KR20190000613A - Smart device based remote access control and multi factor authentication system - Google Patents

Abstract

A smart device based remote access control and multi-factor authentication system is disclosed. The smart device based remote access control and multi-factor authentication system can control a file or a folder stored in a security drive by using a decoding key individually generated for each file or each folder stored in the security derive, thereby remotely controlling or using an encoded file or an encoded folder of the security drive by using a plurality of decoding keys.

Description

TECHNICAL FIELD [0001] The present invention relates to a smart device based remote access control and multi-factor authentication system,

The present invention relates to an authentication system, and more particularly, to a smart device-based remote control system for controlling a file or a folder stored in a secure drive by using a decryption key generated separately for each file or folder stored in the secure drive Access control and multi-factor authentication system.

Recently, according to the security issue related to information leakage, users have to install many related programs on the PC. In case of accessing specific types of information, there is a problem that the work efficiency is lowered due to unnecessary inspection and control, . In order to solve these problems, there is a growing demand for security control and management technology for storing and protecting data and for grasping the status of personal information in both individuals and corporations.

In addition, as the smartphone is used as a universal service terminal, the necessity of systematic countermeasures against smartphone security threats such as leakage of personal information on the Internet and cloud, phishing using SNS, appearance of malicious apps, and the like are increasing.

Meanwhile, among these social needs, users feel inconveniences about increasingly complicated security system and are not relieved of security anxiety. Therefore, there is a demand for a security system that has strong security and can be easily used by users.

In addition, as the number of mobile devices and cloud spreads increases, the number of technologies and markets requiring security increases, and as users increase, security becomes more important. As companies provide various services using the network, DB cipher and access control technology for DBMS.

Therefore, the information security market is being developed along with the characteristics that can be exposed to various kinds of crime and social needs, and the information security market must be developed so that it can be applied to various fields along with services provided by companies.

In keeping with this circumstance, Korean Patent Laid-Open Publication No. 10-2013-0123339 (published on November 12, 2013) discloses a method of authenticating an authenticated user based on an account-based basic authentication by inputting an ID and a password, A dual-authentication login system for a dual-authentication login system.

Such a dual authentication login system can not satisfy the user's need for double authentication, can not eliminate the hassle of the user, can not meet the demand for convenient security control and management technology, Technological needs can not be satisfied sufficiently, and there are difficulties in preventing economic loss from information leakage.

Korean Patent Publication No. 10-2013-0123339 (published Nov. 12, 2013)

Accordingly, a first object of the present invention is to provide a smart device-based remote access control and multi-factor authentication method capable of remotely controlling or using an encrypted file or folder of a secure drive using a plurality of decryption keys, System.

A second object of the present invention is to provide a smart device-based remote access control and multi-factor authentication system that improves security by changing an encryption key whenever a user terminal uses a file or a folder stored on a secure drive .

A third object of the present invention is to provide a smart device-based remote access control and multi-factor authentication system that allows streaming technology to be applied so that a user can not feel the encryption / decryption process when a user terminal uses a high-capacity video file.

In order to achieve the above first to third objects, the present invention provides a remote access control and multi-factor authentication system including a user terminal, a cloud server and a secure drive, A security decryption unit for decrypting the secure drive information and the first decryption key by using the security decryption key and the security decryption key in a case where the current position of the user terminal is equal to the current position of the secure drive, And a first encryption unit encrypting a file or a folder stored in the secure drive so as to match with the first decryption key, wherein the cloud server is configured to encrypt the current location of the user terminal and the secure drive, Only when the current position of the user < RTI ID = 0.0 > Sense provides a remote access control and multi-factor authentication system characterized in that to be connected to the server cloud.

The first decryption key may be generated separately for each file or folder stored in the secure drive.

The user terminal may include an input unit to which an ID and a password are input according to an electrical signal generated according to a user's intention, and a second encryption unit to encrypt the ID and the password.

The user terminal may further include a second communication unit for transmitting an encrypted ID and a password to the cloud server.

The password may be a fake touch based image password.

The cloud server includes a decryption unit for decrypting an ID and a password of the user terminal using a second decryption key, and an ID and a password verification unit for checking whether the decrypted ID and password are the same as the predetermined ID and password , The user terminal can be allowed to access the cloud server only when the decrypted ID and password are the same as the predetermined ID and password.

According to the smart device-based remote access control and multi-factor authentication system of the present invention described above, it is possible to remotely control or use an encrypted file or folder of a secure drive by using a plurality of decryption keys.

