KR20180117083A - System and method for authenticiating user based on location authentication - Google Patents

Abstract

The present invention relates to a location authentication based authentication system and a method thereof for performing additional authentication for a user logged into an enterprise server through a mobile terminal, thereby improving security. According to an embodiment of the present invention, the user authentication system is connected through a network to a plurality of enterprise servers including a first enterprise server, a plurality of administrator terminals including a first administrator terminal corresponding to a first enterprise server, and a plurality of user terminals including a first user terminal connected to the first enterprise server. The user authentication system comprises: a push server receiving connection information and an authentication level of the first user terminal, which are transmitted from the first enterprise server, generating a push message corresponding to the received authentication level, transmitting the generated push message to the first user terminal, receiving additional authentication information transmitted from the first user terminal in response to the transmitted push message, and performing authentication of the first user terminal; and a central server storing enterprise information and personal information transmitted from the first administrator terminal and the first user terminal, setting the push server corresponding to the first enterprise server based on the stored enterprise information, and transmitting an authentication level registration request of the first user terminal to the first administrator terminal.

Description

[0001] SYSTEM AND METHOD FOR AUTHENTICIATING USER BASED ON LOCATION AUTHENTICATION [0002]

The present invention relates to a location authentication-based user authentication system and method, and more particularly, to a system and method for enhancing security by performing additional authentication for a user who logs in to an enterprise server through a mobile terminal.

While the ID and password used to authenticate the user when accessing the server can be used conveniently, there is a high risk of hacking, and when the personal information is leaked, the identity theft, account hijacking, voice phishing, messenger phishing, spam mail and privacy violation It can cause serious damage.

To reduce these damages, recently, users have been asked to generate a long and complicated password by a combination of non-consecutive numbers, English, letters and special characters, to request a periodic change of password, And to strengthen the security policy through such measures as However, there are inconveniences that users can not easily memorize passwords due to complexity and frequent changes of passwords, and hacking technology becomes more intelligent and advanced.

An embodiment of the present invention is directed to a system and method for performing additional authentication based on a user's biometric information and location information based on an authentication level of a user logged into a corporate server through a mobile terminal.

Embodiments according to the present invention can be used to accomplish other tasks not specifically mentioned other than the above-described tasks.

According to an aspect of the present invention, there is provided an information processing system including a plurality of enterprise servers including a first enterprise server, a plurality of administrator terminals including a first administrator terminal corresponding to a first enterprise server, And receives the connection information and the authentication level of the first user terminal transmitted from the first enterprise server and transmits the push information corresponding to the received authentication level to the first user terminal, A push server for generating a message and transmitting the message to the first user terminal, receiving the additional authentication information transmitted from the first user terminal in response to the transmitted push message to perform authentication of the first user terminal, And stores the company information and the personal information transmitted from the first user terminal and sets up a push server corresponding to the first enterprise server based on the stored company information And, a first and a central server that transmits the authentication level registration request of the first user terminal to the administrator terminal, the authentication level proposes a first data access Korean user authentication system of the user terminal corresponding to the first business server.

The push server includes an employee information database for storing employee information including an authentication level of the first user terminal, a connection information receiving unit for receiving the connection information transmitted from the first enterprise server, A message transmission unit for generating a corresponding push message and transmitting the generated push message to a first user terminal corresponding to the received connection information, and an authentication notification unit for performing authentication of the first user terminal by comparing the received additional authentication information with stored employee information .

Further, the employee information includes at least one of first position information or first biometric information of a first user corresponding to the first user terminal, the additional authentication information includes second position information of the first user, Information. ≪ / RTI >

The authentication notification unit may notify the first enterprise server of the authentication success of the first user terminal when the second position information is included within a predetermined radius based on the first position information, It is possible to notify the first enterprise server and the first administrator terminal of the authentication failure of the first user terminal when the information is not included in the radius preset in advance.

The central server may include an enterprise member registration unit that generates an enterprise code and a password corresponding to the stored company information, and issues an API key (application programming interface key) to set up a push server.

The central server further includes an authentication information database for storing authentication information including an authentication date and time of the first user terminal transmitted from the push server and the authentication location, and an authentication information database for storing the authentication information of the stored first user terminal to the first administrator terminal And an authentication information transmitting unit for transmitting the authentication information.

