KR101594846B1 - Variable encryption based network security device and operating method thereof - Google Patents

Abstract

The present invention relates to a network security device based on variable encryption and an operating method thereof. The network security device configures predetermined encryption method information at interval periods, selects the encryption method information with the highest security level as an encryption method candidate to be used to transmit and receive data between multiple terminals connected to a network according to the security levels of the corresponding encryption method information, and changes the encryption method being currently used by the terminals to the encryption method selected as the encryption method candidate when a security problem such as data encryption and decryption failure occurs while the data is transmitted and received between the terminals. Accordingly, the network security device can enhance the security of the network.

Description

TECHNICAL FIELD [0001] The present invention relates to a network security apparatus based on variable encryption and a method of operating the network security apparatus.

Embodiments of the present invention relate to security technologies for enhancing security in environments where various terminals are connected to each other like a network, such as Internet of Thing.

2. Description of the Related Art [0002] Recently, various network environments such as a wireless Internet or a mobile communication have been established, so that a user can access the Internet anywhere using a terminal capable of network communication.

Recently, with the construction of such a network environment, an Internet of Thing system has been introduced to allow a variety of objects in daily life to be connected to one another and to share information.

In this kind of internet system, the necessity of information security is very important in that various information is exchanged between terminals through a network.

Generally, in a method for information security, when a transmitting side transmits data to a receiving side, the transmitting side performs encryption according to a data encryption method previously shared with the corresponding data, and then transmits the encrypted data to the receiving side. When the receiving side decrypts the encrypted data .

In this regard, security can be enhanced by constructing a security environment in which data is encrypted and transmitted / received according to a pre-shared data encryption scheme even in an environment where various terminals are connected to each other, such as the object Internet system.

However, in an environment of transmitting and receiving data by encrypting data according to a pre-shared encryption method, there is a problem in security when the encryption method is exposed to others. Therefore, In an environment where encryption is performed in a simple manner, data encryption according to one encryption method may have various security vulnerabilities.

Therefore, in a situation where various terminals are connected to each other through a network, as in the object Internet system, instead of simply performing data exchange between terminals according to a single encryption method, a change in the security environment It is necessary to study a technique for enhancing security by introducing a security technique that allows each terminal to adaptively change the encryption scheme used in data exchange.

A network security apparatus based on a variable encryption and an operation method thereof according to an embodiment of the present invention configure predetermined encryption scheme information at a specific periodic interval and set the highest security level according to the security level between the encryption scheme information When a security problem such as a data encryption / decryption failure occurs at the time of data transmission / reception among the plurality of terminals after selecting cipher system information having a plurality of terminals as a cipher system candidate to be used for data transmission / reception of a plurality of terminals connected to the network, The security of the network can be enhanced by changing the encryption scheme currently used by the plurality of terminals to the encryption scheme selected as the encryption scheme candidate.

A network security apparatus based on a variable encryption scheme according to an embodiment of the present invention includes a database storing a plurality of scrambling schemes associated with encryption of data, at least one scrambling scheme among the plurality of scrambling schemes at a predetermined first period interval, An encryption unit configured to randomly select a scheme and configure encryption scheme information associated with encryption to cause the at least one scrambling scheme to be sequentially applied to data, An information transmission unit for transmitting the predetermined number of pieces of the cipher system information to a randomly selected first terminal among a plurality of terminals connected to each other in a network when the predetermined number of cipher system information is generated, Lt; RTI ID = 0.0 > A security level receiving unit for receiving security level information for a case where data is encrypted based on each of the plurality of bits, A candidate selection unit for selecting the first cipher system information as a cipher system candidate for data transmission and reception between the plurality of terminals and storing the first cipher system information selected as the cipher system candidate in a memory, When a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception, the first encryption method information is transmitted to the plurality of terminals, The terminals transmit the data based on the first encryption scheme information It includes encryption method for controlling transmission and reception to be expensive to update parts.

Also, a method of operating a variable-encryption-based network security apparatus according to an exemplary embodiment of the present invention includes: maintaining a database storing a plurality of scrambling schemes associated with encryption of data; Randomly selecting at least one scrambling scheme from the scrambling schemes of the at least one scrambling scheme and configuring encryption scheme information associated with the encryption to sequentially apply the at least one scrambling scheme to the data, When the predetermined number of the cipher system information is generated by configuring the cipher system information, transmitting the predetermined number of cipher system information to a randomly selected first terminal among a plurality of terminals connected to each other through a network From the first terminal, The method comprising the steps of: receiving security level information for encrypting data based on each of the plurality of encryption mode information, encrypting the encryption level information with the highest security level among the security levels for each of the predetermined number of encryption mode information Selecting the first cipher system information having the level of the first cipher system information as a cipher system candidate for data transmission and reception between the plurality of terminals and storing the first cipher system information selected as the cipher system candidate in the memory, When a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception in a plurality of terminals, the first encryption method information is transmitted to the plurality of terminals, Based on the first encryption scheme information, Granulation to include the step of controlling to transmit and receive.

