KR20120033193A - Inter-device authentication method in advanced metering infrastructure and sever used therefor - Google Patents

Abstract

PURPOSE: A mutual authentication method between devices in an advanced metering infrastructure and a sever used therefore are provided to indirectly cross-certify devices by using other authorities which commonly mutually certifies. CONSTITUTION: Authentication for a corresponding device which each organization wants to use is processed(S101). Each organization cross-certifies(S102). Each organization cross-certified injects the authentication information of other authorities cross-certified(S103). Devices belonging to the same organization or other organizations respectively request cross certification(S104). A mutual certification process between the devices is completed(S106). The devices having completed cross certification mutually communicate(S107). Each organization receives the cross certification information of each organization through other organizations(S110). Each organization receiving the cross certification information mutually certifies(S111). Each organization injects each authentication information(S112).

Description

Inter-device authentication method in advanced metering infrastructure and sever used therefor}

The present invention relates to a mutual authentication technology between devices of an advanced metering infrastructure (AMI). In particular, the present invention relates to a method of mutual authentication between devices of an intelligent meter reading infrastructure that can provide an automated authentication method that enables mutual authentication between devices of various operators in an intelligent meter reading infrastructure, and a server used therein. .

Smart Grid is a next-generation intelligent grid that combines information technology (IT) with the existing grid to optimize energy efficiency by exchanging real-time information in both directions. This smart grid combines information technology with the existing one-way power grid, which was composed of the stages of 'power generation, transmission, distribution, and sales'. Corresponding.

In addition, power providers can use smart grids to monitor power usage in real time and flexibly adjust supply. In addition, electric power consumers can understand the electricity usage in real time to adjust the electricity usage time and usage by avoiding expensive time periods, and to use electricity generated from homes such as solar power generation, fuel cells, and electric vehicles. You can also sell.

In order to solve the energy supply and demand optimization problem that represents the smart grid, it is essential to introduce an intelligent metering infrastructure as an infrastructure supporting remote metering, bidirectional information exchange and energy load control. And, this intelligent metering infrastructure is built by a variety of devices provided by a variety of operators.

In order to solve the above problems, an object of the present invention is to provide an automated authentication method that enables mutual authentication between devices of various operators in an intelligent meter reading infrastructure.

In addition, an object of the present invention is to enable a method of mutually reciprocal authentication by other organizations that mutually authenticate each other even between devices or organizations that have failed mutual authentication.

It also aims to prevent security incidents such as data leakage, forgery, and device incapacity that can occur when sharing information in an intelligent meter reading infrastructure.

In addition, in the intelligent meter reading infrastructure, an object of the present invention is to simply reflect the information of the institutions or devices that are additionally subscribed and unsubscribed to the authentication scheme by simply modifying the existing authentication scheme.

The mutual authentication method between devices of the intelligent meter infrastructure according to the present invention for achieving the above object, the first authority authenticates the first device owned by the first authority, the second authority has a second Authenticating to the second device; Requesting mutual authentication by the first device and the second device; Confirming, by the first device, whether or not the first organization is authenticated to the second institution, and by the second device, whether or not the second institution is authenticated to the first institution; And determining whether the first device and the second device are in communication according to whether the first organization is authenticated to the second organization and the second organization is authenticated to the first organization. .

At this time, if the certification of the second authority of the first authority and the certification of the first authority of the second authority are not confirmed, mutual authentication is performed with the first authority, and also mutually with the second authority. Determining whether an authenticated third party exists; The third institution providing authentication information of the second authority to the first authority, and the third authority providing authentication information of the first authority to the second authority; The first authority injecting authentication information of the second authority into the first device, and the second authority injecting authentication information of the first authority into the second device; And communicating between the first device and the second device.

At this time, authentication information of the second organization is provided to the first organization by the third organization, and authentication information of the first organization is provided to the second organization, wherein the first organization and the second organization are provided. May further comprise authenticating each other.

At this time, when the authentication of the second organization of the first organization and the authentication of the first organization of the second organization is confirmed, the first device and the second device further communicating with each other. It may include.

In this case, the first organization may further include injecting authentication information of the second organization into the first device, and the second institution may further include injecting authentication information of the first organization into the second device. have.