In addition, the authentication information database may further store the browsing data information of the first user terminal transmitted from the first enterprise server and the downloading information in association with the authentication date and time and the authentication location.

In addition, the central server is connected to a plurality of enterprise servers, and the push servers are implemented in a plurality and can be connected one to one with a plurality of enterprise servers.

According to an embodiment of the present invention, there is provided a method for managing a plurality of enterprise servers including a first enterprise server, a plurality of administrator terminals including a first administrator terminal corresponding to a first enterprise server, A plurality of user terminals connected to the plurality of user terminals through a network are used. The enterprise member registration unit stores enterprise information in response to a request from the first administrator terminal, Generating an authentication level registration request of the first user terminal to the first administrator terminal corresponding to the stored personal information by transmitting the authentication level registration request of the first user terminal And transmitting the employee information, which is transmitted from the first enterprise server to the employee information database and includes the authentication level of the first user terminal, Receiving the connection information transmitted from the first enterprise server by the connection information receiving unit, generating a push message corresponding to the authentication level of the first user terminal corresponding to the connection information in the message transmitting unit, And the authentication notifying unit receives the additional authentication information transmitted from the first user terminal in response to the push message and compares the received additional authentication information with the stored employee information to perform authentication of the first user terminal A method for authenticating a user is proposed.

Here, the step of transmitting the authentication level registration request of the first user terminal may request the setting of the data access right of the first user terminal.

In addition, the step of storing the employee information may store at least one of the first location information of the first user or the first biometric information corresponding to the first user terminal, and the step of performing the authentication of the first user terminal comprises: The first user terminal can be authenticated according to whether the additional authentication information matches the first location information or the first biometric information.

Also, the first location information may be updated at a predetermined time interval through the first enterprise server.

Storing the authentication date and time and the authentication location of the first user terminal transmitted from the push server in the authentication information database; transmitting the authentication date and time of the first user terminal transmitted from the first enterprise server in the authentication information database Storing the browsing data information and the downloading information, and transmitting the authentication date and time, the authentication location, the browsing data information, and the download information stored in the authentication information transmitting unit to the first administrator terminal.

According to the embodiment of the present invention, the security of the enterprise server can be improved by performing the additional authentication of the login user using the biometric information unique to the user and the changed location information. In addition, when additional authentication fails, it is notified to the enterprise server administrator, thereby preventing damage and improving security efficiency.

1 shows a configuration of a user authentication system according to an embodiment of the present invention.
2 shows a configuration of an administrator terminal according to an embodiment of the present invention.
FIG. 3 shows a configuration of a user terminal according to an embodiment of the present invention.
4 is authentication information stored in an authentication information database according to an embodiment of the present invention.
FIG. 5 shows a method of registering a company member using the user authentication system of FIG.
FIG. 6 shows a personal member registration method using the user authentication system of FIG.
7 shows a user addition authentication method using the user authentication system of FIG.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The present invention may be embodied in many different forms and is therefore not limited to the embodiments described herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and the same reference numerals are used for the same or similar components throughout the specification. In the case of publicly known technologies, detailed description thereof will be omitted.

In this specification, when a part is referred to as "including " an element, it is to be understood that it may include other elements as well, without departing from the other elements unless specifically stated otherwise. The terms " part, "" module," and "group ", as used herein, refer to a unit that processes at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software have.

In this specification, "administrator" means a server administrator of an enterprise member, and "user " means an individual member registered in the user authentication system.

In this specification, authentication of a user terminal includes authentication of a user using a user terminal.

1 shows a configuration of a user authentication system according to an embodiment of the present invention.

The user authentication system 10 of FIG. 1 is connected to the enterprise server 300, the administrator terminal 400, and the user terminal 500 through a wireless communication network.

In FIG. 1, the enterprise server 300, the manager terminal, and the user terminal are configured as a plurality of enterprise servers, an administrator terminal, and a plurality of user terminals, respectively. 400, and the user terminal 500 of the individual member belonging to the A company.

At this time, the respective applications provided by the user authentication system 10 are installed in the administrator terminal 400 and the user terminal 500, and the contents of the application will be described in detail with reference to FIG. 2 and FIG.

The enterprise server 300 shown in Fig. 1 stores the service data such as electronic approval, document management, schedule management, in-house bulletin board, and customer management with the server of the enterprise member subscribing to the user authentication system 10. For example, the enterprise server 300 includes an intranet server, an enterprise resource planning (ERP) server, a groupware server, a mail server, and a file server.

