KR20120010899A - Apparatus and method for servicing authentication by using portable device and authentication service system thereof, recordable medium which program for executing method is recorded - Google Patents

Abstract

PURPOSE: An authentication service apparatus using a personal terminal, a method thereof, and an authentication service method are provided to prevent a portable terminal of a user from being connected to a local communication AP or a Bluetooth device. CONSTITUTION: A control block(1102) transfers device information of a portable terminal to an authentication management block(1104). When a user interface signal is inputted for login, the control block transfers an authentication request to the authentication management block. When the authentication management block supplies location related information of the portable terminal, the control block transfers location related information to a server.

Description

TECHNICAL APPARATUS AND AUTHENTICATION BY USING PORTABLE DEVICE AND AUTHENTICATION SERVICE SYSTEM THEREOF, RECORDABLE MEDIUM WHICH PROGRAM FOR EXECUTING METHOD IS RECORDED}

The present invention relates to an authentication service technique using a mobile terminal, and more particularly, to an authentication service apparatus using a mobile terminal suitable for performing authentication using location information of a mobile terminal when accessing a server using a client terminal such as a PC. And a recording medium having recorded thereon a method, a system for executing the system and an authentication service method.

As is well known, in order to access a server using a client terminal having an internet access means such as a PC and provide a desired member service, a user may log in (or authenticate himself / herself) through a unique ID and password (PW). Is common.

That is, users perform a user interface for a client terminal to access a desired server through a network such as the Internet, and then authenticate a user, that is, log in through input of an ID and password given to the user. You will receive various services provided to members.

In addition, in the conventional method, power management in a portable terminal is executed by a user directly operating (interface) a wireless network module mounted in the portable terminal to select and control a power supply. -Fi) module, Bluetooth module, etc., these modules can be mounted (mounted) on the portable terminal at the same time.

In general, the conventional method of allowing access authentication to a server or the like using an ID and a password has a disadvantage in that it is vulnerable to an attack method such as a replay attack and a screen remote illegal capture.

In addition, the conventional method using ID and password has a fundamental problem that it is difficult for a user to directly identify an attack threat such as access point spoofing.

In addition, the conventional method has a problem that the user has to directly operate the power supply to the local area communication module (Wireless LAN, Bluetooth, etc.) whenever data communication is required, which causes inconvenience in use, and does not use the local area communication module. If the power supply to the local area communication module is not accidentally cut off in a local area, power of the portable terminal is unnecessarily consumed.

According to an aspect of the present invention, when the user interface for logging in to the server through the client terminal occurs, the process of confirming the portable terminal ID and location-related information received from the portable terminal through short-range wireless communication, and the portable terminal Checking whether an ID is a pre-stored registration ID, and whether the current location of the mobile terminal is within a preset service area based on the location related information, the mobile terminal ID is the pre-stored registration ID, and the current location is The present invention provides an authentication service method using a mobile terminal, the method including allowing login to the server when within a preset service area.

According to another aspect, the present invention provides a computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 12.

According to another aspect of the present invention, there is provided a storage block for storing one or a plurality of portable terminal IDs as a registration ID, an operation block for generating a user interface for logging in to a server through a client terminal, When generated, the mobile terminal ID received from the mobile terminal through short-range wireless communication is a registration ID previously stored in the storage block, and the current location of the mobile terminal is preset based on the location-related information received from the mobile terminal. An authentication service apparatus using a portable terminal including an authentication management block allowing login to the server when within.

According to another aspect, the present invention provides a process for requesting authentication information to a mobile terminal through short-range wireless communication when a user interface for logging in to a server from a client terminal occurs, and the short-range wireless communication according to the request of the authentication information. Acquiring a mobile terminal ID and location-related information of the mobile terminal transmitted from the mobile terminal through communication; and the mobile terminal ID is a pre-stored registration ID, and the current location of the mobile terminal based on the location-related information. And checking whether the mobile terminal ID is the pre-stored registration ID and allowing the login to the server when the current location is within the preset service area. Provided is an authentication service method using a portable terminal.

According to another aspect of the present invention, when a user interface for logging in to a server occurs, the mobile terminal ID received from the mobile terminal through short-range wireless communication is a pre-stored registration ID, and the location-related information obtained from the mobile terminal. A client terminal allowing login to the server when the current location of the portable terminal is within a preset service area based on the mobile terminal; and connected to the client terminal through the short range wireless communication; It provides an authentication service system using a portable terminal including the portable terminal to provide to the client terminal.

According to the present invention, when a user interface for logging in to a server through a client terminal occurs, the mobile terminal ID received from the mobile terminal through short-range wireless communication is a pre-stored registration ID, and the current location of the mobile terminal is within a preset service area. By allowing the user to log in to the server via the client terminal, the security of service authentication can be enhanced, and the spoofing can be performed because the user's mobile terminal does not connect to a short-range wireless communication AP or a Bluetooth device elsewhere. It can enhance the security (security) from security threats.

In addition, since the present invention does not require a separate operation for executing the short-range wireless communication module for service authentication, it is possible to enhance user convenience and automatically when the mobile terminal leaves the preset service area. Since the power supply to the short range wireless communication module is cut off, unnecessary waste of power can be suppressed.

1 is a system structural diagram of an authentication service system using a mobile terminal according to the present invention;
2 is a block diagram of an authentication service apparatus using a mobile terminal according to the present invention;
3 is a block diagram of a portable terminal suitable for providing an authentication service according to the present invention;
4 is a flowchart illustrating a main process of providing an authentication service using location information of a mobile terminal according to the present invention;
5 is a structural diagram of a communication protocol performed between a client terminal and a portable terminal according to the present invention;
6 is a flowchart illustrating a main process of acquiring location related information of a mobile terminal utilized as authentication information according to the present invention.

