KR102493586B1 - Edge computing system capable of independent data operation and user interface configuration for each user, and with multi-level security applied - Google Patents

Abstract

The present invention relates to an edge computing system capable of independently operating data and configuring a user interface for each user and applying multi-layered, multi-level security.
To this end, the present invention creates a plurality of system manager accounts 1 to n in the ROOT account, each system manager account 1 to n creates a database file for each account, and the account information of user 1 created by the system manager account 1 Data and the account 1 database file, which is the edge system data managed or created by user 1, cannot be accessed by anyone other than the ROOT account or system administrator account 1. When creating a database file in 'Account_Public', it is possible to set access to users 1 to n, enable independent data operation and user interface configuration for each user, and provides an edge computing system with multi-level security applied.

Description

Edge computing system capable of independent data operation and user interface configuration for each user, and multi-layered security applied {omitted}

The present invention relates to edge computing systems. More specifically, it relates to an edge computing system capable of independently operating data and configuring a user interface for each user and applying multi-layered, multi-level security.

Edge computing, in contrast to cloud computing, refers to computing performed at the edge of a network rather than in the cloud or centrally, that is, performing data processing and storage close to the physical location of a user or data source. Faster and more stable service is possible if the data generated from the physical source is processed at a location close to the user's terminal device. Edge computing is one way in which data operations and processing can be distributed using a common pool of resources in multiple locations.

These edge computing systems are used in various fields. In particular, in the field of smart manufacturing, edge computing systems are introduced to quickly and reliably process data processing of robots, controllers, sensors, etc., which are devices used in various manufacturing processes, in the field. there is.

The edge computing system applied to the smart manufacturing field has two sides in terms of security. Since the data stays near the source without passing through an external network, the security of the edge computing method is theoretically superior to that of the general cloud method. This is due to the logic that the less data stored in a data center or cloud environment, the less data is at risk.

However, devices installed in each process, such as robots, controllers, and sensors, and edge computing systems are bound to be physically connected to each other, so the server of the edge computing system is built and managed inside the manufacturer's production line, so it is managed in a specialized data center. There is also an aspect that is vulnerable to security compared to the data to be used.

Moreover, in the case of small and medium-sized enterprises adopting smart factories, the smaller the company size, the more the edge computing system is built, not limited to data collection and management of field devices such as robots, controllers, and sensors, but the overall company departments such as purchase, production, sales, sales, accounting There are many cases where there are requests to utilize edge computing systems in an integrated way. In this situation, since all departments of the company have access to the edge computing system, the importance of security is even greater.

In addition, when users want to access the edge computing system to control and monitor devices installed in each process, they mainly use the web method or CS (Client Server) method. A user accesses a server of an edge computing system via a network through a computer, mobile device, or the like. Security can be compromised in such an environment.

On the other hand, edge computing services of general overseas companies do not provide multi-user multi-user screen configuration services. As described above, since various users from multiple departments access the edge computing system according to the needs of small and medium-sized businesses, it is necessary to provide edge computing services that can be independently configured for each user to enable multilateral data creation and control in one edge computing system. this comes to the fore

Prior art literature: KR Patent Publication No. 2018-0119162 (2018.11.01)

The present invention has been made to solve the above problems, and in particular, an object of the present invention is to provide an edge computing system capable of independent configuration for each user and having enhanced security.

According to the present invention devised to achieve the above object, the edge computing system capable of independently operating data and configuring a user interface for each user and applying multi-layered multi-level security creates a plurality of system administrator accounts 1 to n in the ROOT account, , Each system manager account 1 to n creates a database file for each account, and the account information data of user 1 created by system manager account 1 and the account 1 database file, which is the edge system data managed or created by user 1, are ROOT It is not accessible to anyone other than the account or system administrator account 1, and the data for public use is set to be accessible to users 1 to n when creating a database file in 'System Manager Account_Public', an account created with the system manager properties. It is characterized by doing.

In addition, in the edge computing system according to the present invention, the comparison/analysis monitoring program is executed in the ROOT account under the permission of the ROOT account to monitor all users accessing the system, but to access the edge system in a web or CS (Client Server) method. When a user access request occurs, the comparison/analysis monitoring program checks whether the port number is permissible and blocks access to ports other than the permitted ports. It is possible to block access other than the ROOT account and the second account by checking whether the second account, which is each system manager account, matches.

In addition, in the edge computing system according to the present invention, when the first account matches the second account, the comparison/analysis monitoring program is user information stored in a plurality of database files created in each system manager account (second account). It is possible to block another user's access to data used by the user by checking whether the third account and the first account match.

