WO2020004896A1

WO2020004896A1 - User terminal, electronic device, and method for controlling user terminal and electronic device

Info

Publication number: WO2020004896A1
Application number: PCT/KR2019/007636
Authority: WO
Inventors: 엄충용; 신준범; 찰리이올렉산더; 이동익; 이종성; 정영만; 제상준; 주치홍; 최종민
Original assignee: 삼성전자주식회사
Priority date: 2018-06-25
Filing date: 2019-06-25
Publication date: 2020-01-02
Also published as: KR20200000739A

Abstract

Disclosed are a user terminal, an electronic device, and a method for controlling the user terminal and the electronic device. Specifically, the present disclosure relates to a method for ensuring security when pairing the user terminal and the electronic device on the basis of a beacon signal, transmitted by the electronic device, including authentication information and connection state information.

Description

User terminal, electronic device and control method of user terminal and electronic device

The present disclosure relates to a user terminal, an electronic device, and a method of controlling the user terminal and the electronic device. More specifically, when the electronic device transmits a beacon signal including authentication information and connection state information, the user terminal and the electronic device are based on the same. The present invention relates to a method for securing security regarding pairing between devices.

Recently, due to the development of communication technology, the Internet of Things (IoT) technology, which can conveniently control things by connecting things in a wired and wireless network, has been developed.

However, in order for IoT technology to realize its full potential, high security must be secured when pairing between a user terminal and an electronic device.

As a method for securing security, a public key distribution method through an out-of-band channel is used, but there is a problem in that an additional cost is required to use such a method.

In addition, a method of displaying a personal identification number (PIN) on an electronic device and inputting the same to a user terminal requires that a separate display be provided on the electronic device. It is pointed out that there is a problem of certificate leakage by using -Key.

In order to overcome the limitations described above, an authentication method using a beacon frame has been given as a challenge. However, in the case of following the in-band method, it is vulnerable to attack by a man in the middle (MITM). As a result, there is a need for a method for securing complementarity while utilizing a beacon frame.

The present disclosure has been made in accordance with the above-described necessity, and when an electronic device transmits a beacon signal including authentication information and connection state information, security of pairing between a user terminal and the electronic device can be secured based on this. It's about how to do that.

According to an embodiment of the present disclosure for achieving the above object, a control method of a user terminal may include a first method including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device. Receiving a beacon signal, accessing the electronic device based on the first connection state information, and performing a session connection with the electronic device based on the validity of the authentication information, session with the electronic device When the connection is performed, receiving a second beacon signal including second connection state information indicating that the session connection has been performed from the electronic device; when a user's command is input to the electronic device, the user from the electronic device Receiving a third beacon signal including third connection status information indicating that a command of is input; and And pairing with the electronic device based on third connection state information.

In this case, the authentication information, the first connection state information, the second connection state information, and the third connection state information may be included in a field of a service set identifier (SSID) of the electronic device and transmitted.

The control method of the user terminal may further include not performing a session connection with the electronic device when at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match. have.

On the other hand, the control method of the user terminal is based on the second connection state information included in the received second beacon signal, if it is determined that there are two or more electronic devices that the session connection with the user terminal, the two or more The method may further include not performing pairing with the electronic device.

If the third beacon signal is not received for a preset time after the second beacon signal is received, the control method of the user terminal may further include not performing pairing with the electronic device.

The control method of the user terminal may further include outputting a user notification when the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit.

According to an embodiment of the present disclosure, a method of controlling an electronic device may include transmitting a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device may be connected to the electronic device; When the user terminal accesses the electronic device based on the first connection state information, performing a session connection with the user terminal based on the validity of the authentication information, and performing a session connection with the user terminal. Changing the first connection state information to second connection state information; transmitting a second beacon signal including the changed second connection state information; when a user command is input to the electronic device, Changing the connection state information to the third connection state information and transmitting a third beacon signal including the changed third connection state information; It includes the system.

The authentication information, the first connection state information, the second connection state information, and the third connection state information may be included in a field of a service set identifier (SSID) of the electronic device and transmitted.

Meanwhile, according to an embodiment of the present disclosure, a user terminal includes a communication unit, a memory including at least one command, and a processor connected to the communication unit and the memory to control the user terminal.

The processor receives a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device, from the electronic device through the communication unit, and the first connection state information. Connect to the electronic device based on the validity, perform a session connection with the electronic device based on the validity of the authentication information, and when a session connection with the electronic device is performed, a session from the electronic device through the communication unit. A third beacon signal including second connection state information indicating that connection is performed, and when a user's command is input to the electronic device, a third signal indicating that a user's command is input from the electronic device through the communication unit; Receive a third beacon signal including connection status information, the third connection status information Based on performs a pairing with the electronic device.

In this case, if at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match, the processor may not perform a session connection with the electronic device.

On the other hand, if it is determined that at least two electronic devices are connected to the user terminal based on the second connection state information included in the second beacon signal received through the communication unit, the two or more electronic devices are connected. Pairing with the electronic device may not be performed.

The processor may not perform pairing with the electronic device if the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit.

The user terminal may further include an output unit, and the processor outputs a user notification if the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit. You can control wealth.

In the above description, the preset time may be set as a default or may be set by the user.

An electronic device according to an embodiment of the present disclosure includes a user input unit, a communication unit, a memory including at least one command, and a processor connected to the communication unit and the memory to control the electronic device.

The processor controls the communication unit to transmit a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device, and based on the first connection state information. When the user terminal accesses the electronic device, session connection with the user terminal is performed based on the validity of the authentication information. When session connection with the user terminal is performed, the first connection state information is obtained. Change the second connection state information, and control the communication unit to transmit a second beacon signal including the changed second connection state information, and when the user command is input to the user input unit, remove the second connection state information. Change to three connection state information and transmit a third beacon signal including the changed third connection state information; The control portion.

