KR20220075937A - User authentication method and device - Google Patents

Abstract

A method is disclosed. A method according to an embodiment disclosed in this document uses a first device including a first authentication data acquisition module, a second device, and a third device including a third authentication data acquisition module, wherein the first obtaining, by the device, first authentication data through the first authentication data acquisition module; transmitting to a second device; receiving, by the third device, the first authentication data from the second device through short-range wireless communication in response to a tag input of the second device; and acquiring the second authentication data through the third authentication data acquisition module. In addition to this, various embodiments identified through the specification are possible.

Description

USER AUTHENTICATION METHOD AND DEVICE

Embodiments disclosed in this document relate to a user authentication method in a limited network environment.

Various methods are used for user authentication, such as ID/Password authentication, email authentication, fingerprint authentication, and iris authentication. Recently, as user authentication based on the user's biometric data has been activated, a simple and fast authentication service is provided to the user. User authentication is used in various fields such as access to a specific place and payment.

For example, user authentication for authenticating access rights in a specific place is performed by a device installed in a specific place (eg, a fingerprint recognition door lock, a fingerprint recognition office access device). In this case, data required for user authentication is stored in the installed device. And the device compares the stored data with the data input by the user and performs authentication.

For example, when user authentication is required for a specific purpose, authentication is performed by a server of a company that operates the authentication. And data required for user authentication is stored in the server. The server performs authentication by comparing data stored in the server with data input by the user.

Data used for user authentication (hereinafter, authentication data) is data closely related to user privacy. The authentication data may be stored in a device carried by the user or may be stored in an external device in which user authentication is performed. In this case, if the device or an external device is stolen, there is a risk that the authentication data will be leaked. In particular, when the authentication data is biometric data, since the user cannot change the data like the ID and password methods, the authentication data may be permanently exposed.

When the authentication data is stored by an external server operated by a company, it is stored relatively safely, but there is still a risk of hacking. In addition, authentication by the server has a limitation in that authentication itself becomes impossible in an environment where wired and wireless networks are limited.

Various embodiments disclosed in this document provide a user authentication method capable of performing user authentication even in an environment in which a network is restricted, and minimizing the risk of theft of authentication data, and an electronic device thereof.

A method according to an embodiment disclosed in this document uses a first device including a first authentication data acquisition module, a second device, and a third device including a third authentication data acquisition module, wherein the first acquiring, by the device, first authentication data through the first authentication data acquisition module; transmitting to a second device; receiving, by the third device, the first authentication data from the second device through short-range wireless communication in response to a tag input of the second device; acquiring second authentication data through a third authentication data acquisition module, when the third device matches the first authentication data with the second authentication data, a success flag value through short-range wireless communication to the second device transmitting, and the third device may include deleting the first authentication data and the second authentication data.

In addition, the electronic device according to an embodiment disclosed herein includes a short-range wireless communication circuit configured to communicate with a first device and a second device, a memory, and at least one processor, wherein the at least one processor comprises: Receive first authentication data from the first device through the short-range wireless communication circuit in response to occurrence of a tag input between the first device and the electronic device, and respond to occurrence of a tag input with the second device to transmit the received first authentication data to the second device through the short-range wireless communication circuit, receive a flag value of authentication success related to the first authentication data from the second device, and It may be configured to perform a preset task in response to reception.

According to the embodiments disclosed in this document, there is provided a method for effectively performing user authentication even in an environment in which wired and wireless networks are limited. In addition, a method for preventing leakage of authentication data due to loss or damage of the authentication device is provided. In addition, various effects directly or indirectly identified through this document may be provided.

1 is a view for explaining a user authentication method according to an embodiment.
2 is a block diagram of a registration device according to an embodiment.
3 is a block diagram of a user device according to an embodiment.
4 is a block diagram of an authentication device according to an embodiment.
5 is a block diagram of a server according to an embodiment.
6 is a flowchart of a user authentication method according to an embodiment.
7 is a signal flow diagram of a user authentication method according to an embodiment.
8 is a signal flow diagram of a user authentication method including an encryption process according to an embodiment.
9 is a view for explaining a work support system according to an embodiment.
10 is a signal flow diagram of a work support service provided by the work support system according to an embodiment.
11A to 11D are examples of user device screens according to various embodiments of the present disclosure;
In connection with the description of the drawings, the same or similar reference numerals may be used for the same or similar components.

Hereinafter, various embodiments of the present invention will be described with reference to the accompanying drawings. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that various modifications, equivalents, and/or alternatives of the embodiments of the present invention are included.

1 is a view for explaining a user authentication method according to an embodiment.

The user authentication method may be understood as a method of authenticating whether a specific user is present. The user authentication method according to an embodiment may be performed by the registration device 100 , the user device 200 , the authentication device 300 , and the server 400 .

The registration device 100 may be a device for acquiring authentication data. The authentication data may include biometric data obtained from unique physical characteristics of each person, such as fingerprint data, iris data, and face data.

The user device 200 may be understood as a device possessed or owned by a user to be authenticated. The user may carry the user device 200 and perform authentication using the user device 200 when authentication is required. The user device 200 may be understood as a portable electronic device such as a smart phone or a tablet PC.

