security policy transmitted in the step (b) A security management method using a user mobile terminal.
A computer-readable recording medium having recorded thereon a computer-executable method of any one of claims 11 to 19.

Images