KR20200051185A - Security system based on user terminal - Google Patents

Abstract

The present invention relates to a security authentication system based on a user terminal. More particularly, the present invention relates to a security authentication system based on a user terminal which maintain network security by allowing access to a service server only when a user who wants to perform a specific task or use a service is located in an area close to the service server. According to the present invention, it is possible to improve a security authentication level by multiplying the authentication processes of a user working inside a facility where specific security is required, or by using equipment connected to an in-house network.

Description

Security authentication system based on user terminal {SECURITY SYSTEM BASED USER TERMINAL}

The present invention relates to a security authentication system based on a user terminal, and more specifically, to secure a network by allowing access to a corresponding service server only when a user who wants to perform a specific task or use a service is located in an area close to the service server. It relates to a user terminal-based security authentication system that can maintain.

With the development of information and communication technology, the importance of information protection and security is increasing as information is concentrated online. Information protection securely protects the organization's or individual's computer and information from various illegal activities, including forgery, forgery, leakage, unauthorized service, etc. of information transmitted through a computer-based information system or a network such as wired or wireless Internet, It is a technology to prevent security breaches in the physical space and provide security in a convergence system with other industries. It is divided into common-based security, network security, device security, service security, and convergence security technology.

Security has traditionally grown into two categories: physical security and information security. Recently, physical security and information have been introduced as physical security industries such as access control, parking facility management, and CCTV video security are combined with IT information security technology that protects information on computers and networks. The boundaries of security have been broken down, and an area called convergence security has emerged. In addition, as IT technology is used in existing industries such as automobile, shipbuilding, medical, and electric power, it is necessary to deal with security problems arising from IT and industry convergence. It is included in the new convergence security.

Encryption and authentication refers to a technique for securing confidentiality by encrypting data and communication sections stored in the computer system and authenticating users who want to access the system. As a common-based security technology, the scope of application can be Web Security, DB Security, XML Security, Network Security, Smartphone Security, etc. that encrypts the transmission and reception between a web server and a browser, and Public Key Infrastructure (PKI) such as password, authentication, and electronic signature. have.

In relation to the user authentication technology, it is necessary to authenticate whether the user receiving the service is an appropriate user due to the non-face-to-face nature of online services. If the user cannot be properly authenticated, personal information may be exposed depending on the type of service. It is essential to secure safety and reliability through certification. The element used to determine whether the user receiving the service is legal is called an authentication element.

Disclosed is a technique for generating a security key from an authentication element unique to a specific device and a specific user in a security system for identifying a user in a service provision process.

1 is a block diagram showing a payment security authentication system based on short-range wireless communication according to the prior art, and FIG. 2 is a block diagram showing the configuration of the client terminal and the payment gate server of FIG. 1.

The conventional short-range wireless communication-based payment security authentication system includes a client terminal 100, a seller terminal 130, a payment gate server 150, and a bank server 180.

The client terminal 100 receives payment request information including payment account information and payment amount through short-range wireless communication with the seller terminal 130, and performs payment through the payment gate server 150 for the received payment request information. It is made possible.

Here, the seller terminal 130 is equipped with a short-range wireless communication module that supports short-range wireless communication, the client terminal 100 approached into the short-range wireless communication area, and the payment request information corresponding to the sales amount and deposit account information is short-range. It can be provided to the client terminal 100 by wireless communication.

After the payment gate server 150 communicates with the client terminal 100 through the communication network 170 and undergoes an authentication process for the client terminal 100, if it is processed as normal authentication, account transfer request information requested by the client terminal 100 Receiving and processing the payment amount to be transferred to the withdrawal account bank server 180 registered in the client terminal 100.

The payment gate server 150 exchanges the private key held by the client terminal 100 with the public key held by the payment case server 150 when the client terminal 100 is connected through the communication network 170, and the main data. When the user authentication information registered in the base 160 and the user authentication information transmitted from the client terminal 100 match, the client terminal 100 registers the payment information requested by the client terminal 100 while communicating according to a set security method. It is processed so that payment can be processed in the registered account of the withdrawal account bank server 180.

The client terminal 100 includes a client short-range wireless communication module 102, a client main communication module 103, a client encryption / decryption module 104, a client authentication execution module 105, and a client electronic payment database (DB) 106. And a client control module 108.

The client short-range wireless communication module 102 is controlled by the client control module 108 to perform short-range wireless communication with the seller terminal 130.