The authentication device 300 may be a device installed for user authentication in a specific place. In various embodiments, the authentication device 300 may be respectively installed in a plurality of spaces requiring authentication. For example, when there are a plurality of places where a specific user's access right, access right, etc. need to be authenticated, the authentication device 300 may be installed in each place. The authentication device 300 may obtain authentication data from a user for user authentication.

The server 400 may be understood as a device for operating a user authentication method. The server 400 may determine who the user to be authenticated is, or may generate a task to be performed for the authenticated user. The server 400 may transmit/receive data to and from the registration device 100 , the user device 200 , and/or the authentication device 300 through a network. For example, the server 400 may be understood as a server device operated by a subject providing a user authentication service.

2 is a block diagram of a registration device according to an embodiment.

In an embodiment, the registration device 100 may include a communication circuit 105 , a processor 110 , a memory 120 , and an authentication information capture module 130 . The processor 110 may control the overall dynamics of the registration device 100 . The registration device 100 may transmit/receive data to and from the user device 200 and the server 400 through the communication circuit 105 . The communication circuit 105 may include a short-range communication module (Near Field Communication, NFC module). The registration device 100 transmits/receives data to and from the user device 200 through the short-range communication module of the communication circuit 105 . can do.

In an embodiment, the memory 120 may store user and task information 121 . The user and task information 121 may include, for example, user identification information, authentication data, names, and categories of users registered in advance in the user authentication service. In addition, the user and task information 121 may include information on a task to be performed through the authentication service. The task information may include, for example, task identification information, a name, and various data necessary to execute the task.

The memory 123 may store manager information 123 . For example, when the user authentication method is performed by an administrator having a specific authority, administrator authentication may precede authentication start. The manager information 123 may include manager identification information, authority information, and authentication data required for manager authentication.

The memory 120 may store a program for implementing the user authentication method. The program may be driven based on the user and task information 121 and the manager information 123 . The operation of the processor 110 of the registration device 100 may be determined and performed according to the operation of the program.

The authentication information acquisition module 130 may be understood as a module for acquiring authentication data. When the authentication data is a fingerprint, the authentication information obtaining module 130 may be a fingerprint recognition sensor. When the authentication data is an iris, the authentication information obtaining module 130 may be an iris recognition sensor. When the authentication data is a face, the authentication information acquisition module 130 may be an infrared camera. The authentication information acquisition module 130 may be understood as a known device or module that can be applied according to authentication data used for user authentication.

3 is a block diagram of a user device 200 according to an embodiment.

In an embodiment, the user device 200 may include a communication circuit 205 , a processor 210 , a memory 220 , and a display 230 . The processor 110 may control the overall dynamics of the user device 200 . The user device 200 may transmit and receive data through the communication circuit 205 with the registration device 100 , the authentication device 300 , and the server 400 . The communication circuit 205 may include a short-range communication module (NFC module). The user device 200 may transmit/receive authentication data to and from the registration device 100 and the authentication device 300 through the short-range communication module of the communication circuit 105 .

In an embodiment, the memory 220 may store authentication data 221 and task information 223 . The authentication data 221 may be understood as authentication data for authentication of a user who is an authentication target. The authentication data 221 may be data obtained and transmitted by the registration device 100 . The authentication data 221 may include biometric data of a holder of the user device 200 . The biometric data may include, for example, biometric data that can identify a specific person, such as fingerprint data, iris data, facial data, and heart rate data. The authentication data 223 may be temporarily stored in the user device 200 . For example, when the authentication process is finished, the authentication data 223 may be deleted.

The task information 223 may include, for example, task identification information, a task name, information related to the authentication device 300 , and various data necessary to execute the task. The authentication device 200 and related information may be understood as mapping information stored in advance so that a specific task is executed according to the authentication device 200 on which authentication is performed. For example, when there are authentication devices 200 installed in a plurality of places, a task to be executed for each place may be different. In this case, the user device 200 may be configured to receive identification information of the authentication device 200 and perform a task mapped to the identification information.

The memory 120 may store a program for implementing the user authentication method. The program may be driven based on the authentication data 221 and the task information 223 . The operation of the processor 210 of the user device 200 may be determined and performed according to the operation of the program.

In an embodiment, the user device 200 may execute the program and output an execution screen of the program through the display 230 . The program may include a user authentication module and a task execution module. For example, the task may be a task executed on the premise of user authentication. Examples of the execution screen will be described later with reference to FIGS. 11A to 11D .

4 is a block diagram of an authentication device 300 according to an embodiment.

In an embodiment, the authentication device 300 may include a communication circuit 305 , a processor 310 , a memory 320 , and an authentication information capture module 330 . The processor 310 may control the overall dynamics of the authentication device 300 . The authentication device 300 may transmit/receive data through the user device 200 and the server 400 and the communication circuit 305 . The communication circuit 105 may include a short-range communication module (NFC module). The authentication device 300 may transmit/receive authentication data to and from the user device 200 through the short-range communication module of the communication circuit 305 .