In addition, the mutual authentication server between devices of the intelligent meter reading infrastructure according to the present invention for achieving the above object, the authentication request receiving unit for receiving a communication request from the specific device of the specific institution to the first device of the first authority; A mutual authentication database storing authentication information of a second authority mutually authenticated by the first authority; A third-party authentication manager that detects and outputs authentication information of the second authority in the mutual authentication database when the specific authority corresponds to the second authority; And an authentication result processing unit configured to receive authentication information of the second organization from the third party authentication management unit and determine whether to permit the authentication request for the first device of the specific device.

At this time, a multi-authentication database that stores the authentication information for the third authority that mutually authenticated with the specific authority and mutually authenticated with the first authority; And a multi-authentication retrieval unit for detecting and outputting authentication information of the third authority in the multi-authentication database, wherein the authentication result processing unit receives the authentication information of the third authority and transmits the authentication information to the specific device of the specific authority. Allow the communication request of the first device for the request.

In this case, the multi-certification searching unit may store the authentication information of the specific authority of the third authority in the mutual authentication database as the authentication information of the second authority.

At this time, the authority authentication database that stores the authentication information of the first authority for the first device; And a corresponding authority certification management unit that detects and outputs authentication information of the first authority in the corresponding authority certification database when the specific authority corresponds to the first authority, and wherein the authentication result processing unit authenticates the corresponding authority. The authentication unit may receive authentication information of the first organization and allow an authentication request for the first device of the specific device.

At this time, the mutual authentication database and the multi-authentication database may be updated to reflect the authentication information of the organization that additionally join and leave.

According to the present invention, in an intelligent meter reading infrastructure, it is possible to provide an automated authentication method that enables mutual authentication conveniently between devices of various operators.

In addition, the present invention enables a method of mutually reciprocal authentication through other organizations that mutually authenticate each other, even between devices or organizations that have failed mutual authentication. Therefore, a method of mutual authentication is simplified even between devices or organizations that have failed authentication with each other.

In addition, the present invention can prevent security incidents such as data leakage, forgery, and device incapacitation that may occur when sharing information in an intelligent meter reading infrastructure.

In addition, the present invention, in the intelligent meter reading infrastructure, by simply modifying the existing authentication scheme, it is possible to additionally reflect the information of the institutions or devices to join and leave the authentication scheme.

1 is a flowchart illustrating a method for mutual authentication between devices in an intelligent meter reading infrastructure according to the present invention.
FIG. 2 is a diagram illustrating a mutual authentication method between devices of an intelligent meter reading infrastructure according to the present invention in organizations where mutual authentication is completed.
3 is a view for explaining the flow of specific authentication information of the mutual authentication method between devices of the intelligent meter reading infrastructure in accordance with the present invention, the organizations completed mutual authentication.
4 is a view for explaining the mutual authentication method between devices of the intelligent meter infrastructure in accordance with the present invention, in organizations that mutual authentication has failed.
5 is a block diagram illustrating a configuration of a mutual authentication server between devices in the intelligent meter reading infrastructure according to the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. Here, the repeated description, well-known functions and configurations that may unnecessarily obscure the subject matter of the present invention, and detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more completely describe the present invention to those skilled in the art. Accordingly, the shape and size of elements in the drawings may be exaggerated for clarity.

Hereinafter, a method of mutual authentication between devices of the intelligent meter reading infrastructure according to the present invention will be described.

1 is a flowchart illustrating a method for mutual authentication between devices in an intelligent meter reading infrastructure according to the present invention. In the following, specific organizations and specific devices in the intelligent meter reading infrastructure are defined as, for example, the first and first devices, the second and second devices, the third and third devices. Shall be.

Referring to FIG. 1, in the method of mutual authentication between devices of the intelligent meter reading infrastructure according to the present invention, first, each institution authenticates a corresponding device that each institution wants to use in the intelligent meter reading infrastructure (S101). That is, the first institution authenticates to the first apparatus owned by the first institution, the second institution authenticates to the second apparatus possessed by the second institution, and the third institution has a third apparatus possessed by the third institution. Authenticate

In addition, in the intelligent meter reading infrastructure, when the institutions need to use each other's devices, the institutions authenticate each other (S102). In other words, if the first organization wants to use the second device or the third device, it may mutually authenticate with the second organization or the third organization.