A network security apparatus based on a variable encryption and an operation method thereof according to an embodiment of the present invention configure predetermined encryption scheme information at a specific periodic interval and set the highest security level according to the security level between the encryption scheme information When a security problem such as a data encryption / decryption failure occurs at the time of data transmission / reception among the plurality of terminals after selecting cipher system information having a plurality of terminals as a cipher system candidate to be used for data transmission / reception of a plurality of terminals connected to the network, The security of the network can be enhanced by changing the cipher system currently used by the plurality of terminals to the cipher system selected as the cipher system candidate.

1 is a system conceptual diagram schematically showing a network system according to an embodiment of the present invention.
2 is a diagram illustrating an example of a data header structure for explaining a process of generating a security event based on a header structure of data by a plurality of terminals connected to a network.
3 is a diagram illustrating a structure of a variable-encryption-based network security apparatus according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating an operation method of a variable-encryption-based network security apparatus according to an exemplary embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a system conceptual diagram schematically showing a network system according to an embodiment of the present invention.

Referring to FIG. 1, the network system may include a variable-encryption-based network security apparatus 110 and a plurality of terminals 121, 122, 123, 124, and 125.

In this case, the plurality of terminals 121, 122, 123, 124, and 125 may be connected to each other via a network to exchange data, and the network security apparatus 110 based on the variable encryption may include a plurality of terminals 121, 122, 123, 124, and 125, respectively, and can exchange data with a plurality of terminals 121, 122, 123, 124, and 125, respectively.

First, the network security device 110 based on the variable encryption may include a database in which a plurality of scrambling methods related to encryption of data are stored.

Here, the scrambling method refers to a data changing method used for encrypting plaintext data, and there are usually methods such as transposition, substitution, and algebraic.

For example, if data scrambling is performed by replacing the second bit and the third bit with the plaintext data '1010', the plaintext data may be changed to encrypted data '1101'.

In this regard, the plurality of scrambling schemes may be stored in the database as shown in Table 1 below.

turn Scrambling  system One substitution 2 Replacement 3 Arithmetic ... ...

Under such circumstances, the variable-encryption-based network security device 110 may randomly select at least one scrambling scheme among the plurality of scrambling schemes at predetermined first period intervals, The encryption scheme information associated with the encryption for sequentially applying the scrambling scheme of FIG.

For example, assuming that the selected first period is '24 hours', the network security apparatus 110 based on the variable encryption transmits a plurality of scrambling schemes The at least one scrambling scheme may be randomly selected and the at least one scrambling scheme may be sequentially applied to the predetermined data.

The network security device 110 based on the variable encryption is configured to perform encryption and decryption of data associated with encryption to sequentially apply 'substitution' and 'substitution' to predetermined data after selecting 'substitution' and 'substitution' The encryption method information 1 'can be configured so that' substitution ',' arithmetic ', and' substitution 'are sequentially applied to predetermined data after selecting' substitution ',' arithmetic ' The encryption method information 2 'associated with the encryption that is performed by the first encryption method. In this manner, at least one of the plurality of scrambling schemes is randomly selected every' 24 hours' It is possible to configure the encryption scheme information associated with the encryption so that at least one scrambling scheme is sequentially applied.

When the predetermined number of pieces of the cipher system information is generated by configuring the cipher system information at the predetermined first period intervals, the variable-cipher network security apparatus 110 transmits the predetermined number of cipher system information To a randomly selected first terminal among a plurality of terminals 121, 122, 123, 124, and 125 connected to each other via a network.

For example, it is assumed that the predetermined number is '2', and the encryption scheme information is configured at the selected first period interval, thereby encrypting the encrypted data so that 'substitution' and 'substitution' 'Encryption method information 2' associated with 'encryption method information 1' associated with encryption and 'encryption', 'arithmetic', and 'substitution' are sequentially generated for predetermined data, The network security apparatus 110 based on the variable encryption transmits the 'encryption scheme information 1' and the 'encryption scheme information 1' to the randomly selected first terminal among the plurality of terminals 121, 122, 123, 124 and 125, 2 '.

