Abstract:
Provided herein is an apparatus and method for secure access controlling of a terminal, and more particularly, to a method for secure access controlling of a terminal configured to analyze a behavior pattern of the terminal based on location tracking and path anticipating of the terminal, compare a current location and an anticipated path so as to restrict secure access when an abnormality is discovered from the behavior pattern, and an apparatus thereof, the method including inferring an anticipated path of the terminal based on location information of the terminal collected on a predetermined cycle; determining whether or not the terminal deviated from the anticipated path by comparing a current location of the terminal and the anticipated path of the terminal; and in response to determining that the terminal deviated from the anticipated path, rejecting a secure access request of the terminal.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    The present application claims priority to Korean patent application number 10-2015-0013055, filed on Jan. 27, 2015, the entire disclosure of which is incorporated herein in its entirety by reference. 
       BACKGROUND 
       [0002]    1. Field of Invention 
         [0003]    Various embodiments of the present invention relate to a method for secure access controlling of a terminal and an apparatus thereof, and more particularly, to a method for secure access controlling of a terminal configured to analyze a behavior pattern of the terminal based on location tracking and path anticipating of the terminal, compare a current location and an anticipated path so as to restrict secure access when an abnormality is discovered from the behavior pattern, and an apparatus thereof. 
         [0004]    2. Description of Related Art 
         [0005]    As mobile communication environments develop rapidly due to the recent increased supply of smart terminals, various application services such as financial transactions and office processing that require security are being provided through mobile environments. 
         [0006]    Today&#39;s mobile environments provide secure access controlling services that use user accounts and passwords or information on terminals themselves. 
         [0007]    However, such a conventional method has a disadvantage of weak security in case secure access information such as IDs/passwords or information on terminals themselves is exposed when the terminals are lost or personal information is leaked. 
         [0008]    In order to compensate this disadvantage, recently, secure access methods using location information on terminals have been suggested, but conventional methods related to these methods merely restrict hardware resources when terminals are located in certain areas, and thus there occurs a problem that secure access may not be restricted for terminals located in places other than those certain areas. 
       SUMMARY 
       [0009]    According to an embodiment of the present invention, there is provided a method for secure access controlling a terminal, the method including inferring an anticipated path of the terminal based on location information of the terminal collected on a predetermined cycle; determining whether or not the terminal deviated from the anticipated path by comparing a current location of the terminal and the anticipated path of the terminal; and in response to determining that the terminal deviated from the anticipated path, rejecting a secure access request of the terminal. 
         [0010]    According to another embodiment of the present invention, there is provided an apparatus for secure access controlling of a terminal, the apparatus including a communication unit configured to receive location information on the terminal collected on a predetermined cycle; and a control unit configured to infer an anticipated path of the terminal based on the location information of the terminal collected on the predetermined cycle, compare a current location of the terminal and the anticipated path of the terminal, determine whether or not the terminal deviated from the anticipated path, and in response to determining that the terminal deviated from the anticipated path, reject a secure access request of the terminal. 
         [0011]    A method for secure access controlling of a terminal and an apparatus thereof according to the present disclosure strengthens security in mobile environments by using information obtained by analyzing a behavior pattern in addition to conventional secure access methods. 
         [0012]    Furthermore, a method for secure access controlling of a terminal and an apparatus thereof according to the present disclosure provide secure access control services with strengthened security not only in offices but also outside the offices, thereby providing a same working environment in and outside the offices such as smart offices. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0013]    The above and other features and advantages of the present invention will become more apparent to those of ordinary skill in the art by describing in detail embodiments with reference to the attached drawings in which: 
           [0014]      FIG. 1  is a block diagram illustrating a configuration of an apparatus for secure access controlling of a terminal according to the present disclosure; 
           [0015]      FIG. 2  is a block diagram illustrating a configuration of a control unit of an apparatus for secure access controlling of a terminal according to the present disclosure; 
           [0016]      FIG. 3  is a block diagram illustrating a configuration of a path inferring unit in further detail; 
           [0017]      FIG. 4  is a view for explaining a method for computing an error range of an anticipated path according to the present disclosure; 
           [0018]      FIG. 5  is a flowchart illustrating a method for secure access controlling of a terminal according to the present disclosure; and 
           [0019]      FIG. 6  is a flowchart illustrating a method for secure access controlling of a terminal according to the present disclosure. 
