Continuous user verification and service access control method thruough facial authentication

Abstract

A method of operation of a service access control system is disclosed. The method of operation comprises the steps of: when an access request from a registered user including access authority information is received through a first user terminal, a service server providing a service to the first user terminal; while the service is provided, the service server controlling the first user terminal to capture a facial image of the registered user at a fixed interval regardless of user input; an authentication server acquiring a facial image captured by the first user terminal at a fixed interval; the authentication server performing facial authentication at a fixed interval based on the facial image; and, upon failure of facial authentication, the service server disabling the connection session of the first user terminal to the service to stop the provision of the service.

Description

Technology Field

[0001] The present disclosure relates to a service access control system that verifies a user through facial authentication, and more specifically, to an access control method that performs periodic facial authentication and enhanced authentication. Background Technology

[0002] Typically, certification methods for verifying user reliability are classified into three factors.

[0003] Factor 1 is knowledge-based, performing identity verification during authentication by confirming information known only to the individual. For example, this involves entering a password or PIN number. Factor 2 is possession-based, performing identity verification by presenting a tool possessed only by the individual. For example, this involves authentication using an OTP card or USB security key held by the individual. Factor 3 is biometric-based, performing identity verification by presenting one's own physical characteristics. For example, this involves authentication using facial information or fingerprint data.

[0004] Conventional password-based user authentication methods have seen their security weakened due to large-scale leaks of personal information and passwords, necessitating enhanced identity verification through additional authentication measures. An alternative that involves randomly generating complex passwords requires the use of separate management tools to remember them, thereby losing the convenience of a knowledge-based system. Furthermore, in multi-device environments (where users utilize multiple terminals), this entails the burden of managing stored passwords and imposes limitations on security. Recently, due to these security threats, passwordless authentication methods—that is, authentication methods that do not use passwords—have become preferred.

[0005] In addition, when applying the standard of granting access rights within a set time for each service in accordance with Zero-Trust requirements, repetitive authentication processes must be performed for each service and during the authorization cycle; therefore, one must bear the burden of undergoing identity verification procedures more frequently and extensively to maintain service access rights. Furthermore, there is a disadvantage that as the number of authentication attempts increases, the possibility of exposure regarding the user's information increases. The problem to be solved

[0006] The present disclosure provides a service access control system that controls access to a service by performing facial authentication at regular intervals regardless of user input.

[0007] The present disclosure provides a service access control system that performs facial authentication without user fatigue, and performs enhanced authentication as a condition for service reconnection in the event of facial authentication failure.

[0008] The purposes of the present disclosure are not limited to those mentioned above, and other purposes and advantages of the present disclosure not mentioned may be understood from the following description and will be more clearly understood from the embodiments of the present disclosure. Furthermore, it will be readily apparent that the purposes and advantages of the present disclosure can be realized by the means and combinations thereof set forth in the claims. means of solving the problem

[0009] A method of operation of a service access control system according to one embodiment of the present disclosure comprises: when an access request from a registered user including access authority information is received through a first user terminal, a service server provides a service to the first user terminal; while the service is provided, the service server controls the first user terminal to capture a facial image of the registered user at a fixed period regardless of user input; the authentication server acquires the facial image captured by the first user terminal at each fixed period; the authentication server performs facial authentication at each fixed period based on the facial image; and when the facial authentication fails, the service server disables the connection session of the first user terminal for the service to stop providing the service.

[0010] The method of operation of the above service access control system may include the step of the service server requesting enhanced authentication from the authentication server when a reconnection is requested from the first user terminal while the connection session of the first user terminal is deactivated due to the failure of the facial authentication, the step of the authentication server performing enhanced authentication for the user of the first user terminal, and the step of the service server resuming service provision to the first user terminal upon the success of the enhanced authentication.

[0011] In this case, the step of resuming the provision of the service may include: a step in which, upon the success of the enhanced authentication, the authentication server reissues the access authority information of the registered user that had expired due to the failure of the facial authentication through the first user terminal; a step in which, upon the receipt of an access request from the registered user including the reissued access authority information through the first user terminal, the service server identifies whether the reissued access authority information is valid through the authentication server; and a step in which, if the reissued access authority information is valid, the service server provides the service to the first user terminal.