The administrator terminal 400 of FIG. 1 is a portable terminal of the administrator of the enterprise server 300, and the administrator transmits enterprise information to the user authentication system 10 through the administrator terminal 400 or requests authentication information.

2 shows a configuration of an administrator terminal according to an embodiment of the present invention.

2 includes an enterprise information transmitting unit 410, an authentication level transmitting unit 420, an authentication information requesting unit 430, and an authentication information receiving unit 440. At this time, the enterprise information transmitting unit 410, the authentication level transmitting unit 420, the authentication information requesting unit 430, and the authentication information receiving unit 440 are installed in the administrator terminal 400 in the form of an application.

The enterprise information transmission unit 410 transmits the enterprise information and the manager information to the user authentication system 10. Here, the enterprise information includes the enterprise server address.

The authentication level transmitting unit 420 sets an authentication level of the user terminal according to a request of the user authentication system 10 and transmits the authentication level to the enterprise server 300. The enterprise server 300 receives the authentication level of the user terminal, Information. Herein, the authentication level refers to the access right of the user terminal to the shared document and the confidential document stored in the enterprise server 300. For example, the authentication level may be set based on one or more of a user's department, tenure, or greeting.

The authentication information request unit 430 requests authentication information from the user authentication system 10. Specifically, it requests authentication information corresponding to at least one of a user, a date and time, a connection location, or a viewing data type.

The authentication information receiving unit 440 receives the authentication information transmitted from the user authentication system 10 in response to the request of the authentication information requesting unit 430. [

The user terminal 500 of FIG. 1 is a portable terminal of the user, and the user joins the user authentication system 10 through the portable terminal and connects to the enterprise server 300.

FIG. 3 shows a configuration of a user terminal according to an embodiment of the present invention.

The user terminal 500 of FIG. 3 includes a personal information transmitter 510, a biometric information transmitter 520, and a location information transmitter 530. At this time, the personal information transmitting unit 510, the biometric information transmitting unit 520, and the location information transmitting unit 530 are installed in the user terminal 500 in the form of an application.

The personal information transmission unit 510 transmits the personal information to the user authentication system 10.

The biometric information transmission unit 520 receives the biometric information of the user corresponding to the push message transmitted from the user authentication system 10 and transmits the biometric information to the user authentication system 10. Specifically, at least one of biometric information of a user's fingerprint, voice, iris, or face is input and transmitted through an input device such as a touch pad, a camera, or a microphone located in the user terminal 500.

The location information transmission unit 530 calculates location information of the user corresponding to the push message transmitted from the user authentication system 10 and transmits the location information to the user authentication system 10. Specifically, the GPS module receives GPS signals from a plurality of satellites through a GPS module located in the user terminal 500, calculates the current position of the user based on the received GPS signals, and transmits the current position to the user authentication system 10.

Referring again to FIG. 1, the user authentication system 10 includes a central server 100 for storing membership information and setting up push servers of corporate members in response to a request for joining company members and users, And a push server 200, 200-1, 200-2 for performing additional authentication of the user.

The central server 100 includes an enterprise member registration unit 110, an individual member registration unit 120, a member information database 130 (hereinafter referred to as a "member information DB"), an authentication information database 140 DB "), and an authentication information transmission unit 150. [

The enterprise member registering unit 110 includes an enterprise information receiving unit 111, an enterprise code generating unit 112, and a push server setting unit 113.

The enterprise information receiving unit 111 receives the enterprise information and the manager information transmitted from the administrator terminal 400 and stores them in the member information DB 130. [ Here, the enterprise information includes the enterprise server address.

The enterprise code generation unit 112 generates an enterprise code corresponding to the enterprise information received through the enterprise information reception unit 111. [ For example, the enterprise code generated through the enterprise code generation unit 112 is an eight-digit random number made up of alphabets and numbers. Further, the enterprise code generation unit 112 generates a password corresponding to the generated enterprise code, and transmits the generated password to the administrator terminal 400. In the embodiment of the present invention, the access right of the central server 100 is given to the administrator using the password corresponding to the enterprise code. For example, using the enterprise code and password, the user can be authenticated as an administrator and request user authentication information.

