KR20080102465A - System and method for home network security based on remote management server - Google Patents

Abstract

A home network security system and a home network security method perform a remote security function by implementing the security function in a remote management server connected to a home gateway through an external network. A home gateway(10) provides a home network service by controlling an operation of an information device(15) connected to a home network inside a household according to the request of a client(30) connected through the external network. A remote management server is connected to the client and the home gateway through the external network, and registers and manages the user authentication information and the service approach control information on a database(22) and transmits the confirmation result to the home gateway after confirming the user authentication and the service approach control authority of the corresponding client with reference to the database when the user authentication and the service approach control request-information of client are received from the home gateway.

Description

Home network security system using remote management server and method thereof {System and Method for Home Network Security based on Remote Management Server}

1 is a block diagram of a conventional home network system,

2 is an overall block diagram of a home network security system according to the present invention;

3 is a block diagram of a home gateway according to the present invention;

4 is a block diagram of a remote management server according to the present invention;

5 is a flowchart illustrating an operation of an authentication / access control service of a home gateway for applying an access control policy in real time according to the present invention;

6 is a flowchart illustrating a process in which a client registers information for setting an access control policy in a remote management server according to the present invention;

7 is a flowchart illustrating a process of performing a service of a client through a home network security system according to the present invention.

The present invention relates to a home network security system and a method thereof, and more particularly, to connect a home gateway and an external network without implementing security functions such as user authentication and service access control of the home network system in the home gateway. The present invention relates to a home network security system using a remote management server and a method for implementing the remote management server to perform a security function remotely.

The home network system configures a home network so that information devices installed in a home can transmit and receive data, and the home network network can be connected to an external network to control the information devices installed in the home. to be.

Figure 1 shows the configuration of such a conventional home network system.

As shown in FIG. 1, in general, a home network system includes information devices 15 of a home 1, for example, a computer 15a, a TV 15b, a front door 15c, and the like. It is connected to the home gateway 10 installed in the home 1 through the home gateway 10 is connected to the external client 30 through an external network. The client 30 is a device having a network function used by a user who wants to control the information device 15 of the indoor 1 outside the home, and includes a device such as a mobile phone, a PDA, a computer, and the like.

The home network system having the above-described configuration should perform security functions such as authentication and service access control of a user accessing the home gateway 10 to control the information device 15. This security function is usually performed by the home gateway 10. For this purpose, the home gateway 10 is provided with a security function for user authentication and service access control. In addition, the home gateway 10 interoperates with and manages a database 11 that stores security data such as authentication data and service access control policy data for user authentication. The security function provided in the home gateway 10 may be implemented in a home server, which is a separate computer 15a connected through a home network. Hereinafter, the security function is collectively described as being implemented in the home gateway 10. do.

On the other hand, a home network system in which such a security function is implemented in the home gateway 10 has the following problems.

First, since security functions such as user authentication and service access control for use of the information device 15 and security related data should be provided in the home gateway 10 and the database 11 installed in each premises 1, There is a problem in that the cost of building a home network system at home increases.

Second, security data management such as authentication data and access control policy data and access control policy setting require expertise, and management of the database 11 storing such security data also requires expertise. However, in the conventional home network system, since the home gateway 10 and the database 11 provided in the home 1 are provided with a security function, the home user 10 has a security function requiring such expertise. Because of the management, it puts a lot of pressure on the individual user and adversely affects the activation of the home network system.

Third, since maintenance of the home gateway 10 and the database 11 that perform a security function due to errors and failures must be performed by the general user of the home 1, such maintenance is a burden on the general user. No matter how good the technology and functions, if the normal user is not easy and convenient to use, the end user will turn away from such technology and function.

Fourth, training for the user should be periodically performed for the management of the home gateway 10 and the database 11, such a training time and cost is a burden on the general user.

Accordingly, the present invention has been proposed to solve the problems of the conventional home network system described above, and an object of the present invention is to provide security functions such as user authentication and service access control of a home network system to an external network outside the home. A home network security system using a remote management server that can be implemented on a connected remote management server and managed by an external expert to provide stability and reliability for security and to reduce the burden of cost and maintenance of security functions for each home. To provide that method.

