KR20160006915A - The Management Method and Apparatus for the Internet of Things - Google Patents

Abstract

The present invention relates to an apparatus which analyzes traffic between a wide area network (WAN) interface and a local area network (LAN) interface, and determines a normal operation by using information on pattern data by device so as to improve a systematic management of users due to supply expansion of devices of Internet of things, and to solve problems of security weakness. Also, the apparatus of the present invention includes an application which can be remotely managed and controlled through a software of a smart device registered for management and correspondence in real time.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and apparatus for managing Internet objects,

The present invention relates to a technology for preventing the leakage of personal information due to hacking and the destruction of a device due to a virus infringement to devices having an Internet connection function spreading throughout the industry, And a technology for detecting a failure or the like and informing the user in real time.

Background arts related to the present invention include a packet monitoring and filtering technology used in the Internet network, a real time push messaging technology and a barcode / QR code recognition technology used in application software of a smart terminal.

Packet monitoring and filtering techniques are being used to analyze traffic in and out for purposes such as firewall and Internet billing.

Push messaging technology in smart terminals is used for message arrival notification in SNS (Social Networking Service) service, and is used for real time information notification of various services and the like.

Bar code / QR code recognition technology is widely used for logistics management in logistics systems. Recently, as the spread of smart terminals has expanded, services such as smart terminals have been widely used.

As described above, the technologies related to the present invention are currently being utilized as an infrastructure technology for providing various services, and the technology field to be constantly developed in the future.

The present invention aims at solving the vulnerability of IoT devices connected to the Internet network of individual users having poor management and security.

To this end, it is determined whether or not an abnormal operation is performed by recognizing and analyzing a data use characteristic pattern of each IoT devices. If it is determined that an abnormal operation is performed, the notification is notified to the user in real time. You want to remotely manage and control the device so that you can temporarily block the connection.

In order to achieve the object of the present invention, it is necessary to (1) port a Free OS over a hardware device having a Wide Area Network (WAN) interface and a LAN (Local Area Network) interface, (2) the abnormal operation of the internal devices is judged through the analyzed data, (3) the alarm is notified to the user in real time in case of abnormal operation, and (4) the data communication is interrupted when necessary. A control means is required.

The most important point in the present invention lies in how to determine whether or not an abnormal operation has occurred. In the case of the object Internet apparatus, the data pattern has a certain data pattern in use. The data pattern has characteristics such as data amount and transmission period for each uplink and downlink, By implementing the analysis algorithm, it is possible to minimize the damage by grasping the external intrusion in real time.

In order to achieve the above object, the present invention supports an initial registration function of various IoT devices connected to a device and a pattern analysis function based on measurement data of a predetermined time through an OS kernel based packet analysis, Provides application forms for information sharing and control functions.

Objects in the Internet management system consisting of a real-time management device that monitors, manages and controls Internet devices and Internet devices, a service server that maintains client connection information, and a client (application software) that manages user interfaces and Internet devices A method for managing an Internet device,

The service server

Receiving a service use registration request from a client, permitting service use registration through analysis of a unique identification code of a real-time management apparatus and registering a user ID;

Receiving periodical access information or registration information of the object Internet apparatus from the client and maintaining the same;

And providing the client access information when receiving the client access information request from the real-time management apparatus,

The client

The client requesting a service use registration request including a unique identification code of the real-time management apparatus to the service server;

Registering the object Internet device by providing the registration recognition code of the object Internet device to the real-time management device or the service server after the service registration;

Monitoring setting information including at least one of pattern information (use of the apparatus, data usage type), reporting period and time for object Internet devices, automatic traffic blocking at the occurrence of an abnormal symptom, or access blocking history, Storing in a server;

Periodically providing connection information to a service server to provide user connection information;

Receiving event information from the real-time management device and outputting the received event information to a user;

Requesting the real-time management device to request processing of the event information (confirmation of periodic reporting information, blocking of traffic for abnormal symptoms, connection permission, etc.);

/ RTI >

The real-time management device

Receiving pattern information from a client or a service server as a monitored object Internet device list and monitoring form;

Monitoring in real time the traffic of the objects to be monitored Internet devices;

Generating an event when an abnormal symptom occurs during real-time traffic monitoring or a periodic reporting time designated by the client;

Requesting client access information to a service server;

Transmitting event information generated according to client connection information provided from a service server to a client;

Receiving an event processing request from a client;

Performing an action according to the event processing request, and transmitting the processing details to a client;

Wherein the object Internet device management method comprises:

Through the present invention, the security vulnerability of the object Internet device (IoT device) is improved and the service reliability provided by the IoT device is improved.