SUMMARY OF THE INVENTION Unlike the conventional authentication method that allows authentication by ID and password only, a technical aspect of the present invention is a portable terminal received from a portable terminal through short-range wireless communication when a user interface for logging in to a server through a client terminal occurs. Checking the ID and its location-related information, the mobile terminal ID is a registration ID previously stored in the client terminal, and when the current location of the mobile terminal is within a preset service area, it is allowed to log in to the server through the client terminal. The invention can effectively ameliorate problems in the conventional manner through such technical means.

Here, the client terminal may be, for example, a personal computer (PC), and the portable terminal may be, for example, a mobile phone, a PDA phone, a DMB phone, a PMP, an HSDPA phone, a smartphone, a netbook, or the like. And a short range wireless communication module (wireless network module) each mounted (mounted) may be any one of a Bluetooth module, a wireless LAN module, an infrared module, a Zigbee module, and a binary CDMA module.

The position related information of the mobile terminal is a coordinate value calculated using a GPS signal received from a GPS satellite, a cell ID, an SSID and a MAC address of a WLAN access point, and an SSID and a MAC address of a WLAN AP. It may include at least one, in the case of the coordinate value calculated using the cell ID, the SSID and MAC address of the short-range wireless communication AP, the SSID and MAC address of the WLAN AP, for example, the reliability of the GPS signal is a preset reference value It may be used as location-related information when the mobile terminal is located below or in an area where GPS information cannot be received from a GPS satellite, such as an indoor or underground area.

In addition, the authentication service technique of the present invention, after allowing the client terminal periodically checks the health of the portable terminal after allowing the login, when it is determined that the short-range wireless communication connection with the portable terminal is disconnected from the server The client terminal periodically checks the health of the mobile terminal after executing the process of forcibly logging out or allowing the user to log in, and the elapsed elapsed time when the mobile terminal determines that the mobile terminal has left the preset service area When the calculated departure elapsed time reaches a preset elapsed reference time, a process of forcibly logging out the client terminal from the server may be executed. Here, the health check period can be changed and set by the user.

In addition, the authentication service scheme of the present invention, after performing a forced logout, generates a guide message for guiding this to provide to the monitor of the client terminal, or when the forced logout from the client terminal is performed, wireless in the portable terminal The process of shutting off (off) the power supply to the LAN module may be executed.

Furthermore, the authentication service scheme of the present invention recognizes when the current location of the mobile terminal is outside the preset service area as an intrusion attempt, and a security message (eg, email, SMS, MMS) that warns the intrusion attempt by the client terminal. Etc.) may be generated and transmitted to a predetermined client terminal or portable terminal.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In addition, in the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may be changed according to intention or custom of a user, an operator, or the like. Therefore, the definition should be made based on the technical idea described throughout this specification.

1 is a schematic diagram of an authentication service system using a mobile terminal according to the present invention, and may include a client terminal 110, a short range wireless communication AP 115, and a mobile terminal 120.

Referring to FIG. 1, the client terminal 110 refers to a wired terminal such as a PC having an internet access module, a short range wireless communication module, and the like, and is connected to a server through the Internet to receive a desired service. When a user interface (eg, input of a member ID and password) for logging in occurs, the device ID (mobile terminal ID) and location related information of the mobile terminal received from the mobile terminal 120 through short-range wireless communication are generated. Based on this, it is possible to provide an authentication (connection login to the server) service.

That is, the client terminal 110 is a registration ID pre-stored in the storage block 1105 of the device ID received from the mobile terminal 120, and is based on the location-related information received from the mobile terminal 120. When it is determined that the current location of the terminal 120 is within a preset service area (a preset location range where login is allowed), login to the server according to the user interface is allowed. Here, the short range wireless communication between the client terminal 110 and the portable terminal 120 may be performed by at least one of, for example, Bluetooth, WLAN, infrared, Zigbee, binary CDMA.

To this end, the client terminal 110 has previously stored device information (data) of the mobile terminal 120, that is, the MAC address and the device UUID of the mobile terminal 120.

In addition, the client terminal 110 may provide a function of forcibly logging out the connection to the server when it is determined that the mobile terminal 120 has left the preset service area through a health check during the login connection to the server. Can be.

In addition, the WLAN access device (AP) 115 provides WLAN services to portable terminals entering its service area, and may be, for example, a Wi-Fi communication AP or a binary CDMA communication AP.

Next, the mobile terminal 120 may be, for example, a mobile phone, a PDA phone, a DMB phone, a PMP, an HSDPA phone, a smart phone, a netbook, etc. each having at least one or more wireless LAN modules, a GPS module, and the like. When the terminal 120 enters a preset service area, its ID (ie, device UUID and MAC address) and location related information through short range wireless communication (eg, Bluetooth, WLAN, infrared, Zigbee, binary CDMA, etc.). May be provided to the client terminal 110 as authentication information.

Here, the location related information provided from the mobile terminal 120 to the client terminal 110 for login (authentication) to the server may include a GPS signal (GPS coordinate), a cell ID, an SSID and a MAC address of the WLAN AP, It may be at least one of the coordinate values calculated using the SSID and MAC address of the WLAN AP, the coordinates calculated using the cell ID, SSID and MAC address of the WLAN AP, SSID and MAC address of the WLAN AP. In the case of a value, for example, the reliability of the GPS signal may be selectively used as location-related information when the mobile terminal is located in an area such as an indoor or underground area where the reliability of the GPS signal is less than or equal to a preset reference value or where GPS information cannot be received from a GPS satellite. have. For example, the GPS information includes information such as the unique code of the satellite, the location of the satellite, and the time of the satellite. The GPS information is obtained by comparing the number of received satellites (4 or less) or the time of the satellite signal with the current time. The reliability of can be measured.