The authentication information acquisition module 330 may be understood as a module for acquiring authentication data. The authentication information obtaining module 330 may be referred to as an authentication information obtaining module 130 included in the registration device 100 . Since the registration device 100 and the authentication device 300 work together to perform user authentication, they may have the same authentication information acquisition module.

In an embodiment, the memory 320 may store device identification information 321 and authentication data 323 . The device identification information 321 may be identification information of the authentication device 300 , identification information of a space in which the authentication device 300 is installed, or identification information about a purpose of the authentication device 300 . The device identification information 321 may be transmitted to the user device 200 , and the user device 200 may determine a task to be executed based on the device identification information 321 .

The authentication data 323 may include identification information of users registered in advance in the user authentication service. The authentication data 323 stored in the authentication device 300 may be temporarily stored. For example, when the authentication process is finished, the authentication data 323 may be deleted.

The memory 120 may store a program for implementing the user authentication method. The program may be driven based on the device identification information 321 and the authentication data 323 . The operation of the processor 310 of the authentication device 300 may be determined and performed according to the operation of the program.

The registration device 100 , the user device 200 , and the authentication device 300 described above with reference to FIGS. 2 to 4 may interact to provide a user authentication service. A program installed in each device may be understood as a program implemented and designed to provide the user authentication service. Operations of each of the processors 110 , 210 , and 310 of each device for providing a user authentication service may be induced by running the program. Accordingly, the program installed in each device may be understood as a different program implemented and designed for the operation of each device.

5 is a block diagram of a server according to an embodiment.

Referring to FIG. 5 , the server 400 may include a communication circuit 405 , a processor 410 , and a memory 420 . The processor 410 may control overall operations of the server 400 . The server 400 may perform wireless communication with the registration device 100 , the user device 200 , and/or the authentication device 300 through the communication circuit 405 .

The server 400 may store task information 421 and user information 423 in the memory 420 . The task information 421 is information on a task for which user authentication is required. For example, the task information 421 may include task identification information, task name, and user category information having access to the task. The user information 423 is information about a user who is to be authenticated through a user authentication service. It may include user identification information, user name, and user category information for a user registered in advance in the user authentication service.

The memory 420 may store the task generating program 425 . The task generating program 425 may be understood as a program implemented and designed to generate a task requiring user authentication. The user authentication service according to an embodiment may be provided by a program installed in each of the devices 100 , 200 , and 300 and a task generating program 425 installed in the server 400 . When user authentication is required for a specific task, the user authentication service may provide both authentication and performance of the task. An example of this will be described later with reference to FIGS. 9 to 11D .

6 is a flowchart of a user authentication method according to an embodiment. Referring to FIG. 6 , a user authentication method using the registration device 100 , the user device 200 , and the authentication device 300 may be provided.

In operation 610 , the registration device 100 may acquire first authentication data through the authentication information acquisition module 130 . The first authentication data may be understood as authentication data of a user to be authenticated.

In operation 620 , the registration device 100 may transmit the acquired first authentication data to the user device 200 through short-range wireless communication in response to the tag input of the user device 200 . The tag input may be understood as a tag input generated through short-range wireless communication when the user device 200 approaches the registration device 100 within the coverage of a near-field communication (NFC) module. When a tag input occurs, the registration device 100 may transmit the first authentication data obtained in step 610 to the user device 200 .

In another embodiment, after a tag input occurs between the registration device 100 and the user device 200 , the registration device 100 may acquire the first authentication data (related to operation 610 ). In this case, the tag input may correspond to an action of logging in by a user who has the user device 200 to the registration device 100 . In this case, the registration device 100 may obtain authentication data input for the logged-in user. A message for requesting input of authentication data to the registration device 100 may be output to the user device 200 through the display 230 .

In operation 630 , the authentication device 300 may receive the first authentication data from the user device 200 through short-range wireless communication in response to the tag input of the user device 200 . Alternatively, the user device 200 may transmit the first authentication data to the authentication device 300 in response to a tag input of the authentication device 300 .

In operation 640 , the authentication device 300 may acquire second authentication data through the authentication information acquisition module 330 . The second authentication data may be obtained from a user who inputs a tag to the user device 200 in operation 630 . The user may be understood as a user to be authenticated. In operation 640 , the user device 200 may output a message requesting input of authentication data to the authentication device 300 through the display 230 .

In operation 650, the authentication device 300 may determine whether the first authentication data and the second authentication data match. The first authentication data is authentication data obtained by the registration device 100 , and the second authentication data is authentication data obtained by the authentication device 300 . Accordingly, the authentication device 300 may determine whether the authentication data obtained in operation 610 is the same as the authentication data obtained in operation 650 .

In various embodiments, the registration device 100 may be understood as a device installed in a trusted and safe space and operated by an administrator of a user authentication service. Accordingly, the authentication data obtained by the registration device 100 is necessary for authenticating a legitimate user and may be understood as reliable data. Accordingly, by comparing the authentication data obtained from the user who has accessed the authentication device 300 with the authentication data obtained by the registration device 100 , it is possible to determine whether the user is a legitimate user with actual authority.

