WO2019190007A1

WO2019190007A1 - Access security management system for access control equipment on basis of blockchain sharing of biometric authentication log data

Info

Publication number: WO2019190007A1
Application number: PCT/KR2018/010923
Authority: WO
Inventors: 유미영; 이재형; 강민구
Original assignee: 옥타코 주식회사
Priority date: 2018-03-30
Filing date: 2018-09-17
Publication date: 2019-10-03
Also published as: KR101868589B1

Abstract

The present invention relates to a technique which can effectively and securely control access to access control equipment by providing a biometric authentication module to medical equipment, dangerous equipment, expensive equipment, and the like, configuring same as access control equipment, sharing, with an administrator computer, a biometric authentication access record of the equipment via blockchain, then determining the risk of an abnormal use to be high, if an item that is not consistent with the realtime status of an access-permitted user is detected, and generating a security warning. According to the present invention, use of the medical equipment, dangerous equipment, expensive equipment, and the like can be effectively controlled. Also, according to the present invention, by sharing with the administrator computer via blockchain in realtime, the biometric authentication access record of the medical equipment, dangerous equipment, expensive equipment, and the like, an item that is not consistent with the realtime status of the access-permitted user can be detected via software processing, and a security warning can be immediately generated, thereby effectively and securely controlling an abnormal use of the equipment.

Description

Access security management system based on blockchain sharing of biometric log data for access control equipment

The present invention generally relates to a technique for access management using biometric authentication and blockchain for medical equipment, dangerous equipment, expensive equipment, and the like.

More specifically, the present invention is configured as an access control device by installing a biometric module in medical equipment, dangerous equipment, expensive equipment, etc., and access is granted after sharing the biometric access record for these devices with a block computer on a blockchain. The present invention relates to a technology that can effectively and reliably perform access control on an access control device by determining that a risk of abnormal use is high and generating a security warning when an item incompatible with a real-time status of a user is detected.

In general, medical equipment, hazardous equipment, and expensive equipment have limited access to staff and responsible managers in hospitals and corporations. However, such access restrictions are, in reality, relied on in-house service regulations or administrative directors, and even by physical means, security officers or lockouts can be placed in the area.

In such a situation, even if an unauthorized person uses these devices, the manager may not immediately notice the facts and may not be revealed forever unless the staff is closely inspected. As described above, security management of medical equipment, dangerous equipment, and expensive equipment is incomplete. When people acted according to regulations, they seemed to be well managed, but when people who didn't follow the rules appeared, they were helpless.

Accordingly, there is a demand for a technology that can solve the problems of the prior art by enabling effective access control and monitoring by technically establishing an access management system for such equipment.

An object of the present invention is to provide a technology for access management using biometric authentication and blockchain in general for medical equipment, dangerous equipment, expensive equipment and the like.

In particular, an object of the present invention is to install the biometric authentication module in medical equipment, dangerous equipment, expensive equipment, etc. to configure access control equipment and share the biometric access records for these devices with the administrator computer on the blockchain, and then access the user. If an incompatible item is detected, the risk of abnormal use is judged to be high, and a security warning is issued to provide a technology that can effectively and reliably control access to access control equipment.

The present invention for achieving the above object is an access security management system for a plurality of access control equipment, in response to an access attempt to obtain accessor biometric information through a biometric sensor and accessor biometric information in advance registered reference biometrics In case of successful biometric authentication against information, the device access is allowed and the biometric authentication log data including the device identification information, access location information, and access time information is generated in connection with the access attempt. A plurality of access control equipment 100 for sharing log data in real time; It is installed on the administrator's computer, and through the blockchain processing, the plurality of access control equipment 100 and the biometric log data 200 are shared in real time, and the real-time status information regarding the time-specific location of the plurality of access permission users is obtained and On the basis of the blockchain sharing of biometric log data for access control type devices, including; security management agent unit 300 for generating a security alert when a non-compatible item is found by analyzing and comparing authentication log data and real-time status information. This paper presents an access security management system.

At this time, the access security management system according to the present invention is installed in a mobile terminal carried by the access authorization user, and cooperates with the clock module and the geographical location acquisition module embedded in the mobile terminal to provide a real-time status of the time-based location of the access authorization user. It may be configured to further include; status reporting agent unit 400 to obtain information and provide to the security management agent unit 300 through wired and wireless communication.