In this case, the user input unit may include at least one of a physical button for receiving a user's command, a touch screen, a voice recognition sensor, and an infrared sensor.

On the other hand, in a computer-readable recording medium including a program for executing a method of controlling a user terminal according to an embodiment of the present disclosure, the method of controlling the user terminal from the electronic device to the authentication information of the electronic device and the electronic device. Receiving a first beacon signal including first connection state information indicating that access can be made, accessing the electronic device based on the first connection state information, and based on the validity of the authentication information; Receiving a second beacon signal including second connection state information indicating that the session connection has been performed, when the session connection with the electronic device is performed; When the user's command is input to the device, the electronic device knows that the user's command is input. Includes a first step and performing a pairing with the electronic device based on the third connection information for receiving a third beacon signal including a third connection state information.

1 is a view schematically illustrating a user terminal and an electronic device according to an embodiment of the present disclosure;

2 is a block diagram illustrating a brief configuration of a user terminal according to an embodiment of the present disclosure;

3 is a block diagram showing a detailed configuration of a user terminal according to an embodiment of the present disclosure;

4 is a block diagram illustrating a brief configuration of an electronic device according to an embodiment of the present disclosure;

5 is a view briefly illustrating a configuration of a beacon frame according to an embodiment of the present disclosure;

6 is a sequence diagram illustrating a process of determining validity of authentication information according to an embodiment of the present disclosure;

7 is a flowchart illustrating an overall authentication process according to an embodiment of the present disclosure;

8 is a flowchart illustrating a control method of a user terminal according to an embodiment of the present invention; and

9 is a flowchart illustrating a control method of an electronic device according to an embodiment of the present disclosure.

The embodiments may be variously modified and may have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the scope to a particular embodiment, and it should be understood to include various modifications, equivalents, and / or alternatives of the embodiments of the present disclosure. In connection with the description of the drawings, similar reference numerals may be used for similar components.

In describing the present disclosure, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present disclosure, a detailed description thereof will be omitted.

In addition, the following examples may be modified in many different forms, and the scope of the technical spirit of the present disclosure is not limited to the following examples. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the inventive concept to those skilled in the art.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the scope. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this disclosure, expressions such as "have," "may have," "include," or "may include" may include the presence of a corresponding feature (e.g., numerical value, function, operation, or component such as a component). Does not exclude the presence of additional features.

In the present disclosure, the expression “A or B,” “at least one of A or / and B,” or “one or more of A or / and B”, etc. may include all possible combinations of items listed together. . For example, "A or B," "at least one of A and B," or "at least one of A or B," includes (1) at least one A, (2) at least one B, Or (3) both of cases including at least one A and at least one B.

As used herein, the expressions “first,” “second,” “first,” or “second,” and the like may modify various components, regardless of order and / or importance. It is used to distinguish it from other components and does not limit the components.

One component (such as a first component) is "(functionally or communicatively) coupled with / to" to another component (such as a second component) or " When referred to as "connected to", it should be understood that any component may be directly connected to the other component or may be connected through another component (eg, a third component). On the other hand, when a component (e.g., a first component) is said to be "directly connected" or "directly connected" to another component (e.g., a second component), the component and the It can be understood that no other component (eg, a third component) exists between the other components.

The expression "configured to" used in the present disclosure may, for example, be "suitable for," "having the capacity to," depending on the context. It may be used interchangeably with "designed to," "adapted to," "made to," or "capable of." The term "configured to" may not necessarily mean only "specifically designed to" in hardware.

Instead, in some situations, the expression "device configured to" may mean that the device "can" along with other devices or components. For example, the phrase “processor configured (or configured to) perform A, B, and C” may be implemented by executing a dedicated processor (eg, an embedded processor) to perform its operation, or one or more software programs stored in a memory device. It may mean a general-purpose processor (eg, a CPU or an application processor) capable of performing corresponding operations.

In an embodiment, the module or unit performs at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software. In addition, a plurality of modules or a plurality of units may be integrated into at least one module except for a module or a unit that needs to be implemented with specific hardware, and may be implemented as at least one processor (not shown). Can be.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

1 is a diagram schematically illustrating a user terminal 100 and an electronic device 200 according to an embodiment of the present disclosure.

As illustrated in FIG. 1, the user terminal 100 and at least one electronic device 200 may perform pairing with each other.

The user terminal 100 device according to an exemplary embodiment of the present disclosure may include, for example, a smartphone, a tablet personal computer, a mobile phone, a video phone, and an e-book reader. book reader, desktop personal computer, laptop personal computer, netbook computer, workstation, personal digital assistant, portable multimedia player, mp3 player, It may include at least one of a mobile medical device, a camera or a wearable device.

Here, the wearable device may be an accessory type (e.g. a watch, ring, bracelet, anklet, necklace, eyeglass, contact lens, or head-mounted-device (HMD)), a fabric or clothing integrated type (e.g., electronic clothing) ), A body attachment type (eg, a skin pad or tattoo), or a living implantable type (eg, an implantable circuit).

That is, in FIG. 1, only the smart phone is illustrated as an example of the user terminal 100, but the present disclosure is not limited thereto.

In addition, the electronic device 200 according to an embodiment of the present disclosure may include, for example, a smart TV, a digital video disk (DVD) player, an audio, a refrigerator, an air conditioner, a cleaner, an oven, a microwave oven, a washing machine, an air purifier, a set top, and the like. box (set-top box), home automation sheet Orientation control panel (home automation control panel), the security control panel (security control panel), TV box (for example, Samsung HomeSync ^TM, Apple TV ^TM, or Google TV ^TM), game It may include at least one of a console (eg, Xbox ^TM , PlayStation ^TM ), an electronic dictionary, an electronic key, a camcorder, or an electronic picture frame.