In various embodiments, the authentication device 300 may operate in an environment in which a network is restricted (eg, access to a control area inside a military facility, an important warehouse in a developing country). As a representative example, when authentication for access authority to a control area inside a military facility is required, the user authentication method according to FIG. 6 may be used. In this case, a soldier having access to a specific area may carry the user device 200 and authenticate the access authority through the authentication device 300 installed in the specific area.

In addition, even if the network environment is limited, data transmission between the registration device 100 , the user device 200 , and the authentication device 300 is performed by a short-range communication module (eg, the communication circuit 105 of FIG. 2 , the communication circuit 205 of FIG. 3 ). ), because it can be achieved by the communication circuit 305 of FIG. 4), user authentication becomes possible. Accordingly, even when wired and wireless network facilities are not provided in the control area, user authentication is possible only by installing the authentication device 300 .

If the authentication in step 650 is successful, in step 660 the authentication device 300 may transmit a success flag value to the user device 200 through short-range wireless communication.

In operation 670, the authentication device 300 may delete the first authentication data and the second authentication data. When user authentication is completed, the authentication device 300 may delete authentication data received in the authentication process. By deleting the authentication data, even when an accident such as theft or damage of the authentication device 300 occurs, the risk of leaking the authentication data can be eliminated.

7 is a signal flow diagram of a user authentication method according to an embodiment. Referring to FIG. 7 , a user authentication method using the server 400 , the registration device 100 , the user device 200 , and the authentication device 300 may be provided. For example, the server 400 may be understood as a server device for providing a user authentication service for a specific task.

The server 400 may generate a task requiring user authentication. For example, when the server 400 creates a task, task information (task identification information) and user information associated with the task (identification information about a user who performs a task or has access to the task) may be determined. have. The server 400 may generate a task by driving the task generating program 425 stored in the memory 420 . The server 400 may determine task information and user information related to the task based on the task information 421 and the user information 423 , and transmit it to the registration device 100 .

The registration device 100 may perform administrator authentication to secure authentication data for the created task ( 705 ). For example, in order to guarantee the reliability of the authentication data obtained by the registration device 100, a pre-designated administrator may exist. The administrator may be a user designated in advance by the server 400 .

The administrator authentication may be performed based on authentication data acquired from the administrator by the authentication information acquisition module 130 like other user authentication. For example, the registration device 100 may perform manager authentication by comparing the manager's authentication data previously stored in the manager information 123 with the acquired authentication data.

If the administrator authentication is successful, authentication data of a user associated with the created task may be acquired ( 707 ). For example, the registration device 100 may acquire user authentication data corresponding to user identification information (eg, name, ID). The user identification information may be information included in task-related information received from the server 300 . The administrator who has performed the administrator authentication in operation 705 checks whether the person who will input the authentication data in operation 707 is a user corresponding to the user identification information.

When a tag input occurs between the user device 200 and the registration device 100 ( 709 ), the registration device 100 may transmit the first authentication data to the user device 200 ( 711 ). In operation 711 , the registration device 100 may transmit first authentication data to the user device 200 in response to the occurrence of the tag input, or the user device 200 registers in response to the occurrence of the tag input The device 100 may request transmission of the first authentication data.

Between operations 711 and 713 , the user may move to a place where the authentication device 300 is installed. The moving user may place the user device 200 close to the authentication device 300 and generate a tag input between the two devices.

When a tag input occurs between the user device 200 and the authentication device 300 ( 713 ), the user device 200 may transmit the first authentication data to the authentication device 300 ( 715 ). In operation 715 , the user device 200 may transmit first authentication data to the authentication device 300 in response to the occurrence of the tag input, or the authentication device 300 is registered in response to the occurrence of the tag input The device 200 may request transmission of the first authentication data.

The authentication device 300 may acquire second authentication data from a user carrying the user device 200 through the authentication information acquisition module 330 (S717). At this time, a message requesting to input authentication data may be output through the display 230 of the user device 200 (eg, the screen 1150 of FIG. 11B ). The authentication device 300 may perform user authentication by checking whether the first authentication data and the second authentication data match (S719).

When the first authentication data and the second authentication data match, the authentication device 300 may transmit a success flag value to the user device 200 ( 721 ). In this case, the authentication device 300 may transmit identification information of the authentication device 300 together with a success flag value. The identification information of the authentication device 300 may be, for example, a device unique ID or a code number of an installation place of the authentication device 300 .

In various embodiments, the user device 200 may generate an input request event based on identification information of the authentication device 300 (eg, a screen 1160 of FIG. 11C ). The user device 200 may receive input data in response to the input request event. For example, a task according to successful authentication may be to receive input data from a user. An example of this (task of creating a work log) will be described later with reference to FIGS. 9 to 11D .

The user device 200 may execute the task upon receiving the success flag value ( 725 ). The task may be determined by the server 400 .

In an embodiment, the task may be determined according to the received identification information of the authentication device 300 . Through the user authentication program 225 of the user device 200 , the stored task may be executed by being mapped with the identification information of the authentication device 300 . The mapping information may be stored in task information 223 . The task information 223 of the user device 200 may be updated by the server 400 and may be synchronized with the task information 421 of the server 400 .