[0012] The step of performing the above-mentioned enhanced authentication may transmit a request to perform enhanced authentication for the first user terminal to an authentication portal connected to a separate authentication channel.

[0013] Alternatively, the step of performing the enhanced authentication may involve the authentication server transmitting an image containing code information to the first user terminal, and if another second user terminal, which is previously registered for the enhanced authentication procedure of the user of the first user terminal, accesses a web page matching the code information, facial authentication may be performed through the second user terminal.

[0014] Meanwhile, the method of operation of the above-mentioned service access control system may include the steps of: when access to the service is requested from a third user terminal of an unregistered user who has no history of being issued access authority information, the service server requests the authentication server to register authentication information for facial authentication and enhanced authentication of the unregistered user; the authentication server registers a facial image received from the third user terminal for facial authentication of the unregistered user; according to an enhanced authentication procedure selected based on user input received through the third user terminal, the authentication server sets the third user terminal or another fourth user terminal of the unregistered user as a target terminal for enhanced authentication; perform identity authentication related to enhanced authentication through the target terminal and register the enhanced authentication procedure of the target terminal; and when the enhanced authentication procedure is registered, the authentication server issues access authority information to the third user terminal of the unregistered user to register the unregistered user.

[0015] In this case, the step of registering the enhanced authentication procedure of the target terminal may, when the third user terminal is set as a target terminal matching the enhanced authentication procedure of the unregistered user, provide the authentication server with web page information to the third user terminal for performing enhanced authentication through an authentication portal connected to a separate authentication channel.

[0016] Alternatively, the step of registering the enhanced authentication procedure of the target terminal may be such that, when the fourth user terminal is set as a target terminal matching the enhanced authentication procedure of the unregistered user, at least one web page for identity verification related to enhanced authentication is provided to the fourth user terminal, and when identity authentication of the fourth user terminal is performed through the web page, the authentication server may register the enhanced authentication procedure of the unregistered user for the fourth user terminal.

[0017] And the method of operation of the above service access control system may include the step of, when an access request for the service is first received from the third user terminal after the access authority information is issued, the step of the service server requesting enhanced authentication for the user terminal from the authentication server; the step of the authentication server performing the enhanced authentication for the registered user of the third user terminal; and the step of the service server providing the service to the third user terminal upon the success of the enhanced authentication. Effects of the invention

[0018] The service access control system according to the present disclosure has the advantage of enabling both reduced user fatigue and enhanced security by automatically performing periodic facial authentication during the service provision process without user awareness or fatigue, and requesting enhanced authentication only in the event of a facial authentication failure.

[0019] The service access control system according to the present disclosure maintains a secure connection environment with continuous user reliability verification applied by authenticating through the capture of facial information using a camera attached to a user terminal without user intervention. In the event of a change in the user environment, such as a change in user, being away from the desk, or the detection of multiple users, the system can automatically block the connection session and control access rights according to security policies through re-authentication.

[0020] Conventional Single Sign-On technology acquires authority for multiple services through a single authentication in the application domain, but through the present invention, it is possible to acquire authority up to the application domain through a single authentication at the time of connecting to the network environment.

[0021] The blocking function resulting from user facial authentication failure enables effective response to threats by uniformly applying privilege revocation and access control in both the network environment and the application area.

[0022] By applying enhanced user authentication methods during the re-authentication process for users who have failed facial authentication, user reliability can be increased by applying various enhanced authentication methods based on additional authentication means to the same user. Brief explanation of the drawing

[0023] FIG. 1 is a drawing for explaining the configuration and operation of a service access control system according to the present disclosure, FIG. 2 is a sequence diagram illustrating a procedure for a service access control system to register an unregistered user according to one embodiment of the present disclosure, FIG. 3 is a sequence diagram illustrating the operation of a service access control system according to an embodiment of the present disclosure to preferentially perform enhanced authentication in response to an initial access request by a registered user. FIG. 4 is a diagram illustrating the operation of a service access control system according to one embodiment of the present disclosure performing periodic facial authentication while a service is provided to a registered user. FIG. 5 is an algorithm for explaining the operation of a service access control system according to one embodiment of the present disclosure, which performs service suspension or enhanced authentication based on the result of periodic facial authentication, FIG. 6 is a diagram illustrating a User Interface (UI) provided by an authentication server according to an embodiment of the present disclosure through a user terminal to register a facial image for periodic facial authentication. FIGS. 7a to 7c are drawings for exemplifying a User Interface (UI) provided through a user terminal in each case where the service is interrupted due to a failure in facial authentication during the service provision process. Specific details for implementing the invention

[0024] Before specifically describing the present disclosure, the method of description in the specification and drawings is described.