In addition, each institution that is mutually authenticated through step S102 injects authentication information of another organization that is mutually authenticated with respect to the device of each organization (S103). For example, in step S102, when the first authority mutually authenticates with the second authority, the first authority injects authentication information of the second authority into the first device, and the second authority sends the second device to the second device. 1 Inject authentication information from the organization.

In addition, in the intelligent meter reading infrastructure, devices belonging to the same institution or belonging to different institutions request mutual authentication (S104). That is, the first device requests the second device to authenticate for mutual communication.

In addition, it is determined whether the mutual authentication request of the devices in step S104 is successful (S105). That is, the first device confirms whether or not the first organization is authenticated to the second organization, and the second device confirms whether or not the second organization is authenticated to the first organization.

In addition, through the step (S105), if the mutual authentication request of the devices is successful, the mutual authentication process between the devices is completed (S106). That is, if it is confirmed that the first device has been authenticated to the second organization of the first organization, and if the second device has been verified to the first organization of the second organization, mutual authentication between the first device and the second device is performed. Complete the procedure.

In addition, devices that have been mutually authenticated through step S106 are in communication with each other (S107).

In addition, through the step (S105), if the mutual authentication request of the devices failed, it is determined whether there is another authority mutually authenticated with each authority (S108). That is, if the mutual authentication request between the first device and the second device fails, it is determined whether there is a third institution that mutually authenticates with the first authority and mutually authenticates with the second authority.

In addition, if it is determined in step S108 that there is no other institution mutually authenticated with each other in common, mutual authentication between devices fails (S109). That is, when the third institution does not exist, the mutual authentication request of the first device and the second device will finally fail.

In addition, if it is determined through the step (S108) that there is a mutual authentication mutually in common with each organization, each institution is provided with mutual authentication information of each organization through the other organization (S110). That is, the first institution receives the authentication information of the second organization from the third institution, and the second institution receives the authentication information of the first organization from the third organization.

In addition, each institution that receives the mutual authentication information of each organization from the other institution is to authenticate each other (S111). In other words, the first and second institutions authenticate each other.

In addition, each organization injects authentication information of each organization into the apparatus of each organization (S112). That is, the first organization injects authentication information of the second organization into the first device, and the second organization injects authentication information of the first organization into the second device. In step S106, mutual authentication between devices is completed.

Hereinafter, a description will be given of the mutual authentication method and the flow of specific authentication information between the devices of the intelligent meter infrastructure according to the present invention in the organizations that mutual authentication is completed.

FIG. 2 is a diagram illustrating a mutual authentication method between devices of an intelligent meter reading infrastructure according to the present invention in organizations where mutual authentication is completed. 3 is a view for explaining the flow of specific authentication information of the mutual authentication method between devices of the intelligent meter reading infrastructure in accordance with the present invention, the organizations completed mutual authentication.

Referring to FIG. 2, first, the first institution A authenticates the first device a, and the second institution B authenticates the second device b (①). Then, the first organization A and the second organization B authenticate each other (2). Further, the first engine A injects the authentication information of the second engine B into the first device a, and the second engine B feeds into the second device b of the first engine A. Inject authentication information (③). In addition, the first device (a) and the second device (b) requests the cooperative use of mutual device authentication as necessary (④). In addition, the first device (a) reviews the authentication information for the second device (b) based on the authentication information of the second organization (B), and the second device (b) is the authentication of the first organization (A). Based on the information, the authentication information for the first device a is reviewed (5). In addition, the first device (a) and the second device (b) has completed the mutual authentication information is completed (⑥).

Referring to FIG. 3, the first institution A obtains the authentication information sign [A] _B of the second authority B, and the second authority B obtains the authentication information sign [B of the first authority A. FIG. ] Acquire _A (①). Further, the first engine A injects information of sign [a] _A and sign [A] _B into the first device a, and the second engine B signs [b into the second device b. ] Information of _B and sign [B] _A is injected (②). In addition, if there is a mutual authentication request between the first device (a) and the second device (b) (③), the first device (a) verifies the sign [B] _A , the second device (b) sign [A] Verify _B and authorize each one (④). In addition, when authentication of the first device a and the second device b is completed, the first device a and the second device b communicate with each other (⑤).