That is, according to the present invention, when the reliability of the GPS information is less than or equal to the reference value or when the GPS information cannot be received, the portable terminal 120 includes the cell ID, the SSID and MAC address of the WLAN AP, and the SSID of the WLAN AP. And one of the coordinate values calculated using the MAC address may be selectively provided to the client terminal 110 as the location related information of the mobile terminal 120.

Here, in the case of the coordinate value calculated using the SSID and the MAC address of the WLAN AP, for example, when the mobile terminal 120 recognizes the SSID and MAC address of a certain WLAN AP, the position of the WLAN AP is The SSID and MAC address and corresponding positions estimated in advance can be obtained from a list of recorded WLAN APs, and can be estimated from the current position (coordinate value) of the mobile terminal. The list may be information previously stored in a storage block of the portable terminal 120 or information obtained by the portable terminal 120 communicating with an external server (not shown) when a situation occurs.

Meanwhile, in the present exemplary embodiment, the mobile terminal estimates (acquires) a coordinate value from a list of WLAN APs in which the SSID and MAC address of the WLAN AP and a predetermined position corresponding thereto are recorded. This is not necessarily limited thereto, and the mobile terminal transmits the SSID and the MAC address information of the WLAN AP to the client terminal, and the client terminal (the client terminal equipped with the authentication service apparatus) receiving the same is the same as the mobile terminal. The current position of the mobile terminal may be estimated from the list of WLAN APs in which the SSID and MAC address of the WLAN AP and the estimated position corresponding to the WLAN AP are recorded. Information stored in the server or when a situation occurs, the client terminal communicates with an external server (not shown). Information that can be obtained.

2 is a block diagram of an authentication service apparatus using a mobile terminal according to the present invention, including an operation block 1101, a control block 1102, a monitor 1103, an authentication management block 1104, a storage block 1105, and Bluetooth module 1106 and the like.

Referring to FIG. 2, the operation block 1101 may mean an input means (user interface means), such as a keyboard, a mouse, a touch panel (touch screen), etc., provided in a client terminal, for example, a server desired by a user. Interface signals generated when performing an interface (such as member ID and password input) for logging in to the device, and device information (MAC address and device UUID, etc.) of the mobile terminal to be used for authentication input by the user are included in the control block ( 1102).

Next, the control block 1102 includes, for example, a microprocessor for performing overall operation control of the client terminal, and transmits device information of the mobile terminal to be used for authentication to the authentication management block 1104, and for login. When a user interface signal is input, a corresponding authentication request is generated and transmitted to the authentication management block 1104, and the like, and the location related information of the mobile terminal together with the authentication permission command from the authentication management block 1104 is provided. When provided, the member ID, password, and location-related information (or current location information) are transmitted to a remote server (not shown) to provide a function of requesting login (authentication).

In addition, the control block 1102 may provide a function of forcibly logging out the client terminal from the currently connected server when the logout command signal selectively generated through the health check is transmitted from the authentication management block 1104.

The monitor 1103 receives and displays screen data provided from the control block 1102, displays a non-authentication message, a forced logout guide message, and the like provided from the authentication management block 1104. to provide.

Meanwhile, when an authentication request is transmitted from the control block 1102, the authentication management block 1104 generates and transmits an authentication information request message corresponding thereto to the Bluetooth module 1106 (request of authentication information), and in response thereto. When a device ID (mobile terminal ID) and location related information are received from the Bluetooth module 1106, whether the device ID is a registration ID (ID of the mobile terminal to be used for authentication) stored in the storage block 1105. Checks whether or not the portable terminal to be authenticated enters into a preset service area (location range where login is allowed) based on the location related information. Here, the location-related information may be any one of a GPS signal (GPS coordinate), a cell ID, a coordinate value calculated using the SSID and MAC address of the WLAN AP, and the SSID and MAC address of the WLAN AP. Here, the authentication management block 1104 may perform a control command to supply power to the Bluetooth module 1106 which is powered off before the request for authentication information.

To this end, the storage block 1105 stores the ID (registration ID) of the mobile terminal to be used for authentication, preset service area information, device ID and location related information received through the Bluetooth module 1106, and the like. A mobile terminal number or an e-mail address that is registered in advance to send a message may be stored.

The authentication management block 1104 generates an authentication permission command when it is determined that the device ID is a pre-stored registration ID and the current location of the mobile terminal based on the location related information is within a preset service area. Or a current location information) to the control block 1102.

In addition, the authentication management block 1104 periodically performs a health check to monitor whether the mobile terminal leaves the preset service area after allowing the login to the server. When it is determined that the portable terminal (portable terminal to be used for quotation) has left the preset service area, a logout command signal for forcibly logging out is generated and transmitted to the control block 1102. Specific details of monitoring the departure of the will be described in detail later with reference to FIG.

Further, the authentication management block 1104 is a mobile terminal ID received from the mobile terminal in response to a request for authentication information (mobile terminal ID and location related information) is not a pre-stored registration ID or is based on the current information of the mobile terminal based on the location related information. When it is determined that the location is out of the preset service area, it is recognized as an intrusion attempt, and a corresponding security message is generated to send an e-mail to a predetermined client terminal through a wired communication network or to be designated through a wired / wireless communication network. A function such as sending by SMS or MMS to the mobile terminal can be executed.