[0025] First, the terms used in this specification and claims have been selected based on general terms considering their functions in the various embodiments of this disclosure. However, these terms may vary depending on the intent of those skilled in the art, legal or technical interpretations, and the emergence of new technologies. Additionally, some terms have been arbitrarily selected by the applicant. Such terms may be interpreted according to the meanings defined in this specification; in the absence of specific definitions, they may be interpreted based on the overall content of this specification and common technical knowledge in the relevant field.

[0026] In addition, the same reference numbers or symbols described in each drawing attached to this specification represent parts or components that perform substantially the same function. For convenience of explanation and understanding, the same reference numbers or symbols are used to describe different embodiments. That is, even if components having the same reference number are all depicted in multiple drawings, the multiple drawings do not imply a single embodiment.

[0027] Additionally, in this specification and claims, terms including ordinal numbers, such as "first," "second," etc., may be used to distinguish between components. These ordinal numbers are used to distinguish identical or similar components from one another, and the meaning of the terms should not be limited by the use of such ordinal numbers. For example, the order of use or arrangement of components combined with such ordinal numbers should not be restricted by the number. If necessary, each ordinal number may be used interchangeably.

[0028] In this specification, singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, terms such as "comprising" or "consisting of" are intended to specify the existence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0029] In the embodiments of the present disclosure, terms such as "module," "unit," "part," etc. are used to refer to a component that performs at least one function or operation, and such component may be implemented in hardware or software, or in a combination of hardware and software. Additionally, a plurality of "modules," "units," "parts," etc. may be integrated into at least one module or chip and implemented as at least one processor, except where each needs to be implemented in specific individual hardware.

[0030] Furthermore, in the embodiments of the present disclosure, when a part is described as being connected to another part, this includes not only a direct connection but also an indirect connection through another medium. Additionally, the meaning that a part includes a certain component implies that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0031] FIG. 1 is a diagram illustrating the configuration and operation of a service access control system according to the present disclosure. Referring to FIG. 1, the service access control system of the present disclosure may include a service server (100) and an authentication server (200).

[0032] The service server (100) is a device for providing a service to at least one user terminal. The service server (100) can provide a service to the user terminal through at least one web page or application accessible via a network environment.

[0033] In this case, the service may be a service where security is critical due to its connection to internal business operations, such as video conferencing or ERP (Enterprise Resource Planning), but is not limited to these; various types of services that can be provided via at least one user terminal are possible.

[0034] The service server (100) can configure a Relying Party (RP) for authentication and is linked with an authentication server (200) that verifies whether a user attempting to access the service is a user with usage rights.

[0035] The service server (100) may correspond to a device or system comprising one or more computers including at least one memory and at least one processor.

[0036] The authentication server (200) is a device for performing facial authentication or enhanced authentication through at least one user terminal. To this end, the authentication server (200) can register each user's facial image or a code in which the facial image has been converted for each user.

[0037] The authentication server (200) may correspond to a device or system comprising one or more computers including at least one memory and at least one processor.

[0038] The user service environment may include at least one user terminal (10, 20, etc.) for providing services to the user. For example, if the service is a video conference, a user terminal (10) for providing video conference may be included, which is connected to a camera for photographing the user during the video conference. At this time, periodic facial authentication by the authentication server (200) may be performed through facial images periodically acquired via the user terminal (10) while the service is being provided. If facial authentication fails, the connection session of the user terminal (10) for the service (e.g., video conference) may be deactivated, and the provision of the service may be suspended, and the authentication server (200) may perform enhanced authentication through the user terminal (10) or a separate other user terminal (20). Here, the service server (100) may resume the provision of the service to the user terminal (10) on the premise that the enhanced authentication is successful.