In the present invention, the access control device 100 includes a biometric information acquisition unit 110 for obtaining biometric information of an accessor through a biometric sensor in response to an access attempt; A reference storage unit 120 which receives and stores biometric information of an access permission user registered in advance for the access control type device; The accessor biometric information obtained through the biometric information acquisition unit is compared with the reference biometric information stored in the reference storage unit, and the accessor biometric information is authenticated. When the biometric authentication is successful, the device access is allowed. A biometric authentication unit 130; Location time identification unit 140 for obtaining geographic location information and time information for the access control device; Equipment identification information indicating unique identification information for the access control device in relation to the access attempt, access location information indicating the geographical position information obtained from the location time identification unit 140 at the time of the access attempt, location time at the time of the access attempt A log information manager 150 for generating biometric log data 200 including access time information indicating time information obtained from the identification unit 140; Blockchain equipment processing unit 160 for performing the blockchain processing according to a predetermined schedule to share the biometric log data 200 with other access control equipment 100 and the security management agent 300 in real time; Can be configured.

In addition, the security management agent unit 300, the user status management unit 310 for obtaining real-time status information regarding the time-by-hour position of the plurality of access permission users; A blockchain server processor 320 performing blockchain processing according to a preset schedule to share the plurality of access control equipment 100 and the biometric log data 200 in real time; Analyze the biometric log data 200 of the access control devices and the real-time status information of the access permission users according to the distance between the device access location and the access permission user location and the corresponding time interval according to the preset mobility criteria A log data analyzer 330 for determining whether there is an incompatible item; It may be configured to include; security risk warning notification unit 340 for generating a security warning according to the abnormal use risk in case of finding an incompatible item.

According to the present invention has an advantage that can effectively achieve the use control for medical equipment, dangerous equipment, expensive equipment and the like.

In addition, according to the present invention, by sharing the biometric access records for medical equipment, dangerous equipment, expensive equipment, etc. to the administrator computer through the blockchain in real time, the software process detects incompatible items and incompatible with the real-time status of the access authorization security warning The immediate onset of these benefits provides an effective and reliable control of abnormal use of these equipment.

1 is a view showing the overall configuration of an access security management system of an access control device according to the present invention.

Figure 2 is a flow chart showing the overall process of the access security management system of access control equipment according to the present invention.

Figure 3 is a block diagram showing the internal functional configuration of the access control equipment in the present invention.

Figure 4 is a block diagram showing the internal functional configuration of the security management agent unit in the present invention.

5 is a flowchart illustrating an operation process of a security management agent unit in the present invention.

Hereinafter, with reference to the drawings will be described in detail the present invention.

Referring to FIG. 1, the access security management system is configured as an access control device by installing a biometric module on medical equipment, dangerous equipment, expensive equipment, and the like, and a user who has been previously granted access to the access control device 100. The security management agent unit 300 monitors whether the access control is properly performed as well as blocking access to the other people 501 and only the access to the 401. In this case, the status report agent 400 may be further provided to secure the status information of the access permission user 401 in real time by the security management agent 300.

First, the access control device 100 is characterized in that the biometric sensor 110, for example, a fingerprint sensor or an iris sensor is provided. At this time, the biosensor 110 is preferably installed integrally integrated into the access control equipment 100. Using the biometric sensor 110, the access control device 100 determines whether to grant the access when someone attempts to access the device. Requesting biometric information (eg, fingerprint, iris, etc.) from an accessor to obtain biometric biometric information through the biometric sensor 110, and biometric authentication processing to compare the obtained biometric biometric information with reference biometric information previously registered Perform If the biometric authentication succeeds, the device access is allowed, while if the biometric authentication fails, the device access is rejected.

In addition, the access control device 100 generates a record associated with the access attempt if there is. That is, after generating the biometric log data 200 including the device identification information (equipment unique identification information), the access location information (geographic location information), the access time information (time stamp) in response to the access attempt, the blockchain Through the processing, the biometric log data 200 is shared in real time. The biometric log data 200 is generated asynchronously in the individual access control equipment 100, the biometric log data 200 generated by the various access control equipment 100 through the blockchain processing is not only collected. As well as the plurality of access control equipment 100 and the security management agent 300 is shared.

The security management agent unit 300 is installed in the form of dedicated software on the manager computer 301 and compares the access information generated from the access control device 100 with the security information against the status information of the access permission users 401. Monitor if it exists. To this end, the security management agent unit 300 receives the biometric log data 200 collected by the plurality of access control devices 100 through a blockchain process in real time in a shared manner. In addition, the security management agent unit 300 obtains real-time status information about the time location of the plurality of access users 401.