Lastly, the Bluetooth module 1106 refers to, for example, a short range wireless communication module. For the sake of convenience and understanding of the description, the Bluetooth module 1106 is described herein as a Bluetooth module, but the present invention is not limited thereto. Of course, it can be a LAN module, an infrared module, a Zigbee module, a binary CDMA module, or the like.

That is, the Bluetooth module 1106 wirelessly transmits the authentication information request message, the health check message, and the like, which are selectively delivered from the authentication management block 1104, to the portable terminal through the transmission antenna, and transmits the device ID (the device ID wirelessly transmitted by the portable terminal). A mobile terminal ID), location-related information, a health response message, and the like, through a receiving antenna and delivered to the authentication management block 1104.

The Bluetooth module 1106 may provide a general Bluetooth communication function between the client terminal and a portable terminal (or a Bluetooth device such as an earphone or a speaker, etc.) in a Bluetooth service area.

On the other hand, when a user interface occurs to log in to the server, the client terminal generates an authentication information request message and wirelessly transmits it to the portable terminal, thereby receiving authentication information (mobile terminal ID and location related information) for login from the portable terminal. As described above, the present invention is not necessarily limited thereto, and authentication information transmitted periodically by a mobile terminal entering a preset service area (for example, a period of 5 seconds, 10 seconds, 15 seconds, 20 seconds, etc.) is described. The client terminal receives and stores (or updates) the data in a storage block, and when the user interface for login occurs in the client terminal, the client terminal transmits the data to the server based on the authentication information stored in the storage block (for example, the most recently received authentication information). Of course, it can be set to determine whether to allow the login.

3 is a block diagram of a portable terminal suitable for providing an authentication service according to the present invention, which includes an operation block 1201, a cell communication module 1202, a GPS module 1203, a reliability measurement block 1204, and a control block ( 1205, a storage block 1206, a WLAN module 1207, a Bluetooth module 1208, and the like.

Referring to FIG. 3, the operation block 1201 may refer to a touch screen, a touch pad, a keypad, or the like, which is mounted on a display screen such as an LCD panel, an OLED panel, and the like, and the user may input the operation block 1201. The user interface (touch, etc.) can be provided with the service on the mobile terminal desired by the user, and also input the system information (MAC address, system UUID, etc.) of the client terminal to provide to the control block 1102. Can be.

The cell communication module 1202 provides a communication service (eg, a voice communication service, a data communication service, a wireless Internet service, etc.) with a remote client terminal or a remote portable terminal, including a transmission / reception antenna, etc. A function of acquiring a cell ID of a base station providing a communication service to a mobile terminal entering an area and transferring the same to a control block 1205 is provided. Here, the cell ID may be used as one of the location related information for the mobile terminal.

In addition, the GPS module 1203 is configured to receive GPS information received from each of a plurality of satellites not shown, that is, GPS information including unique code information of a GPS satellite, location information of a satellite, and visual information of a satellite. Each GPS information received here is transferred to the reliability measurement block 1204.

Subsequently, the reliability measuring block 1204 measures the reliability (accuracy) of the GPS information by comparing the number of received satellites (4 or less, etc.) or the time of the satellite signal with the current time. When the reliability is greater than or equal to a preset reference value (eg, 98% or more), a GPS signal (GPS coordinate value) is extracted from the GPS information and transmitted to the control block 1205.

Next, the control block 1205 includes, for example, a microprocessor or the like that performs overall operation control of the mobile terminal, and stores the GPS signal (GPS coordinate value) transmitted from the reliability measurement block 1204. The wireless LAN module 1207 controls to connect to the WLAN AP when the portable terminal enters the WLAN service area. In this case, the WLAN module 1207 receives the SSID and the MAC address of the WLAN AP and provides the same to the control block 1205.

Here, the WLAN module 1207 means, for example, a short-range wireless communication module. For convenience of description and improvement of understanding, the WLAN module 1207 is described as a WLAN module, but the present invention is not necessarily limited thereto. As long as it provides a short range wireless communication service to a portable terminal through an AP, such as a binary CDMA module, any one can be adopted.

In addition, the control block 1205 retrieves its ID (MAC address and device UUID) and location-related information from the storage block 1206 when the authentication information request message is received through the Bluetooth module 1208, and wirelessly transmits it to the client terminal. It provides a function such as transferring to the Bluetooth module 1208 as authentication information for transmission. Here, the location-related information may be any one of a coordinate value calculated (estimated) using a GPS signal, a cell ID, an SSID and a MAC address of the WLAN AP, and an SSID and a MAC address of the WLAN AP. When the block 1205 determines that the reliability of the GPS information is less than or equal to a predetermined reference value, the block 1205 calculates the location information of the mobile terminal using the cell ID, the SSID and the MAC address of the WLAN AP, and the SSID and the MAC address of the WLAN AP. This is because one of the (estimated) coordinate values is transmitted to the Bluetooth module 1208. Here, the cell ID and the SSID and the MAC address of the WLAN AP may be information previously defined by the user and stored in the storage block 1206. In addition, the control block 1205 provides a function of generating a health response message corresponding to the health check message periodically and transmitting the same to the Bluetooth module 1208.

That is, the portable terminal uses the cell ID, the predefined SSID and MAC address of the WLAN AP, the SSID and the MAC address of the WLAN AP when the reliability of the GPS information is equal to or less than a reference value (or when the GPS information is not received). Any one of the calculated (estimated) coordinate values may be provided to the client terminal as location related information of the mobile terminal.

To this end, the storage block 1206 includes the UUID and MAC address of the mobile terminal, the system UUID and MAC address of the pre-registered client terminal, the GPS signal, the cell ID of the base station, the SSID and MAC address of the predefined WLAN AP, and the like. Can be stored.