The push server setting unit 113 issues an API (Application Programming Interface) key corresponding to the enterprise code generated through the enterprise code generating unit 112 and sets a push server.

The personal member registration unit 120 includes a personal information receiving unit 121 and an authentication level requesting unit 122.

The personal information receiving unit 121 receives the personal information transmitted from the user terminal 500 and stores the personal information in the member information DB 130. At this time, the personal information includes the user's enterprise code. In addition, the personal information receiver 121 receives an email address or a telephone number transmitted from the user terminal 500, and performs user authentication using the received email address or telephone number.

The authentication level requesting unit 122 searches the administrator terminal 400 corresponding to the enterprise code of the authenticated user through the personal information receiving unit 121 and requests the searched administrator terminal 400 to register the authentication level.

The member information DB 130 stores company information and personal information received from the company information receiving unit 111 and the personal information receiving unit 121. [

The authentication information DB 140 stores the authentication date and time (connection date) and the authentication position (connection position) of the user terminal transmitted from the push servers 200, 200-1 and 200-2. At this time, as shown in FIG. 4, the user's browsing data information corresponding to the authentication date and time and the authentication location and whether or not to download the data can be received from the enterprise server and further stored.

The authentication information transmitting unit 150 retrieves the authentication information corresponding to the authentication information request transmitted from the administrator terminal 400 and transmits the authentication information to the administrator terminal 400.

The push server of FIG. 1 includes a first push server 200, a second push server 200-1, and a third push server 200-2 corresponding to the servers of the enterprise members registered in the enterprise member registering unit 110, And the like. For example, a first push server 200 for performing an additional authentication of a user belonging to an A company, a second push server 200-1 for performing an additional authentication of a user belonging to the B company, and a C And a third push server 200-2 that performs additional authentication of the user belonging to the corporation.

Since the first push server 200, the second push server 200-1 and the third push server 200-2 have the same configuration, the first push server 200 Repeated explanations of the configurations of the second push server 200-1 and the third push server 200-2 are omitted.

The first push server 200 includes a connection information receiving unit 210, an employee information database 220 (hereinafter referred to as an "employee information DB"), a message transmitting unit 230 and an authentication notifying unit 240 .

The connection information receiving unit 210 receives connection information transmitted from the enterprise server 300. Here, the connection information includes an ID (ID) and a password (PW) input by the user to access the enterprise server 300 through the user terminal 500. At this time, the ID may be the number of the user.

The employee information DB 220 stores employee information of the company. At this time, the information of the employees includes name, e-mail address, telephone number, enterprise server access information, designated location (work area, business area), department, rank, certification level and biometric information. Lt; / RTI > For example, the employee information stored in the employee information DB 220 may be provided from the enterprise server 300 of the A company.

The message transmitting unit 230 generates a push message corresponding to the authentication level of the user terminal and transmits the generated push message to the user terminal 500 corresponding to the connection information received by the connection information receiving unit 210. Specifically, based on the authentication level of the user terminal stored in the employee information DB 220, a push message for requesting additional authentication information is generated and transmitted. For example, when the authentication level of the user terminal is divided into upper, middle, and lower, the push message requesting the location information is transmitted when the authentication level of the user terminal corresponding to the received access information is 'lower'. If the authentication level of the user terminal is 'middle', a push message requesting biometric information is transmitted. If the authentication level of the user terminal is 'up', a message requesting location information and biometric information is transmitted. At this time, location information and biometric information can be sequentially requested.

The authentication notifying unit 240 receives the additional authentication information transmitted from the user terminal 500 in response to the push message, and authenticates the user using the received additional authentication information. At this time, the additional authentication information includes biometric information and location information. The authentication notifying unit 240 notifies the authentication result to the enterprise server 300, the administrator terminal 400, and the user terminal 500. [

The authentication notifying unit 240 according to the embodiment of the present invention determines whether the received biometric information matches the biometric information stored in the employee information DB 220 and authenticates the user. Also, it is determined whether or not the received location information matches the working area or business area stored in the employee information DB 220 to authenticate the user. Here, the work area or the travel area stored in the employee information DB 220 is location information previously stored by the user through the enterprise server 300. That is, when the received position (current position of the user) is included within a predetermined radius based on the working area or the travel area (the position preset by the user) stored in the employee information DB 220, do.