Then, the security management agent unit 300 checks whether the incompatible items exist by comparing the biometric log data 200 and the real-time status information of the access users 401, and if it finds incompatible items, Security alerts to help administrators recognize them immediately. The incompatible item in the present invention conceptually considers whether an access attempt is made to the access control device 100 in a place where the access user 401 cannot physically exist when considering the geographical location information and the time information. To check.

As described above, the present invention is characterized in that it shares the biometric log data 200 for the access control devices 100 in real time using a blockchain and monitors a security threat for an access attempt based thereon.

A block chain generally has the concept of a public digital transaction book where transaction information generated on a network is replicated and distributed as many as the number of nodes shared among network participants. Blockchain technology is currently being actively applied around the cryptocurrency, in the present invention, the access control device 100 generates the biometric log data 200 for the access attempt security management agent 300 We will use blockchain technology to collect and share data. Accordingly, according to the present invention, the plurality of access control devices 100 and the security management agent unit 300 participate in the digital ledger management of the blockchain as a peer.

The status reporting agent unit 400 is installed and implemented in the form of an app (APP) on a mobile terminal carried by the access permission users 401, for example, a watch module and a geographical location acquisition module (eg, embedded in the mobile terminal). GPS module) to obtain real-time status information on the time-by-hour position of the corresponding access permission user 401, respectively, and provide the security management agent 300 through wired and wireless communication.

Meanwhile, in the present invention, it is preferable that the security management agent 300 acquires real-time status information of the access permission users 401 through the status reporting agent 400, but is not necessarily limited thereto. It is also possible to use the manual or authorized user's computer login record of the authorized user (401).

2 is a flow chart showing the overall process of the access security management system of the access control device according to the present invention.

Step S100: First, a plurality of access control equipment 100 performs biometric authentication using biometric sensor 110 installed for each user's access attempt. The access control device 100 obtains accessor biometric information through the biometric sensor 110 and authenticates the accessor biometric information in comparison with reference biometric information registered in advance. It is to check whether the person who attempts to access the access control device 100 is a person who has previously registered as a person who has been granted access to the device through biometric information, for example, a fingerprint or an iris.

On the other hand, the access control device 100 receives the biometric information about the access permission user 401 from the manager computer 301, for example, and registers it. In this specification, the registered biometric information is referred to as 'reference biometric information'. For biometric information security, reference biometric information and accessor biometric information obtained through the biometric sensor 110 at that time are preferably stored in an encrypted form in an internal memory space of the access control device 100.

Steps S110 to S130: The access control device 100 checks whether the biometric authentication is successful for the accessor biometric information, and if the biometric authentication fails, the access control device 100 is preferably used. It informs the accessor of the biometric failure and denies access to the device. For example, an authentication failure is displayed in a form in which an error message is largely displayed on a display panel provided in the access control device 100. On the other hand, if the biometric authentication is successful, the access control device 100 allows the device access.

Then, the access control device 100 generates biometric log data 200 for the device access attempt. The biometric log data 200 includes device identification information indicating unique identification information of the access control device 100, access location information indicating geographical location information of the access control device 100 at the time of an access attempt, and access. It includes access time information indicating time information at the time of attempt. The information configuration of the biometric log data 200 is for effectively assisting security threat monitoring by the security management agent 300.

Steps S140 and S150: A plurality of access control devices 100 and a plurality of access control devices 100 and the security management agent 300 perform blockchain processing according to a preset schedule (for example, a 10 minute period). Collect the bio-authentication log data 200, which are generated separately, and share them in real time.

Step S160: Meanwhile, the security management agent unit 300 obtains real-time status information regarding the time-based location of the access permission users 401. It may be obtained through the status reporting agent 400 or may be obtained by another path, for example, by a manual log of a responsible employee or a computer login record of an authorized user 401.

Steps S170 to S190: The security management agent 300 compares the biometric log data 200 of the access control devices 100 and the real-time status information of the access permission users 401 to be incompatible with each other. If it is found that the risk of something abnormal use is determined to raise a security warning. In other words, when analyzing the geographic location information and time information identified from these information, if the access attempt is made to the access control device 100 where the access user 401 cannot physically exist, the security threat is threatened. To judge that there is.

In FIG. 2, it is assumed that an unauthorized user 501 uses a hacking technique to steal biometric information of an access user 401 and attempt to access a specific access control device 100. The access control device 100 may determine that the access attempt is normal based on the biometric information, and allow the access. However, the security management agent unit 300 may identify that there is a security threat to the access because the nominal access permission user 401 knows the current location.