In addition, the Bluetooth module 1208, like the Bluetooth module 1106 shown in FIG. 2, means a short-range wireless communication module, for example. However, the present invention is not necessarily limited thereto, and of course, the present invention may be a wireless LAN module, an infrared module, a Zigbee module, a binary CDMA module, and the like.

That is, the Bluetooth module 1208 receives the authentication information request message, the health check message, and the like, which are selectively transmitted from the client terminal through the receiving antenna, and transmits the received information to the control block 1205, and selectively delivers the data from the control block 1205. A mobile terminal ID, location-related information, a health response message, and the like are wirelessly transmitted to a client terminal through a transmission antenna.

Next, a description will be given of a series of processes for providing an authentication service for logging in through the authentication service apparatus and the system of the present invention having the above-described configuration.

4 is a flowchart illustrating a main process of providing an authentication service using location information of a mobile terminal according to the present invention.

Referring to FIG. 4, a user performs an interface to the client terminal 110 to connect to a desired server through the Internet (step 402), and inputs a user interface for logging in, that is, a member ID and a password, and selects authentication. When clicking (step 404), the authentication management block 1104 in the client terminal 110 generates an authentication information request message and enters a preset service area through Bluetooth communication using the Bluetooth module 1106 ( And wirelessly transmits to step 120 (step 406).

In response, the mobile terminal 120 wirelessly transmits authentication information according to the request for the authentication information, that is, the mobile terminal ID and the location related information through Bluetooth communication, so that the client terminal 110 receives the mobile terminal ID and the location related information. In operation 408, a detailed process thereof will be described in detail with reference to FIG. 5.

5 is a structural diagram of a communication protocol performed between a client terminal and a portable terminal according to the present invention.

First, when a device equipped with a Bluetooth module, such as a mobile terminal, enters a service range (Bluetooth communication range) of another device equipped with a Bluetooth module, such as a client terminal, Bluetooth pairing between the mobile terminal and the client terminal (near field wireless communication pairing). ) Will be executed automatically. Therefore, hereinafter, it is assumed that Bluetooth pairing is performed between the mobile terminal and the client terminal.

Referring to FIG. 5, when authentication information is requested according to generation of a user interface (eg, input of a member ID and password) for logging in to a server, the control block 1205 of the mobile terminal 120 performs a Bluetooth communication. Request system data to the client terminal 110 side (step 502).

In response, the authentication management block 1104 of the client terminal 100 retrieves the system data, that is, the system UUID and its own MAC address from the storage block 1105, and transmits it to the portable terminal 120 through Bluetooth communication ( Step 504).

Next, the control block 1205 of the mobile terminal 120 searches for the storage block 1206 to verify whether the system UUID and MAC address received from the client terminal 110 are valid data (received system UUID and MAC). Authenticating an address is system data registered in the storage block 1206 by the user), and generating an acknowledgment (ACK) message corresponding to the valid data when the authentication is valid data. (Step 506).

Subsequently, the authentication management block 1104 of the client terminal 110 requests device data from the portable terminal 120 side via Bluetooth communication (step 508).

In response, the control block 1205 of the mobile terminal 120 retrieves the device data, that is, the device UUID and its MAC address from the storage block 1206, and transmits the device data to the client terminal 110 through Bluetooth communication (step S205). 510).

Next, the authentication management block 1104 of the client terminal 110 searches the storage block 1105 to verify whether the device UUID and MAC address received from the mobile terminal 120 are valid data (received device UUID and Authenticating that the MAC address is the device data previously registered in the storage block 1105 by the user), and generating an acknowledgment (ACK) message corresponding to the authenticating data when the MAC address is valid data. (Step 512).

As a result, the control block 1205 of the portable terminal 120 transmits its location related information to the client terminal 110 side via Bluetooth communication (step 514).

Here, the location-related information of the mobile terminal, the GPS signal received from the GPS satellite, the cell ID, the SSID and MAC address of the WLAN (for example, Wi-Fi communication, binary CDMA communication, etc.) AP, SSID and MAC address of the WLAN AP It can be any one of the coordinate value calculated using the cell ID, the SSID and MAC address of the WLAN AP, the coordinate value calculated using the SSID and MAC address of the WLAN AP, for example, the reliability of the GPS signal When the mobile terminal is located in an area that is less than a preset reference value or cannot receive GPS information from a GPS satellite, such as an indoor or underground, the mobile terminal may be selectively used as location-related information. Here, a detailed process of acquiring the location related information by the mobile terminal will be described in detail below with reference to FIG. 6.

That is, according to the present embodiment, the client terminal 110 executes a series of processes using near field communication as described above to obtain authentication information, that is, mobile terminal ID and location related information, from the mobile terminal 120. . Here, the present invention, unlike the conventional method of performing a connection for communication without additional authentication when the MAC and SSID of the discovered WLAN AP matches the previously accessed information, using the MAC, SSID, UUID Since the client terminal and the mobile terminal perform data communication after authenticating in both directions, security can be further enhanced from an attack such as spoofing.

Meanwhile, in the present exemplary embodiment referring to FIG. 5, the client terminal and the portable terminal have been described as exchanging authentication information with respect to each other and location information of the portable terminal through Bluetooth communication, but this is merely illustrative for convenience of description. The invention is not necessarily limited thereto, and of course, wireless LAN communication, infrared communication, Zigbee communication, binary CDMA communication, etc. may be used as a short range wireless communication method between the client terminal and the portable terminal.

6 is a flowchart illustrating a main process of obtaining location related information of a mobile terminal utilized as authentication information according to the present invention.