Further, each time a user terminal uses a file or a folder stored on a secure drive, there is an effect of improving security by changing the encryption key.

When the user terminal uses a high-capacity video file, the streaming technique is applied to prevent the user from feeling the encryption / decryption process.

1 is a diagram showing a schematic configuration of a remote access control and multi-factor authentication system, which is an embodiment of the present invention.
FIG. 2 is a schematic block diagram of a security drive according to an embodiment of the present invention.
3 is a diagram showing a schematic configuration of a user terminal, which is an embodiment of the present invention.
4 is a diagram showing a schematic configuration of a cloud server which is a constitution of the present invention.
5 is a diagram showing a schematic configuration of a remote access control and multi-factor authentication system according to another embodiment of the present invention.

It is to be understood that the words or words used in the present specification and claims are not to be construed in a conventional or dictionary sense and that the inventor can properly define the concept of a term in order to best describe the user's invention And should be construed in light of the meanings and concepts consistent with the technical idea of the present invention.

Throughout the specification, when an element is referred to as " comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise. In addition, the term " "... "," ... Unit, "" module, "" device, "and the like refer to a unit that processes at least one function or operation, which may be implemented as a combination of hardware and / or software.

The terms used in the embodiments of the present invention will be briefly described, and these embodiments will be described in detail.

Although the terms used in the embodiments of the present invention have been selected in consideration of the functions of the present invention, the present invention is not limited thereto and can be varied depending on the intention or the precedent of the artisan skilled in the art, . Also, in certain cases, some terms are arbitrarily selected by the applicant, and in this case, the meaning thereof will be described in detail in the description of the corresponding embodiments. Therefore, the terms used in the embodiments should be defined based on the meaning of the terms, not on the names of simple terms, and on the contents of the embodiments throughout.

In an embodiment of the present invention, terms including ordinal numbers such as first, second, etc. may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Further, in the embodiments of the present invention, the singular expressions include plural expressions unless the context clearly indicates otherwise.

Furthermore, in the embodiments of the present invention, terms such as "comprises" or "having ", etc. are intended to specify the presence of stated features, integers, steps, operations, elements, parts, or combinations thereof, Steps, operations, elements, components, or combinations of elements, numbers, steps, operations, components, parts, or combinations thereof.

Also, in the embodiments of the present invention, 'module' or 'sub' performs at least one function or operation, and may be implemented in hardware or software, or a combination of hardware and software. In addition, a plurality of 'modules' or a plurality of 'parts' may be integrated into at least one module except for 'module' or 'module' which needs to be implemented by specific hardware, and may be implemented by at least one processor.

Further, in the embodiment of the present invention, when a part is referred to as being "connected" with another part, it is not limited to a case where it is " directly connected " And the like.

Further, in the embodiment of the present disclosure, " application " refers to a set of computer programs designed to perform a specific task. In the embodiments of the present disclosure, the application may vary. But are not limited to, a gaming application, a video playback application, a map application, a memo application, a calendar application, a phonebook application, a broadcast application, a motion support application, a payment application, and a photo folder application.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a schematic configuration of a remote access control and multi-factor authentication system, which is an embodiment of the present invention.

1, a remote access control and multi-factor authentication system may include a secure drive 100, a user terminal 200, and a cloud server 300.

More specifically, the secure drive 100 may compare the current location of the user terminal 200 with the current location of the secure drive 100 in real time to determine whether they are the same.

Also, the secure drive 100 transmits the secure drive 100 information and the first decryption key to the user terminal 200 only when the current position of the user terminal 200 and the current position of the secure drive 100 are the same .

The secure drive 100 may then encrypt the file or folder stored in the secure drive 100 to match the first decryption key.

The cloud server 300 may allow the user terminal 200 to connect to the cloud server 300 only when the current location of the user terminal 200 and the current location of the secure drive 100 are the same.

Also, a separate authentication server can be connected to the cloud server 300. [

The authentication server can perform the authentication procedure when the user terminal 200 accesses the cloud server 300 by using the NoSQL in combination with the BMS (Data Base Management System).

The authentication server may perform a first authentication procedure by the user terminal 200, and the second authentication procedure may be performed by the secure drive 100. [

The authentication server may include a master server and a domain server.

And the master server can control the area server.

The real-time server can store the real database.

Such a database may be a file or a folder stored in the secure drive 100.