Home network security system using a remote management server according to the present invention for achieving the above object in the home network system to control the operation of the information equipment installed in the home via an external client, through an external network network A home gateway providing a home network service by controlling an operation of an information device connected to a home network in a home according to a request of a connected client; Connected to the client and the home gateway through an external network, and registers and manages user authentication information and service access control information of the client in a database, and receives user authentication and service access control request information of the client from the home gateway. And a remote management server that checks the user authentication and service access control authority of the corresponding client with reference to the database and transmits the verification result to the home gateway.

The home gateway may include a client connection unit that processes a connection request of a client connected through an external network; A management server communication unit for requesting user authentication and service access control policy to a remote management server connected through an external network and receiving response data transmitted from the remote management server; An authentication / access control manager configured to manage user authentication and service access control authority of a client who wants to control an in-house information device connected to a home gateway; It comprises a; home network processing unit for controlling the operation of the information device connected to the home network.

The remote management server includes a gateway communication unit for receiving user authentication and service access control request data from a home gateway and transmitting response data; A gateway registration access unit that receives user authentication and service access control information from a client set as an administrator of each home, registers and manages the database through a database manager; An authentication processor for searching for user authentication information registered in a database and processing user authentication according to a user authentication request of the home gateway; And an access control processor configured to process the user access control authentication by searching the database according to the service access control authentication request of the home gateway.

On the other hand, the home network security method using a remote management server according to the present invention for achieving the above object in the home network security method for controlling the operation of the information device installed in the home via an external client, the remote management server Registering user information and service access control information of the client in a database connected to the client; Requesting a user authentication by accessing a client through a external network to a home gateway connected to premises information devices through a home network; Requesting user authentication by transmitting user authentication information of a client requesting user authentication at a home gateway to a remote management server connected through an external network; Retrieving user information of a client registered in a database from a remote management server to perform user authentication, and then transmitting the authentication result to a home gateway; And checking the user service access authority according to the authentication result of the remote management server in the home gateway to provide a home network service to the corresponding client.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is an overall block diagram of a home network security system according to an embodiment of the present invention.

As shown in FIG. 2, the home network security system according to the present invention includes a home gateway 10 controlling an information device 15; 15a, 15b, and 15c connected to a home network of a home 1, and the home. A remote management server 20 connected to the gateway 10 through an external network to perform a security function, and a client 30 connected to the home gateway 10 and the remote management server 20 through the external network. It is made, including.

The remote management server 20 is a computer that performs security functions such as user authentication and service access control of the client 30 to control the information device 15 of the home 1 through the home gateway 10. The remote management server 20 has a firewall 21 for preventing illegal intrusion from the outside in order to increase the stability and reliability of the management server itself, and is connected to security, such as user authentication data and service access control policy data. A database 22 is stored in which data is stored. The firewall 21 and the database 22 are managed by the remote management server 20.

A web browser 310 and a dedicated application 320 are installed in the client 30 used by the user of each home to control the information device 15 of the home 1 outside the home. The web browser 310 and the dedicated application 320 are connected to the home gateway 10 or the remote management server 20 through an external network to transmit and receive data.

3 is a block diagram of a home gateway according to an exemplary embodiment of the present invention, and FIG. 4 is a block diagram of a remote management server.

As shown in FIG. 3, the home gateway 10 according to the present invention includes an authentication / access control management unit 110 that performs user authentication and service access control, and a client connection unit 120 that manages a connection of the client 30. ), A management server communication unit 130 for communicating with the remote management server 20, a home network processing unit 150 for processing a home network service requested from the client 30, and data transmission and reception through an external network The password processing unit 140 for city security is provided.

The authentication / access control manager 110 is a program module that manages user authentication and access control of a service of a client 30 to control an information device 15 of a home connected to the home gateway 10. The authentication / access control management unit 110 includes a session management module 112 for performing user authentication session processing, an access control module 113 for service access control processing, the session management module 112, and an access control module. An authentication / access control service 111 is provided in association with 113 to provide an authentication / access control processing service until the home gateway 10 is driven and terminated. The authentication / access control service 111 starts when the home gateway 10 is driven, and the authentication and access control policy values are set by the authentication and access control policy data transmitted from the remote management server 20. The authentication / access control service 111 refers to the session management module 112 and the access control module 113 for user authentication and service access control.