Hereinafter, it is assumed that the first terminal is a terminal corresponding to a reference numeral 122 in a plurality of terminals 121, 122, 123, 124 and 125.

When the predetermined number of pieces of cipher system information is transmitted from the network security apparatus 110 based on the variable encryption to the first terminal 122, the first terminal 122 transmits, based on each of the predetermined number of cipher system information, Performs differential attack analysis (Differential Cryptanalysis) when data is encrypted, calculates propagation ratios for each of the predetermined number of cipher system information, and then calculates a propagation ratio for each of the predetermined number of cipher system information The security level information for each of the predetermined number of cipher system information may be configured such that a higher security level is assigned as the propagation rate for the selected cipher system information is lower.

Here, the differential attack analysis is an analysis method for evaluating the security of the cryptosystem. Considering the differential characteristic probabilities of successive rounds, the key of the last round is estimated, It is an analysis method to recover. In the differential attack analysis, the propagation ratio can be calculated as a result value for expressing the stability of the specific cipher system, and the lower the propagation ratio, the more stable the cipher system can be determined.

Accordingly, when the first terminal 122 receives the predetermined number of encryption scheme information from the network security apparatus 110 based on the variable encryption scheme and encrypts the data based on each of the predetermined number of encryption scheme information, Wherein the control unit calculates a propagation ratio for each of the predetermined number of pieces of cipher system information by performing a differential attack analysis on the cipher system information and then assigns a higher security level to each of the predetermined number of cipher system information, The security level information for each of the predetermined number of encryption scheme information can be configured.

For example, if 'cipher system information 1' and 'cipher system information 2' are received by the first terminal 122, the first terminal 122 transmits data according to 'cipher system information 1' and 'cipher system information 2' After performing the differential attack analysis for encryption, it is possible to calculate the 'propagation ratio 1' for 'encryption scheme information 1' and the 'propagation ratio 2' for 'encryption scheme information 2'.

At this time, if the 'propagation ratio 2' among 'propagation ratio 1' and 'propagation ratio 2' has a value smaller than 'propagation ratio 1', the first terminal 122 may set the security level of ' The security level information for the 'encryption method information 1' and the 'encryption method information 2' can be configured in such a manner that the security level of the 'encryption method information 1' is allocated to the low security level.

In this case, according to another embodiment of the present invention, when the predetermined number of encryption scheme information is received from the network security apparatus 110 based on the variable encryption, the first terminal 122 does not perform the differential attack analysis A linear attack analysis (Linear Cryptanalysis) is performed for data encryption based on each of the predetermined number of cipher system information, and a bias for each of the predetermined number of cipher system information is calculated The security level information for each of the predetermined number of pieces of cipher system information may be configured such that a higher security level is allocated as the bias for each of the predetermined number of cipher system information is lower.

Here, linear attack analysis is an analysis method for evaluating the security of cryptography, and it is an analysis method for recovering key information by considering the linear characteristic probability of continuous rounds. In the linear attack analysis, the bias can be calculated as a result value for expressing the stability of the specific cipher system, and the lower the corresponding bias, the more stable the cipher system can be judged.

Accordingly, when the first terminal 122 receives the predetermined number of encryption scheme information from the network security apparatus 110 based on the variable encryption scheme and encrypts the data based on each of the predetermined number of encryption scheme information, And performs a linear attack analysis on the predetermined number of pieces of cipher system information, calculates a bias for each of the predetermined number of cipher system information, and calculates a bias for each of the predetermined number of cipher system information, It is possible to configure the security level information for each of the encryption scheme information.

When the first terminal 122 completes the configuration of the security level information for each of the predetermined number of the cipher system information, the variable ciphering-based network security apparatus 110 transmits the security Level information.

Then, the network security apparatus 110 based on the variable encryption encrypts the first encryption scheme information having the highest security level among the security levels for the predetermined number of encryption scheme information by referring to the security level information, It is possible to store the first encryption scheme information selected as the encryption scheme candidate in the memory after selecting the encryption scheme candidate for data transmission / reception between the terminals 121, 122, 123, 124,

Thereafter, the network security device 110 based on the variable encryption encrypts the security event associated with the data encryption / decryption failure during the data transmission / reception between the plurality of terminals 121, 122, 123, 124, Or more than the predetermined number of times.

When encrypted data is received from any one of the terminals, the plurality of terminals 121, 122, 123 and 124 decrypts the encrypted data and parses the decrypted data to be included in the decrypted data And comparing the header structure information according to a communication protocol standard for exchanging data of the decoded data stored in the memory with the header structure information, If it is determined that the information does not match, the security event may be generated.