3 is a block diagram showing the internal functional configuration of the access control device 100 in the present invention. Referring to FIG. 3, in the present invention, the access control device 100 includes a biometric information acquisition unit 110, a reference storage unit 120, a biometric authentication unit 130, a location time identification unit 140, and a log information management unit. 150, the blockchain equipment processing unit 160 is configured.

Hereinafter, each functional component constituting the access control device 100 will be described in detail.

First, the biometric information acquisition unit 110 is a module for obtaining biometric information of a user through biometric sensors such as a fingerprint sensor and an iris sensor. When an access attempt for the access control device 100 is received, a guide message is provided through a display screen to obtain biometric information from a corresponding accessor through a biometric sensor.

The reference storage unit 120 is a module that provides a storage space for receiving and storing biometric information of an access permission user registered in advance for the corresponding access control device.

The biometric authentication unit 130 compares the accessor biometric information previously obtained through the biometric information acquisition unit 110 with reference biometric information previously stored in the reference storage unit 120 to access the biometric information of the accessor to the device. Whether or not it is the authorized user 401 is authenticated. As a result of the authentication process, when the biometric authentication is successful, the device access to the access control device 100 is allowed.

The location time identification unit 140 obtains geographic location information and time information on the access control device 100. It can be implemented by including a GPS module and a clock module inside the equipment, or by using a time stamp set by the moving path and the receiver after externally transmitting a test packet.

The log information manager 150 generates biometric log data 200 in connection with an attempt to access the corresponding device. Preferably, log data is generated whenever there is an access attempt, regardless of the success or failure of biometric authentication. The biometric log data 200 includes device identification information indicating unique identification information of the access control type device, access location information indicating geographic location information obtained from the location time identification unit 140 at the time of access attempt, and access point of time. It may be configured to include the access time information indicating the time information obtained from the location time identification unit 140.

The blockchain equipment processing unit 160 is a component that performs blockchain processing on the access control equipment 100 side according to a preset schedule. Through the blockchain process, the access control device 100 shares the biometric log data 200 with other access control device 100 and the security management agent 300 in real time.

4 is a block diagram showing the internal functional configuration of the security management agent 300 in the present invention. Referring to FIG. 4, in the present invention, the security management agent unit 300 includes a user status management unit 310, a blockchain server processing unit 320, a log data analysis unit 330, and a security risk warning notification unit 340. It is configured by.

Hereinafter, each functional component constituting the security management agent unit 300 will be described in detail.

First, the user status management unit 310 obtains real-time status information regarding the time-by-hour position of the access permission users 401. It is preferable that the user status management unit 310 obtains real-time status information of the access users 401 through the status reporting agent 400, but is not necessarily limited thereto.

The blockchain server processing unit 320 is a component that performs blockchain processing on the security management agent 300 according to a preset schedule. Through the blockchain processing, the security management agent 300 receives the biometric log data 200 from a plurality of access control equipment 100 in a real time sharing format.

The log data analysis unit 330 analyzes the biometric log data 200 of the access control devices 100 and the real-time status information of the access permission users, and the distance between the device access location and the access permission user location according to time, and the corresponding. In preparation for the time interval, it is determined whether there is an incompatible item according to a preset mobility criterion. When analyzing the geographic location information and time information identified in these information, if the access user 401 attempts to access the access control device 100 where the user himself cannot physically exist, it is determined that there is a security threat. will be.

When the security risk warning notification unit 340 finds an incompatible item, it generates a security warning according to an abnormal use risk and assists the administrator to immediately recognize and perform a corresponding action accordingly.

5 is a flowchart illustrating an operation process of the security management agent 300 in the present invention.

Step (S200): First, the user status management unit 310 obtains real-time status information regarding the hourly position of the access users 401 from the status report agent 400 possessed by the access permission users 401. .

Step S210: The blockchain server processing unit 320 performs blockchain processing according to a preset schedule, thereby controlling access control devices 100 and biometric log data 200 (equipment identification information, access location information, and access). Time information) in real time.

Step S220: The log data analysis unit 330 analyzes the biometric log data 200 of the access control devices 100 and the real-time status information of the access permission users 401, and the device access position and time by time. Prepare for correlation of access user location. That is, for each time zone, the access control type device 100 is located and the access permission users 401 are prepared for the location.