The client main communication module 103 is controlled by the client control module 108 to communicate with the payment gate server 150.

The client electronic payment database (DB) 106 is controlled by the client control module 108, such as authentication information and payment processing information, and stores various kinds of information.

The client control module 108 processes the signal received through the client short-range wireless communication module 102, processes the signal received from the payment gate server 150 through the client main communication module 103, and the payment gate server After communicating with the public key of the payment gate server 150 when communicating with the 150, the payment gate server 150 and the transmission target information using the symmetric key subsequently provided by the payment gate server 150 The control target elements including the client encryption / decryption module 104 are controlled so as to encrypt and transmit and receive processing.

In addition, the client control module 108 stores and processes processing information and information requiring storage in the client electronic payment database 106.

The payment gate server 150 determines whether the client terminal 100 is connected, and when it is confirmed that it is connected, exchanges the public key it has. That is, the client terminal 100 transmits the private key held to the payment gate server 150, and the payment gate server 150 transmits the public key held to the client terminal 100.

Thereafter, the payment gate server 150 tests the private key received from the client terminal 100 (step 230). In addition, the client terminal 100 also tests the public key received from the payment gate server 150.

Here, if the key testing process is successfully completed, it is determined whether the information transmitted by encrypting with the other party's key is normally decrypted by the other party, and if it is determined that the normal decryption has been performed, the payment gate server 150 uses the symmetric key as the client terminal 100. Encrypted with the private key of and transmitted to the client terminal 100, the client terminal 100 decrypts the received symmetric key with its own private key, and then uses the symmetric key to the client terminal 100 and the payment gate server 150 ) Encrypt information to be transmitted to each other so that transmission and reception processing is possible.

However, in the security authentication system based on the short-range wireless communication, a user accessing a specific system is required to have a terminal capable of short-range wireless communication. Takes.

In addition, when a user has a terminal equipped with a terminal, and there is a function different from normal activity and detects it, there is no function to prevent intrusion or hacking, which is a factor for security.

KR 10-1395315 B1 KR 10-2016-0016244 A KR 10-2016-0072391 A KR 10-1666791 B1

The present invention for solving the above-mentioned problems allows a user terminal connected to a service server and a wireless communication network to be used as a general smartphone, and installs an application and a unique key in the smartphone to provide a security system without a dedicated terminal. The objective is to provide a user terminal-based security authentication system that can be built.

Also, after the user accesses the service server and stores the work history performed, it is recorded in a table so that a third-party unauthorized theft can be prevented by performing a verification process when executing a different job from the normal job contents. The objective is to provide a user terminal-based security authentication system.

In addition, when the user presses the data deletion or blocking button in an urgent situation, the administrator server deletes a specific file stored in the service server or moves the file to the backup server to block third-party access to the user terminal-based security authentication system. It aims to provide.

In addition, by introducing block chain technology, information about each user's access authentication information and access history is stored in a distributed user terminal to prevent hacking or falsification of security authentication information by providing a user terminal-based security authentication system. It is aimed at providing.

The present invention devised to solve the above-mentioned problems is a security authentication system that allows access to the service server only when a user is located in an area close to the service server, a gateway app that exchanges information for user authentication ( 213) and a user terminal 210 including a unique key 215 used as user authentication information; A service server 230 that allows the user to access and work or use the service; An administrator server 240 for controlling the operation of the service server 230, data storage, change, and deletion; It includes; the user terminal 210, the service server 230, the network 220 to enable data transmission and reception by connecting the administrator server 240; includes, the service server 230 is a wireless communication module 231 ), And the service server 230 allows access to the user when the user terminal 210 is located in an accessible area close enough to be connected to the wireless communication module 231.

The wireless communication module 231 is characterized in that it is a short-range wireless communication equipment using the Bluetooth protocol.

Further comprising; a backup server 250 for moving and storing data stored in the service server 230, the administrator server 240, when an emergency signal is input from the user terminal 210, the service server It characterized in that the specific data stored in (230) is moved to the backup server (250) and then deleted from the service server (230).

When the emergency signal is inputted from the user terminal 210, the manager server 240 blocks the connection between the service server 230 and the network.

The administrator server 240 collects information about the time when the user accesses the service server 230, the accessing folder, and the files used, and records the information in a table, and the user performs the service server 230 When the content of the work to be performed is different from the content recorded in the table, it is characterized in that the user terminal 210 used by the user requests additional authentication.