Hereinafter, a description will be given of the mutual authentication method between the devices of the intelligent meter infrastructure in accordance with the present invention in organizations that mutual authentication has failed.

4 is a view for explaining the mutual authentication method between devices of the intelligent meter infrastructure in accordance with the present invention, in organizations that mutual authentication has failed.

Referring to FIG. 4, first, the second institution B and the third institution C have completed, i.e., completed, mutual authority certification (①), and the first institution A and the second institution B. Failed mutual authority certification (②). Further, the first institution A and the third institution C have succeeded, that is, completed mutual authority certification (③).

At this time, the third institution (C) which the first organization (A) and the second organization (B) are mutually certified by the third organization (C) with respect to the first organization (A) to the second organization (B) ) Provides the authentication information, so that the second institution (B) authenticates the first institution (A) (④). In addition, the third institution (C) provides the first institution (A) with certification information of the third institution (C) for the second institution (B), whereby the first institution (A) is the second institution (B). Will be authenticated (⑤). Further, the first engine A injects the authentication information sign [B] _A for the second engine B into the first device a, and the second engine B sends the second device b into the second device b. 1 Inject authentication information sign [A] _B for institution (A) (⑥). Further, the first device a and the second device b request mutual authentication as necessary (⑦). Accordingly, the first device (a) verifies the sign [B] _A , and the second device (b) verifies the sign [A] _B to grant mutual rights (8). When the authentication of the first device a and the second device b is completed, the first device a and the second device b communicate with each other (9).

Hereinafter, the configuration and operation of the mutual authentication server between devices according to an embodiment of the present invention will be described.

5 is a block diagram showing the configuration of a mutual authentication server between devices according to the present invention.

Referring to FIG. 5, the mutual authentication server 100 between devices of the intelligent meter reading infrastructure according to the present invention includes a corresponding authority authentication database 110, a mutual authentication database 120, a multiple authentication database 130, an authentication request receiving unit 140, The authentication information comparator 150, a corresponding authority authentication management unit 160, another authority authentication management unit 170, a multiple authentication retrieval unit 180, and an authentication result processing unit 190 are configured. Hereinafter, in the intelligent meter reading infrastructure, it is assumed that a communication request is received from a specific device of a specific organization to a first device of the first organization.

The authority authentication database 110 stores the authentication information of the first authority for the first device.

The mutual authentication database 120 stores authentication information of a second authority mutually authenticated by the first authority. In addition, the mutual authentication database 120 updates the authentication information from time to time to reflect the authentication information of the organization to further join and leave.

The multi-certification database 130 stores authentication information of a third authority which mutually authenticates with a specific authority and also mutually authenticates with a first authority. In addition, the multi-authentication database 130 updates the authentication information from time to time to reflect the authentication information of the organization that additionally joins and leaves.

The authentication request receiving unit 140 receives a communication request from a specific device of a specific organization to a first device of the first organization.

The authentication information comparing unit 150 determines whether the request received by the authentication request receiving unit 140 is by the first authority, based on the corresponding authority authentication database 110. If the authentication information comparing unit 150 determines that the request received by the authentication request receiving unit 140 is due to the first authority, the authentication information comparing unit 150 outputs information on the received request to the corresponding institution authentication management unit 160. . In addition, if it is determined that the request received by the authentication request receiving unit 140 is made by another organization other than the first organization, the authentication information comparison unit 150 may request the other organization authentication management unit 170 for the received request. Print information.

The authority certification management unit 160 detects and outputs authentication information of the first authority from the authority certification database 110 when the specific authority corresponds to the first authority.

The third party certification manager 170 detects and outputs authentication information of the second authority from the mutual authentication database 120 when the specific authority corresponds to the second authority.

The multiple authentication search unit 180 detects and outputs authentication information of the third institution in the multiple authentication database 130. When the third authority is detected, the multi-authentication searching unit 180 stores the authentication information of the third authority in the mutual authentication database 120. In other words, the third institution is treated as a second institution mutually certified by the first institution.