That is, in FIG. 1, only the refrigerator 200-1, the TV 200-2, and the air conditioner 200-3 are illustrated as examples of the electronic device 200, but the present disclosure is not limited thereto.

In addition, the user terminal 100 and the electronic device 200 according to an embodiment of the present disclosure may include various sensors such as a motion sensor, a temperature sensor, a humidity sensor, an illuminance sensor, and the like. In addition, the user terminal 100 and the electronic device 200 according to an embodiment of the present disclosure may include a network communication module capable of performing wired and wireless communication with each other.

The user terminal 100 according to an embodiment of the present disclosure may perform pairing with various electronic devices 200 and control the electronic device 200 based on the pairing.

Of course, pairing may also be performed between the electronic devices 200, and the user terminal 100 may also be a kind of electronic device. However, in the description of the present disclosure, for convenience, a user may control a paired electronic device. The device 100 is referred to as a terminal 100 and a device to be controlled after pairing is referred to as an electronic device 200.

In detail, the user terminal 100 may receive from the electronic device 200 a first beacon signal including authentication information of the electronic device 200 and first connection state information indicating that the electronic device 200 may be accessed. Can be. Here, the first connection state information may be information indicating that a software enabled access point (Soft-AP) is driven in the electronic device 200.

The user terminal 100 may access the electronic device 200 based on the first state information, and perform a session connection with the electronic device 200 based on the validity of the authentication information.

When the session connection between the user terminal 100 and the electronic device 200 is performed, the electronic device 200 changes the first connection state information to second connection state information and includes a second connection state information. The beacon signal can be transmitted. Here, the second connection state information may mean information indicating that the session connection between the user terminal 100 and the electronic device 200 has been performed.

Thereafter, the user terminal 100 may receive a second beacon signal including second connection state information from the electronic device 200.

In this case, the user may access the electronic device 200 to perform pairing with the user terminal 100, and input a user command through the user input unit of the electronic device 200. Here, the user command may mean confirming that the user is the electronic device 200 to perform pairing with the user terminal 100.

When a user command is input to the electronic device 200, the electronic device 200 may change the second connection state information into third connection state information and transmit a third beacon signal including the third connection state information.

The user terminal 100 may receive a third beacon signal including third connection state information from the electronic device 200. Here, the third connection state information may mean information for notifying that the user command is input to the electronic device 200.

When the third beacon signal including the third connection state information is received from the electronic device 200, the user terminal 100 may perform pairing with the electronic device 200 based on the third connection state information.

As described above, in the process of performing pairing between the user terminal 100 and the electronic device 200, when the electronic device 200 transmits a beacon signal including authentication information and connection state information, the user terminal ( 100 may secure the security in the pairing process by performing an authentication process based on the authentication information and the connection state information.

On the other hand, since the present disclosure relates to securing security in the process of performing pairing between the user terminal 100 and the electronic device 200, the user terminal 100 is specifically the electronic device 200 after the pairing is performed. ) Is not described in detail.

2 is a block diagram illustrating a simplified configuration of a user terminal 100 according to an exemplary embodiment.

As illustrated in FIG. 2, the user terminal 100 according to an embodiment of the present disclosure may include a communication unit 110, a memory 120, and a processor 130.

The communicator 110 may perform communication with the electronic device 200. In particular, in various embodiments of the present disclosure, the communication unit 110 may receive a beacon signal transmitted by the electronic device 200, and may also transmit various communication signals to the electronic device 200.

Meanwhile, the following description mainly illustrates an example in which the electronic device 200 transmits a Wi-Fi beacon frame, but the present disclosure is not necessarily limited thereto, and various communications including a Bluetooth Low Energy (BLE) scheme are provided. Of course, it can be applied to the method.

In detail, the communication unit 110 may receive a beacon signal including authentication information and connection state information of the electronic device 200 from the electronic device 200. Here, the authentication information may be a public key generated from the electronic device 200, and more specifically, may be a public key hash generated from the public key.

The connection state information may refer to information regarding a connection state between the user terminal 100 and the electronic device 200. Specifically, the first connection state information is connection state information indicating that the user terminal 100 can access the electronic device 200, and the second connection state information is a session between the user terminal 100 and the electronic device 200. The connection state information indicating that the connection is performed and the third connection state information may refer to connection state information indicating that a user's command is input to the electronic device 200.

The memory 120 may include at least one command regarding the user terminal 100. The memory 120 may store an operating system (O / S) for driving the user terminal 100. In addition, the memory 120 may store various software programs or applications for operating the user terminal 100 according to various embodiments of the present disclosure.

In addition, the memory 120 may store various information such as various data input, set, or generated during execution of a program or an application.

In addition, the memory 120 may include various software modules for operating the user terminal 100 according to various embodiments of the present disclosure, and the processor 130 may execute various software modules stored in the memory 120. An operation of the user terminal 100 according to various embodiments of the present disclosure may be performed.

On the other hand, the memory 120 may further include a security module (not shown). The security module may be composed of an encryption module and a decryption module. The security module can perform encryption and decryption for security at the network level.

The processor 130 may control the overall operation of the user terminal 100. In particular, in various embodiments of the present disclosure, the processor 130 may control an overall process leading to pairing between the user terminal 100 and the electronic device 200.

In detail, the processor 130 may control the communicator 110 to receive a beacon signal including authentication information and connection state information from the electronic device 200, and may access the electronic device 200. Processes such as session connection with the electronic device 200 and pairing with the electronic device 200 may be controlled.

In detail, upon receiving the first beacon signal including the first connection state information indicating that the electronic device 200 can be connected to the electronic device 200 through the communication unit 110, the processor 130 receives the first connection. The communication unit 110 may be controlled to access the electronic device 200 based on the state information.