When the task execution is completed, the user device 200 may transmit the task execution result and related data to the server 400 ( 727 ). The task execution result may be a success flag value of the task. In this case, data input or generated during task execution may be transmitted as related data. The task execution result may be the failure flag value of the task. In this case, task error codes or data generated during execution may be transmitted as related data.

Referring to FIG. 7 , by registering authentication data once through the registration device 100 , the user may carry the authentication data in the user device 200 . In various embodiments, even when a plurality of authentication devices 300 are required (eg, authentication of access qualifications for a plurality of zones), the user can perform authentication in a plurality of zones using the user device 200 carried by the user. have. The conventional method is a method of storing authentication data in the authentication device 300, and according to this method, since authentication data must be stored in all of the authentication devices 300, it becomes cumbersome, and the risk of theft of the authentication data increases. Authentication to multiple authentication devices 300 is possible only by registering authentication data once, and the user can carry authentication data in the user device 200, so that convenience, economy, and security can be increased.

8 is a signal flow diagram of a user authentication method including an encryption process according to an embodiment. Hereinafter, operations overlapping those of FIG. 7 will be replaced with descriptions in FIG. 7 .

When the server 400 creates a task, it may generate encryption information for the task ( 801 ). Operation 801 may correspond to operation 701 of FIG. 7 . When the server 400 determines task information and user information associated with the task, encryption information may also be generated.

In an embodiment, the encryption information may include a pair of public and private keys generated by the RSA encryption method. The server 400 may transmit the generated public key to the registration device 100 ( 803 ). The server 400 may transmit the generated private key to the authentication device 300 ( 805 ).

Operations 807 and 809 may correspond to operations 705 and 707 of FIG. 7 , respectively. When the registration device 100 obtains the first authentication data, it may encrypt the first authentication data using the received public key ( 811 ). By performing encryption on the data immediately after the registration device 100 obtains the authentication data, the authentication data may then be distributed in an encrypted state. Security can be increased.

When a tag input occurs between the registration device 100 and the user device 200 ( 813 ), the registration device 100 may transmit the encrypted first authentication data to the user device 200 ( 815 ).

When a tag input occurs between the user device 200 and the authentication device 300 ( 817 ), the user device 200 may transmit the encrypted first authentication data to the authentication device 300 ( 819 ). The authentication device 300 may acquire the second authentication data through the authentication data acquisition module 330 ( 821 ) (corresponding to operation 717 of FIG. 7 ). The authentication device 300 may decrypt the encrypted first authentication data using the private key received from the server 400 .

In various embodiments, when the server 400 generates encryption information in operation 801 , the validity period of the encryption information may be determined. When transmitting the public key or the private key, the server 400 may transmit the validity period information together. In another example, when the authentication device 300 does not include the communication circuit 305 for a wired or wireless network, the private key may be directly stored in the memory 320 by an administrator without going through a network.

In this case, the authentication device 300 may check the validity period of the private key before performing the decryption. When the validity period of the private key has elapsed, the authentication device 300 cannot decrypt the encrypted first authentication data. In this case, the authentication device 300 may transmit an encryption information update request to the user device 200 or may directly transmit an encryption information update request to the server 400 .

In various embodiments, different encryption information may be allocated to each user category of a user registered in the authentication service. For example, the user's category may be a rank (in the case of a user group belonging to a company) or a rank (in the case of a user group belonging to the military). For example, in a company, encrypted information allocated to employees and encrypted information allocated to executives may be different. Accordingly, in the encryption process of operation 811, encryption may be performed with a different public key for each user category. Similarly, in the decryption process of operation 823, decryption may be performed with a different private key for each user category. Accordingly, different tasks may be executed for each category of the user. You can have execution rights for different tasks for each user category.

The authentication device 300 may perform user authentication by determining whether the decrypted first authentication data and the second authentication data match ( 825 ). Thereafter, operations 827 to 833 correspond to operations 721 to 727 of FIG. 7 .

In various embodiments, user authentication may be performed for a plurality of groups. For example, the registration device 100 may obtain a plurality of authentication data from users to be authenticated, and may perform encryption on the plurality of authentication data. In addition, encryption or decryption may be performed once for a plurality of authentication data. When there are a plurality of users involved in the task, since a plurality of authentication data can be moved from the registration device 100 to the user device 200 and from the user device 200 to the authentication device 300 at once, efficiency can be increased. In addition, security may be guaranteed due to encryption.

9 is a view for explaining a work support system according to an embodiment.

Referring to FIG. 9 , as an application example of the user authentication method of the present invention, an embodiment of performing user authentication and work log creation tasks for work in a specific area in a military facility where a network environment is limited is disclosed. Hereinafter, the system disclosed in FIG. 9 is referred to as a work support system. The duty support system according to an embodiment may be understood as a system capable of supporting and managing the work of a soldier at a work site of a military facility that is not equipped with a network environment, and recording and managing a work log.

The work support system includes a server 401 (eg, server 400 in FIG. 5 ), registration device 101 (eg, registration device 100 in FIG. 2 ), and user device 201 (eg, user in FIG. 3 ). The device 200) and the authentication device 301 (eg, the authentication device 300 of FIG. 4 ) may be included.

The server 401 may create a worker manpower schedule, record a work log, and manage it. The worker manpower schedule may include identification information of the worker, and information on the work place and work time of the worker. A work log can be understood as a log for a specific work place, work time.