There is an effect that the operation state of the current operation of the IoT device can be checked through the remote monitoring function.

In addition, the pattern analysis DB of the IoT devices of the present invention has an effect of supporting various types of supplementary services in addition to the original purpose.

1 is a system configuration diagram to which the present invention is applied.
FIG. 2 is a flowchart illustrating a method of using a service according to the present invention.

The present invention is not limited to the conventional corporate or public network security solutions, but various private-property Internet devices, such as personal information through malicious access to the attack, Management apparatus and method.

The functions supported by the present invention include a function of constructing a usage environment such as authentication, profiling, and interactive security setting for various object Internet devices, smart device and integrity security access technology for device control, network traffic analysis, Analysis response function.

Table 1 is a functional description of the object Internet security solution realizing the present invention.

1) Device authentication function: Existing security device has no functions and algorithms related to device identification / authentication / authority control, which makes it inconvenient to use and can not be efficiently managed and controlled. Accordingly, the present invention provides an authentication function using device authentication, ID / PW, MAC, and PKI standardization in progress using the object Internet authentication technology using QR Code, Bar code, NFC and the like.

2) Device profiling function: It analyzes the characteristics of each device constituting the Internet, and analyzes and analyzes the performance and functions of the device to provide a function to monitor and manage the device.

3) Interactive security setting function : It provides security threat warning and interlocking function using QR code, bar code, NFC, security setting using smart device app, and push notification technology for users who are unfamiliar with security equipment.

4) Data Integrity, Security Function : Provides integrity security function using IPSec function to secure data transmitted / received between Internet device and authenticated external device.

5) Network traffic analysis function : It manages network flow with objects internet, examines data stream, and classifies it according to type and target application. Also, it controls network performance and analyzes devices that generate traffic. And a function of securing security by controlling the access of the network of the abnormal operation device by finding a suspicious packet.

6) packet filtering (Packet filtering function: In the past , high-speed packet processing was performed by using a dedicated chip. However, in order to secure price competitiveness, a loadable kernel module type provides a packet filtering function that can be installed in the OS during the system boot process to provide wire speed throughput

7) IPv4 / IPv6 Conversion function: Provides IPv4 / IPv6 conversion function for IPv6 address-based Internet network interworking.

Item Item Small items Device authentication function Device Identification - Identification using QR Code, Bar code, NFC, ID - Identification using smartphone app Device authentication - ID / PW, MAC, encryption protocol, PKI, IBE authentication - Device-specific authentication scenario using XML - Authentication using standardized Internet authentication technology Device authorization control - Controlling service permissions by device Device profiling function Device Classification
- Analyze the characteristics of each device constituting the Internet of things - Classification by category and device Device Function / Performance Profiling
- Profiling of device performance, function analysis - Technology to monitor and manage devices Interactive security monitoring function Security settings - Security setting using SW OTP, QR code, Bar code, NFC, Smartphone app Security threat monitoring - Real-time security threat warning through SNS Messenger - Interlock function using smartphone app Data Integrity, Security Features Data Encryption - IPsec Network traffic analysis function Manage data flow - Checking the data stream - Classification by data flow type - Suspicious packet detection and control Packet filtering function Packet Filtering - Incoming packets are classified into Internet of things and general Internet traffic, and Bypass and Internet packets of general Internet are transmitted to the part of performing attack detection function. Block scan detection - External scan detection reporting and blocking IPv4 / IPv6 interworking function IPv4 / IPv6 address translation Dual stack support for devices with IPv6 addresses - Address translation technology for interworking with IPv4 network User application Indoor Device Management - QR code recognition function - DHCP table lookup and device mapping Device-specific traffic management - Upload / Download threshold setting - Action setting when threshold is exceeded Access user management - Access account management - Send alert to administrator's smartphone when unauthorized user access

The function of the security solution for the residential object Internet device to which the present invention is applied will be described as follows.

1. Device authentication function

The authentication technology of the real-time management device can be classified into device identification, device authentication, and device authority control functions.

(1) Device identification

It is a function to identify the object Internet device. It identifies the device through the QR Code, Bar code, NFC, ID included in the device, and extracts the identifier.

(2) Device authentication

It is a process of verifying the validity of the identity presented by the object Internet device through identification. It provides the following functions according to the authentication method by ID / PW, MAC, PKI authentication function as follows.

- ID / PW authentication: Function to respond to ID / PW authentication request by Internet device

- MAC Authentication: It provides the function to approve / deny the connection when requesting device network access by managing MAC-48, EUI-48, and EUI-64 device MAC addresses.