[0039] In order to enable service or authentication by linking with the aforementioned service server (100) or authentication server (200), a camera control function for acquiring the user's facial information and a facial information module for encoding the acquired facial information may be installed in the user service environment. The facial information module may be included on a user terminal (e.g., 10, 20), but under the trend of the user service environment becoming increasingly virtualized, it may be located anywhere other than the user terminal (e.g., 10), such as a network section connected to the service access environment (e.g., another user terminal, a virtual module within an external server, etc.).

[0040] A camera for facial authentication may be included on a user terminal (10) where the service is provided, or it may be implemented as a separate camera device installed to photograph the user while being connected to the user terminal (10).

[0041] User terminals included in the user service environment (e.g., 10, 20, …) may include, but are not limited to, desktop PCs (e.g., including output devices such as monitors), notebook PCs, kiosks, smartphones, tablet PCs, PDAs, screen devices, camera devices (e.g., live web cameras).

[0042] Communication between a user terminal, a service server (100), and an authentication server (200) constituting a user service environment can be performed through various wired or wireless communication networks. In this case, in addition to direct communication, indirect communication through at least one relay device or gateway device is also possible.

[0043] Each device may include circuits, modules, chips, etc. for communicating with at least one external device using various wired or wireless communication methods.

[0044] Depending on the area or scale, a network may be a Personal Area Network (PAN), Local Area Network (LAN), Wide Area Network (WAN), etc., and depending on the openness of the network, it may be an Intranet, Extranet, or Internet, etc.

[0045] Each device can be connected to external devices through various wireless communication methods such as LTE (long-term evolution), LTE-A (LTE Advance), 5G (5th Generation) mobile communication, CDMA (code division multiple access), WCDMA (wideband CDMA), UMTS (universal mobile telecommunications system), WiBro (Wireless Broadband), GSM (Global System for Mobile Communications), DMA (Time Division Multiple Access), WiFi (Wi-Fi), WiFi Direct, Bluetooth, NFC (near field communication), and Zigbee.

[0046] Each device may also be connected to external devices via various wired communication methods such as Ethernet, the Internet, USB, HDMI, and Thunderbolt.

[0047] FIG. 2 is a sequence diagram illustrating a procedure for a service access control system to register an unregistered user according to one embodiment of the present disclosure.

[0048] An unregistered user may refer to a user who has no history of being issued access rights information for a service. For example, a user terminal may support the user's registration process for a service provided by a service server (100). During the registration process, the user terminal may be granted access rights information by registering a facial image for facial authentication on an authentication server (200), and as a result, the user may become a registered user.

[0049] As described in more detail below with reference to FIG. 2, first, a service server (100) can receive a request for access to a service from an unregistered user from a user terminal (10) (S210). Specifically, the service server (100) can transmit the received access request data to an authentication server (200), and the authentication server (200) can confirm that the user is an unregistered user who does not include access authority information.

[0050] In this case, the service server (100) may request the authentication server (200) and the user terminal (10) to register a face for facial authentication (S220). This corresponds to a new registration procedure for unregistered users, and a facial information module for registering a face image or a code converted from a face image may be installed on the user terminal (10) that received the request for face registration from the service server (100). This operation may be performed through a conventional method of redirecting a connection request from the RP (server or network equipment) to a separate user authentication management portal, but is not limited thereto.

[0051] Upon receipt of a request for facial registration, the user terminal (10) can transmit a facial image to the authentication server (200) (S230). To this end, the authentication server (200) can provide a graphic UI through the user terminal (10) that guides the shooting or registration of the face as shown in FIG. 6.

[0052] When a facial image is obtained in this manner, the authentication server (200) can register the user's facial image for facial authentication (S240). At this time, the image data of the facial image may be stored as is on the authentication server (200), or it may be stored in the form of a code containing feature information extracted from the facial image.

[0053] When the above-described facial registration process is completed, the authentication server (200) can perform the registration process of the enhanced authentication procedure.

[0054] Specifically, referring to FIG. 2, the authentication server (200) can provide a UI to the user terminal (10) for selecting an enhanced authentication procedure (S250). Then, the enhanced authentication procedure can be selected according to user input received through the user terminal (10) (S260).

[0055] Here, the enhanced authentication procedure may be selected as an enhanced authentication procedure that sets the user terminal (10) receiving the service itself as the target terminal, or an enhanced authentication procedure that sets a user terminal (e.g., 20) different from the user terminal (10) described above as the target terminal.