           [0020]      FIG. 7  is a flow chart illustrating a method for secure access controlling of a terminal. 
       
    
    
     DETAILED DESCRIPTION 
       [0021]    Hereinafter, embodiments will be described in greater detail with reference to the accompanying drawings. Embodiments are described herein with reference to cross-sectional illustrates that are schematic illustrations of embodiments (and intermediate structures). As such, variations from the shapes of the illustrations as a result, for example, of manufacturing techniques and/or tolerances, are to be expected. Thus, embodiments should not be construed as limited to the particular shapes of regions illustrated herein but may include deviations in shapes that result, for example, from manufacturing. In the drawings, lengths and sizes of layers and regions may be exaggerated for clarity. Like reference numerals in the drawings denote like elements. 
         [0022]    Terms such as ‘first’ and ‘second’ may be used to describe various components, but they should not limit the various components. Those terms are only used for the purpose of differentiating a component from other components. For example, a first component may be referred to as a second component, and a second component may be referred to as a first component and so forth without departing from the spirit and scope of the present invention. Furthermore, ‘and/or’ may include any one of or a combination of the components mentioned. 
         [0023]    Furthermore, ‘connected/accessed’ represents that one component is directly connected or accessed to another component or indirectly connected or accessed through another component. 
         [0024]    In this specification, a singular form may include a plural form as long as it is not specifically mentioned in a sentence. Furthermore, ‘include/comprise’ or ‘including/comprising’ used in the specification represents that one or more components, steps, operations, and elements exist or are added. 
         [0025]    Furthermore, unless defined otherwise, all the terms used in this specification including technical and scientific terms have the same meanings as would be generally understood by those skilled in the related art. The terms defined in generally used dictionaries should be construed as having the same meanings as would be construed in the context of the related art, and unless clearly defined otherwise in this specification, should not be construed as having idealistic or overly formal meanings. 
         [0026]      FIG. 1  is a block diagram illustrating a configuration of an apparatus for secure access controlling of a terminal according to the present disclosure. 
         [0027]    Referring to  FIG. 1 , the apparatus for secure access controlling of a terminal according to the present disclosure may include a communication unit  101 , input unit  103 , control unit  105 , output unit  107 , and storage unit  109 . 
         [0028]    The communication unit  101  performs data communication with an external apparatus. 
         [0029]    According to an embodiment of the present disclosure, the communication unit  101  may perform data communication with a terminal or server to receive information related to the terminal. The communication unit  101  receives location information of the terminal collected on a predetermined cycle. The communication unit  101  may receive information on a user of the terminal besides the location information of the terminal. The information on the user may be basic information on the user including a basic path, basic moving time, location, occupation and the like. Furthermore, the information on the user may be cyber information on the user including information on using SNS, information on using electronic payment systems and the like. 
         [0030]    According to an embodiment of the present disclosure, the communication unit  101  may receive a secure access request from the terminal, and transmit a secure access approval or rejection response to the terminal. 
         [0031]    The input unit  103  may receive an input of a manipulation signal by the user. The input unit  103  may be configured in any format of a key pad, dome switch, touch pad (constant pressure/capacitive), jog wheel, jog switch, touch pad and the like. 
         [0032]    According to an embodiment of the present disclosure, in response to the terminal deviating from an anticipated path, the input unit  103  may sense an input regarding whether or not to approve the current deviated location. 