The server 401 and the registration device 101 may be located in a control center. A control center may be understood as a safe area within a military installation, where administrative tasks of the military installation are performed. The authentication device 301 may be deployed in respective working areas within the military installation. User authentication may be performed through the authentication device 301 for recording whether the work of the worker in the corresponding work area starts, progresses, or ends.

A soldier who is a worker may carry the user device 201 . An application for a work support system may be installed in the user device 201 . The user device 201 may be provided with the service of the work support system by driving the application.

When the work schedule is determined, the work support system may receive fingerprint data of a user designated as a worker (hereinafter referred to as a worker) through the registration device 101 . If the employee's fingerprint data is already stored in the registration device 101, the process of inputting the fingerprint data may be omitted. When the user device 201 is tagged to the enrollment device 101 via near field communication (NFC), the first fingerprint data of the worker is moved from the enrollment device 101 to the user device 201 to It may be stored in a memory (eg, the memory 320 of FIG. 3 ).

The worker carries the user device 201 in which his or her fingerprint data is stored and moves to the work area. When the user device 201 is tagged through near field communication (NFC) to the authentication device 301 disposed in the work place, the first fingerprint data is moved from the user device 201 to the authentication device 301, and the authentication device 301 ) may be stored in a memory (eg, the memory 420 of FIG. 4 ).

The authentication device 301 may acquire the employee's second fingerprint data through a fingerprint recognition module (eg, the authentication information acquisition module 330 of FIG. 4 ). The authentication device 301 may authenticate the worker by comparing the first fingerprint data and the second fingerprint data.

When authentication is completed, the authentication device 301 may transmit an authentication success flag value to the user device 201 . A task to be performed in the work support system may be work log writing. In response to the transmission of the success flag value, the user device 201 may output a screen interface for writing a work log through a display (eg, the display 230 of FIG. 3 ). According to the screen, the worker can input the work log data (write the work log). The input work log may be uploaded to the server 401 through the user device 201 . The server 401 may store the input work diary in memory.

10 is a signal flow diagram of a work support service provided by the work support system according to an embodiment. 11A to 11D are examples of user device screens according to various embodiments of the present disclosure; Hereinafter, examples of the screen of the user device 201 displayed for each operation will also be described with reference to FIGS. 10 and 11A to 11D .

The server 401 may generate a worker manpower schedule. In this case, a work schedule for the first user who is a specific worker may be determined ( 1001 ). The server 40 may transmit work schedule information for the first user and identification information for the first user to the registration device 101 .

The first user may carry the user device 201 at a time determined by the work schedule. Referring to FIG. 11A , a first screen 1100 may be displayed on the display of the user device 201 . The first screen 110 may be a message requesting input of a tag between the registration device 101 and the user device 201 provided in the control center. The user device 201 may be maintained in an inactive state until the tag is input.

The first user may tag the user device 201 to the registration device 101 in response to the output of the first screen 1100 ( 1005 ). Referring to FIG. 11A , a second screen 1110 displayed according to the tag input is illustrated. For example, after the tag input 1007, checklist information commonly applied to all users may be updated.

The checklist information may be a list of items included in the work log stored in the server 401 . For example, the checklist information may include items to be checked during working hours for each work location.

The first user may input a fingerprint into the enrollment device 101 . The enrollment device 101 may acquire the fingerprint data of the first user through the fingerprint acquisition module ( 1007 ). The first authentication data of the first user may be transmitted to the user device through short-range wireless communication ( 1009 ).

Referring to the third screen 1120 of FIG. 11A , a screen displayed on the user device 201 after the first user's fingerprint data input is completed is shown. It may be understood as a screen for loading user information and checklist information for the workplace where the user will work. The user device 201 may download work schedule information received from the server 401 and checklist information to be input according to the schedule from the registration device 101 . In another example, the user device 201 may directly download work schedule information and checklist information from the server 401 .

Referring to FIG. 11B , when a specific user logs in to the user device 201 , a fourth screen 1130 may be displayed through the user device 201 . The user device 201 may be a device commonly used by a plurality of users registered in the work support service. Accordingly, when a specific user among a plurality of users registered in the work support service possesses the specific user device 201 , the application for the work support system of the user device 201 may be in a log-in state by the specific user.

Referring to the fourth screen 1130 , the number of lists to be checked for the work place code may be displayed. The work place code may be understood as an identification code for any one work place among a plurality of work places. The work place code may also be referred to as identification information of the authentication device 301 of the corresponding work place. The number of lists to be checked may mean the number of items to be input through the checklist.

The first user may arrive at the workplace and tag the authentication device 301 using the user device 201 . When a tag input occurs between the user device 201 and the authentication device 301 ( 1011 ), the first fingerprint data stored in the user device 201 may be transmitted to the authentication device 301 through short-range wireless communication ( 1013).

Referring to the fifth screen 1140 of FIG. 11B , a synchronization standby screen in response to a tag input is displayed. When synchronization is completed, the user device 201 may output a message requesting fingerprint input to the authentication device 301 through the sixth screen 1150 .