The client connection unit 120 is a program module that processes a connection request of the client 30. The client connection unit 120 is provided with a web page unit 121 and an application unit 122. The web page unit 121 and the application unit 122 may include a web browser 310 provided with the client 30, Each of the access requests by the dedicated application 320 is processed.

The management server communication unit 130 is a program module for requesting user authentication or service access control policy to the remote management server 20 connected through an external network, and receiving response data transmitted from the remote management server 20. The management server communication unit 130 transmits and receives a transmission and reception module 131 for performing the request and response data to and from the remote management server 20, the remote management server 20 detects the event information occurs when the authentication / access control An event listener 132 is provided to transmit the policy to the authentication / access control service 111 of the management unit 110 to reflect the policy according to the event occurrence in real time.

When the encryption processing unit 140 uses a security protocol when communicating with the management server 20 through the management server communication unit 130 or communication between the client connection unit 120 and the client 30 by the connection request of the client 30 Program module that processes encryption and decryption.

The home network processor 150 is a program module that is responsible for the control process of the home network service, that is, the information device 15 connected to the home network. The home network processing unit 150 collects user authentication information transmitted from the information device 15 connected to the home network and authenticates / access control processing unit 151 linked with the authentication / access control management unit 110 and the home network. A home network processing unit 152 for processing and managing communication with various information devices 15 connected to the network, and a service processing unit 153 for controlling the information device 15 connected to the actual home network network are provided. .

As shown in FIG. 4, the remote management server 20 includes a gateway registration access unit 210 for inputting and registering user authentication and service access control data of each home gateway 10 connected through an external network. A gateway communication unit 220 for communicating with the home gateway 10, a database manager 240 for managing the database 22, an authentication processor 250 for processing a user authentication request, and an access control request The access control processor 260 and the encryption processing unit 230 for security when transmitting and receiving data through the external network is provided. The remote management server 20 according to the present invention is connected to the external network through the firewall 21 to block the illegal intrusion of the outside to increase the stability and reliability.

The gateway registration access unit 210 allows a user of each home to register and manage data necessary for authentication and access control in the remote management server 20 in order to use the information device 15 installed in their home. Module. The gateway registration connection unit 210 can be accessed only by a user who has an administrator's authority of each home registered in advance, and the user can easily manage the registration, modification, and deletion of data. Graphical User Interface) environment. The user may access the gateway registration access unit 210 through the web browser 310 or the dedicated application 320 provided in the client 30. For this purpose, the gateway registration access unit 210 may access the web browser of the client 30. A web server 211 that processes the connection via 310 and an application unit 212 that processes the connection of the dedicated application 320 of the client 30 are provided. The data transmitted from the client 30 through the gateway registration access unit 210 is registered and stored in the database 22 through the database manager 240.

The gateway communication unit 220 is a program module that communicates with the management server communication unit 130 of the home gateway 10 to perform communication. The gateway communication unit 220 includes a transmission / reception module 221 for receiving user authentication and access control request data from the management server communication unit 130 and transmitting response data, and home information device information or user authentication or access control information. When changed, an event generator 222 for generating event information including corresponding change information is provided. When event information is generated by the event generator 222, the event listener 132 of the management server communication unit 130 provided in the home gateway 10 detects and receives the received event information and authenticates the received event information with the authentication / access control manager. Transmitted to 110 so that the changed information can be reflected in real time.

The encryption processing unit 230 processes encryption and decryption when using a security protocol when communicating with the client 30 through the gateway registration access unit 210 or with the home gateway 10 through the gateway communication unit 220. Program module.

The authentication processor 250 is a program module for processing a user authentication request of the home gateway 10. The authentication processor 250 authenticates a corresponding user in the database 22 according to a user authentication request of the home gateway 10. Authentication query unit 251 for performing a query for, and receives the authentication result data for the query from the database 22 generates the authentication data and transmits it to the home gateway 10 through the gateway communication unit 220 An authentication data generator 252 is provided.

The access control processing unit 260 is a program module for processing a service access control request of the home gateway 10. The access control processing unit 260 may access the database 22 according to the service access control request of the home gateway 10. An access control policy query unit 261 that performs an access control query and an access control policy generator 262 that receives the result data for the query from the database 22 and combines them to form an access control policy. It is.

Hereinafter, a process of performing a home network service through the home network security system according to the present invention having the above configuration will be described.