         [0033]    The control unit  105  controls overall operations of the apparatus for secure access controlling of a terminal  100 . For example, the control unit  105  infers an anticipated path of the terminal based on location information of the terminal, and compares a current location of the terminal and the anticipated path of the terminal to determine whether or not the terminal deviated from the anticipated path. In response to determining that the terminal deviated from the anticipated path, the control unit  105  controls such that a secure access request of the terminal is rejected. 
         [0034]    Operations of the control unit  105  will be explained in detail later on. 
         [0035]    The output unit  107  outputs information processed in the apparatus for secure access controlling of a terminal  100 . According to an embodiment of the present disclosure, the output unit  107  may display a UI or GUI, output an alarm sound or warning sound, or light up an LED and the like to notify whether or not the terminal deviated from the anticipated path. 
         [0036]    The storage unit  109  may store a program, information and data necessary for operations of the apparatus for secure access controlling of a terminal  100 . According to an embodiment of the present disclosure, the storage unit  109  may store information on location information and anticipated path of the terminal either permanently or temporarily. 
         [0037]    Control operations of the control unit  105  according to the present disclosure will be explained in further detail later on. 
         [0038]      FIG. 2  is a block diagram illustrating a configuration of the control unit of the apparatus for secure access controlling of a terminal according to the present disclosure.  FIG. 2  illustrates a logical structure of the control unit equipped in the apparatus for secure access controlling of a terminal. 
         [0039]    Referring to  FIG. 2 , the control unit  200  may include an information collecting unit  201 , path inferring unit  203  and secure access management unit  205 . 
         [0040]    The information collecting unit  201  collects information on a terminal and/or user of the terminal from the terminal and/or a server that manages the terminal. 
         [0041]    Specifically, the information collecting unit  201  collects location information of the terminal on a predetermined cycle through the location information collecting unit  207 . Furthermore, the information collecting unit  201  collects a basic path, basic moving time, location, occupation and the like as the basic information on the user of the terminal through the basic information collecting unit  209 . Furthermore, the information collecting unit  201  collects information on using SNS and information on using electronic payment system and the like as cyber information on the user of the terminal through the cyber information collecting unit  211 . The basic information and cyber information on the user of the terminal are used to improve accuracy when inferring an anticipated path of the terminal. 
         [0042]    For the aforementioned information collecting, the information collecting unit  201  may be connected to the communication unit of the apparatus for secure access controlling of a terminal. 
         [0043]    The information collecting unit  201  transmits the collected information to the path inferring unit  203 . The information transmitted to the path inferring unit  203  is accumulated and managed in the path inferring unit  203 , and used in inferring an anticipated path of the terminal. 
         [0044]    The path inferring unit  203  infers an anticipated path of the terminal based on the information collected through the information collecting unit  201 , and in response to the terminal deviating from the anticipated path, the path inferring unit  203  notifies the deviation to the secure access management unit  205 . 
         [0045]    In various embodiments of the present disclosure, an apparatus for secure access controlling of a terminal determines whether or not the terminal deviated from an anticipated path using information on a current location and accumulated location information of the terminal. K-neighbor method is a representative path anticipating method. K-neighbor method is a method of selecting k pieces of information on past locations having the highest relevance with a current location, and then comparing the selected past location information with the current location. Since all of the k pieces of information and the current location must be compared in this k-neighbor method, computations must be made k times. When k is set to a small number in order to reduce the amount of computation, the accuracy of determination on path deviation will deteriorate. Thus, when determining whether or not a terminal deviated from an anticipated location by comparing all accumulated location information and the current location of the terminal, the more accumulated the location information of the terminal is, the more amount of computation has to be performed to determine the deviation, thereby reducing the processing speed. 
         [0046]    Therefore, in the present disclosure, an anticipated path of a terminal is inferred using accumulated location information, and then it is determined whether or not the current location deviated from the anticipated path. Furthermore, in the present disclosure, in order to improve the accuracy of determining the deviation from an anticipated path, an error range of the anticipated path is computed, and when the terminal deviated from the error range, it is determined that the terminal deviated from the anticipated path. 