Referring to FIG. 6, when a request for authentication information is received from the client terminal 110, the control block 1205 of the portable terminal 120 turns on the power supply to the GPS module 1203 (step 602). GPS information received via 1203 is passed to a reliability measurement block 1204 (step 604).

As a result, the reliability measurement block 1204 measures the reliability (accuracy) of the GPS information by comparing the number of received satellites (4 or less, etc.) or the time of the satellite signal with the current time, and the reliability measurement result. The value is passed to a control block 1205 (step 606). In this case, when the mobile terminal is located at a location (eg, underground) where GPS information cannot be received, GPS information may not be received, and in this case, the reliability measurement block 1204 receives a signal indicating that GPS information is not received. Will be generated and passed to control block 1205.

Next, the control block 1205 checks whether or not the reliability measurement result value of the GPS information is equal to or greater than or equal to a preset reference value (step 608), where the check result reliability measurement result value is a preset criterion. If determined to be greater than or equal to the value, the control block 1205 determines the GPS signal (GPS coordinate value) as the location-related information of the mobile terminal 120 and transmits it to the client terminal 110 (step 610).

On the other hand, if it is determined that the reliability of the measured GPS information is equal to or less than a preset reference value, the control block 1205 blocks (off) power supply to the GPS module 1203 (step). 612), by turning on the power supply to the short range wireless communication module, that is, the wireless LAN module 1207 (step 614), the neighboring WLAN APs are searched (step 616).

Thereafter, the control block 1205 checks whether there is a WLAN AP previously registered in the storage block 1206 among the discovered neighboring WLAN APs (step 618). As a result of the check here, the found WLAN If it is determined that there is no registered WLAN AP among the APs, the control block 1205 blocks the supply of power to the WLAN module 1207 (step 620) and sets the cell ID to the location of the mobile terminal 120. The determined information is transmitted to the client terminal 110 (step 622). Here, in order to prevent unnecessary power consumption, the power supply to the WLAN module 1207 is blocked when the WLAN AP fails to search. The WLAN AP may be searched for a predetermined number of times (eg, 3 times, 5 times, etc.) with a predetermined delay time when the search fails.

As a result of the check in step 618, if there is already registered WLAN AP among the discovered WLAN APs, the control block 1205 relates the SSID and MAC address of the WLAN AP to the location of the mobile terminal 120. The information is determined and transmitted to the client terminal 110 (step 624).

Unlike the above, in the control block 1205, the SSID and MAC address of the found WLAN AP and the estimated position corresponding to the WLAN AP are obtained from the list of the recorded WLAN APs, and the position related information of the mobile terminal (the Coordinate values) may be estimated. The list of the WLAN APs may be information previously stored in the storage block 1206 of the mobile terminal 120 or an external server (not shown) when the situation occurs. Can be obtained by contact.

That is, through the above-described series of processes, the client terminal 110 receives the GPS signal, the cell ID, the SSID and the MAC address of the WLAN AP, the SSID and the MAC of the WLAN AP from the portable terminal 120 through the short range wireless communication. Any one of the coordinate values calculated (estimated) using the address may be provided as the location related information of the mobile terminal.

Referring again to FIG. 4, in the authentication management block 1104 of the client terminal 110, the obtained mobile terminal ID (ie, device UUID and MAC address) is used for registration ID (stored in the storage block 1105) for authentication. A mobile terminal ID registered by the user in advance (step 410), and whether the current location of the mobile terminal 120 based on the location-related information is within a preset service area (preset location range where login is allowed). Check (step 412). Here, step 410 of checking whether the portable terminal ID is a pre-stored registration ID corresponds to steps 502 to 512 shown in FIG. 5.

It is determined that the mobile terminal ID received as a result of the check in step 410 is not a pre-stored registration ID or that the current location of the mobile terminal 120 is not within a preset service range as a result of the check in step 412. At this time, the authentication management block 1104 recognizes this as an illegal intrusion attempt and generates a security message (eg, an intrusion attempt warning, a password change recommendation, etc.) warning the intrusion attempt (step 414), and generates the generated security message. E-mail is sent to a predetermined client terminal through a wired communication network or SMS or MMS is sent to a predetermined mobile terminal through a wired / wireless communication network (step 416).

When it is determined that the two conditions are satisfied as a result of the check in the two steps 410 and 412, the authentication management block 1104 generates an authentication permission command and together with the location-related information (or current location information) of the mobile terminal. It passes to control block 1102 (login is allowed), and as a result, control block 1102 is allowed to log into the server for the client terminal to the server with the location related information, member ID and password (step 418).

On the other hand, when login is permitted and the client terminal 110 is connected to the server, the authentication management block 1104 monitors whether the mobile terminal 120 leaves the preset service area. By periodically executing a check (ping + ping back), that is, the client terminal transmits the health check message to the mobile terminal and in response to the mobile terminal transmits the health response message to the client terminal at a predetermined cycle ( In step 420, it is monitored whether the mobile terminal leaves the preset service area (step 422). Here, the period of the health check can be changed and set by the user.

As a result of the check in step 422, when it is determined that the mobile terminal will leave the preset service area (when there is no health response), the authentication management block 1104 determines that the elapsed elapsed time (the mobile terminal is preset service). Time elapsed while leaving the area) (step 424), and whether the calculated elapsed time elapsed reaches a preset elapsed reference time (eg, 30 seconds, 1 minute, 2 minutes, 3 minutes, etc.). Check (step 426). Here, the elapsed reference time can be changed and set by the user.