5 is a flowchart illustrating an operation of an authentication / access control service of a home gateway for applying an access control policy in real time according to an embodiment of the present invention.

As shown in FIG. 5, first, when the home gateway 10 starts to be driven (step S100), the authentication / access control manager 110 of the home gateway 10 initializes the authentication / access control service 111. The operation is performed (step S110).

After initializing the authentication / access control service of the home gateway 10, the authentication / access control management unit 110 requests the access control policy for the home gateway to the remote management server 20 through the management server communication unit 130 (step S120).

The access control processing unit 260 of the remote management server 20 that has received the access control policy for the home gateway from the home gateway 10 queries the access control policy to the database 22 through the access control policy query unit 261. After receiving the query result, the access control policy generator 262 combines the query result to configure the access control policy and transmits it to the home gateway 10 (step S130).

The authentication / access control manager 110 of the home gateway 10 sets the authentication / access control service 111 as an access control policy for the home gateway transmitted from the remote management server 20 (step S140).

On the other hand, with the initialization of the authentication / access control service 111 in step S110, the event listener 132 provided in the management server communication unit 130 is driven, the event listener 132 is a remote management server 20 The event signal generated by the event generator 222 provided in the gateway communication unit 220 is inspected (step S160).

If the access control policy of the remote management server 20 is changed and an event signal is generated through the event generator 222, the event listener 132 of the home gateway 10 detects this (step S170) and the step S120. After the request for the changed home gateway access control policy to the remote management server 20 will be performed.

The process of detecting and processing an event occurrence of the remote management server 20 through the event listener 132 is repeatedly performed until the operation of the home gateway 10 is terminated (step S150).

6 is a flowchart illustrating a process in which a client registers information for setting an access control policy in a remote management server according to an embodiment of the present invention.

As shown in FIG. 6, a user of each household who wants to register information for setting an access control policy on the remote management server 20 firstly through the web browser 310 or the dedicated application 320 of the client 30. Access to the remote management server 20 (step S200), enter the login information in the login field provided by the gateway registration connection unit 210 of the remote management server 20 (step S210), and performs user authentication (step S210). S220).

The authentication processing unit 250 of the remote management server 20 performs authentication of the user through user authentication information registered in the database 22, by checking whether the user who logs in is a valid user who can register information (step S230). If it is not a valid user, the access is blocked (step S231). In the embodiment of the present invention, the user authentication is authorized only when the administrator is a user of each registered home.

If the user is a valid user, an information registration page of the GUI environment is provided to the user so that the user can perform operations such as inserting, modifying, and deleting information on access control policy setting (step S240). The information changed by the user is registered and managed in the database 22 by the database manager 240.

When the information is changed by the user, the event generator 222 of the gateway communication unit 220 generates event information indicating that the user information has been changed (step S250), and the generated event information is the management server communication unit of the home gateway 10. Sensed by the event listener 132 provided in the 130 is transmitted to the home gateway 10 is reflected in the access control policy of the home gateway 10 in real time (step S260).

The information registration process of the user is repeatedly performed until the user logs off (step S270).

7 is a flowchart illustrating a process of performing a service of a client through a home network security system according to an embodiment of the present invention.

As shown in FIG. 7, the user of each home accesses the home gateway 10 through the web browser 310 or the dedicated application 320 of the client 30 to request a home network service (step S300). .

When the client 30 accesses the home gateway 10 and requests a service, the authentication / access control manager 110 of the home gateway 10 has a session of the client 30 through the session management module 112. After checking whether (step S310), if the session of the client 30 does not exist, the remote management server 20 requests a user authentication of the client 30 (step S311). The session management module 112 of the authentication / access control management unit 110 generates a session indicating the login information of the corresponding user when the client 30 is logged in with the user authentication. Accordingly, the session of the corresponding client 30 is generated. This existence indicates that the client 30 has already been authenticated by the user, so that a separate user authentication process is omitted.

If there is a session of the client 30 in this step, or if the user authentication of the client 30 from the remote management server 20 is successful (step S312), the home gateway 10 is the authentication / access control service ( After checking the service access right of the client 30 through 111 (step S330), the service with the access right is provided to the client 30 through the home network processor 150 (step S340). If the user authentication of the client 30 fails in this step or if there is no access right to the requested service, the access to the corresponding service fails (step S313).