[0056] For example, if a user terminal (10) is set as a target terminal that matches the enhanced authentication procedure, the authentication server (200) may provide web page information for performing identity verification to the user terminal (10) through an authentication portal connected to a separate authentication channel. Then, the authentication server (200) may obtain the result of the identity verification performed on the web page. As identity verification is performed in this manner, if a problem arises with facial recognition during the subsequent service provision process, enhanced authentication can be performed through communication between the authentication server (200) and the user terminal (20).

[0057] As another example, if a separate user terminal (20) different from the user terminal (10) receiving the service is set as the target terminal for the enhanced authentication procedure, the authentication server (200) may provide at least one web page for identity verification related to enhanced authentication to the user terminal (20). Specifically, the authentication server (200) may provide code information (e.g., QR code) for enhanced authentication to the user terminal (10). The code information may be matched to a web page for performing enhanced authentication through the user terminal (20). Here, when the user terminal (20) accesses the web page by scanning the QR code, the authentication server (200) may perform identity verification through the user terminal (20). At this time, the user terminal (20) may correspond to a smartphone, wearable device, etc. that the user possesses directly. As identity verification is performed in this manner, if a problem arises with facial recognition during the subsequent service provision process, enhanced authentication can be performed through communication between the authentication server (200) and the user terminal (20).

[0058] When identity authentication is performed through a target terminal according to at least one of the above-described embodiments, the authentication server (200) can register an enhanced authentication procedure for a user that matches the target terminal (S270).

[0059] Thus, when the registration for the facial registration and enhanced authentication procedure for facial authentication is completed, the authentication server (200) can complete the registration procedure for the user.

[0060] However, after the registration of the enhanced authentication procedure, the authentication server (200) may request the user terminal (10) to take a picture of the face for comparison with the previously registered face image (or code), and may perform face authentication by comparing the face image (or code) received from the user terminal (10) with the registered face image (or code). In this case, the authentication server (200) may complete the user's registration procedure on the premise that face authentication is successful.

[0061] The authentication server (200) can complete the registration procedure for a user who was previously unregistered and issue access rights information for the service to the user (S280). The access rights information may include information values ​​such as an Access Token, ID Token, and Role, but is not limited thereto.

[0062] Meanwhile, when the first request for access to the service is received from a user who has been granted access rights information as described above, the service server (100) may provide the service on the premise that enhanced authentication is performed through the authentication server (200). This applies only to the first access request of a registered user and will be explained in more detail below through FIG. 3.

[0063] FIG. 3 is a sequence diagram illustrating the operation of a service access control system according to one embodiment of the present disclosure to preferentially perform enhanced authentication in response to the first access request of a registered user.

[0064] Referring to FIG. 3, when a request for access to a service from a registered user is received (S310), the service server (100) can identify whether the access request from the registered user is the first access request since registration based on the authentication server (200)'s verification of the access authority information included in the access request (S320).

[0065] In the case of the first access request, the service server (100) may request the authentication server (200) to perform enhanced authentication (S340).

[0066] In this case, the authentication server (200) can perform enhanced authentication through a target terminal that matches the registered enhanced authentication procedure.

[0067] When the target terminal is a user terminal (10) that is the target of the service provision, the authentication server (200) may perform enhanced authentication through the separate authentication channel described above, and the method of enhanced authentication may include facial authentication, facial gesture authentication, other biometric information authentication, OTP / certificate, identity authentication, etc., but is not limited thereto.

[0068] If the target terminal is a user terminal (20) other than the user terminal (10) that is the target of the service provision, the authentication server (200) may provide code information (e.g., QR code) for enhanced authentication to the user terminal (10). The code information may be matched to a web page for performing enhanced authentication through the user terminal (20). Here, when the user terminal (20) accesses the web page by scanning the QR code, the authentication server (200) may perform enhanced authentication through the user terminal (20). At this time, the method of enhanced authentication may be facial authentication, facial gesture authentication, other biometric information authentication, OTP / certificate, identity authentication, etc., but is not limited thereto.

[0069] And, as the enhanced authentication of the authentication server (200) is successful (S350), the service server (100) can provide the service to the user terminal (10) (S360).