On the master server, Hadoop's NameNode and JobTracker daemons are loaded, ZooKeeper's QuorumPeerMain daemon is loaded, and HBase's HMaster daemon can be loaded.

On the zone server, Hadoop's DataNode and TaskTracker daemon are loaded, ZooKeeper's QuorumPeerMain daemon is loaded, and HBase's HRegionServer can be loaded.

2 is a diagram showing a schematic configuration of a secure drive 100, which is an embodiment of the present invention.

Referring to FIG. 2, the secure drive 100 may include a location determination unit 110, a first communication unit 120, a first encryption unit 130, and a first decryption key change unit 140.

The position determination unit 110 may compare the current position of the user terminal 200 with the current position of the secure drive 100 in real time to determine whether they are the same or not.

More specifically, the user terminal 200 can determine the current location of the user terminal 200 using geographical location information using an IP (Internet Protocol) address, GPS (Global Positioning System), and the like.

The user terminal 200 may transmit the current position of the user terminal 200 to the secure drive 100.

The position determination unit 110 may compare the current position of the user terminal 200 received from the user terminal 200 with the position of the current secure drive 100.

The location determination unit 110 may compare the current location of the user terminal 200 with the current location of the secure drive 100 to determine whether they are the same.

The first communication unit 120 can transmit the secure drive 100 information and the first decryption key to the user terminal 200 only when the current position of the user terminal 200 and the current position of the secure drive 100 are the same have.

The first encryption unit 130 may encrypt a file or a folder stored in the secure drive 100 so as to match the first decryption key.

The first decryption key changing unit 140 may change the first decryption key whenever the user terminal 200 uses a file or a folder stored in the secure drive 100 through the cloud server 300. [

Each time the user terminal 200 uses a file or a folder stored in the secure drive 100 through the cloud server 300, the first encryption unit 130 changes the first decryption key change unit 140 Encrypts the file or folder stored in the secure drive 100 to match the first decryption key.

Also, the first communication unit 120 can transmit the changed first decryption key to the user terminal 200. [

Here, the first decryption key may be generated separately for each file or folder stored in the secure drive 100.

That is, each file or folder stored in the secure drive 100 may be separately encrypted.

When the user terminal 200 accesses the cloud server 300 and then uses the high-capacity moving image file stored in the secure drive 100, the secure drive 100 applies the streaming technology, Can not be felt.

Here, the high capacity can be arbitrarily set by the administrator.

Accordingly, even if a user uses a file having a large capacity as a moving picture file, the user can not feel the encryption / decryption process, thereby improving the user's convenience.

3 is a diagram showing a schematic configuration of a user terminal 200 which is an embodiment of the present invention.

3, the user terminal 200 may include an input unit 210, a second encryption unit 220, a second communication unit 230, and a location determination unit 240.

The input unit 210 can input an ID and a password according to an electrical signal generated according to a user's intention.

The second encryption unit 220 can encrypt the ID and the password input by the input unit 210.

Also, the second communication unit 230 can transmit the encrypted ID and password to the cloud server 300. [

Here, the password input by the input unit 210 may be a fake touch-based image password.

The location determination unit 240 can determine the current location of the user terminal 200. [

The location determination unit 240 can determine the current location of the user terminal 200 using geographical location information using an IP (Internet Protocol) address, a GPS (Global Positioning System), and the like.

The second communication unit 230 can transmit the current position of the user terminal 200, which is detected by the position detection unit 240, to the secure drive 100.

4 is a diagram showing a schematic configuration of a cloud server 300 which is a constitution of the present invention.

Referring to FIG. 4, the cloud server 300 may include a decryption unit 310 and a password verification unit.

The decryption unit 310 can decrypt the ID and the password of the user terminal 200 using the second decryption key.

That is, the decryption unit 310 can decrypt the ID and the password received from the user terminal 200.

The ID and password verification unit 320 can confirm whether the ID and the password decrypted by the decryption unit 310 are the same as the ID and password set in advance.

The cloud server 300 determines that the user terminal 200 is connected to the cloud server 300 only when the decrypted ID and password are the same as the predetermined ID and password as a result of checking by the ID and password verification unit 320, Lt; / RTI >

After the ID and password input by the input unit 210 are encrypted by the second encryption unit 220 and the decryption unit 310 of the cloud server 300 decrypts the ID and the password, It is possible to securely protect the user from security threats such as hacking by improving security.