         [0047]    According to an embodiment of the present disclosure, the more number of pieces of accumulated location information there is, the more accurate the anticipated path becomes. And since whether or not the terminal deviated from the anticipated path may be confirmed by comparing the current location and a predetermined anticipated path only, it is possible to determine abnormal behaviors of the terminal more efficiently. 
         [0048]    Furthermore, in various embodiments of the present disclosure, an apparatus for secure access controlling of a terminal may determine whether or not the terminal deviated from an anticipated path based on a sample anticipated path consisting of at least part of the anticipated paths of the terminal. Determining whether or not the terminal deviated from an anticipated path using the entire anticipated paths inferred may increase the amount of calculation required, and thus the apparatus for secure access controlling of a terminal of the present disclosure infers a sample anticipated path by extracting part from the anticipated paths inferred. In the present disclosure, a 2-phase path deviation determination method has been conceived where a sample anticipated path is compared to a current location of the terminal, and then in response to determining that the terminal deviated from the sample anticipated path, then it is determined whether or not the terminal deviated from the anticipated path based on the entire anticipated paths of the terminal. According to the embodiment of the present disclosure, the apparatus for secure access controlling of a terminal may determine whether or not the terminal deviated from the anticipated path at a faster speed and also guarantee the accuracy of the determination. 
         [0049]    For the aforementioned operations, the path inferring unit  203  may include a path management unit  213  and path deviation determining unit  215 . 
         [0050]    The path management unit  213  infers an anticipated path of the terminal based on the information collected from the information collecting unit  201 . The path management unit  213  may manage the entire anticipated paths of the terminal and/or a sample anticipated path consisting of at least part extracted from the entire anticipated paths. 
         [0051]    The path deviation determining unit  215  may determine whether or not the terminal deviated from an anticipated path by comparing the anticipated path of the terminal with a current location of the terminal. The path deviation determining unit  215  compares a sample anticipated path of the terminal with the current location of the terminal, and in response to determining that the terminal deviated from the sample anticipated path, the path deviation determining unit  215  compares the entire anticipated paths of the terminal with the current location of the terminal, thereby determining whether or not the terminal deviated from the anticipated path. 
         [0052]    In various embodiments of the present disclosure, the path deviation determining unit  215  computes an error range of an anticipated path of the terminal. The path deviation determining unit  215  may determine that the terminal deviated from the anticipated path when the current location of the terminal is outside the error range of the anticipated path. In an embodiment, the path deviation determining unit  215  may compute the error range of a sample anticipated path of the terminal, and when the terminal deviated from the error range of the sample anticipated path, compute the error range of the entire anticipated paths of the terminal, and determine whether or not the terminal deviated from the error range of the entire anticipated paths. 
         [0053]    Inferring an anticipated path by the path inferring unit  203  and determining whether or not the terminal deviated from the anticipated path will be explained in further detail with reference to  FIG. 3  later on. 
         [0054]    In response to determining that the terminal deviated from an anticipated path, the path deviation determining unit  215  notifies the secure access management unit  205  that the terminal deviated from the anticipated path. In response to receiving the notification that the terminal deviated from the anticipated path from the path deviation determining unit  215 , the secure access management unit  205  restricts secure access of the terminal. 
         [0055]    The secure access management unit  205  receives a secure access request from the terminal through the secure access request unit  217 . The secure access request unit  217  transmits the received secure access request and information on whether or not the terminal deviated from the anticipated path received from the path deviation determining unit  215  to the secure access control unit  219 . 
         [0056]    The secure access control unit  219  approves or rejects secure access of the terminal using the information received from the secure access request unit  217 . In response to determining that the terminal deviated from the anticipated path, the secure access control unit  219  rejects secure access, and in response to determining that the terminal did not deviated from the path, the secure access control unit  219  approves the secure access. In the case of rejecting the secure access, the secure access control unit  219  may output information on the deviation from the anticipated path of the terminal and notify a managing person. For this purpose, the secure access control unit  219  may be connected to an output unit of the apparatus for secure access controlling of a terminal. 