Specifically, when a software enabled access point (Soft-AP) is driven in the electronic device 200, the communication unit 110 notifies the user terminal 100 that the electronic device 200 may access the electronic device 200 from the electronic device 200. Since the first beacon signal including the first connection state information may be received, the processor 130 may control the communicator 110 to access the electronic device 200 based on the first connection state information. . Here, the meaning of being able to access may mean that a communication channel may be established between the user terminal 100 and the electronic device 200.

In addition, the processor 130 may perform a session connection with the electronic device 200 based on the validity of the authentication information. In detail, when it is determined that the authentication information is valid, the processor 130 may perform a session connection with the electronic device 200. If it is determined that the authentication information is not valid, the processor 130 may establish a session connection with the electronic device 200. It may not be performed.

In detail, when at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match, the processor 130 may not perform a session connection with the electronic device 200. A detailed description of the validity determination process of the specific authentication information is described in detail with reference to FIG. 6.

When a session connection with the electronic device 200 is performed after determining validity of the authentication information, the communication unit 110 receives a second beacon signal including second connection state information indicating that the session connection has been performed from the electronic device 200. Can be received.

In this case, the user may access the electronic device 200 to perform pairing with the user terminal 100 and input a user command through the user input unit of the electronic device 200.

Here, the user command may mean confirming that the user is the electronic device 200 to perform pairing with the user terminal 100. An input process of a user command through the user input unit of the electronic device 200 will be described in detail with reference to FIG. 4.

Meanwhile, when a user's command is input to the electronic device 200, the communication unit 110 receives a third beacon signal including third connection state information indicating that the user's command is input from the electronic device 200. The processor 130 may control the communication unit 110 to perform pairing with the electronic device 200 based on the third connection state information.

When pairing with the electronic device 200 is performed, the processor 130 may control overall operations of the electronic device 200.

For example, when the smartphone (the user terminal 100) and the refrigerator (the electronic device 200) are paired, the user can grasp the storage state, the expiration date, and the like of the food stored in the refrigerator through the smartphone. You can control the various functions and operations of the refrigerator, the freezing temperature and other refrigerators through the smartphone.

3 is a block diagram illustrating a detailed configuration of a user terminal 100 according to an exemplary embodiment.

As shown in FIG. 3, the user terminal 100 according to an exemplary embodiment of the present disclosure may include a communication unit 110, a memory 120, a processor 130, a sensing unit, an output unit 140, and an input unit 150. It may include. However, such a configuration is exemplary, and of course, in the present disclosure, a new configuration may be added or some configurations may be omitted in addition to such a configuration.

As described above, the communication unit 110 may perform communication with the electronic device 200. The communication unit 110 may include at least one of a WiFi chip 111, a Bluetooth chip 112, and a wireless communication chip 113.

In particular, each of the WiFi chip 111 and the Bluetooth chip 112 may perform communication using a WiFi method and a Bluetooth method. In the case of using the WiFi chip 111 or the Bluetooth chip 112, various connection information such as SSID may be transmitted and received first, and then communication information may be transmitted and received using the same.

In addition, the wireless communication chip 113 refers to a chip that performs communication according to various communication standards such as IEEE, Zigbee, 3rd Generation (3G), 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), and the like.

As described above, the memory 120 may include at least one command regarding the user terminal 100. The memory 120 may include a semiconductor memory such as a flash memory, a magnetic storage medium such as a hard disk, or the like.

As described above, the processor 130 may control the overall operation of the user terminal 100. The processor 130 may be implemented in various ways. For example, the processor 130 may include an application specific integrated circuit (ASIC), an embedded processor, a microprocessor, hardware control logic, a hardware finite state machine (FSM), and a digital signal processor. Processor, DSP) may be implemented as at least one.

In addition, the processor 130 may include a ROM, a RAM, a Graphic Processing Unit (GPU), a CPU, and a bus, and the ROM, RAM, a Graphic Processing Unit (GPU), a CPU, and the like may be connected to each other through a bus.

Meanwhile, the role of the communication unit 110, the memory 120, and the processor 130 in various embodiments of the present disclosure has been described above with reference to FIG. 2, and thus descriptions thereof will not be repeated.

The output unit 140 may output various functions that may be performed by the electronic device 200. In detail, the output unit 140 may include a display 141, a speaker 142, a vibration device 143, and the like. However, the output unit 140 is not necessarily limited to such a configuration, and in addition, a new configuration may be added or some components may be omitted.

The output unit 140 notifies that reception of a beacon signal, connection to the electronic device 200, session connection with the electronic device 200, and pairing with the electronic device 200 are performed according to an embodiment of the present disclosure. Various notifications can be output in various ways.

For example, when pairing is performed between the user terminal 100 and the electronic device 200, a visual image indicating that the pairing is performed may be output through the display 141, or the pairing may be performed through the speaker 142. The voice notifying that the operation has been performed may be output, and the vibration indicating the pairing is performed through the vibration device 143.

The input unit 150 may receive various types of state information. In addition, the input unit 150 may be combined with the sensing unit. For example, the sensing unit and the input unit 150 may be combined to form a touch sensing unit. However, it is not limited to this structure.

Meanwhile, the user may directly input a user command through the input unit 150 based on the connection state information according to an embodiment of the present disclosure to control whether pairing is performed or the like.

For example, if the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit 110, the processor 130 may control the output unit 140 to output a user notification. In addition, the user who receives the notification may input a user command directly through the input unit 150 to prevent pairing.

4 is a block diagram illustrating a simplified configuration of an electronic device 200 according to an embodiment of the present disclosure.

As illustrated in FIG. 4, the electronic device 200 according to an embodiment of the present disclosure may include a communication unit 210, a memory 220, a processor 230, and a user input unit 240.