For example, when the first terminal 121 of the plurality of terminals 121, 122, 123, 124, and 125 encrypts and transmits the IP-based data to the second terminal 122, After decoding the data, the decoded data may be parsed to determine the data header structure included in the decoded data.

At this time, even if the data is scrambled and encrypted, the type and the number of bits of each data included in the header structure of the data are not changed. Therefore, the terminal 2 122 may store the data header structure included in the decoded data The header structure information according to the communication protocol standard for IP-based data such as the example shown in FIG. 2 is compared, and if the data header structure is determined not to match the header structure information, the security event may be generated .

That is, in the data header structure included in the decoded data, as in the example shown in FIG. 2, in the case of IP version 4, the first 4 bits are '0100' in binary number, and the next 4 bits are 5 in header length 15, it is necessary to match the value stored in the 'Header Checksum' when the checksum of the information included in the header is calculated. However, The terminal 2 122 can not recognize that the security event related to the data encryption / decryption failure is not matched with the header structure information according to the communication protocol standard, Can be generated.

In this manner, the plurality of terminals 121, 122, 123, 124, and 125 determine whether the data encryption / decryption has been normally performed based on the header structure of the received data during data exchange with each other, If it is determined that it is not performed, the security event may be generated.

When the plurality of terminals 121, 122, 123, 124, and 125 generate the security event, the network security apparatus 110 based on the variable encryption has the plurality of terminals 121, 122, 123, 124 and 125 ), It is possible to determine whether or not a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period.

If it is determined that a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception between a plurality of terminals 121, 122, 123, 124, and 125, The network security apparatus 110 based on the variable encryption transmits the first encryption scheme information to the plurality of terminals 121, 122, 123, 124, and 125, 124, and 125 can encrypt / decrypt data based on the first encryption scheme information and transmit / receive the encrypted data.

For example, in the network security apparatus 110 based on the variable encryption, the 'encryption method information 2' associated with the encryption for sequentially applying 'substitution', 'arithmetic', and 'substitution' Data is transmitted and received according to a cipher scheme in which a plurality of terminals 121, 122, 123, 124, and 125 are sequentially applied with a scrambling scheme of 'substitution' and 'arithmetic' The network security apparatus 110 based on the variable encryption transmits the 'encryption scheme information 2' to the plurality of terminals 121 (121), when the security event associated with the data encryption / decryption failure occurs within the predetermined period 122, 123, 124, and 125, the scrambling scheme of 'substitution' and 'arithmetic' is sequentially applied to the plurality of terminals 121, 122, 123, 124 and 125 It is possible to perform encryption / decryption of the data based on the cipher systems to which the 'replacement', 'arithmetic', and 'replacement' according to the 'encryption scheme information 2' are sequentially applied.

Accordingly, the plurality of terminals 121, 122, 123, 124, and 125 do not transmit and receive data through a cipher scheme in which scrambling schemes such as existing 'substitution' and 'arithmetic' , 'Arithmetic', and 'substitution' are sequentially applied.

In this case, according to an embodiment of the present invention, the network security apparatus 110 based on the variable encryption scheme may transmit the scrambling scheme to the plurality of scrambling schemes at the predetermined first period intervals even after the first encryption scheme information is selected as the encryption scheme candidate The at least one scrambling scheme may be randomly selected and the at least one scrambling scheme may be sequentially applied to the predetermined data.

Accordingly, the network security apparatus 110 based on the variable encryption scheme newly configures the encryption scheme information at the selected first period interval after the first encryption scheme information is selected as the encryption scheme candidate, When the cipher system information is generated by the predetermined number including the first cipher system information, the predetermined number of new cipher system information including the first cipher system information is transmitted to a plurality of terminals 121, 122, 123 , 124, and 125 to the second terminal that is randomly reselected.

The network security device 110 based on the variable encryption can receive the new security level information for the case where the data is encrypted based on each of the predetermined number of new encryption scheme information from the second terminal, 122, 123, 124, and 125, the second encryption scheme information having the highest security level among the security levels for each of the predetermined number of new encryption scheme information with reference to the new security level information, The second cipher system information re-selected as the cipher system candidate may be stored in the memory.

At this time, during the data transmission / reception between the plurality of terminals 121, 122, 123, 124, and 125, when the security event associated with the data encryption / decryption failure occurs more than the predetermined number of times within the predetermined period , The network security apparatus 110 based on the variable encryption transmits the second encryption scheme information to the plurality of terminals 121, 122, 123, 124 and 125 so that the plurality of terminals 121, 122 and 123 , 124, and 125 can perform encryption / decryption of data based on the second encryption scheme information to perform transmission / reception.