5 is a diagram showing a schematic configuration of a remote access control and multi-factor authentication system according to another embodiment of the present invention.

5, the remote access control and multi-factor authentication system may include a secure drive 100, a user terminal 200, a cloud server 300, and a monitoring server 400.

The security drive 100, the user terminal 200, and the cloud server 300 are basically the same as those described with reference to FIGS. 1 to 4, and the additional contents will be described later.

The secure drive 100 may send each file or folder that it is storing to the monitoring server 400,

The user terminal 200 may generate a control command composed of an electrical signal and the user terminal 200 accesses the secure drive 100 through the cloud server 300 and transmits the control command to the secure drive 100 through the control command. The user can use, change, or delete each file or folder stored in the storage medium.

And the user terminal 200 may transmit the control command to the monitoring server 400. [

The secure drive 100 may transmit each file or folder that is used, changed, or deleted according to a control command of the user terminal 200 to the monitoring server 400.

The monitoring server 400 stores the master key and can decrypt each file or folder received from the secure drive 100 using the stored master key.

The monitoring server 400 may store each file or folder received from the secure drive 100 in the first DB and may store each file or folder that is used, changed or deleted in accordance with the control command received from the secure drive 100 The folder can be stored in the second DB.

Here, each file or folder stored in the first DB refers to a file or folder before being used, changed or deleted according to the control command.

Then, the monitoring server 400 can use, change or delete each file or folder stored in the first DB according to the control command received from the user terminal 200, and can use, change, or delete each file or folder The folder can be stored in the third 3DB.

If the file or folder stored in the second DB is different from the file or folder stored in the second DB, the monitoring server 400 may compare the file or folder stored in the second DB with the file or folder stored in the second DB. The contents of the error occurrence can be transmitted to the administrator terminal.

Through the monitoring server 400, it is possible not only to synchronize a file or a folder stored in the secure drive 100, but also to detect a control command recognition error of the secure drive 100.

In addition, when the error occurs, the monitoring server 400 transmits the error occurrence contents to the previously registered administrator terminal rather than the user directly inquiring or contacting the administrator, thereby improving the management convenience for the administrator. There is an advantage that the security drive can be used more conveniently.

As described above, the configuration and operation of the remote access control and multi-factor authentication system based on the smart device according to the embodiment of the present invention can be performed, while the concrete embodiment has been described in the description of the present invention. However, And can be practiced without departing from the scope of the invention.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, and that various modifications and changes may be made by those skilled in the art.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, disclosure methods should be considered from an illustrative point of view, not from a restrictive point of view. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

100: security drive 110: position determination unit
120: first communication unit 130: first encryption unit
140: first decryption key changing unit 200:
210: input unit 220: second encryption unit
230: second communication unit 240:
300: Cloud server 310: Decryption unit
320: ID and password verification unit

Claims (6)

1. A remote access control and multi-factor authentication system comprising a user terminal, a cloud server and a secure drive,
The secure drive
A position determination unit for comparing the current position of the user terminal with the current position of the secure drive in real time to determine whether they are the same;
A first communication unit for transmitting the secure drive information and the first decryption key to the user terminal only when the current position of the user terminal is the same as the current position of the secure drive;
A first encryption unit encrypting a file or a folder stored in the secure drive so as to match the first decryption key;
Lt; / RTI >
The cloud server
Wherein the user terminal is connectable to the cloud server only when the current location of the user terminal and the current location of the secure drive are the same.
The method according to claim 1,
The first decryption key
Wherein the secure drive is generated separately for each file or folder stored in the secure drive.
The method according to claim 1,
The user terminal
An input unit for inputting an ID and a password by an electrical signal generated according to a user's intention;
A second encryption unit for encrypting the ID and the password;
A remote access control and multi-factor authentication system.
The method of claim 3,
The user terminal
A second communication unit for transmitting an encrypted ID and a password to the cloud server;
And a remote access control and multi-factor authentication system.
The method of claim 3,
The password
Wherein the remote access control and multi-factor authentication system is a fake touch-based image password.
5. The method of claim 4,
The cloud server
A decryption unit for decrypting an ID and a password of the user terminal using a second decryption key;
An ID and a password verifying unit for verifying whether the decrypted ID and password are the same as a predetermined ID and password;
, ≪ / RTI &
And permits the user terminal to connect to the cloud server only if the decrypted ID and password are the same as the predetermined ID and password.

Images