         [0057]    In various embodiments, the managing person may determine that the current location of the terminal that deviated from the anticipated path is a location for which secure access should be approved. In such a case, the secure access control unit  219  receives a current location approval request of the terminal through the input unit of the apparatus for secure access controlling of a terminal. The secure access control unit  219  transmits the current location approval request of the terminal to the path deviation determining unit  215 . The path deviation determining unit  215  that received the current location approval request transmits the current location to the path management unit  213  so that it can be used when inferring an anticipated path in the future. 
         [0058]    Hereinafter, the method for inferring an anticipated path and determining a path deviation of a terminal according to the present disclosure will be explained in further detail. 
         [0059]      FIG. 3  is a block diagram illustrating a configuration of a path inferring unit in further detail. 
         [0060]    Referring to  FIG. 3 , the path inferring unit  300  according to an embodiment of the present disclosure that infers an anticipated path of a terminal and determines whether or not the terminal deviated from the path includes a path management unit  301  and path deviation determining unit  303 . 
         [0061]    The path management unit  301  infers an anticipated path of the terminal using at least one of location information, basic information and cyber information of the terminal collected. The path management unit  301  includes an entire anticipated path management unit  305 , sample anticipated path filter  307 , and sample anticipated path management unit  309 . The entire anticipated path management unit  305  manages the entire anticipated paths of the terminal inferred. The sample anticipated path filter  307  extracts at least part of the entire anticipated paths of the terminal according to a predetermined filtering rule. A filtering rule may be determined as being any rule that enables a minimum number of sample location information to be extracted within a range where the accuracy of the sample anticipated path is guaranteed. The filtering rule may be input directly by the managing person of the apparatus for secure access controlling of a terminal. The sample anticipated path management unit  309  manages the at least part of the anticipated paths extracted by the sample anticipated path filter  308  as a sample anticipated path. 
         [0062]    The path anticipated determining unit  303  obtains an anticipated path of the terminal from the path management unit  301 , determines whether or not the terminal deviated from the anticipated path, and in response to determining that the terminal deviated from the anticipated path, notifies the deviation to the secure access management unit. 
         [0063]    In various embodiments of the present disclosure, the path deviation determining unit  303  may first determine whether or not the terminal deviated from the sample anticipated path based on the sample anticipated path stored in the sample anticipated path management unit  309 . In response to determining that the terminal deviated from the sample anticipated path, the path deviation determining unit  303  may determine whether or not the terminal deviated from the anticipated path based on the entire anticipated paths stored in the entire anticipated path management unit  305 . 
         [0064]    In various embodiments of the present disclosure, the path deviation determining unit  303  may compute an error range of an anticipated path through the error range computation unit  311 , and when the terminal deviated from the error range, the determining unit  313  may determine that the terminal deviated from the anticipated path. 
         [0065]    An error range of an anticipated path may be computed by various methods. In an embodiment of the present disclosure, an error range of an anticipated path may consist of a circle having the location at a first time point as the center and a radius of a difference between the location at the first time point and a location at a second time point that comes before the first time point. Detailed explanation of the aforementioned is as follows. 
         [0066]    In  FIG. 4 , the location of the terminal at a first time point, i, which is a past point is (x i , y i , z i ), and the location of the terminal at a second time point, i−1, is (x i−1 , y i−1 , z i−1 ). Herein, in a case where the location information of the terminal is collected on a cycle of T, the first time point and the second time point may have an interval of cycle T. Herein, an anticipated path of the terminal may be located on a straight line that connects (x i , y i , z i ) and (x i−1 , y i−1 , z i−1 ). Accordingly, it may be inferred that the location of the terminal at a time point of i+1 is (x i+1 , y i+1 , z i+1 ). The error range of the anticipated path of the terminal at the time point of i+1 may consist of a circle  401  having the location at the first time point, (x i , y i , z i ), as the center, and a difference between the location at the first time point, (x i , y i , z i ), and the location at a second time point, (x i−1 , y i−1 , z i−1 ), as a radius of Z e . The radius, Z e , may be expressed as in math equation 1 below. 