[0070] In the following, through FIGS. 4 and 5, a specific embodiment is described in which periodic facial authentication and, if necessary, enhanced authentication are performed during the process of providing a service after a registered user's access request.

[0071] FIG. 4 is a sequence diagram illustrating the operation of a service access control system according to one embodiment of the present disclosure performing periodic facial authentication while a service is provided to a registered user.

[0072] Referring to FIG. 4, the service server (100) can receive a request for access to a service from a user terminal (10) for a registered user (S410). Likewise, the service server (100) can identify whether the user matching the access request is a registered user based on the authentication server (200)'s verification of the access authority information included in the access request.

[0073] As described above, when an access request for a registered user is received, the service server (100) can provide a service to the user terminal (10) (S420).

[0074] While the service is being provided, the service server (100) may request a facial image from the user terminal (10) (S430). Specifically, the service server (100) may control the user terminal (10) to capture a facial image of a registered user at regular intervals, regardless of user input.

[0075] Thus, the facial images acquired periodically can be transmitted to the authentication server (200) (S440). At this time, the user terminal (10) may transmit the facial images to the authentication server (200) via the service server (100), or it may transmit the facial images to the authentication server (200) without passing through the service server (100). Here, the data of the facial image itself may be transmitted, but it is also possible to transmit a code in which the facial image has been converted. When the facial image is transmitted as a converted code, the facial information module of the user terminal (10) may verify the acquired facial image to identify whether multiple users are included, whether the user is absent, or whether prohibited acts (such as filming with a separate camera or possessing prohibited items) exist in addition to the code value of the facial image, and may add additional code values ​​accordingly. To this end, the user terminal (10) may include an artificial intelligence model for recognizing each user's face within the facial image, an artificial intelligence model for recognizing objects related to prohibited acts (e.g., a separate camera, prohibited items, etc.). This artificial intelligence model for verification to add additional code values ​​may be transmitted from the authentication server (200) to the user terminal (10) during the process of performing step S230 of FIG. 2 described above, but is not limited thereto.

[0076] The authentication server (200) can perform periodic facial authentication based on the received facial image (S450). Specifically, the authentication server (200) can compare the received facial image or code of a previously registered user with the facial image, and this facial authentication can be performed according to a certain period when the facial image is received.

[0077] At this time, the authentication server (200) can identify the result of facial authentication according to various situations other than simply facial mismatch. For example, facial authentication can be identified as a failure in cases where two or more users' faces are identified within an image obtained through the user terminal (10), or where a user's face is not identified within the image.

[0078] The authentication server (200) can transmit the result of facial authentication to the service server (100) (S460), and the service server (100) can determine whether to maintain the provision of the service based on the facial authentication result (S470). For example, if facial authentication is successful, the connection session of the user terminal (10) to the service is maintained, but if facial authentication fails, the service server (100) can stop the provision of the service by deactivating the connection session of the user terminal (10) to the service. Deactivation of the connection session can be handled by commands such as Logout, Disconnect, Access Reject, or Login Fail within the service, but is not limited thereto. In this case, the user's access rights information issued by the authentication server (200) may be revoked or deactivated. For example, the qualification of the Access Token constituting the access rights information may be revoked.

[0079] In this way, if the provision of service is interrupted due to a failure of facial authentication, the service server (100) can resume the provision of service on the premise of successful enhanced authentication, as explained below through FIG. 5.

[0080] FIG. 5 is an algorithm for explaining the operation of a service access control system according to one embodiment of the present disclosure, which performs service interruption or enhanced authentication based on the result of periodic facial authentication.

[0081] Referring to FIG. 5, the service server (100) may receive a request for access to the service from a user terminal (10) (S505). If the user is an unregistered user who has no history of being issued access rights information (S510 - N), the service server (100) may perform a user registration procedure through the authentication server (200) as described in FIG. 2 above (S515).

[0082] On the other hand, when an access request from a registered user containing access rights information is received (S510 - Y), the service server (100) provides a service to the user terminal (10) (S520), while the authentication server (200) can perform facial authentication through the user terminal (10) at regular intervals (S525).

[0083] Periodic facial authentication may be performed (S530, S535), and if facial authentication fails (S530 - N), the service server (100) may disable the connection session of the user terminal (10) to stop the service (S540).