The administrator server 240 releases the connection to the service server 230 when the additional authentication requested by the user terminal 210 is not received or when the additional authentication is inappropriate.

According to the present invention, there is an effect of improving the security authentication level by performing the authentication process of a user working inside a facility requiring specific security or by using equipment connected to an in-house network.

1 is a block diagram showing a payment security authentication system based on short-range wireless communication according to the prior art.
Figure 2 is a block diagram showing the configuration of the client terminal and the payment gate server of Figure 1;
Figure 3 is a block diagram showing the configuration of a security authentication system according to an embodiment of the present invention.
4 is a conceptual diagram showing whether to allow access between a user terminal inside an accessible area and a user terminal outside.
5 is a block diagram showing the configuration of a user terminal.
Figure 6 is a flow chart showing the operation process of the security authentication system.
7 is a block diagram illustrating the concept of distributedly storing data about a user's access record.
8 is a conceptual diagram showing a process of collecting a user's usage patterns and writing them into a table.
9 is a conceptual diagram showing a method of deleting or blocking data in an emergency.

Hereinafter, a "user terminal-based security authentication system" (hereinafter referred to as a 'security authentication system') according to an embodiment of the present invention will be described with reference to the drawings.

3 is a block diagram showing the configuration of a security authentication system according to an embodiment of the present invention, and FIG. 4 is a conceptual diagram showing whether a user terminal in an accessible area and a user terminal outside are allowed to access, FIG. 5 is a user It is a block diagram showing the configuration of a terminal.

The security authentication system 200 of the present invention is used for the purpose of allowing a user to access a system by authenticating a user who has access to a specific physically separated space, thereby allowing access to the system. It can also be used to authenticate users entering and exiting certain security zones.

The security authentication system 200 includes a plurality of user terminals 210 connected to a network 220, a service server 230, an administrator server 240, and a backup server 250.

The user terminal 210 has a wireless communication function, and is preferably a device capable of installing an application and storing a unique key 215, and a smart phone or tablet PC, which is commonly used, is most suitable. For security authentication, information stored in the user terminal 210 must be input in addition to the security code input by the user.

The network 220 may also use a wide area open network, such as the Internet, but in general, an external network and an intranet blocked so that access is possible only within a specific building or facility will be most suitable.

The service server 230 refers to a device used by a user to perform work or work, and includes all devices that provide a user with specific services such as financial transactions, information retrieval, and security work. In order to access the service server 230, in addition to the authentication code, the user terminal 210 must be brought inside a certain area. For this, a wireless communication module 231 is installed in the service server 230.

The wireless communication module 231 can be applied to any device including a short-range wireless communication protocol, it is preferable to use a module using a Bluetooth communication method to easily check whether the user terminal 210 is in the short distance. The wireless communication module 231 transmits and receives data to and from the user terminal 210 in a Bluetooth manner, and operates in a manner of having its own battery or sharing power used for the service server 230.

The wireless communication module 231 is small and can be manufactured in one piece with the service server 230 by manufacturing it as an embedded module.

The administrator server 240 performs operations such as operation of the security authentication system 200 of the present invention, intrusion prevention, and tracking of unauthorized persons, and is generally installed in a remote location, but is physically the same space as the service server 230 Might be installed on

The backup server 250 moves and stores data stored in the service server 230 in an emergency. After the manager moves the specific file or the like to the backup server 250 according to the signal input from the user terminal 210, the administrator controls to delete the file at the original location. In some cases, the administrator can fundamentally prohibit access to the backup server 250 from the outside by separating the backup server 250 from the network 220.

In order to utilize the security authentication system 200 of the present invention, the user must install a dedicated application on his / her user terminal 210. In the present invention, this is called a gateway app 213.

The user terminal 210 in which the gateway app 213 is installed may operate as an authentication device for accessing the security authentication system 200.

The user approaches the area where the service server 230 to be used is located while the user terminal 210 is in possession. 3 and 4, a certain area from the service server 230 is called an accessible area (ⓐ). When the Bluetooth module is used as the wireless communication module 231, the connectable area will be about 3 m in radius from the wireless communication module 231. However, depending on the use and size of the service server 230 and the output of the wireless communication module 231, the size of the connectable area may vary.

Preferably, when the user terminal 210 enters the connectable area, the presence of the service server 230 and the wireless communication module 231 is displayed on the display of the user terminal 210. In addition, while an authenticated user is working on the service server 230, when the user leaves the accessible area while moving away from the service server 230, the connection is released due to the user leaving the area on the display of the 210 Let me know that it's done.