Step S230: The log data analyzer 330 determines whether there are incompatible items according to a preset mobility criterion in preparation for the distance between the equipment access location and the access permission user location and the corresponding time interval. That is, the access control device 100 to determine the location of the access control device 100 and the access permission user 401 around the time when the access attempt has occurred, the access permission user 401 himself This is to check whether or not an access attempt has been made to the access control device 100 where it cannot exist physically.

Steps (S240 ~ S260): If the above check does not find an incompatible item, it may not take special measures because it has not found anything that is considered a security threat.

On the other hand, when incompatible items are found, the log data analysis unit 330 determines that the unauthorized use of the unauthorized user 501 attempts to access the access control device 100 has a high risk of abnormal use. In this case, the possibility of a security threat cannot be ignored, so take appropriate action. For example, the security risk warning notification unit 340 may generate a security warning according to the abnormal use risk, and the security management agent 300 may directly control the access control device 100 to stop the operation of the device. .

Meanwhile, the present invention may be embodied in the form of computer readable codes on a computer readable nonvolatile recording medium. Such nonvolatile recording media include various types of storage devices, such as hard disks, SSDs, CD-ROMs, NAS, magnetic tapes, web disks, cloud disks, etc., and code is distributed in a plurality of networked storage devices. Forms that are implemented and executed may also be implemented. In addition, the present invention may be implemented in the form of a computer program stored in a medium in combination with hardware to execute a specific procedure.

Claims

Access security management system for multiple access control equipment,

In response to the access attempt, the accessor biometric information is acquired through the biometric sensor, and if the biometric authentication succeeds in comparing the accessor biometric information with a pre-registered reference biometric information, the device access is allowed to be processed. A plurality of access control type devices 100 generating biometric log data including equipment identification information, access location information, and access time information and sharing the biometric log data in real time through a blockchain process;

It is installed on the administrator computer, and through the blockchain processing to share the plurality of access control type device 100 and the biometric log data 200 in real time and obtain the real-time status information on the time-by-hour location of the plurality of access permission users A security management agent 300 for generating a security alert when the biometric log data and the real-time status information are compared and found to be incompatible with each other;

Access security management system based on blockchain sharing of biometric log data for access control devices, including.
The method according to claim 1,

It is installed in the mobile terminal carried by the access permission user, and cooperates with the clock module and the geographic location acquisition module embedded in the mobile terminal to obtain real-time status information regarding the time-based location of the access permission user through the wired / wireless communication. Status reporting agent unit 400 provided to the agent unit 300;

Access security management system based on the blockchain sharing of biometric log data for access control equipment further comprising.
The method according to claim 1 or 2,

The access control equipment 100,

A biometric information acquisition unit 110 for obtaining biometric information of an accessor through a biometric sensor in response to an access attempt;

A reference storage unit 120 which receives and stores biometric information of an access permission user registered in advance for the access control type device;

The accessor biometric information obtained through the biometric information acquisition unit is compared with the reference biometric information stored in the reference storage unit, and the accessor biometric information is authenticated. When the biometric authentication is successful, the device is accessed. Biometric processing unit 130 for allowing the processing;

Location time identification unit 140 for obtaining geographic location information and time information for the access control device;

The device identification information indicating the unique identification information of the access control device in relation to the access attempt, the access location information indicating the geographical location information obtained from the location time identification unit 140 at the time of the access attempt, the access attempt A log information management unit 150 generating biometric log data 200 including access time information indicating time information obtained from the location time identification unit 140 at a time point;

A blockchain equipment processing unit 160 for performing blockchain processing according to a preset schedule to share the biometric log data 200 with other access control equipment 100 and the security management agent 300 in real time;

Access security management system based on the blockchain sharing of biometric log data for access control equipment, characterized in that comprising a.
The method according to claim 3,

The security management agent unit 300,

A user status management unit 310 for obtaining real-time status information regarding a time-based location of a plurality of access permission users;

A blockchain server processor 320 for performing blockchain processing according to a predetermined schedule to share the plurality of access control equipment 100 and the biometric log data 200 in real time;

Based on the biometric log data 200 of the access control devices and the real-time status information of the access permission users by analyzing the separation degree of the device access location and the access user location by time and the preset mobility possibility in preparation for the corresponding time interval Log data analysis unit 330 to determine whether there is an incompatible item according to;

Access security management system based on the blockchain sharing of biometric log data for access control equipment, characterized in that comprising a.
The method according to claim 4,

The security management agent unit 300,

A security risk warning notification unit 340 for generating a security warning according to an abnormal use risk when the incompatible item is found;

Access security management system based on the blockchain sharing of biometric log data for access control equipment further comprising a.