According to the present invention, it is designed to enter the comparison/analysis monitoring program through the ROOT account under the permission of the ROOT account, thereby minimizing the risk of hacking.

In addition, according to the present invention, when accessing individual DBs and public DBs through the ROOT account, common DBs are implemented in a dump form to provide temporary storage space, generate hash values at every booting, and are deleted like RAM when power is cut off. , there is an effect of preventing indiscriminate copying or movement of common data stored in a common DB.

In addition, according to the present invention, through a multi-layered, multi-level security process, a single comparison/analysis monitoring program fundamentally blocks unauthorized external access and deletion and manipulation of user's own data by other users to ensure stability. It works.

1 is a conceptual diagram showing a general edge computing system architecture in case of access by web method or CS method;
2 is a conceptual diagram showing the database structure of a general edge computing system when accessing by web method or CS method;
3 is a conceptual diagram illustrating a database structure of an edge computing system according to a preferred embodiment of the present invention.
4 is a conceptual diagram showing an access method for each user of an edge computing system according to a preferred embodiment of the present invention;
5 is a block diagram showing a database configuration of an edge computing system according to a preferred embodiment of the present invention;
6 is an execution flow chart of a comparison/analysis monitoring program of an edge computing system according to a preferred embodiment of the present invention;
7 is a conceptual diagram illustrating a method for enabling independent data operation and UI configuration for each user of an edge computing system according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. First, in adding reference numerals to components of each drawing, it should be noted that the same components have the same numerals as much as possible even if they are displayed on different drawings. In addition, in describing the present invention, if it is determined that a detailed description of a related known configuration or function may obscure the gist of the present invention, the detailed description will be omitted. In addition, although preferred embodiments of the present invention will be described below, the technical idea of the present invention is not limited or limited thereto and can be modified and implemented in various ways by those skilled in the art.

multiple Create system administrator account

1 is a conceptual diagram showing the architecture of a general edge computing system in case of access by web method or CS method, and FIG. 2 is a conceptual diagram showing the database structure of a general edge computing system in case of access by web method or CS method. .

Referring to FIGS. 1 and 2 , a user accesses data of an edge computing system through a network.

When accessing data through a network, a web access method or CS (Client Server) method is used. In this case, user account information is stored in a database created by an operating system manager account. For example, in the case of UNIX or LINUX, the operating system administrator account is one system administrator account created from the ROOT account.

When multiple users access one edge computing system, there is a risk that all information of multiple users in the database may be exposed if the information of one system administrator account, which is an account that creates and manages a database, is exposed.

3 is a conceptual diagram illustrating a database structure of an edge computing system according to a preferred embodiment of the present invention.

Referring to FIG. 3 , in the present invention, a plurality of system administrator accounts are created to manage database files for each system administrator account. That is, instead of one system manager account managing the database files of the entire edge computing system, a plurality of system manager accounts each manage the database files.

When trying to access the edge computing system through web access or CS-type network, security and stability are ensured by independently managing the data in the database for each account by linking the account trying to access with multiple system administrator accounts.

Access rights for database files depend on the operating system. When applied to a UNIX-based operating system, the user's own database file has the highest level of security, and even if the security of other user accounts is compromised, an intruder cannot access the database file created by the user's account. Therefore, when a database file is created for each account in multiple system administrator accounts created in the operating system, the database file is configured so that other accounts cannot access it.

3, the account information data of user 1 created by 'system manager account 1' created in the operating system and the edge system data (account 1 database file) managed or created by user 1 cannot be accessed by anyone other than the ROOT account or system manager account 1. can't That is, set the permissions of the database file so that only your own account or the ROOT account can access it.

For data that needs to be used in public, you can set it so that all users can access it when creating a database file in one account (system administrator account_public) created as a system administrator property.

In FIG. 3, the 'system manager account_public' created in the operating system is set so that all users 1 to n can access device data (public database files) such as robots, controllers, and sensors connected to the edge system of the smart manufacturing site.

Comparison/Analysis Monitoring Program

4 is a conceptual diagram showing an access method for each user of an edge computing system according to a preferred embodiment of the present invention, and FIG. 5 is a block diagram showing a database configuration of an edge computing system according to a preferred embodiment of the present invention. 6 is an execution flow chart of the comparison/analysis monitoring program of the edge computing system according to a preferred embodiment of the present invention.