Even if the user has a normal user terminal 210, the user cannot access the corresponding service server 230 unless it is within the designated accessibility area. Therefore, the user must possess the user terminal 210 in which his / her own key 215 is installed in addition to the authentication information for user authentication, so that a user can perform a desired task or use a service.

The user terminal 210 is usually used as a personal communication terminal such as a smartphone, the user terminal 210 is installed with an operating system (OS) 211 and an API (Application Program Interface) 212.

The OS 211 refers to an operating system software that controls hardware of a smartphone or computer and provides a base environment for application software, and serves as an arbitration function so that a user can use a terminal.

The API 212 refers to a language or message format used for communication between the OS 211 and an application program. The API 212 is used as an operating system or program interface for programmers. The API 212 has a language or message format used when an application program communicates with a system program such as the OS 211 or a database management system, and calls a function that provides a connection to a specific subroutine for execution within the program. Is implemented.

The user can use the user terminal 210 as a security authentication means by installing the gateway app 213 on his or her user terminal 210 and installing the unique key 215.

The unique key 215 is used as information for user authentication. Since it is encrypted by using the hardware information and communication service authentication information provided to the user terminal 210 together, it is difficult to duplicate, hack, or tamper and improve security. have.

The communication module 214 allows the authentication process while transmitting and receiving data to and from the Bluetooth module installed in the service server 230.

The process of performing security authentication using such a system will be described.

6 is a flow chart showing the operation process of the security authentication system.

First, the user prepares to use the security authentication service by installing and executing the gateway app 213 on his or her user terminal 210. (S102) A unique key in a predetermined manner with the installation of the gateway app 213. 215).

Then, the user executes the gateway app 213 of the user terminal 210 and inputs authentication information to request access to the service server 230. The service server 230 detects the user terminal 210 connected to the wireless communication module 231 and checks whether the user terminal 210 of the corresponding user is in the accessible area (S104, S106).

If the user terminal 210 is not in the reachable area, the service server 230 transmits an access failure message to the user terminal 210 and disallows the user's access (S108).

If the authentication information transmitted from the user terminal 210 of the user who requested the connection is suitable, and the presence of the user terminal 210 is also detected, the service server 230 requests the user terminal 210 to transmit the unique key. Check this. (S110)

In addition, access to the service server 230 is allowed according to the user's request. (S112) The user can work on the service server 230 in a predetermined manner or use various services (S114).

In addition, when the user's work is finished and the job termination message is transmitted, the service server 230 blocks the connection. If the user intentionally or accidentally leaves the connectable area during work, the connection is terminated and the user is notified.

On the other hand, in the present invention, the authentication information for the user's access and the information about the connection history are applied not to the service server 230 or to the user terminal 210 of a specific user but to be distributed and stored.

7 is a block diagram showing the concept of distributedly storing data on a user's access record.

As shown in FIG. 7, the manager server 240 calls authentication information and access history information stored in a specific user terminal 210 from the service server 230 and transmits the information to a plurality of different user terminals 210. And save. If a specific user changes authentication information or when a history of accessing the service server 230 is newly generated, the changed authentication information or new history information is transmitted to the plurality of user terminals 210 and stored.

Distributing and storing data in all user terminals 210 belonging to the security authentication system 200 of the present invention is a method for improving security. In some cases, it is possible to increase the efficiency of the network by selecting an appropriate number of user terminals 210 and storing only a portion.

On the other hand, the present invention discloses a method of storing data for each user's work pattern performed by a user accessing the service server 230 for each user and using it for security incident verification.

It is highly likely that a specific user accesses a specific physical space to access the service server 230 and perform his / her duties. And the work related to these positions will not change much for the same user.

For example, if a specific user connects to the service server 230 early in the morning and is in charge of creating or modifying a personnel-related file, there is a high possibility of performing the same operation at about the same time. However, if a third party steals the user's information or steals the user terminal 210 and acts abnormally, it may be suspected that a security accident has occurred.

The present invention discloses a method of generating and utilizing a specific user's work history as a table. 8 is a conceptual diagram showing a process of collecting a user's usage pattern and writing it into a table.

The manager server 240 collects information about the time a user normally accesses the service server 230, frequently accessed folders, and files that are created or stored. Through this, it analyzes when a specific user mainly accesses, accesses a folder, and performs a task to generate a result using an artificial intelligence (AI) algorithm. Then, write it as a table and save it. Tables created for each user are stored in the service server 230 or the manager server 240.