As a result of the check in the step 426, if the calculated departure elapsed time reaches the preset elapsed reference time, the authentication management block 1104 generates a forced logout command signal for forcibly logging out the control block 1102; As a result, the control block 1102 forces the logout of the connection to the server (step 428).

At the same time, the authentication management block 1104 generates and displays a logout guide message indicating that the mobile terminal has forcibly logged out of the connection to the server because the mobile terminal has left the preset service area and displayed on the monitor 1103 (see FIG. Step 430). This is to allow the user who has returned from the login allowance position for more than the elapsed reference time to recognize that the user is forcibly logged out due to the service area departure.

In this case, the control block 1205 of the mobile terminal 120 that leaves the preset service area no longer receives the health check message from the client terminal 110. In this case, the control block 1205 may perform the health check message. The power supply to the Bluetooth module 1208 may be cut off (off) by checking the unreceived duration.

Meanwhile, in the present exemplary embodiment, the client terminal requests the provision of authentication information to the portable terminal when the user interface for logging in to the server occurs. However, the present invention is not limited thereto. Regardless of the attempt, the mobile terminal performs automatic pairing (for example, Bluetooth pairing) with the client terminal, and the mobile terminal automatically transmits authentication information (mobile terminal ID and location related information) to the client terminal. In addition, the client terminal may store the received authentication information in a storage block, and may be configured to determine whether to allow the login using the stored authentication information when the user interface for login occurs. Such authentication information may be periodically transmitted to the client terminal at predetermined time intervals, and the client terminal will update and store new authentication information whenever it is received.

In addition, in the present embodiment, the mobile terminal forcibly logs out the client terminal from the server when the elapsed departure time out of the preset service area becomes the preset elapsed reference time, but the present invention is not necessarily limited thereto. In addition, if the health response of the mobile terminal corresponding to the check of the health does not exceed a predetermined reference number (eg, 10 times, 15 times, etc.), the client terminal may be configured to force logout from the server.

On the other hand, the study plan service method of the present invention, which provides an embodiment as described above, may be embodied as computer executable code on a computer (or portable computer) readable recording medium. The recording medium may include any kind of recording device in which data is stored which can be read by a computer system. Examples of such computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices and carrier waves (eg, transmission over the Internet).

In the above description has been described by presenting a preferred embodiment of the present invention, but the present invention is not necessarily limited to this, and those skilled in the art to which the present invention pertains within a range without departing from the technical spirit of the present invention It will be readily appreciated that branch substitutions, modifications and variations are possible.

110: client terminal 120: portable terminal
1101: operation block 1102: control block
1103 monitor 1104 authentication management block
1105: storage block 1106: Bluetooth module
1201: operation block 1202: cell communication module
1203: GPS module 1204: reliability measurement block
1205: control block 1206: storage block
1207: WLAN module 1208: Bluetooth module

Claims (30)