The communication unit 210 may perform communication with the user terminal 100. The communication unit 210 may include at least one of a WiFi chip, a Bluetooth chip, and a wireless communication chip.

In particular, each of the WiFi chip and the Bluetooth chip may perform communication using a WiFi method and a Bluetooth method. In the case of using a WiFi chip or a Bluetooth chip, various connection information such as SSID may be transmitted and received first, and then communication information may be transmitted and received using the same.

In addition, the wireless communication chip refers to a chip that performs communication according to various communication standards such as IEEE, Zigbee, 3rd Generation (3G), 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), etc.

In particular, in various embodiments of the present disclosure, the communication unit 210 may transmit a beacon signal and may also receive various communication signals from the user terminal 100.

Here, the communication unit 210 may transmit the beacon signal means that the beacon signal may be broadcast. That is, in various embodiments of the present disclosure, when the electronic device 200 transmits the beacon signal through the communication unit 210, a target to receive the beacon signal does not necessarily need to be specified.

Of course, when the electronic device 200 transmits a beacon signal through the communication unit 210, the user terminal 100 receives the beacon signal from the electronic device 200 through the communication unit 110, a pairing process according to the present disclosure This can be done.

In detail, the communication unit 210 may transmit a beacon signal including authentication information and connection state information of the electronic device 200. Here, the authentication information may be a public key generated from the electronic device 200, and more specifically, may be a public key hash generated from the public key.

The memory 220 may include at least one command regarding the electronic device 200. The memory 220 may include a semiconductor memory such as a flash memory, a magnetic storage medium such as a hard disk, or the like.

The memory 220 may store an operating system (O / S) for driving the electronic device 200. Also, various software programs or applications for operating the electronic device 200 may be stored in the memory 220 according to various embodiments of the present disclosure.

The memory 220 may store various information such as various data input, set, or generated during execution of a program or an application.

In addition, the memory 220 may include various software modules for operating the electronic device 200 according to various embodiments of the present disclosure, and the processor 230 may execute various software modules stored in the memory 220. An operation of the electronic device 200 according to various embodiments of the present disclosure may be performed.

On the other hand, the memory 220 may further include a security module (not shown). The security module may be composed of an encryption module and a decryption module. The security module can perform encryption and decryption for security at the network level.

The processor 230 may control overall operations of the electronic device 200. Such a processor may be implemented in various ways. For example, the processor 230 may include an application specific integrated circuit (ASIC), an embedded processor, a microprocessor, hardware control logic, a hardware finite state machine (FSM), and a digital signal processor. Processor, DSP) may be implemented as at least one.

In addition, the processor 230 may include a ROM, a RAM, a Graphic Processing Unit (GPU), a CPU, and a bus, and the ROM, the RAM, the Graphic Processing Unit (GPU), a CPU, and the like may be connected to each other through a bus.

In particular, in various embodiments of the present disclosure, the processor 230 may control an overall process leading to pairing between the user terminal 100 and the electronic device 200.

In detail, the processor 230 may control the communication unit 210 to transmit the first beacon signal including the authentication information of the electronic device 200 and the first connection state information indicating that the electronic device 200 may be connected to the electronic device 200. Can be. Here, the meaning of being able to access may mean that a communication channel may be established between the user terminal 100 and the electronic device 200.

Meanwhile, when the user terminal 100 accesses the electronic device 200 based on the first connection state information, the processor 230 may perform a session connection with the user terminal 100 based on the validity of the authentication information. Can be. A detailed description of the validity determination process of the authentication information is described in detail with reference to FIG. 6.

Meanwhile, when the session connection with the user terminal 100 is performed, the processor 230 may change the first connection state information to second connection state information. In addition, the processor 230 may control the communication unit 210 to transmit the second beacon signal including the second connection state information.

In this case, the user may access the electronic device 200 to perform pairing with the user terminal 100, and input a user command through the user input unit 240 of the electronic device 200. Here, the user command may mean confirming that the user is the electronic device 200 to perform pairing with the user terminal 100.

Meanwhile, when a user command is input to the user input unit 240, the processor 230 may change the second connection state information into third connection state information. In addition, the processor 230 may control the communication unit 210 to transmit the third beacon signal including the third connection state information.

Thereafter, the processor 130 of the user terminal 100 may perform pairing with the electronic device 200 based on the third connection state information.

The user input unit 240 may receive a user command. Meanwhile, the user input unit 240 may include at least one of a physical button, a voice recognition sensor, and an infrared sensor for receiving a user's command.

In detail, the user input unit 240 may include a physical button, and the user may input a user command by pressing the physical button.

In addition, the user input unit 240 may include a touch screen, and the user may input a user command by touching the touch screen.

In addition, the user input unit 240 may include a voice recognition sensor, and the user may input a user command by uttering a specific voice.

In addition, the user input unit 240 may include an infrared sensor, and the user may input a user command by approaching a preset distance from the electronic device 200. Here, the preset distance may be set as a default or may be set by the user.

In the above, the user input unit 240 includes a case of including a physical button, a voice recognition sensor, and an infrared sensor, but in addition, the user input unit 240 may interact with the user to receive a user's command. Various configurations may be included.

Meanwhile, as described above with respect to a specific configuration of the user terminal 100 according to an embodiment of the present disclosure in FIG. 3, the electronic device 200 according to an embodiment of the present disclosure also includes a communication unit 210 and a memory 220. Of course, it may include a variety of configurations other than the processor 230 and the user input unit 240.

According to various embodiments of the present disclosure as described above, in performing pairing between the user terminal 100 and the electronic device 200, the authentication information and the connection state information may be reduced while using the in-band method. Based on the authentication process, it is possible to secure security against man-in-the-middle attacks.

A detailed authentication process for securing security will be described in detail with reference to FIGS. 6 and 7.