The authentication device 301 may obtain second fingerprint data of the first user ( 1015 ). For example, the first user may perform a fingerprint input in response to the request message on the fifth screen 1140 . The second fingerprint data may be input through a fingerprint recognition module (eg, the authentication information acquisition module 330 of FIG. 4 ) of the authentication device 301 .

The authentication device 301 may authenticate the first user by comparing the first fingerprint data and the second fingerprint data ( 1017 ). If authentication is successful, the authentication device 301 may transmit a success flag value and a work place code value to the user device 201 ( 1019 ).

The user device 201 may generate an input request event based on the received work place code value ( 1021 ). The input request event may be, for example, an input request for a check list of a specific work place. The user device 201 may receive input data in response to the input request event ( 1023 ). The input data may be stored in a memory of the user device 201 (eg, the memory 220 of FIG. 3 ).

For example, after user authentication is successful, the application stored in the user device 201 may be implemented to output a pop-up message through a display.

Referring to the seventh screen 1160 of FIG. 11C , a screen on which a check risk for a specific work site is displayed is illustrated, for example. The user device 201 may receive, for example, a selection input for any one item among poor/good/excellent and a text input for an unusual item for each item. The user device 201 may store the received input data in a memory.

Checklist items in the work log can be added, changed, or deleted by the administrator of the Control Center. Changes are reflected in the server 401 and may be reflected in the user device 201 through applications installed on the server 401 and the user device 201 .

In various embodiments, operations 1021 and 2023 may be repeatedly performed as a pop-up event. Referring to the eighth screen 1170 of FIG. 11C , when a predetermined time elapses from tag input between the authentication device 301 and the user device 201, the user device 201 displays a message requesting re-authentication through the display. can be printed The predetermined time may be a predetermined time or a time determined at random. Therefore, a message requesting re-authentication may pop up regularly or irregularly.

By repeatedly requesting authentication, it may be recorded whether the first user is continuously located at the work place and continues to work. In addition, the user device 201 may record and store the first user's working location, working hours, and number of authentications. The stored records may be uploaded to the server 401 and reflected in the work log of the server 401 . Through the repeated authentication, it is possible to prevent workers from leaving the workplace.

The authentication device 301 may delete the received first fingerprint data and second fingerprint data when the first user's working hours have elapsed or there is no need to additionally perform authentication ( 1025 ).

The user device 201 may transmit data input by the first user to the server 401 ( 1027 ). For example, the user device 201 may be set to automatically upload data input during the working time to the server 401 after the user's work is finished. In another example, a mounting space for the user device 201 may be provided in the control center. When the user device 201 is located in the holding space, the input data may be automatically uploaded.

The server 401 may update the work log based on the received input data ( 1031 ). When the transmission of the input data is completed, the user device 201 may delete the first fingerprint data ( 1029 ).

Referring to the ninth screen 1180 of FIG. 11D , a standby screen is shown, for example, while input data is transmitted and the work log of the server 401 is updated. Referring to the tenth screen 1190, when the work diary is updated when the user device 201 is placed in the storage space, a request message to remove the user device 201 from the storage space is output through the screen when the update is completed. can be

The electronic device according to various embodiments disclosed in this document may have various types of devices. The electronic device may include, for example, a portable communication device (eg, a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance device. The electronic device according to the embodiment of the present document is not limited to the above-described devices.

The various embodiments of this document and the terms used therein are not intended to limit the technical features described in this document to specific embodiments, but it should be understood to include various modifications, equivalents, or substitutions of the embodiments. In connection with the description of the drawings, like reference numerals may be used for similar or related components. The singular form of the noun corresponding to the item may include one or more of the item, unless the relevant context clearly dictates otherwise. As used herein, "A or B", "at least one of A and B", "at least one of A or B," "A, B or C," "at least one of A, B and C," and "A , B, or C" each may include all possible combinations of items listed together in the corresponding one of the phrases. Terms such as "first", "second", or "first" or "second" may be used simply to distinguish an element from other elements in question, and may refer elements to other aspects (e.g., importance or order) is not limited. It is said that one (eg, first) component is "coupled" or "connected" to another (eg, second) component, with or without the terms "functionally" or "communicatively". When referenced, it means that one component can be connected to the other component directly (eg by wire), wirelessly, or through a third component.

As used herein, the term “module” may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as, for example, logic, logic block, component, or circuit. A module may be an integrally formed part or a minimum unit or a part of the part that performs one or more functions. For example, according to an embodiment, the module may be implemented in the form of an application-specific integrated circuit (ASIC).

Various embodiments of the present document include a machine (eg, the registration device 100 of FIG. 2 , the user device 200 of FIG. 3 , the authentication device 300 of FIG. 4 , and the server 400 of FIG. 4 )) one or more stored in a storage medium (eg, the memory 120 of FIG. 2 , the memory 220 of FIG. 3 , the memory 320 of FIG. 4 , the memory 420 of FIG. 5 ) readable by May be implemented as software comprising instructions. For example, a processor (eg, FIG. 2 ) of a device (eg, the registration device 100 of FIG. 2 , the user device 200 of FIG. 3 , the authentication device 300 of FIG. 4 , and the server 400 of FIG. 4 ) The processor 110 of FIG. 2, the processor 210 of FIG. 3, the processor 320 of FIG. 3, and the processor 420 of FIG. 4) call at least one of the one or more instructions stored from the storage medium, and can run This makes it possible for the device to be operated to perform at least one function according to the called at least one command. The one or more instructions may include code generated by a compiler or code executable by an interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not contain a signal (eg, electromagnetic wave), and this term is used in cases where data is semi-permanently stored in the storage medium and It does not distinguish between temporary storage cases.