         [0000]        Z   e =( x   i   ,y   i   ,z   i )−( X   t−1   ,y   t−1   ,z   t−1 )  [Math equation 1]
 
         [0067]    Supposing the current location of the terminal at a current point, j, that is before one cycle passes, from the first time point, i, is (x j , y j , z j ), (that is, i≦j≦i+1), the difference, p e , between the current location, (x j , y j , z j ), and the location at the first time point, i, (x −i , y i , z i ), is as in math equation 2 below. 
         [0000]        p   e   =abs[ ( x   j   ,y   j   ,z   j )−( x   i   ,y   i   ,z   i ) ]   [Math equation 2]
 
         [0068]    When p e  is smaller than Z e , the current location of the terminal, (x j , y j , z j ), exists within the error range of the anticipated path. On the other hand, when p e  is greater than Z e , the current location of the terminal, (x j , y j , z j ), exists outside the error range of the anticipated path. When p e  is smaller than Z e , the determining unit  313  determines that the terminal did not deviate from the anticipated path, but when p e  is greater than Z e , the determining unit  313  determines that the terminal deviated from the anticipated path. 
         [0069]    When it is determined that the terminal deviated from the path, the determining unit  313  notifies the secure access management unit that the terminal deviated from the path. In response to receiving a request to approve the current location from the secure access management unit, the determining unit  313  may transmit the request to the path management unit  301  so that an anticipated path may be re-inferred based on the current location. 
         [0070]    Hereinafter, explanation will be made on the overall operations of a secure access control according to a configuration of the apparatus for secure access controlling of a terminal mentioned above. 
         [0071]      FIG. 5  is a flowchart illustrating a method for secure access controlling of a terminal according to the present disclosure. 
         [0072]    Referring to  FIG. 5 , the apparatus for secure access controlling of a terminal  501  is connected to a terminal  503  through a network. The apparatus for secure access controlling of a terminal  501  may be connected to at least one server  505 ,  507  that manages information on a user of the terminal through the network. The location information of the terminal  503  may be collected on a predetermined cycle  509 . Furthermore, basic information and cyber information on the user of the terminal  503  may also be collected  511 ,  513 . The apparatus for secure access controlling of a terminal  501  obtains collected information  515 . The apparatus for secure access controlling of a terminal  501  infers an anticipated path of the terminal  503  according to an embodiment of the present disclosure based on the obtained information. 
         [0073]    In response to receiving a secure access request from the terminal  503 ,  517 , the apparatus for secure access controlling of a terminal  501  obtains secure access information such as an anticipated path corresponding to the terminal  503  that requested secure access and the current location of the terminal  503 ,  519 . The apparatus for secure access of controlling of a terminal  501  determines whether or not the terminal deviated from the anticipated path using the anticipated path and the current location of the terminal  503  according to an embodiment of the present disclosure, and approves or rejects secure access of the terminal  503  according to the determined result  521 . 
         [0074]    The terminal  503  proceeds or stops the secure access according to the secure access approval or rejection  523 . 
         [0075]      FIG. 6  is a flowchart illustrating a method for secure access controlling of a terminal according to the present disclosure. 
         [0076]    Referring to  FIG. 6 , the apparatus for secure access controlling of a terminal collects location information of the terminal  601 . The apparatus for secure access controlling of a terminal collects location information of the terminal on a predetermined cycle. In various embodiments, the apparatus for secure access controlling of a terminal collects basic information, basic moving time, location, and occupation and the like as basic information of the user of the terminal. Furthermore, the apparatus for secure access controlling of a terminal collects information on using SNS, and information on using electronic payment systems and the like as cyber information on the user of the terminal through the cyber information collecting unit  211 . 