5 is a diagram briefly illustrating a configuration of a beacon frame according to an embodiment of the present disclosure.

Beacon frame according to an embodiment of the present disclosure may be configured as shown in FIG. That is, not only the device name of the electronic device 200 but also authentication information of the electronic device 200 and connection state information of the electronic device 200 may be included in a field of a service set identifier (SSID) of the electronic device 200. .

In detail, the device name of the electronic device 200 may include a MAC address or a serial number of the electronic device 200, and the authentication information of the electronic device 200 may include a public key hash value.

The connection state information of the electronic device 200 may be the first connection state information, the second connection state information, or the third connection state information as described above.

Although not shown in FIG. 5, each area of the device name, authentication information, and connection state information constituting the SSID field as described above may be distinguished through a delimiter.

6 is a sequence diagram illustrating a process of determining validity of authentication information according to an embodiment of the present disclosure.

Specifically, the authentication information is transmitted through each communication unit of the user terminal 100 and the electronic device 200, and each communication unit (eg, through the

processors

130 and 230 of each of the user terminal 100 and the electronic device 200). 110 and 210, and the overall authentication process is controlled, hereinafter, for convenience, the user terminal 100 and the electronic device 200 will be described as performing the authentication process, respectively.

Meanwhile, hereinafter, the case in which the electronic device 200 transmits a Wi-Fi beacon frame will be described as an example, but the present disclosure is not necessarily limited thereto, and various communication schemes including a Bluetooth Low Energy (BLE) scheme are provided. Of course, it can be applied to.

First, the electronic device 200 generates a public key (S601), and then applies a Secure Hash Algorithm 3 (SHA-3) to the generated public key to generate a public key hash value. It may be (S602).

Here, the hash value means a fixed length value obtained by applying the hash function. The hash function refers to a function that maps arbitrary data having an arbitrary length to data of a fixed length. Hereinafter, although SHA-3 will be described as an example of a hash function, the present disclosure is not limited thereto.

The public key hash value generated by applying SHA-3 may be set in the SSID field as described above (S603).

The electronic device 200 may drive a software enabled access point (Soft-AP) (S604) and transmit a beacon frame including the public key hash value (S605). It has been described above that the beacon frame may also include connection state information.

The user terminal 100 may receive a beacon frame from the electronic device 200 (S606), collect a public key hash value from the SSID field of the beacon frame (S607), and store the collected public key hash value (S608). . Subsequently, when the electronic device 200 is connected to the Soft-AP driven (S609), the user terminal 100 may request a TLS (Transport Layer Security) handshake (S610).

In the following description, the case of TLS will be described as an example of an encryption protocol. However, the present disclosure is not limited thereto.

The electronic device 200 may transmit the public key to the user terminal 100 (S611), and may respond to the requested TLS handshake (S612). In addition, the user terminal 100 may receive the public key (S613) and generate a public key hash value by applying SHA-3 to the received public key (S614).

Thereafter, the user terminal 100 may compare the public key hash value generated as described above with the stored public key hash value and check whether there is a match (S615).

If the public key hash values do not match, the user terminal 100 may not perform a session connection with the electronic device 200. On the other hand, if the public key hash value matches, the user terminal 100 may respond to the TLS handshake to the electronic device (200) (S616).

In addition, in the user terminal 100 and the electronic device 200, master keys (symmetric keys) are derived, respectively (S617 and S618). Thereafter, when the master key is matched, the master key authentication is completed (S620), and the TLS handshake may be completed (S619, 621).

If the master keys do not match, the user terminal 100 may not perform a session connection with the electronic device 200. If the master key values also match, the user terminal 100 may perform a session connection with the electronic device 200.

Through the authentication process as described above, a session connection may be performed between the electronic device 200 that has transmitted the public key and the user terminal 100. In this way, the intermediate key may transmit a public key transmitted by the electronic device 200 to secure the complementary to the attack method that attempts to pair with the user terminal 100.

However, the intermediate person may intervene when the user terminal 100 performs a session connection with the electronic device 200. Specifically, the middle man may attack by detecting an association packet at the time when the user terminal 100 establishes an association with the electronic device 200, and attempts to pair with the user terminal 100. .

In order to secure the complementary to such an attack, the beacon signal transmitted according to an embodiment of the present disclosure is not only the authentication information of the electronic device 200 but also the first connection state information of the electronic device 200 and the second. Since the connection state information and the third connection state information are included, a method of ensuring complementarity based on the connection state information will be described with reference to FIG. 7.

7 is a flowchart illustrating an overall authentication process according to an embodiment of the present disclosure.

As described with reference to FIG. 6, in detail, authentication information is transmitted through each communication unit of the user terminal 100 and the electronic device 200, and the processor 130 of each of the user terminal 100 and the electronic device 200. Although each of the

communication units

110 and 210 and the overall authentication process are controlled through the 230, hereinafter, the user terminal 100 and the electronic device 200 respectively perform the authentication process for convenience.

First, the user terminal 100 may receive a first beacon signal including authentication information of the electronic device 200 and first connection state information indicating that the electronic device 200 may be accessed (S701). Here, the first connection state information may be information indicating that the Soft-AP has been driven in the electronic device 200.

In operation S703, the user terminal 100 may access the electronic device 200 based on the first state information, and may determine the validity of the authentication information. In detail, if it is determined that the authentication information is not valid, the user terminal 100 does not perform a session connection with the electronic device 200 (S704). A session connection may be performed (S705).

The validity determination process of the specific authentication information is performed through the process described above in the description of FIG. 6. In conclusion, when at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match, The session connection with the electronic device 200 may not be performed.

When a session connection is performed between the user terminal 100 and the electronic device 200 (S705), the electronic device 200 changes the first connection state information to the second connection state information, and the changed second connection state. The second beacon signal including the information may be transmitted. Here, the second connection state information may be information for notifying that the session connection is performed between the user terminal 100 and the electronic device 200.