That is, the network security device 110 based on the variable encryption continuously configures the encryption scheme information at the predetermined first period interval, and if the predetermined number of the encryption scheme information is generated, Performs a process of selecting specific cryptosystem information as a cryptosystem candidate for data transmission / reception between a plurality of terminals (121, 122, 123, 124, 125) by comparing security level information on the information, When the new cipher system information is generated and the total sum of the cipher system information selected by the existing cipher system candidate and the new cipher system information corresponds to the selected number, Compares the security level information with the encryption scheme information, and transmits the specific encryption scheme information to the plurality of terminals 121, 122, 123, 124, 1 25 as a cipher system candidate for data transmission / reception.

Accordingly, the network security apparatus 110 based on the variable encryption can continuously update the cipher system candidates for data transmission / reception between the plurality of terminals 121, 122, 123, 124, and 125 at predetermined period intervals.

In this way, the network security apparatus 110 based on the variable encryption continuously updates the cipher method candidates for data transmission / reception between the plurality of terminals 121, 122, 123, 124, and 125 at predetermined period intervals, A plurality of terminals 121, 122, 123, 124, and 125 may determine that a security event associated with a data encryption / decryption failure has occurred more than a specific number of times within a predetermined time interval between the terminals 121, 122, It is determined that there is a problem with the cipher system currently used for data transmission and reception and the cipher system candidates stored in the memory are renewed at predetermined period intervals and transmitted to the plurality of terminals 121, 122, 123, 124 and 125 Thereby enabling the plurality of terminals 121, 122, 123, 124, and 125 to transmit and receive data according to a new encryption scheme, thereby enhancing security.

At this time, according to an embodiment of the present invention, the network security apparatus 110 based on the variable encryption transmits the at least one randomly selected scrambling scheme among the plurality of scrambling schemes stored in the database, One scrambling scheme may be deleted, and at least one new scrambling scheme may be created and stored in the database.

Accordingly, the network security apparatus 110 based on the variable encryption can update the database itself at the predetermined second period intervals separately from the encryption scheme information at the predetermined first period intervals, It is possible to diversify the generation scenarios of the encryption scheme information generated at the first periodic intervals, thereby further enhancing the security.

3 is a diagram illustrating a structure of a variable-encryption-based network security apparatus according to an exemplary embodiment of the present invention.

The database 311 stores a plurality of scrambling schemes associated with encryption of data.

The encryption unit 312 randomly selects at least one scrambling scheme among the plurality of scrambling schemes at a predetermined first periodic interval and encrypts the at least one scrambling scheme sequentially with respect to the data. And configures the associated encryption scheme information.

When the predetermined number of pieces of the cipher system information is generated by configuring the cipher system information at the selected first period intervals, the information transmitting unit 313 transmits the predetermined number of cipher system information to the network To the first selected terminal among the plurality of terminals 321, 322, and 323 randomly selected.

The security level receiving unit 314 receives the security level information for the case where the data is encrypted based on each of the predetermined number of the encryption method information from the first terminal.

In this case, according to an embodiment of the present invention, the first terminal performs a differential attack analysis for encrypting data based on each of the predetermined number of pieces of cipher system information, The security level information may be configured such that a higher security level is assigned to each of the predetermined number of encryption scheme information as the propagation ratio is lower.

According to another embodiment of the present invention, the first terminal performs a linear attack analysis on data encryption based on each of the predetermined number of encryption scheme information, The security level information may be configured such that a higher security level is allocated as the bias for each of the predetermined number of encryption scheme information is lower.

The candidate selecting unit 315 refers to the security level information and transmits the first encryption scheme information having the highest security level among the security levels for the predetermined number of encryption scheme information to the plurality of terminals 321, 323, and then stores the first encryption scheme information selected as the encryption scheme candidate in the memory.

When a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception between a plurality of terminals 321, 322, and 323, the encryption method update unit 316 updates the encryption / By transmitting the first cipher system information to the plurality of terminals 321, 322, and 323, the plurality of terminals 321, 322, and 323 encrypt and decrypt data based on the first cipher system information To be transmitted and received.

In this case, according to an embodiment of the present invention, when the encrypted data is received from any one of the terminals, the plurality of terminals 321, 322, and 323 decrypt the encrypted data and then parse the decrypted data, The data header structure included in the decoded data is identified and the header structure information according to a communication protocol standard for exchanging data of the decoded data stored in the memory with the data header structure is compared, If it is determined that the header structure information does not match, the security event may be generated.