[0084] However, if a request for reconnection to the service is received from the user terminal (10) while the service is interrupted (S545 - Y), the service server (100) may request enhanced authentication for the user from the authentication server (200).

[0085] In this case, the authentication server (200) can perform enhanced authentication for the user of the user terminal (10) (S550).

[0086] For example, if the target terminal is a user terminal (10) that is the target of service provision, the authentication server (200) can perform enhanced authentication through the separate authentication channel described above.

[0087] For example, if the target terminal is a user terminal (20) other than the user terminal (10) that is the target of the service provision, the authentication server (200) may provide code information (e.g., QR code) for enhanced authentication to the user terminal (10). The code information may be matched to a web page for performing enhanced authentication through the user terminal (20). Here, when the user terminal (20) accesses the web page by scanning the QR code, the authentication server (200) may perform enhanced authentication through the user terminal (20).

[0088] As the enhanced authentication succeeds (S555 - Y), the service server (100) can resume providing services to the user terminal (10) (S560). Specifically, upon the successful enhancement authentication, the authentication server (100) can reissue the access rights information of the registered user, which had previously expired due to the failure of facial authentication, through the user terminal (10). When an access request from the registered user containing the reissued access rights information is received through the user terminal (10), the service server (100) can identify whether the reissued access rights information is valid through the authentication server (200). If the reissued access rights information is valid, the service server (100) can activate the connection session of the user terminal (10) to provide services.

[0089] Meanwhile, FIG. 6 is a diagram illustrating a User Interface (UI) provided through a user terminal by an authentication server according to an embodiment of the present disclosure for registering a facial image for periodic facial authentication. The UI of FIG. 6 can be utilized in the facial registration process of an unregistered user, but is not provided for the periodic facial authentication process performed during the service provision process. That is, during the service provision process, facial authentication can be performed at regular intervals without guidance to the user.

[0090] FIGS. 7a to 7c are drawings for exemplifying a User Interface (UI) provided through a user terminal in each case where the service is interrupted due to a failure in facial authentication during the service provision process. FIGS. 7a to 7c each assume a situation where the provided service is a video conference and illustrate a service screen provided through a user terminal (10).

[0091] As a result of periodic facial authentication being performed during the provision of a service (video conference), if the face does not match a pre-registered face as in FIG. 7a, if the face is not recognized as in FIG. 7b, or if the faces of two or more users are recognized as in FIG. 7c, the facial authentication may be identified as having failed.

[0092] As a result, as shown in FIGS. 7a to 7c, the service server (100) can provide a UI item indicating service suspension through the user terminal (10), and the service server (200) can disable the connection session and stop providing the service. Subsequently, when a reconnection request from the user terminal (10) is received, the service can be resumed only if enhanced authentication through the authentication server (200) is successful.

[0093] Meanwhile, the various embodiments described above may be implemented by combining two or more embodiments, provided that they do not conflict or contradict each other.

[0094] Meanwhile, the various embodiments described above may be implemented in a recording medium readable by a computer or a similar device using software, hardware, or a combination thereof.

[0095] According to hardware implementation, the embodiments described in this disclosure may be implemented using at least one of ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), processors, controllers, microcontrollers, microprocessors, and other electrical units for performing functions.

[0096] In some cases, the embodiments described herein may be implemented as the processor itself. In a software implementation, embodiments such as the procedures and functions described herein may be implemented as separate software modules. Each of the aforementioned software modules may perform one or more functions and operations described herein.

[0097] Meanwhile, computer instructions or computer programs for performing processing operations in a service server (100), authentication server (200), collection device (300), AI management device (400), etc., according to various embodiments of the present disclosure described above, may be stored in a non-transitory computer-readable medium. When such computer instructions or computer programs stored in a non-transitory computer-readable medium are executed by a processor of a specific device, the specific device described above performs processing operations in a service server (100), authentication server (200), collection device (300), AI management device (400), etc., according to various embodiments described above.

[0098] A non-transient computer-readable medium refers to a medium that stores data semi-permanently and can be read by a device, unlike media that store data for a short period of time such as registers, caches, and memory. Specific examples of non-transient computer-readable media include CDs, DVDs, hard disks, Blu-ray discs, USBs, memory cards, and ROMs.