Checking a mobile terminal ID and location related information received from the mobile terminal through short-range wireless communication when a user interface for logging into the server through the client terminal occurs;
Checking whether the portable terminal ID is a pre-stored registration ID and whether the current location of the portable terminal based on the location related information is within a preset service area;
Allowing a login to the server when the portable terminal ID is the previously stored registration ID and the current location is within the preset service area.
Authentication service method using a mobile terminal comprising a. The method of claim 1,
Wherein the user interface comprises:
Enter the member ID and password for logging into the server.
Authentication service method using a mobile terminal. The method of claim 1,
The mobile terminal ID and location related information,
Periodically received and updated from the portable terminal before generation of the user interface
Authentication service method using a mobile terminal. The method of claim 1,
The checking process,
Requesting authentication information to the portable terminal through the short range wireless communication when the user interface occurs;
Acquiring the portable terminal ID and the location related information transmitted from the portable terminal through the short range wireless communication according to the request of the authentication information;
Authentication service method using a mobile terminal comprising a. The method of claim 1,
The short range wireless communication,
Performed by at least one of Bluetooth, WLAN, infrared, Zigbee, and binary CDMA schemes.
Authentication service method using a mobile terminal. The method of claim 1,
The checking process,
Transmitting the MAC address and the system UUID of the client terminal to the portable terminal;
Acquiring the MAC address and the device UUID of the portable terminal transmitted from the portable terminal when the MAC address and the system UUID of the client terminal are authenticated in the portable terminal;
Transmitting, by the client terminal, an acknowledgment (ACK) to the portable terminal when the MAC address and the device UUID of the portable terminal are authenticated;
Acquiring the portable terminal ID and the location related information transmitted from the portable terminal receiving the confirmation response;
Authentication service method using a mobile terminal comprising a. The method of claim 1,
The location related information,
At least one of a GPS signal, a cell ID, a SSID and a MAC address of a WLAN access point, and a coordinate value calculated using the SSID and a MAC address of the WLAN access device.
Authentication service method using a mobile terminal. The method of claim 7, wherein
The checking process,
When the reliability of the GPS signal is less than or equal to a preset reference value, based on at least one of the cell ID, the SSID and the MAC address of the WLAN access device, and the coordinate value, whether the current location is within the preset service area. Checked
Authentication service method using a mobile terminal. The method of claim 1,
The authentication service method,
Recognizing the intrusion attempt when the current location is out of the preset service area;
Generating a security message warning the intrusion attempt and transmitting the security message to a predetermined client terminal or mobile terminal;
Authentication service method using a mobile terminal further comprising. The method of claim 1,
The authentication service method,
Periodically checking the health of the mobile terminal after allowing the login;
Forcibly logging out the client terminal from the server when it is determined that the portable terminal has left the preset service area as a result of the check of the health;
Authentication service method using a mobile terminal further comprising. The method of claim 10,
The forced logout,
Executed when the health response of the portable terminal corresponding to the check of the health is not received more than a predetermined reference number, or when the elapsed time when the portable terminal leaves the preset service area reaches a preset elapsed reference time.
Authentication service method using a mobile terminal. The method of claim 10,
The authentication service method,
When the forced logout is executed, generating and providing a guide message for guiding the forced logout, or when the power supply to the short-range wireless communication module mounted on the portable terminal to perform the short-range wireless communication is cut off.
Authentication service method using a mobile terminal.
A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 12.
A storage block for storing one or more portable terminal IDs as registration IDs;
An operation block for generating a user interface for logging in to the server via the client terminal,
When the user interface is generated, the mobile terminal ID received from the mobile terminal through short-range wireless communication is a registration ID stored in the storage block, and the current location of the mobile terminal is based on the location-related information received from the mobile terminal. Authentication management block allowing login to the server when within the preset service area
Authentication service apparatus using a mobile terminal comprising a. The method of claim 14,
The authentication management block,
When the user interface is generated, request authentication information to the portable terminal through the short range wireless communication, and relate to the location and the portable terminal ID transmitted from the portable terminal through the short range wireless communication according to the request of the authentication information. Obtaining information
Authentication service apparatus using a mobile terminal. The method of claim 14,
The short range wireless communication,
Performed by at least one of Bluetooth, WLAN, infrared, Zigbee, and binary CDMA schemes.
Authentication service apparatus using a mobile terminal. The method of claim 14,
The location related information,
At least one of a GPS signal, a cell ID, a SSID and a MAC address of a WLAN access point, and a coordinate value calculated using the SSID and a MAC address of the WLAN access device.
Authentication service apparatus using a mobile terminal. The method of claim 17,
The authentication management block,
When the reliability of the GPS signal is less than or equal to a preset reference value, based on at least one of the cell ID, the SSID and the MAC address of the WLAN access device, and the coordinate value, whether the current location is within the preset service area. Judging
Authentication service apparatus using a mobile terminal. The method of claim 14,
The authentication management block,
The mobile terminal periodically checks the health of the portable terminal after the login is allowed, and when the portable terminal determines that the portable terminal has left the preset service area, the client terminal is forcibly logged out of the server. Letting
Authentication service apparatus using a mobile terminal. The method of claim 19,
The authentication management block,
When the health response of the portable terminal corresponding to the check of the health is not received more than a predetermined reference number or when the elapsed time when the portable terminal leaves the preset service area reaches a preset elapsed reference time, Force a forced logout
Authentication service apparatus using a mobile terminal. The method of claim 14,
The authentication management block,
Recognizing an intrusion attempt when the current location is out of the preset service area, generating a security message corresponding to the intrusion attempt, and transmitting the generated security message to a predetermined client terminal or a mobile terminal.
Authentication service apparatus using a mobile terminal.
Requesting authentication information to the mobile terminal through short-range wireless communication when a user interface for logging in from the client terminal to the server occurs;
Acquiring a portable terminal ID transmitted from the portable terminal and the location related information of the portable terminal through the short range wireless communication according to the request of the authentication information;
Checking whether the portable terminal ID is a pre-stored registration ID and whether the current location of the portable terminal is within a preset service area based on the location-related information;
As a result of the checking, when the portable terminal ID is the pre-stored registration ID and the current location is within the preset service area, allowing a login to the server
Authentication service method using a mobile terminal comprising a. The method of claim 22,
The location related information,
At least one of a GPS signal, a cell ID, a SSID and a MAC address of a WLAN access point, and a coordinate value calculated using the SSID and a MAC address of the WLAN access device.
Authentication service method using a mobile terminal. The method of claim 23,
The checking process,
When the reliability of the GPS signal is less than or equal to a preset reference value, based on at least one of the cell ID, the SSID and the MAC address of the WLAN access device, and the coordinate value, whether the current location is within the preset service area. Checked
Authentication service method using a mobile terminal. The method of claim 22,
The authentication service method,
Periodically checking the health of the mobile terminal after allowing the login;
Forcibly logging out the client terminal from the server when it is determined that the portable terminal has left the preset service area as a result of the check of the health;
Authentication service method using a mobile terminal further comprising. The method of claim 25,
The forced logout,
Executed when the health response of the portable terminal corresponding to the check of the health is not received more than a predetermined reference number, or when the elapsed time when the portable terminal leaves the preset service area reaches a preset elapsed reference time.
Authentication service method using a mobile terminal.
When the user interface for logging in to the server occurs, the mobile terminal ID received from the mobile terminal through short-range wireless communication is a pre-stored registration ID, and the current location of the mobile terminal is based on the location-related information obtained from the mobile terminal. A client terminal allowing login to the server when within a preset service area;
The mobile terminal is connected to the client terminal through the short range wireless communication, and provides the mobile terminal ID and location related information to the client terminal.
Authentication service system using a mobile terminal comprising a. The method of claim 27,
The location related information,
At least one of a GPS signal, a cell ID, a SSID and a MAC address of a WLAN access point, and a coordinate value calculated using the SSID and a MAC address of the WLAN access device.
Authentication service system using a mobile terminal. 29. The method of claim 28,
The client terminal,
When the reliability of the GPS signal is less than or equal to a preset reference value, based on at least one of the cell ID, the SSID and the MAC address of the WLAN access device, and the coordinate value, whether the current location is within the preset service area. Judging
Authentication service system using a mobile terminal. The method of claim 27,
The client terminal,
Forcibly logging out the connection to the server when the mobile terminal leaves the preset service area during the login connection to the server.
Authentication service system using a mobile terminal.

Images