- PKI authentication: It provides certificate registration, deletion management function and digital signature based authentication function for devices with authentication method based on public key based digital signature.

(3) Device authorization control

The network service authority is defined for each authenticated device, and a function to control the network service authority when the operation is performed over a predetermined authority is provided.

2. Device profiling function

- Analyze the characteristics of each device class constituting the Internet

- Provides the function to recognize the abnormal operation of the device by specifying the function / performance of the device based on the analyzed profiling data of the device.

3. Interactive  Security monitoring function

- Device security setting: Provides QR code, Bar code, device registration and security setting function using NFC smartphone app.

- Device security monitoring: Registered smartphone app or SNS Messenger alerts real-time security threats such as device malfunction, network traffic, external scan, unauthorized access attempts, etc., and user can selectively handle security threats through feedback Function.

4. Data Integrity Security Features

- Provides IPSec function to ensure the integrity and security of data that may infringe privacy such as voice, image, and personal information.

- Provides the ability to encrypt and store log data to track data and device behavior from Internet devices, in the cloud or external storage.

5. Network traffic  Analysis function

And provides a function for identifying a communication protocol and a device for classifying all the traffic of the object Internet device by each flow and transmitting the packet to the network.

6. Packet Filtering Function

- Packet Filtering: to filter the incoming traffic from the network separates the public Internet packet and the Internet of Things Packet Common Internet packets Bypass and things Internet packets boot for high-speed processing performance with the ability to deliver network traffic analysis It is provided as a loadable module that can be loaded into the Linux OS.

- Scan Detection: Detects malicious TCP Connect, SYN, FIN, ACK, NULL, IDLE, and UDP scans from external attackers to find the object Internet attack targets, reports them, and blocks them according to user setting criteria.

7. IPv4 / IPv6  Interlock function

- Support IPv4 / IPv6 dual stack for IPv4 network interworking of Internet devices with IPv6 address and ID before the ISP subscriber network is switched from IPv4 network to IPv6 network.

- Supports both IPv4 / IPv6 protocols, so it can be set to IPv4 address and IPv6 address. It can acquire its IPv4 address by using IPv4 mechanism (eg DHCP), and obtain the corresponding IPv6-only address using IPv6 protocol mechanism. Function and IPv4 <-> IPv6 address interconversion technology.

8. For users APP  function

- In-house device management function: QR code recognition function, DHCP table inquiry and device mapping

- Device traffic management: upload / download threshold setting, action setting when threshold is exceeded

- Access user management: Access account management (issuing / modifying / deleting, etc.), sending alert to administrator's smart device software when unauthorized user access

The service solution according to the present invention is a security solution for the security of the in-house internet device, which comprises a real-time management device, application software for a user interface, and a service server.

FIG. 1 is a conceptual diagram of a service applied to a product manufactured by the present invention.

As shown in FIG. 1, there are a plurality of Internet devices (IoT devices: wearable devices, healthcare, notebook / tablet, desktop PC, smart TV, CCTV etc.) (Smart terminal, application installed on a smart phone, client) for controlling the device, and a service server (not shown in Fig. 1) for managing the service.

The real-time management device is capable of managing, monitoring, collecting and controlling the devices connected to various types of object Internet devices, and the software including the upgrade function considering the change of the usage environment and the change of the Internet device of the connection object .

① Customers purchasing a real-time management device connect their LAN line to the WAN port from the Internet provider they are using and connect to the modem or router of the company using LAN port. When the basic Internet connection is completed, ② the user installs the application software through the official application distribution application of smart terminal (Apple store, play store, etc.). (3) A unique identification number (QR code or Bar code, etc.) of the real-time management device is registered in the service server through the application, and the service use right is granted. (4) Afterwards, the user attaches the device registration recognition code (QR or Bar code) included in the purchase of the real-time management device to the IOT devices one by one and registers the attached code through the application software. At this time, the IOT device may be directly registered in the real-time management device, or may be registered in the service server and then transmitted to the real-time management device. Once you have registered all the necessary Internet devices, you will complete the basic configuration for using the service.

⑤ The user saves the basic pattern information (information of device usage and data usage type) of each device in the smart phone application for real-time management device and / or service server for profiling of registered devices . The stored pattern information is used by the real-time management device to determine whether the IoT device is infringing due to an abnormality or an external attack, and to transmit real-time notification information to the user application software. When the above operation is completed, the hardware connection and the software environment that can utilize the service provided by the present invention are all provided.

2 is a service procedure diagram in which a service is provided by the present invention. The objects appearing in the procedure are application software (client), service server, and real-time management device installed in the smart terminal.