         [0077]    The apparatus for secure access controlling of a terminal infers an anticipated path of the terminal based on the collected location information of the terminal  603 . In various embodiments, the apparatus for secure access controlling of a terminal may infer a sample anticipated path that consists of at least part of the anticipated paths of the terminal. 
         [0078]    In response to receiving a secure access request from the terminal  605 , the apparatus for secure access controlling of a terminal determines whether or not the terminal deviated from the anticipated path  607 . A method for secure access controlling of a terminal is illustrated in detail in  FIG. 7 . 
         [0079]    Referring to  FIG. 7 , the apparatus for secure access controlling of a terminal infers a sample anticipated path  701 . The apparatus for secure access controlling of a terminal extracts at least part of the entire anticipated paths of the terminal according to a predetermined filtering rule. A filtering rule may be determined as being any rule that enables a minimum number of sample location information to be extracted within a range where the accuracy of the sample anticipated path is guaranteed. The filtering rule may be input directly by a managing person of the apparatus for secure access controlling of a terminal. The apparatus for secure access controlling of a terminal infers the at least part of the anticipated paths extracted by the sample anticipated path filter as a sample anticipated path. 
         [0080]    The apparatus for secure access controlling of a terminal computes an error range of the sample anticipated path  703 . An error range of an anticipated path may consist of a circle having the location at a first time point as the center and a radius of a difference between the location at the first time point and a location of a second time point that comes before the first time point. 
         [0081]    The apparatus for secure access controlling of a terminal determines whether or not the terminal deviated from the error range of the sample anticipated path  705 . When the terminal did not deviate from the error range of the sample anticipated path, the apparatus for secure access controlling of a terminal determines that the terminal did not deviate from the anticipated path  713 . 
         [0082]    When the terminal did not deviate from the error range of the sample anticipated path, the apparatus for secure access controlling of a terminal computes an error range of the entire anticipated paths of the terminal  707 . An error range may consist of a circle having the location at a first time point as the center and a radius of a difference between the location at the first time point and a location of a second time point that comes before the first time point. 
         [0083]    The apparatus for secure access controlling of a terminal determines whether or not the terminal deviated from the error range of the entire anticipated paths  709 . When the terminal did not deviate from the error range of the entire anticipated paths, the apparatus for secure access controlling of a terminal determines that the terminal did not deviate from the entire anticipated paths  713 . To the contrary, when the terminal deviated from the error range of the entire anticipated paths, the apparatus for secure access controlling of a terminal determines that the terminal deviated from the entire anticipated paths  711 . 
         [0084]    In response to determining that the terminal did not deviate from the anticipated paths as a result of determining deviation of the terminal  609 , the apparatus for secure access controlling of a terminal approves secure access of the terminal  609 . 
         [0085]    Meanwhile, in response to determining that the terminal deviated from the anticipated paths, the apparatus for secure access controlling of a terminal rejects secure access of the terminal  611 . In an embodiment, the apparatus for secure access controlling of a terminal may output information for notifying that the terminal deviated from the anticipated paths  613 . The apparatus for secure access controlling of a terminal may display a UI or GUI, output an alarm sound or warning sound, or light up an LED and the like to notify whether or not the terminal deviated from the anticipated paths. In an embodiment, a managing person of the apparatus for secure access controlling of a terminal may request approval for a current location that deviated from the anticipated paths. In response to sensing the current location approval request  615 , the apparatus for secure access controlling of a terminal may re-infer the anticipated path of the terminal using the current location  617 . The re-inferred anticipated path is used to control secure access of the terminal. 
         [0086]    In the drawings and specification, there have been disclosed typical exemplary embodiments of the invention, and although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation. As for the scope of the invention, it is to be set forth in the following claims. Therefore, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.