According to the embodiment of the present invention, while the user authentication is performed in the authentication notifying unit 240, the enterprise server 300 keeps the login of the user in a standby state, receives the user authentication result transmitted from the authentication notifying unit 240 Thereby allowing or blocking the connection of the user terminal 500.

FIG. 5 shows a method of registering a company member using the user authentication system of FIG.

First, the company information is received through the enterprise information receiving unit 111 and stored in the member information DB 130 (S 10). The server information is received and stored in the member information DB 130 (S 12).

Thereafter, an enterprise code corresponding to the enterprise information received in step S10 is generated through the enterprise code generating unit 112 (S14). In step S14, a password corresponding to the enterprise code is generated and transmitted to the administrator terminal 400. [

Thereafter, an API key corresponding to the enterprise code generated in step S14 is generated through the push server setting unit 113 (S16), and a push server is set (S18).

FIG. 6 shows a personal member registration method using the user authentication system of FIG.

First, the enterprise code and the e-mail address are received through the personal information receiving unit 121 (S20), and the user is authenticated using the received e-mail address (S22).

In step S24, the manager corresponding to the enterprise code of the user authenticated in step S22 is searched through the authentication level request unit 122 (S24), and the registered administrator is requested to register the authentication level of the user terminal (S26).

7 shows a user addition authentication method using the user authentication system of FIG.

First, the access information of the user is received through the access information receiving unit 210 (S30).

Thereafter, the authentication level of the user terminal is determined based on the connection information received in step S30 through the message transmission unit 230 (S32), and the push message is transmitted to the user terminal 500 according to the determination result of step S32 . At this time, the push message includes an additional authentication information request.

The authentication level of the user terminal stored in the employee information DB 220 is extracted based on the received number in step S30. (S32). If the authentication level of the user terminal is 'low', a location information request message is transmitted (S34). If the authentication level of the user terminal is not 'low', it is determined that the authentication level is 'up', and the location information and the biometric information request message are transmitted (S36).

Thereafter, additional authentication information corresponding to the request message in step S34 or S36 is received via the authentication notification unit 240 (S38), and the received additional authentication information and the employee information stored in the employee information DB 220 It is determined whether or not they match (S40).

As a result of the comparison in step S40, if the received additional authentication information matches the stored employee information, the authentication result (authentication success) is transmitted to the enterprise server 300. If not, the enterprise server 300 and the administrator terminal 400) (S42).

According to the embodiment of the present invention, the primary authentication is performed using the login information of the user terminal accessing the enterprise server, the secondary authentication is performed using the location information of the user who has completed the primary authentication and the biometric information, The security effect of the enterprise server can be improved.

According to an embodiment of the present invention, an administrator of an enterprise server stores an authentication level corresponding to an access right of an individual member who is subscribed to a user authentication system in an enterprise server, By requesting the authentication information, the security effect of the enterprise server can be maximized.

According to the embodiment of the present invention, the authentication information of the user terminal is collected and stored and provided to the administrator, so that it can be utilized as digital forensics and can be used as evidence for security problems of the enterprise server.

While the present invention has been particularly shown and described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It belongs to the scope.

10: User authentication system
100: central server
110: Corporate Membership Register
111: Enterprise information receiver
112: Enterprise code generation unit
113: push server setting section
120: Personal Membership Register
121: personal information receiver
122: authentication level request unit
130: Membership Information DB
140: Authentication information DB
150: Authentication information transmission unit
200, 200-1, 200-2: push server
210: Connection information receiver
220: Employee information DB
230:
240:
300: Enterprise Server
400: administrator terminal
500: user terminal

Claims (1)

A plurality of enterprise servers including a first enterprise server, a plurality of administrator terminals including a first administrator terminal corresponding to the first enterprise server, and a first user terminal connected to the first enterprise server 1. A location authentication based user authentication system connected to a user terminal via a network,
Receiving the connection information and the authentication level of the first user terminal transmitted from the first enterprise server, generating a push message corresponding to the received authentication level, and transmitting the generated push message to the first user terminal, A push server for receiving the additional authentication information transmitted from the first user terminal and performing authentication of the first user terminal in response to
Stores the company information and personal information transmitted from the first administrator terminal and the first user terminal and sets the push server corresponding to the first enterprise server based on the stored company information, And a central server for transmitting an authentication level registration request of the first user terminal,
Wherein the authentication level is a data access right of the first user terminal corresponding to the first enterprise server.

Images