According to one embodiment, the method according to various embodiments disclosed in this document may be provided as included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product is distributed in the form of a machine-readable storage medium (eg compact disc read only memory (CD-ROM)), or via an application store (eg Play Store ^TM ) or on two user devices ( It can be distributed (eg downloaded or uploaded) directly or online between smartphones (eg: smartphones). In the case of online distribution, at least a part of the computer program product may be temporarily stored or temporarily generated in a machine-readable storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

According to various embodiments, each component (eg, a module or a program) of the above-described components may include a singular or a plurality of entities. According to various embodiments, one or more components or operations among the above-described corresponding components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (eg, a module or a program) may be integrated into one component. In this case, the integrated component may perform one or more functions of each component of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. . According to various embodiments, operations performed by a module, program, or other component are executed sequentially, in parallel, repeatedly, or heuristically, or one or more of the operations are executed in a different order, or omitted. or one or more other operations may be added.

Claims (15)

A user authentication method using a first device including a first authentication data acquiring module, a second device including a first authentication data acquiring module, and a third device including a third authentication data acquiring module, the method comprising:
acquiring, by the first device, first authentication data through the first authentication data acquiring module;
transmitting, by the first device, the acquired first authentication data to the second device through short-range wireless communication in response to the tag input of the second device;
receiving, by the third device, the first authentication data from the second device through short-range wireless communication in response to the tag input of the second device;
acquiring, by the third device, second authentication data through the third authentication data acquiring module;
transmitting, by the third device, a success flag value through short-range wireless communication to the second device when the first authentication data and the second authentication data match; and
and deleting, by the third device, the first authentication data and the second authentication data. The method according to claim 1,
The user authentication method is
Further comprising a server comprising a communication circuit configured to communicate with the first device and the third device,
generating, by the server, a task associated with a specific user; and
Further comprising the step of transmitting information on the task and information on the specific user to the first device, the user authentication method. 3. The method according to claim 2,
Creating the task includes:
generating a pair of a private key and a public key as encryption information associated with the task;
transmitting, by the server, the public key to the first device; and
Further comprising the step of the server transmitting the private key to the third device, the user authentication method. 4. The method according to claim 3,
The step of the first device transmitting the first authentication data to the second device,
encrypting the first authentication data using the received public key, and transmitting the encrypted first authentication data;
The step of the third device receiving the first authentication data to the second device,
to receive the encrypted first authentication data,
Decrypting the encrypted first authentication data using the received private key, User authentication method. 4. The method according to claim 3,
The step of the server generating a pair of a private key and a public key,
Further comprising the step of generating information on the validity period of the pair of private key and public key, user authentication method. The method according to claim 1,
The step of obtaining the first authentication data by the first device comprises:
When the manager authentication by the first device is successful, the first authentication data is acquired through the first authentication data acquisition module, the user authentication method. The method according to claim 1,
The step of the third device transmitting the success flag value to the second device comprises:
Including the step of transmitting the identification information of the third device to the second device, user authentication method. 8. The method of claim 7,
generating, by the second device, an input request event based on the received identification information of the third device;
Receiving, by the second device, input data in response to the occurrence of the input request event; further comprising, a user authentication method. In an electronic device,
short-range wireless communication circuitry configured to communicate with the first device and the second device;
Memory; and
at least one processor;
The at least one processor,
Receive first authentication data from the first device through the short-range wireless communication circuit in response to generation of a tag input between the first device and the electronic device,
In response to occurrence of a tag input with the second device, transmitting the received first authentication data to the second device through the short-range wireless communication circuit,
receiving a flag value of authentication success related to the first authentication data from the second device;
The electronic device is configured to perform a preset task in response to receiving the flag value. 10. The method of claim 9,
further comprising a display;
The at least one processor,
and output a message requesting input of second authentication data to the second device through the display in response to occurrence of a tag input with the second device. 10. The method of claim 9,
The at least one processor,
The electronic device is configured to receive the flag value and identification information of the second device. 12. The method of claim 11,
The at least one processor,
Generates an input request event based on the identification information of the second device,
an electronic device configured to receive input data in response to the input request event. 12. The method of claim 11,
The memory is
storing identification information of the second device and mapping information of a task;
The at least one processor,
The electronic device is configured to perform the task mapped with the identification information of the second device. 10. The method of claim 9,
Further comprising a wireless communication circuit configured to communicate with a server that provides a user authentication service,
The at least one processor,
an electronic device configured to transmit a result of performing the task to the server. 10. The method of claim 9,
further comprising a display;
The at least one processor,
The electronic device is configured to display a screen including an input request message through the display as the preset task is performed.

Images