Referring to FIG. 4, in the present invention, when a user accesses an edge computing system through a web or CS-type network, the comparison/analysis monitoring program determines the account to be accessed (hereinafter referred to as 'first account'), the account in the operating system (hereinafter referred to as 'first account') , 'second account'), compare and analyze whether the user information and access rights (hereinafter referred to as 'third account') of the created database file match, and if the information does not match, access the database file with the account you want to access. make it impossible

Comparison/Analysis monitoring program runs under the ROOT account, which is the highest authority in the operating system, to monitor all users accessing the system. That is, since the comparison/analysis monitoring program is a program entered through the ROOT account under the permission of the ROOT account, it can be seen that there is no risk of hacking into the comparison/analysis monitoring program unless the ROOT account is breached.

The ROOT account of the UNIX or LINUX operating system is the highest administrator with the authority to destroy the system. Therefore, a system administrator account additionally created from the ROOT account cannot have priority over the ROOT account, and programs running in the ROOT account (for example, a comparison/analysis monitoring program) cannot access even a system administrator account.

Referring to FIGS. 5 and 6 , first, a comparison/analysis monitoring program is executed using the ROOT account (S10).

When a data access request is received from the web server and data server (S20), the account information (first account) of the visitor is checked (S30).

Comparison/analysis monitoring programs operate a multi-layered, multi-level security process.

(1) Port scan: Step 1

First, when an access request from a user who wants to access the edge system through a web or CS network is generated, it is checked whether the port number is allowable. The port number indicates where the data should go when the data transmitted in TCP/IP communication reaches the destination where it is used. The port number consists of 16 bits and is usually managed by international standards.

For example, port 20 is FTP (data), port 21 is FTP (control), port 53 is DNS, port 80 is HTTP, port 443 is HTTPS, etc. By looking at the port, you can tell which protocol the data is going through. This means that you can control the protocol the data goes through the port.

When the edge system is configured in the web access method, the comparison/analysis monitoring program allows only 80 ports for HTTP (HyperText Transfer Protocol) type web access among ports. port) and by fundamentally blocking access attempts to other ports, access to the edge system database is restricted except for the permitted ports.

When web access and CS access are allowed, the comparison/analysis monitoring program can be implemented to allow access to ports 80 and 49152 and block the rest.

Level 1 security fundamentally blocks various access methods that can be used in TCP/IP methods such as SSH (port number 22) and Telnet (port number 23) to access the edge computing system database with malicious intent.

(2) System administrator account check: Step 2

Second, if the port is allowable, the comparison/analysis monitoring program checks whether the first account and the second account match.

When an account is created on a UNIX or LINUX operating system, the account information is recorded in the /etc/passwd file. Since this information can only be verified by the ROOT account, monitoring programs running in the ROOT account can access it, but other accounts cannot access it. Accordingly, the comparison/analysis monitoring program compares and analyzes whether the account ID (second account) in the /etc/passwd file and the accessor's ID (first account) match.

The stage of building the edge system is carried out by the system administrator. In the stage of system construction, account IDs (second accounts) for several users are created in advance through the ROOT account, and the generated account IDs (second accounts) are unknown to anyone other than the ROOT account.

Therefore, the security of access permission is strengthened by comparing and analyzing whether the ID (first account) to be accessed is the ID (second account) assigned when the system was built in the comparison/analysis monitoring program.

The second-level security divides the database file into several groups for each user created in the ROOT account, and blocks access except for the ROOT account and the account that created the database file (the second account).

(3) Check database user information: Step 3

Thirdly, the comparison/analysis monitoring program checks whether the user information (third account) stored in several database files created in each system manager account (second account) and the accessor's information (first account) match. Compare/analyze.

Even for a database file created by the system administrator account (second account), you can use the chmod command to set the file's access privileges so that only the ROOT account and the user's own account can use it.

Since the comparison/monitoring program is executed in the ROOT account and each created database file can be accessed from the ROOT account, the comparison/analysis monitoring program is used by users who access the user information (third account) stored in the database file and the network. It is possible to compare information (first account).

When building an edge system, account IDs (second accounts) for multiple users who want to access the system are created using the ROOT account, and a database file is separately configured for each second account.

Inside the separately configured database file, the subject (ID, password) that created the file is stored, and this information cannot be accessed by anyone other than the ROOT account and the account of the subject.

The comparison/analysis monitoring program compares/analyzes whether the accessor's ID (first account) and the ID (third account) stored in the database file match, and fundamentally blocks access to the database file created by another account.

In the 3rd level security, the user information (third account) stored in each database file and the accessor information (first account) are compared for the database files created in multiple numbers to block other users' access to the data used by the user himself. do.

Through such a multi-layered multi-level security process, data stability is secured when one system is used by multiple users.

The comparison/analysis monitoring program accurately synchronizes the users allowed for level 1 to 3 security and the database files for those users, so that the user can identify the query/tree structure inside the database file managed by the user himself and read and write data. It is possible, and other users block access itself.