When a specific user accesses and works with the service server 230 while generating a work pattern table for each user from the information collected for a considerable time as described above, the manager server 240 displays the information recorded in the table and the current user. Monitor whether work is consistent. It monitors whether it is in a time zone similar to the time of normal access, accessing a folder that has never been accessed before, or opening or creating a file of a different type from the normal format.

If the behavior of the currently accessed user differs from the behavior pattern stored in the table by a certain level or higher, the administrator server 240 considers that there is a possibility of a security accident, thereby improving the security level. Specifically, it is possible to take measures such as requesting additional high-level security authentication information for the user currently working or directly checking the user by dispatching to the site. If there is no answer to the request for additional security authentication or incorrect information is entered, the connection to the service server 230 is immediately released and a warning alarm is sent.

Meanwhile, various types of data generated and stored by an operator will be stored in the service server 230 installed in a place requiring a high level of security. In addition, third-party hacking attempts may occur for such data.

In the present invention, since a user who wants to work enters and works directly in an area where the service server 230 is installed, when a security accident occurs, the user can directly take emergency measures to protect or prevent data leakage. .

9 is a conceptual diagram illustrating a method of deleting or blocking data in an emergency.

When the user detects an attempt to hack the service server 230 during the operation or knows an attempt to steal data through another path, the user may press the “delete” button displayed on his / her user terminal 210. If the emergency "delete" button is pressed while the gateway app 213 is running, the gateway app 213 transmits it to the manager server 240 and the service server 230.

When the delete command is input, the manager server 240 immediately deletes the corresponding data from the service server 230. In some cases, the connection between the service server 230 and the network 220 is blocked to prevent data leakage. In addition, the data to be deleted or the data requiring urgent protection is moved to the backup server 250, and when the transfer is completed, the backup server 250 is blocked from the network to make access impossible.

In this way, it is possible to implement a function that can protect data or prevent leakage in an emergency situation.

The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but the above-described technical configuration of the present invention is not limited to those skilled in the art to which the present invention pertains without changing the technical spirit or essential features of the present invention. It will be understood that can be carried out. Therefore, the above-described embodiments are to be understood in all respects as illustrative and not restrictive, and the scope of the present invention is indicated by the following claims rather than the detailed description, and the meaning and scope of the claims and It should be construed that any altered or modified form derived from the equivalent concept is included in the scope of the present invention.

200: security authentication system 210: user terminal
220: network 230: service server
231: Wireless communication module 240: Manager server
250: backup server

Claims (6)

As a security authentication system that allows access to the service server only when the user is located in an area close to the service server,
A user terminal 210 including a gateway app 213 for exchanging information for user authentication and a unique key 215 used as user authentication information;
A service server 230 that allows the user to access and work or use the service;
An administrator server 240 for controlling the operation of the service server 230, data storage, change, and deletion;
It includes; the user terminal 210, the service server 230, the network 220 to enable data transmission and reception by connecting the administrator server 240; includes,
The service server 230 includes a wireless communication module 231,
When the user terminal 210 is located in an accessible area close enough to be able to access the wireless communication module 231, the service server 230 allows the user to access the user terminal-based security Authentication system. According to claim 1,
The wireless communication module 231 is a short-range wireless communication equipment using a Bluetooth protocol, user terminal-based security authentication system. According to claim 1,
It further includes a backup server 250 for moving and storing data stored in the service server 230,
When the emergency signal is input from the user terminal 210, the manager server 240 moves specific data stored in the service server 230 to the backup server 250 and then deletes it from the service server 230. Characterized in that, the user terminal-based security authentication system. According to claim 1,
When the emergency signal is input from the user terminal 210, the administrator server 240 blocks the connection between the service server 230 and the network, and the user terminal-based security authentication system. According to claim 1,
The administrator server 240 collects information about the time when the user accesses the service server 230, the accessing folder, and the files used, and records the information in a table, and the user performs the service server 230 If the content of the work to be done is different from the content recorded in the table, the user terminal 210, characterized in that requiring additional authentication, the user terminal-based security authentication system. The method of claim 5,
The administrator server 240 releases access to the service server 230 when the additional authentication requested by the user terminal 210 is not received or when additional authentication is inappropriate, based on the user terminal. Security authentication system.

Images