A user who has purchased a device for use of the service downloads (10) the client (application software) provided by the service provider to the smart terminal owned by the user, using the distribution channel authorized for each terminal.

When the client installation is completed, the user requests the service use registration to the service server using the unique identification code (QR-code / bar code tag) attached to the real-time management device using the recognition function of the client (11) The unique ID code of the real-time management device sent from the terminal is analyzed and the user ID registration is completed (20). That is, since the real-time management device is essential for the object Internet management service (the service for monitoring, managing and controlling the object Internet), the user is authenticated and registered based on the unique ID code attached to the real-time management device.

After registering the service, the user attaches a device identification code (QR or Bar code) included in the real-time management device purchase to the held object Internet devices and registers the attached code in the real-time management device (30). Although not shown in the figure, the device registration registration code may be registered in the service server, and then the object Internet device registration information may be transmitted to the real-time management device.

The user connects the object Internet devices he or she owns with the real-time management device via a wired or wireless network (31).

Through the client, the object Internet device is searched and the network connection is confirmed (32)

(33) the pattern information (usage of the apparatus, data usage type, etc.) of the connected Internet devices, monitoring setting information on the reporting period and time are input through the client and stored in the real-time management device and / or the service server. Through the above process, the ID registration for the service use and the pattern information of the Internet devices of the accepting objects are inputted and the environment construction for the service use is completed.

When the environment setup for the service use is completed, the real-time management device monitors all the up / down traffic of the IoT devices in the network in real time (34)

The real-time management device generates event information (35) when an abnormal symptom occurs during real-time traffic monitoring or when it is a regular reporting time designated by the user. At this time, although not shown in the drawing, the client may include automatic action information in the monitoring setting information in advance, and automatically block traffic or block access without an intervention of a client in the event of an abnormal symptom.

When the event information is generated, the real-time management device requests user client access information to the service server (36).

The client of the user periodically provides the connection information to the service server (12) so that the service server can secure and confirm the user connection information in real time (21).

The real-time management device sends event information generated according to the user client access information secured from the service server (37).

The user confirms the transmitted event information to the client (13) and requests the real-time management device to process the related event (14). Examples of event handling requests include checking for periodic reporting information, blocking traffic for abnormal symptoms, or allowing access.

The real-time management device receiving the event processing request processes the related request and transmits the processing details to the user's client through a push message in real time (38).

The user client can access the real-time management device at any time and anywhere through provision of periodical access information, and the connection between the client and the real-time management device prevents another security problem through security access using IPSec.

As described above, the object Internet apparatus can be managed by the client, the service server, and the real-time management apparatus, but the object Internet apparatus can be managed by only the client and the real-time management apparatus. In this case, the client makes a request to the real-time management device for a list of object Internet devices to be monitored, pattern information of monitoring type, reporting period and time of the event information, automatic processing information upon occurrence of an abnormal symptom during real- .

Claims (1)

Objects in the Internet management system consisting of a real-time management device that monitors, manages and controls Internet devices and Internet devices, a service server that maintains client connection information, and a client (application software) that manages user interfaces and Internet devices A method for managing an Internet device,
The service server
Receiving a service use registration request from a client, permitting service use registration through analysis of a unique identification code of a real-time management apparatus and registering a user ID;
Receiving periodical access information or registration information of the object Internet apparatus from the client and maintaining the same;
And providing the client access information when receiving the client access information request from the real-time management apparatus,
The client
The client requesting a service use registration request including a unique identification code of the real-time management apparatus to the service server;
Registering the object Internet device by providing the registration recognition code of the object Internet device to the real-time management device or the service server after the service registration;
Monitoring setting information including at least one of pattern information (use of the apparatus, data usage type), reporting period and time for object Internet devices, automatic traffic blocking at the occurrence of an abnormal symptom, or access blocking history, Storing in a server;
Periodically providing connection information to a service server to provide user connection information;
Receiving event information from the real-time management device and outputting the received event information to a user;
Requesting the real-time management device to request processing of the event information (confirmation of periodic reporting information, blocking of traffic for abnormal symptoms, connection permission, etc.);
/ RTI &gt;
The real-time management device
Receiving pattern information from a client or a service server as a monitored object Internet device list and monitoring form;
Monitoring in real time the traffic of the objects to be monitored Internet devices;
Generating an event when an abnormal symptom occurs during real-time traffic monitoring or a periodic reporting time designated by the client;
Requesting client access information to a service server;
Transmitting event information generated according to client connection information provided from a service server to a client;
Receiving an event processing request from a client;
Performing an action according to the event processing request, and transmitting the processing details to a client;
Wherein the object Internet device management method comprises:

Images