Through the above process, the user of each home can use the home network service to which the user has access rights at home and abroad.

As described above, the home network security system according to the present invention allows security functions such as user authentication or service access control to be performed through the remote management server 20 installed outside the home. It should be understood that various modifications and variations can be made by those skilled in the art to which the present invention pertains without departing from the spirit and scope of the appended claims. .

As described above, the home network security system and method thereof according to the present invention do not implement security functions such as user authentication and service access control for using the home network service in a home gateway existing in the home, but do not have a remote management server outside the home. By implementing to be implemented through, it is possible to reduce the cost burden of building a security function through the home gateway in each home.

In addition, by connecting one remote management server with multiple generations of home network systems, it is possible to reduce the cost of constructing an overall home network security system and secure the remote management server by managing it by experts. There is an effect to increase the stability and reliability for.

In addition, the security of the home network system in the home is maintained through a remote management server managed by an external expert, so that general users can skip the training process that should be performed periodically to maintain the security of the home network system. The cost and time can be saved, and the user can concentrate on the home network system service operation.

Claims (7)

In the home network system to control the operation of the information equipment installed in the home through the client outside the home, A home gateway 10 that provides a home network service by controlling the operation of the information device 15 connected to the home network of the home 1 at the request of the client 30 connected through the external network; It is connected to the client 30 and the home gateway 10 through an external network, registers and manages user authentication information and service access control information of the client 30 in the database 22, and manages the home gateway 10. When the user authentication and service access control request information of the client 30 is received from the client 30, the user gateway and the service access control authority of the client 30 are checked with reference to the database 22. Remote management server 20 for transmitting to the home network security system, characterized in that comprises a. The method according to claim 1, The home gateway 10 includes a client connection unit 120 for processing a connection request of a client 30 connected through an external network; A management server communication unit 130 for requesting a user authentication and service access control policy to a remote management server 20 connected through an external network and receiving response data transmitted from the remote management server 20; An authentication / access control manager 110 for managing user authentication and service access control authority of the client 30 to control the information device 15 of the premises 1 connected to the home gateway 10; And a home network processor (150) for controlling the operation of the information device (15) connected to the home network. The method according to claim 1, The management server communication unit 130 detects the event information including the corresponding change information by changing the information device information or user authentication and service access control information of the home (1) in the remote management server 20 to detect the remote Home network security system, characterized in that provided with an event listener (132) for requesting event information to the management server (20). The method according to claim 1, The remote management server 20 includes a gateway communication unit 220 for receiving user authentication and service access control request data from the home gateway 10 and transmitting response data; A gateway registration access unit 210 which receives user authentication and service access control information from a client 30 set as an administrator of each home, registers and manages the database 22 through the database manager 240; An authentication processing unit (250) for processing user authentication by searching for user authentication information registered in the database (22) according to the user authentication request of the home gateway (10); And an access control processor (260) for searching the database (22) and processing user access control authentication according to the service access control authentication request of the home gateway (10). The method according to claim 4, The home network security, characterized in that the gateway communication unit 220 is provided with an event generator 222 for generating event information including the change information when the home information device information or user authentication and service access control information is changed. system. In the home network security method to control the operation of the information equipment installed in the home via an external client, (a) registering user information and service access control information of the client 30 in the database 22 connected to the remote management server 20; (b) requesting user authentication by accessing the client 30 through an external network to a home gateway 10 connected to the information device 15 of the home 1 through a home network; (c) requesting user authentication by transmitting user authentication information of the client 30 requesting user authentication from the home gateway 10 to a remote management server 20 connected through an external network; (d) retrieving user information of the client 30 registered in the database 22 from the remote management server 20 to perform user authentication, and then transmitting the authentication result to the home gateway 10; (e) checking the user service access authority according to the authentication result of the remote management server 20 in the home gateway 10 to provide a home network service to the corresponding client 30; Network security method. The method according to claim 6, Registering the user information and access control information of the client 30 in the database 22 connected to the remote management server 20 (a) (a1) a step in which the client 30 accesses the remote management server 20 through an external network and performs user authentication to confirm access authority; (a2) registering user information and access control information of each client 30 in the database 22 after user authentication of the client 30; (a3) generating event information informing that the information has been changed through the step; and home network security method.

Images