The comparison/analysis monitoring program secures stability by blocking unauthorized external access with one monitoring program and preventing other users from deleting or manipulating the data they use.

If all parts compared/analyzed through Steps 1 to 3 match and access to the database file is possible, database access and processing (S70) for the requested data is possible, allowing access to the database for each user account.

The accessed and processed data is transmitted and stored in the database of the web server and data server (S80).

The edge system to be accessed and used through a web or CS-type network serves as a server, and the server is built in the form of a web server and data server inside the edge system. The visitor connects to the server using a web browser or a separate dedicated application when trying to access by web access method using a client device such as a PC or mobile device from a distance.

From the server's point of view, a web server and a data server are built to handle data requests from various client devices, and a separate database is built to operate the built server.

In this separately constructed database (hereinafter referred to as 'public DB'), only publicly used data exists, and data used individually for each user is stored in a database created in each account (hereinafter referred to as 'individual DB').

Comparison/Analysis Monitoring Program receives a request for data operated by each account from the web server and data server, and sends the requested data to the database of the web server and data server (public DB) is sent to

At this time, the common DB is a kind of Dump, providing a temporary storage space, generating a hash value at each booting and deleting it like RAM when power is cut off. Through this, indiscriminate copying or movement of common data stored in a common DB can be prevented.

In FIG. 5 , 'user 1 account database' to 'user n account database' on the right side correspond to individual DBs, and 'established server database' on the left side corresponds to a common DB.

Independent data management and user interface configuration

7 is a conceptual diagram illustrating a method for enabling independent data operation and UI configuration for each user of an edge computing system according to a preferred embodiment of the present invention.

It frequently occurs that multiple users access and operate a single edge computing system. For example, the data managed by the person in charge of controlling and monitoring each production process and the data managed by the person in charge of the sales department and purchasing department will be different, and some of the data managed by each department and individual will be shared and some will be distinguished from each other. .

In the present invention, the execution of the design tool for independent data operation and UI configuration for each user can be executed independently for each account, so that independent device control and monitoring screen configuration for each user type is possible.

As mentioned in the background technology of the invention, in the case of a general edge computing service accessed using a web method or a CS method, most have a single database file structure. In this case, any problem with the database file can cause problems with all users' data.

In the present invention, by designing to have an independent database file structure for each user account, independent data operation and UI configuration for each department and individual are possible.

According to the present invention, it is configured to acquire and control only necessary information for each department and individual, and at the same time, all data processed in the edge system configures a separate database for each user to enable independent system design and operation for each account. do.

The above description is merely an example of the technical idea of the present invention, and those skilled in the art can make various modifications, changes, and substitutions without departing from the essential characteristics of the present invention. will be. Therefore, the embodiments disclosed in the present invention and the accompanying drawings are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings. . The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

S10: The step of running the program with the ROOT account
S20: Step of determining whether a data access request has been received from the web server and data server
S30: Step to verify accessor account information
S40: Step of determining whether the port is allowable
S50: Step to determine whether the ROOT account matches the system account created
S60: Step of determining whether it matches user information stored in the database
S70: Data race access and processing step for the requested data
S80: Transmitting and storing the accessed and processed data

Claims (3)

Create multiple system administrator accounts 1 to n in the ROOT account,
Each system administrator account 1 to n creates a database file for each account,
The account information data of User 1 created by system administrator account 1 and the account 1 database file, which is the edge system data managed or created by user 1, cannot be accessed by anyone other than the ROOT account or system administrator account 1.
For publicly used data, set access to users 1 to n when creating a database file in 'System Manager Account_Public', an account created as a system manager property.
The comparison/analysis monitoring program runs under the ROOT account under the permission of the ROOT account and monitors all users accessing the system.
When an access request occurs from a user who wants to access the edge system by web or CS (Client Server) method, the comparison/analysis monitoring program checks whether the port number is allowable, blocks access to ports other than the allowed ones,
In the case of an allowable port, the comparison/analysis monitoring program checks whether the first account, which is the account to be accessed, and the second account, which is each system administrator account, match, and blocks access except for the ROOT account and the second account.
An edge computing system that enables independent data operation and user interface configuration for each user, and is applied with multi-level security. delete According to claim 1,
If the first account matches the second account, the comparison/analysis monitoring program checks whether the third account, which is user information stored in a plurality of database files created in each system manager account (second account), matches the first account. Block other users' access to the data used by the user by checking,
An edge computing system that enables independent data operation and user interface configuration for each user, and is applied with multi-level security.

Images