According to an embodiment of the present invention, the information transmission unit 313 newly configures the encryption scheme information at the selected first period interval after the first encryption scheme information is selected as the encryption scheme candidate, When the predetermined number of cipher system information including the first cipher system information is generated, the predetermined number of new cipher system information including the first cipher system information is transmitted to the plurality of terminals 321 and 322 , 323 to the second terminal that is randomly reselected.

At this time, the security level receiving unit 314 can receive the new security level information for the case where the data is encrypted based on each of the predetermined number of new encryption method information from the second terminal, and the candidate selecting unit 315 Refers to the new security level information, and transmits the second encryption scheme information having the highest security level among the security levels for the predetermined number of new encryption scheme information to the plurality of terminals 321, 322, 323 It is possible to store the second encryption scheme information reselected as the encryption scheme candidate in the memory after reselecting as the encryption scheme candidate for data transmission and reception.

The encryption method updating unit 316 updates the encryption method based on the number of times the security event associated with the data encryption / decryption failure is received within the predetermined period during the data transmission / reception between the plurality of terminals 321, 322, The plurality of terminals 321, 322, and 323 transmit the second cipher system information to the plurality of terminals 321, 322, and 323 based on the second cipher system information It is possible to perform control such that data is transmitted / received by encryption / decryption.

According to an embodiment of the present invention, the variable-encryption-based network security apparatus 310 may transmit at least one randomly selected one of the plurality of scrambling schemes stored in the database 311, And a database updating unit 317 for deleting one scrambling scheme and generating at least one new scrambling scheme and storing the new scrambling scheme in the database 311. [

The structure of the network security device 310 based on the variable encryption according to the embodiment of the present invention has been described above with reference to FIG. Here, the variable-encryption-based network security device 310 according to an embodiment of the present invention can correspond to the variable-encryption-based network security device 110 described with reference to FIGS. 1 and 2, A description thereof will be omitted.

4 is a flowchart illustrating an operation method of a variable-encryption-based network security apparatus according to an exemplary embodiment of the present invention.

In step S410, a database is stored in which a plurality of scrambling schemes associated with encryption of data are stored.

In step S420, at least one scrambling scheme among the plurality of scrambling schemes is randomly selected at a predetermined first periodic interval, and encryption associated with encryption to sequentially apply the at least one scrambling scheme to the data Configure method information.

In step S430, the cipher system information is configured at the predetermined first period intervals. When the predetermined number of cipher system information is generated, the predetermined number of cipher system information is transmitted to a plurality of To the randomly selected first terminal among the terminals.

In step S440, the first terminal receives the security level information for encrypting the data based on each of the predetermined number of encryption method information.

In this case, according to an embodiment of the present invention, the first terminal performs a differential attack analysis for encrypting data based on each of the predetermined number of pieces of cipher system information, The security level information may be configured such that a higher security level is assigned to each of the predetermined number of encryption scheme information as the propagation ratio is lower.

According to another embodiment of the present invention, the first terminal performs a linear attack analysis on data encryption based on each of the predetermined number of encryption scheme information, The security level information may be configured such that a higher security level is allocated as the bias for each of the predetermined number of encryption scheme information is lower.

In step S450, the first cryptographic scheme information having the highest security level among the security levels for each of the predetermined number of cryptographic scheme information is referenced to the security level information, and the first cryptographic scheme information having the highest security level is encrypted Method candidates, and stores the first encryption scheme information selected as the encryption scheme candidate in the memory.

In a case where a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception between the plurality of terminals, in step S460, By transmitting the first encryption scheme information, the plurality of terminals perform encryption / decryption of data based on the first encryption scheme information to perform transmission / reception.

In this case, according to an embodiment of the present invention, when the encrypted data is received from one of the terminals, the plurality of terminals decrypt the encrypted data and then parse the decrypted data, The data header structure is compared with header structure information according to a communication protocol standard for exchanging data of the decoded data stored in the memory with the data header structure so that the data header structure is not matched with the header structure information It may generate the security event.