In operation S706, the user terminal 100 may receive a second beacon signal from the electronic device. If it is determined that at least two electronic devices 200 to which the session connection is performed are performed on the user terminal 100 based on the second connection state information included in the received second beacon signal (S707), the user terminal ( 100 may not perform all pairing with two or more electronic devices 200 (S708).

That is, when a session connection is performed between the electronic device 200 and the intermediate person, which the user intends to perform pairing with, the user terminal 100 by a so-called parallel attack of the intermediate person, the user terminal 100 receives the received connection. On the basis of the second connection state information included in the second beacon signal, if it is determined that two or more electronic devices 200 are connected to the session, all pairing processes with the two or more electronic devices 200 are performed. You can exit.

As such, even after completing all processes without performing pairing, the authentication process according to one embodiment of the present disclosure is performed again, and thus, normal pairing with security can be performed.

Meanwhile, a session connection is performed between the intermediate person and the user terminal 100 by an attack of the intermediate person, while a session is established between the electronic device 200 and the user terminal 100 that the user intends to perform pairing with the user terminal 100. In some cases, the connection may not be performed.

In this case, the second beacon signal is received from the intermediary to inform that the session connection with the user terminal 100 has been performed, and thus, even if a user's command is input to the user input unit of the electronic device 200, Since the session connection has not been performed between the user terminals 100, the third beacon signal including the third connection state information cannot be received by the user terminal 100.

Therefore, if the third beacon signal is not received during the preset time after the second beacon signal is received by the user terminal 100 (S709), the user terminal 100 may not perform pairing with the electronic device 200. (S708).

Here, the preset time may be set as default or may be set by the user.

On the other hand, if a user's command is input to the electronic device 200 on which the session is connected after the session connection is normally performed with the electronic device 200 to which the user wants to perform pairing, the electronic device 200 may be configured. The second connection state information may be changed into third connection state information, and a third beacon signal including the changed third connection state information may be transmitted. Here, the third connection state information may be information for notifying that the user command is input to the electronic device 200.

If a third beacon signal is received within a preset time after the second beacon signal is received by the user terminal 100 (S709), the user terminal 100 may perform pairing with the electronic device 200 ( S710).

As described above, the electronic device 200 continuously transmits not only authentication information of the electronic device 200 but also connection state information changed according to the connection state of the electronic device 200 to the user terminal 100 in a beacon signal. In addition, by performing the authentication process based on the user terminal 100, the user terminal 100 may secure security for all cases of the man-in-the-middle attack.

8 is a flowchart illustrating a control method of the user terminal 100 according to an exemplary embodiment.

According to a control method of the user terminal 100 according to an exemplary embodiment of the present disclosure, the user terminal 100 may access the authentication information of the electronic device 200 and the electronic device 200 from the electronic device 200. The notification may receive a first beacon signal including the first connection state information (S801).

Here, the authentication information and the first connection state information may be included in the field of the service set identifier (SSID) of the electronic device 200 and transmitted. In addition, second connection state information and third connection state information included in the second beacon signal and the third beacon signal may also be transmitted in the field of the SSID (Service Set IDentifier) of the electronic device 200.

Thereafter, the user terminal 100 may access the electronic device 200 based on the first connection state information, and perform a session connection with the electronic device 200 based on the validity of the authentication information (S802).

Meanwhile, if at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match, the user terminal 100 may not perform a session connection with the electronic device 200.

When the session connection with the electronic device 200 is performed, the user terminal 100 may receive a second beacon signal including second connection state information indicating that the session connection has been performed from the electronic device 200 (S803). ).

On the other hand, based on the second connection state information included in the received second beacon signal, if it is confirmed that there is more than one electronic device 200 is connected to the user terminal 100, the user terminal 100 is Pairing with the two or more electronic devices 200 may not be performed.

When a user's command is input to the electronic device 200, the user terminal 100 may receive a third beacon signal including third connection state information indicating that the user's command is input from the electronic device 200. (S804).

Thereafter, the user terminal 100 may perform pairing with the electronic device 200 based on the third connection state information (S805).

Meanwhile, if the third beacon signal is not received for a preset time after the second beacon signal is received, the user terminal 100 may not perform pairing with the electronic device 200.

9 is a flowchart illustrating a control method of the electronic device 200 according to an embodiment of the present disclosure.

According to a control method of the electronic device 200 according to an embodiment of the present disclosure, the electronic device 200 may be authenticated by the electronic device 200 and first connection state information indicating that the electronic device 200 may be connected to the electronic device 200. The first beacon signal including a may be transmitted (S901).

Here, the first connection state information may be information indicating that the Soft-AP is driven in the electronic device.

Meanwhile, the authentication information and the first connection state information may be included in a field of a service set identifier (SSID) of the electronic device 200 and transmitted. In addition, second connection state information and third connection state information included in the second beacon signal and the third beacon signal may also be transmitted in the field of the SSID (Service Set IDentifier) of the electronic device 200.

When the user terminal 100 accesses the electronic device 200 based on the first connection state information, the electronic device 200 may perform a session connection with the user terminal 100 based on the validity of the authentication information. There is (S902).

When the session connection with the user terminal 100 is performed, the electronic device 200 may change the first connection state information into second connection state information (S903).

Thereafter, the electronic device 200 may transmit a second beacon signal including the second connection state information (S904). Here, the second connection state information may be information indicating that a session connection is performed between the user terminal and the electronic device.

When a user command is input to the electronic device 200, the electronic device 200 may change the second connection state information into third connection state information in operation S905.

Thereafter, the electronic device 200 may transmit a third beacon signal including the changed third connection state information (S906). Here, the third connection state information may be information indicating that a user command is input to the electronic device.