[0099] Although preferred embodiments of the present disclosure have been illustrated and described above, the present disclosure is not limited to the specific embodiments described above. It is understood that various modifications can be made by those skilled in the art without departing from the essence of the present disclosure as claimed in the claims, and such modifications should not be understood individually from the technical spirit or perspective of the present disclosure. Explanation of the symbols

[0100] 100: Service Server 200: Authentication Server

Claims

Claim 1 A method of operation of a service access control system comprises: when an access request from a registered user including access authority information is received through a first user terminal, a service server provides a service to the first user terminal; while the service is provided, the service server controls the first user terminal to capture a facial image of the registered user at a fixed period regardless of user input; an authentication server performing authentication to provide the service acquires the facial image captured by the first user terminal at the fixed period; and the authentication server performs facial authentication at the fixed period based on the facial image. A method of operation of a service access control system, comprising: a step in which, as the facial authentication fails, the service server disables the connection session of the first user terminal for the service and stops providing the service; wherein, if a reconnection is requested from the first user terminal while the connection session of the first user terminal is disabled due to the failure of the facial authentication, the service server requests enhanced authentication from the authentication server; the authentication server transmits an image containing code information for enhanced authentication to the first user terminal; and the authentication server performs facial authentication through the second user terminal when another second user terminal, which is previously registered for the enhanced authentication procedure of the first user terminal, accesses a web page matching the code information. Claim 2 A method of operation of a service access control system according to claim 1, further comprising the step of the service server resuming service provision to the first user terminal upon successful enhancement authentication. Claim 3 In paragraph 2, the step of resuming the provision of the service comprises: a step in which, upon successful enhancement authentication, the authentication server reissues the access rights information of the registered user that had expired due to the failure of the facial authentication through the first user terminal; a step in which, upon receiving an access request from the registered user including the reissued access rights information through the first user terminal, the service server identifies whether the reissued access rights information is valid through the authentication server; and a step in which, if the reissued access rights information is valid, the service server provides the service to the first user terminal; a method of operation of a service access control system. Claim 4 A method of operation of a service access control system, wherein the step of performing the enhanced authentication in claim 1 is to transmit a request to perform the enhanced authentication for the first user terminal to an authentication portal connected to a separate authentication channel. Claim 5 delete Claim 6 In claim 1, the method of operation of the service access control system comprises: a step in which, when access to the service is requested from a third user terminal of an unregistered user who has no history of receiving access authority information, the service server requests the authentication server to register authentication information for facial authentication and enhanced authentication of the unregistered user; a step in which the authentication server registers a facial image received from the third user terminal for facial authentication of the unregistered user; a step in which, according to an enhanced authentication procedure selected based on user input received through the third user terminal, the authentication server sets the third user terminal or another fourth user terminal of the unregistered user as a target terminal for enhanced authentication; a step in which identity authentication related to enhanced authentication is performed through the target terminal and the enhanced authentication procedure of the target terminal is registered; and a step in which, when the enhanced authentication procedure is registered, the authentication server issues access authority information to the third user terminal of the unregistered user to register the unregistered user. Claim 7 In claim 6, the step of registering the enhanced authentication procedure of the target terminal is a method of operation of a service access control system in which, when the third user terminal is set as a target terminal matching the enhanced authentication procedure of the unregistered user, the authentication server provides web page information to the third user terminal for performing enhanced authentication through an authentication portal connected to a separate authentication channel. Claim 8 In claim 6, the step of registering the enhanced authentication procedure of the target terminal comprises, when the fourth user terminal is set as a target terminal matching the enhanced authentication procedure of the unregistered user, providing at least one web page for identity verification related to enhanced authentication to the fourth user terminal, and when identity authentication of the fourth user terminal is performed through the web page, the authentication server registering the enhanced authentication procedure of the unregistered user for the fourth user terminal. Claim 9 In claim 6, the method of operation of the service access control system comprises: a step in which, when an access request for the service is first received from the third user terminal after the access authority information is issued, the service server requests the authentication server to perform enhanced authentication for the user terminal; a step in which the authentication server performs the enhanced authentication for the registered user of the third user terminal; and a step in which, upon success of the enhanced authentication, the service server provides the service to the third user terminal.

Images