The authentication result processing unit 190 receives the authentication information of the first organization from the authority certification management unit 160, and permits an authentication request for the first device of the specific device. In addition, the authentication result processing unit 190 receives the authentication information of the second organization from the other institution authentication management unit 170, and permits the authentication request for the first device of the specific device. In addition, the authentication result processing unit 190. Receives the authentication information of the third organization from the multi-authentication search unit 180, and permits the communication request of the first device to the specific device.

As described above, the mutual authentication method between devices of the intelligent metering infrastructure according to the present invention and the server used therein are not limited to the configuration and method of the embodiments described as described above. All or part of each of the embodiments may be selectively combined to be implemented.

100; Mutual authentication server between devices in the intelligent metering infrastructure
110; Organization Certification Database
120; Mutual Authentication Database
130; Multi-authentication database
140; Authentication request receiver
150; Certification information comparison department
160; Approved Authority Certification Department
170; Third Party Certification
180; Multi-authentication search part
190; Authentication result processing unit

Claims (10)

Authenticating, by a first authority, a first device possessed by said first authority, and authenticating, by a second authority, a second device possessed by said second authority;
Requesting mutual authentication by the first device and the second device;
Confirming, by the first device, whether or not the first organization is authenticated to the second institution, and by the second device, whether or not the second institution is authenticated to the first institution; And
Determining whether the first device and the second device are in communication according to whether the first organization is authenticated to the second organization and the second organization is authenticated to the first organization. A method of mutual authentication between devices in an intelligent meter infrastructure. The method according to claim 1,
If the certification for the second authority of the first authority and the certification for the first authority of the second authority are not confirmed,
Determining whether there is a third authority which mutually authenticates with the first authority and mutually authenticates with the second authority;
The third institution providing authentication information of the second authority to the first authority, and the third authority providing authentication information of the first authority to the second authority;
The first authority injecting authentication information of the second authority into the first device, and the second authority injecting authentication information of the first authority into the second device; And
And mutually communicating the first device and the second device with each other. The method according to claim 2,
Authentication information of the second authority is provided to the first authority by the third authority, and authentication information of the first authority is provided to the second authority,
The first authority and the second authority further comprises the step of authenticating each other mutual authentication method between devices of the intelligent meter reading infrastructure. The method according to claim 1,
When the certification of the first authority of the first authority and the certification of the first authority of the second authority are confirmed,
And mutually communicating the first device and the second device with each other. The method of claim 4,
And the first institution injects authentication information of the second institution into the first device, and the second institution further includes injecting authentication information of the first authority into the second device. Method of mutual authentication between devices in the intelligent metering infrastructure. An authentication request receiving unit for receiving a communication request from a specific device of a specific organization to a first device of the first organization;
A mutual authentication database storing authentication information of a second authority mutually authenticated by the first authority;
A third-party authentication manager that detects and outputs authentication information of the second authority in the mutual authentication database when the specific authority corresponds to the second authority; And
And an authentication result processor configured to receive authentication information of the second authority from the third party authentication management unit and determine whether to permit the authentication request for the first device of the specific device. Mutual authentication server. The method of claim 6,
A multi-authentication database which stores authentication information for a third authority which mutually authenticates with the specific authority and mutually authenticates with the first authority; And
Further comprising a multi-authentication search unit for detecting and outputting the authentication information of the third organization in the multi-authentication database,
The authentication result processing unit receives the authentication information of the third organization, the mutual authentication server between devices of the intelligent meter reading infrastructure, characterized in that to permit the communication request of the first device to the specific device of the specific organization. The method according to claim 7,
The multi-authentication search unit
And the authentication information of the specific authority of the third authority is stored in the mutual authentication database as authentication information of the second authority. The method of claim 6,
A corresponding authority authentication database storing authentication information of the first authority for the first device; And
When the specific authority corresponds to the first authority, the corresponding authority authentication management unit for detecting and outputting the authentication information of the first authority in the corresponding authority authentication database, further comprising:
The authentication result processing unit receives authentication information of the first institution from the corresponding authority authentication management unit, and permits an authentication request for the first device of the specific device. . The method according to claim 7,
The mutual authentication database and the multi-authentication database are mutually authenticated between devices of the intelligent meter reading infrastructure, characterized in that the update is updated to reflect the authentication information of the organization to join and leave.

Images