As described above, according to the present embodiment, in performing the pairing between the user terminal 100 and the electronic device 200, while reducing the cost by using the in-band method, authentication based on authentication information and connection state information Through this process, the security against man-in-the-middle attack can be secured.

Meanwhile, the control method of the user terminal 100 or the control method of the electronic device 200 according to the above-described embodiment may be implemented as a program and provided to the display 141 device. In particular, a program including a control method of the user terminal 100 and a control method of the electronic device 200 may be stored and provided in a non-transitory computer readable medium.

The non-transitory readable medium refers to a medium that stores data semi-permanently and is readable by a device, not a medium storing data for a short time such as a register, a cache, a memory, and the like. Specifically, the various applications or programs described above may be stored and provided in a non-transitory readable medium such as a CD, a DVD, a hard disk, a Blu-ray disk, a USB, a memory card, a ROM, or the like.

In addition, while the above has been shown and described with respect to preferred embodiments of the present disclosure, the present disclosure is not limited to the specific embodiments described above, the technical field to which the disclosure belongs without departing from the gist of the present disclosure claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present disclosure.

Claims

In the control method of the user terminal,

Receiving a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device from the electronic device;

Accessing the electronic device based on the first connection state information and performing a session connection with the electronic device based on the validity of the authentication information;

When the session connection with the electronic device is performed, receiving a second beacon signal including second connection state information indicating that the session connection has been performed from the electronic device;

When the user's command is input to the electronic device, receiving a third beacon signal including third connection state information indicating that the user's command has been input; And

Performing pairing with the electronic device based on the third connection state information; Control method of a user terminal comprising a.
According to claim 1,

And the authentication information, the first connection state information, the second connection state information, and the third connection state information are included in a field of a service set identifier (SSID) of the electronic device and transmitted.
According to claim 1,

If at least one of a public key included in the authentication information and a symmetric key derived from the public key does not match, not performing a session connection with the electronic device; Control method of the user terminal further comprising.
According to claim 1,

On the basis of the second connection state information included in the received second beacon signal, if it is determined that two or more electronic devices are connected to the user terminal, the pairing with the two or more electronic devices is not performed. Does not step; Control method of the user terminal further comprising.
According to claim 1,

If the third beacon signal is not received for a preset time after the second beacon signal is received, not performing pairing with the electronic device; Control method of the user terminal further comprising.
According to claim 1,

Outputting a user notification when the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit; Control method of the user terminal further comprising.
In the control method of an electronic device,

Transmitting a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device;

When the user terminal accesses the electronic device based on the first connection state information, performing a session connection with the user terminal based on the validity of the authentication information;

When the session connection with the user terminal is performed, changing the first connection state information to second connection state information;

Transmitting a second beacon signal including the changed second connection state information;

Changing the second connection state information to third connection state information when a user command is input to the electronic device; And

Transmitting a third beacon signal including the changed third connection state information; Control method of an electronic device comprising a.
The method of claim 7, wherein

And the authentication information, the first connection state information, the second connection state information, and the third connection state information are included in a field of a service set identifier (SSID) of the electronic device and transmitted.
In the user terminal,

Communication unit;

A memory containing at least one instruction; And

A processor connected to the communication unit and the memory to control the user terminal; Including,

The processor,

Receiving a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device, from the electronic device through the communication unit;

Access the electronic device based on the first connection state information, perform a session connection with the electronic device based on the validity of the authentication information,

When a session connection with the electronic device is performed, a second beacon signal including second connection state information indicating that the session connection has been performed is received from the electronic device through the communication unit,

When a user's command is input to the electronic device, a third beacon signal including third connection state information indicating that the user's command is input from the electronic device is received through the communication unit,

The user terminal performs pairing with the electronic device based on the third connection state information.
The method of claim 9,

The processor,

If at least one of the public key included in the authentication information and the symmetric key derived from the public key does not match, the user terminal does not perform a session connection with the electronic device.
The method of claim 9,

The processor,

On the basis of the second connection state information included in the second beacon signal received through the communication unit, if it is determined that there are two or more electronic devices that have performed session connection with the user terminal, User terminal that does not perform pairing.
The method of claim 9,

The processor,

If the third beacon signal is not received for a predetermined time after the second beacon signal is received through the communication unit, the user terminal does not perform pairing with the electronic device.
The method of claim 9,

An output unit; More,

The processor,

And controlling the output unit to output a user notification when the third beacon signal is not received for a preset time after the second beacon signal is received through the communication unit.
In an electronic device,

A user input unit;

Communication unit;

A memory containing at least one instruction; And

A processor connected to the communication unit and the memory to control the electronic device; Including,

The processor,

Control the communication unit to transmit a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device is accessible;

When the user terminal accesses the electronic device based on the first connection state information, a session connection with the user terminal is performed based on the validity of the authentication information;

When the session connection with the user terminal is performed, change the first connection state information to second connection state information,

Controlling the communication unit to transmit a second beacon signal including the changed second connection state information,

When a user command is input to the user input unit, the second connection state information is changed to third connection state information.

And control the communication unit to transmit a third beacon signal including the changed third connection state information.
In a computer-readable recording medium comprising a program for executing a control method of a user terminal,

The control method of the user terminal,

Receiving a first beacon signal including authentication information of the electronic device and first connection state information indicating that the electronic device can access the electronic device from the electronic device;

Accessing the electronic device based on the first connection state information and performing a session connection with the electronic device based on the validity of the authentication information;

When the session connection with the electronic device is performed, receiving a second beacon signal including second connection state information indicating that the session connection has been performed from the electronic device;

When the user's command is input to the electronic device, receiving a third beacon signal including third connection state information indicating that the user's command has been input; And

Performing pairing with the electronic device based on the third connection state information; Computer-readable recording medium comprising a.