According to an embodiment of the present invention, the method of operating the variable-encryption-based network security apparatus further includes a step of, after the first encryption scheme information is selected as the encryption scheme candidate, When the new cipher system information including the first cipher system information is generated by the predetermined number, the predetermined number of new cipher system information including the first cipher system information is transmitted to the plurality of Receiving new security level information for a case where data is encrypted based on each of the predetermined number of new encryption scheme information from the second terminal, Referring to the new security level information, the predetermined number of new encryption scheme information And reselects the second encryption scheme information having the highest security level among the security levels for each of the plurality of terminals as the encryption scheme candidate for data transmission and reception between the plurality of terminals, And when the security event associated with the data encryption decryption failure occurs more than the predetermined number of times within the predetermined period during data transmission / reception among the plurality of terminals, And transmitting the second cipher system information to the plurality of terminals to perform encryption / decryption of data based on the second cipher system information to transmit / receive the data.

According to another aspect of the present invention, there is provided a method for operating a network security apparatus based on a variable encryption scheme, the network security apparatus comprising: at least one randomly selected one of the plurality of scrambling schemes stored in the database, The method may further include deleting the first scrambling scheme and generating at least one new scrambling scheme and storing the generated new scrambling scheme in the database.

The operation of the variable-encryption-based network security apparatus according to an embodiment of the present invention has been described above with reference to FIG. Here, the operation method of the network security apparatus based on the variable encryption according to the embodiment of the present invention corresponds to the configuration of operations of the network security apparatus 110 and 310 based on the variable encryption, A detailed description thereof will be omitted.

The method for operating the network security device based on the variable encryption according to an embodiment of the present invention may be implemented by a computer program stored in a storage medium for execution through a combination with a computer.

In addition, the operation method of the variable security-based network security apparatus according to an exemplary embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: Network security device based on variable encryption
121, 122, 123, 124, 125: a plurality of terminals
310: Network security device based on variable encryption
311: Database 312: Encryption component
313: Information transferring unit 314: Security level receiving unit
315: candidate selection unit 316: encryption method update unit
317:
321, 322 and 323:

Claims (14)

A database in which a plurality of scrambling schemes associated with encryption of data are stored;
At least one scrambling scheme among the plurality of scrambling schemes is randomly selected at a predetermined first periodic interval and encryption scheme information associated with encryption for sequentially applying the at least one scrambling scheme to data, An encryption unit configured to configure the encryption unit;
Wherein when the predetermined number of the encryption scheme information is generated by the encryption scheme information at the selected first period interval, the predetermined number of encryption scheme information is randomly generated among a plurality of terminals connected to each other in the network An information transmission unit transmitting the selected information to the selected first terminal;
A security level receiver for receiving security level information about a case where data is encrypted based on each of the predetermined number of encryption scheme information from the first terminal;
The first encryption scheme information having the highest security level among the security levels for each of the predetermined number of encryption scheme information is selected as an encryption scheme candidate for data transmission / reception between the plurality of terminals with reference to the security level information A candidate selector for storing the first encryption scheme information selected as the encryption scheme candidate in a memory; And
When a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception between the plurality of terminals, the first encryption method information The encryption method update unit for controlling the plurality of terminals to encrypt and decrypt data based on the first encryption scheme information to transmit and receive the data,
The network security device comprising: The method according to claim 1,
The information transmission unit
The encryption scheme information is newly configured at the selected first period interval after the first encryption scheme information is selected as the encryption scheme candidate, so that the newly configured encryption scheme information includes the first encryption scheme information, Transmitting the predetermined number of new encryption scheme information including the first encryption scheme information to a randomly reselected second terminal among the plurality of terminals,
The security level receiver
Receiving new security level information for a case where data is encrypted based on each of the predetermined number of new encryption scheme information from the second terminal,
The candidate selector
Referring to the new security level information, second encryption scheme information having the highest security level among the security levels for each of the predetermined number of new encryption scheme information is transmitted as an encryption scheme candidate for data transmission / reception between the plurality of terminals Storing the second encryption scheme information reselected as the encryption scheme candidate in the memory after reselecting,
The encryption method update unit
When a security event associated with a data encryption / decryption failure occurs more than the predetermined number of times within the predetermined period during data transmission / reception between the plurality of terminals, Based on the first encryption scheme information, the encryption scheme information, and controls the plurality of users to encrypt and decrypt data based on the second encryption scheme information to transmit and receive the encrypted data. The method according to claim 1,
At least one first scrambling scheme randomly selected from among the plurality of scrambling schemes stored in the database at a predetermined second periodic interval and generating at least one new scrambling scheme and storing the generated at least one new scrambling scheme in the database Updating unit
The network security device further comprising: The method according to claim 1,
The first terminal
A differential cryptanalysis is performed for data encryption based on each of the predetermined number of cipher system information, and a propagation ratio for each of the predetermined number of cipher system information is computed And configures the security level information so that a higher security level is allocated to each of the predetermined number of encryption scheme information as the propagation ratio is lower. The method according to claim 1,
The first terminal
A linear attack analysis (Linear Cryptanalysis) is performed for data encryption based on each of the predetermined number of cipher system information, a bias for each of the predetermined number of cipher system information is calculated And configures the security level information so that a higher security level is assigned as the bias for each of the predetermined number of encryption scheme information is lower. The method according to claim 1,
The plurality of terminals
When the encrypted data is received from any one of the terminals, the decrypted data is parsed and the decrypted data is parsed to grasp the data header structure included in the decrypted data, The data structure of the data structure is compared with header structure information according to a communication protocol standard for exchanging data of the decoded data previously stored in the header structure information, and if the data structure is not matched with the header structure information, Based network security device. Maintaining a database in which a plurality of scrambling schemes associated with encryption of data are stored;
At least one scrambling scheme among the plurality of scrambling schemes is randomly selected at a predetermined first periodic interval and encryption scheme information associated with encryption for sequentially applying the at least one scrambling scheme to data, ≪ / RTI >
Wherein when the predetermined number of the encryption scheme information is generated by the encryption scheme information at the selected first period interval, the predetermined number of encryption scheme information is randomly generated among a plurality of terminals connected to each other in the network To a selected first terminal;
Receiving security level information for a case where data is encrypted based on each of the predetermined number of pieces of cipher system information from the first terminal;
The first encryption scheme information having the highest security level among the security levels for each of the predetermined number of encryption scheme information is selected as an encryption scheme candidate for data transmission / reception between the plurality of terminals with reference to the security level information Storing the first encryption scheme information selected as the encryption scheme candidate in a memory; And
When a security event associated with a data encryption / decryption failure occurs more than a predetermined number of times within a predetermined period during data transmission / reception between the plurality of terminals, the first encryption method information And controlling the plurality of terminals to encrypt and decrypt data based on the first encryption scheme information to transmit and receive the data
Wherein the network security device is a network security device. 8. The method of claim 7,
The encryption scheme information is newly configured at the selected first period interval after the first encryption scheme information is selected as the encryption scheme candidate, so that the newly configured encryption scheme information includes the first encryption scheme information, Transmitting the predetermined number of new cipher system information including the first cipher system information to a randomly reselected second terminal among the plurality of terminals when the predetermined number of cipher systems are generated;
Receiving new security level information for a case where data is encrypted based on each of the predetermined number of new encryption scheme information from the second terminal;
Referring to the new security level information, second encryption scheme information having the highest security level among the security levels for each of the predetermined number of new encryption scheme information is transmitted as an encryption scheme candidate for data transmission / reception between the plurality of terminals Storing the second encryption scheme information reselected as the encryption scheme candidate in the memory after reselecting the second encryption scheme information; And
When a security event associated with a data encryption / decryption failure occurs more than the predetermined number of times within the predetermined period during data transmission / reception between the plurality of terminals, And controlling the plurality of terminals to transmit / receive data based on the second encryption scheme information by encrypting and decrypting the data by transmitting the encryption scheme information
Further comprising the steps of: 8. The method of claim 7,
Removing at least one first scrambling scheme randomly selected from the plurality of scrambling schemes stored in the database at a predetermined second periodic interval and generating at least one new scrambling scheme and storing the generated at least one new scrambling scheme in the database
Further comprising the steps of: 8. The method of claim 7,
The first terminal
A differential cryptanalysis is performed for data encryption based on each of the predetermined number of cipher system information, and a propagation ratio for each of the predetermined number of cipher system information is computed And configuring the security level information so that a higher security level is allocated to each of the predetermined number of encryption scheme information as the propagation ratio is lower. 8. The method of claim 7,
The first terminal
A linear attack analysis (Linear Cryptanalysis) is performed for data encryption based on each of the predetermined number of cipher system information, a bias for each of the predetermined number of cipher system information is calculated And configuring the security level information so that a higher security level is allocated as the bias for each of the predetermined number of encryption scheme information is lower. 8. The method of claim 7,
The plurality of terminals
When the encrypted data is received from any one of the terminals, the decrypted data is parsed and the decrypted data is parsed to grasp the data header structure included in the decrypted data, The data structure of the data structure is compared with header structure information according to a communication protocol standard for exchanging data of the decoded data previously stored in the header structure information, and if the data structure is not matched with the header structure information, Based network security device. 13. A computer-readable recording medium recording a program for performing the method of any one of claims 7 to 12. 13. A computer program stored in a storage medium for executing the method of any one of claims 7 to 12 through a combination with a computer.

Images