KR20180116878A - DYNAMIC ACCESS CONTROL SYSTEM AND METHOD FOR IoT SECURITY USING THE DETECTION OF FABRICATION AND MODIFICATION - Google Patents

Abstract

The present invention relates to a dynamic access controlling system for IoT security using forgery/alteration detection and a method thereof. According to one embodiment of the present invention, the dynamic controlling system for IoT security using forgery/alteration detection comprises: an IoT data collecting unit (DCU) extracting a DNA code which is forgery/alteration detection information of a terminal; an IoT security management server performing forgery/alteration detection and verification of the terminal by comparing the DNA code with a previously registered DNA code according to an authentication request of the DNA code; and an IoT security G/W connecting an IPSec G/W and a IPSec VPN tunnel in a state in which application data can be transferred according to the authentication result of the DNA code.

Description

TECHNICAL FIELD [0001] The present invention relates to a dynamic access control system for IoT security using forgery-and-

The present invention relates to a dynamic access control system for IoT security using forgery detection, and more particularly to a dynamic access control system for IoT security and a method for detecting dynamic access control of a terminal through connection of an IPSec VPN tunnel by extracting and comparing DNA codes, And more particularly to a dynamic access control system and method for IoT security using forgery detection to provide an IOT service that is safe from an external attack.

The Internet evolved into the Internet of Things (IoT) network (hereinafter referred to as "IoT"), which exchanges information among distributed components such as objects in a human-centered network where humans generate and consume information. .

In order to implement IoT, technology elements such as sensing technology, wired / wireless communication, network infrastructure, service interface technology and security technology are required. In recent years, sensor network, machine to machine , M2M), and MTC (Machine Type Communication).

In the IoT environment, as the number of IoT devices increases, a countermeasure against the security threat of the IoT service is required. These requirements relate to network isolation through virtual private networks, end-to-end IP layer encryption and integrated authentication, network-level access control, and terminal security for firmware tampering detection.

The response to these requirements has been in the form of preventing or tracking attacks through firewalls or simple intrusion detection systems. In this case, in the IoT environment, a built-in intrusion detection system such as a firewall is built in order to prevent forgery and falsification. However, if the intruder succeeds in detecting an illegal intrusion by a hacker, It is difficult to do.

In this regard, Korean Patent Publication No. 2011-0117799 (a method for preventing forgery of parameters and a terminal for carrying out the method), a specific application can determine whether a parameter received from another application is falsified or altered A technique has been disclosed for providing a judgment on the user.

Therefore, in the IoT environment, it is necessary to propose an environment that can be safely blocked from external hacking and attack threats through dynamic access control.

Korean Patent Publication No. 10-2011-0117799

It is an object of the present invention to provide a method and a system for performing dynamic access control of a terminal through connection of an IPSec VPN tunnel by extracting and comparing DNA codes that are forgery- A dynamic access control system for IoT security and a method thereof.

The dynamic access control system for IoT security using forgery detection according to an embodiment of the present invention includes an IoT DCU (Data Collecting Unit) for extracting DNA code which is forgery detection information of a terminal; An IoT security management server for performing forgery detection and verification of the terminal by comparing it with previously registered DNA code according to an authentication request of the DNA code; And an IoT security G / W for connecting the IPSec G / W and the IPSec VPN tunnel in a state where the application data can be transferred according to the result of the authentication of the DNA code.

The IoT DCU may be coupled to one or more IoT devices within the IoT device network to collect and transmit data.

The IoT DCU may include a security posture agent (SPA) for extracting the DNA code of the terminal.

The security forcourse agent may generate the DNA code by collecting and extracting unique information of the system file of the terminal on the basis of binary hashing.

The IoT security G / W may be connected to the IPSec G / W and the IPSec VPN tunnel in a state where application data transmission of the terminal is blocked at the time of initial connection.

The IoT security G / W can perform dynamic access control through connection or disconnection setting for each IP address of the IoT DCU.

The IoT security G / W can perform dynamic access control using a rule parameter.

Meanwhile, a dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention includes extracting a DNA code that is falsification detection information of the terminal when the terminal requests a connection; Performing a forgery detection and verification of the terminal by comparing the DNA code with a previously registered DNA code according to an authentication request of the DNA code; And connecting the IPSec VPN tunnel in a state in which application data can be transferred according to the authentication result of the DNA code.

The performing step may connect the IPSec VPN tunnel with the application data transmission blocked.

The dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention may further include periodically extracting a DNA code of the terminal after the connection step and comparing the DNA code with the previously registered DNA code; As shown in FIG.

Also, the dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention checks whether there is application change information when the service is completed, The method comprising the steps of:

The dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention may further include performing an update on the pre-registered DNA code after the update progress step .

The extracting step may collect and extract unique information of the system file of the terminal based on binary hashing to generate the DNA code.

The present invention extracts and compares DNA codes, which are forgery detection information of a terminal, and performs dynamic access control of a terminal through connection of an IPSec VPN tunnel, thereby providing a secure IOT service from an external attack.

In addition, the present invention can provide a secure connection path through firmware forgery / fake correspondence, mutual authentication, and provide network level access control.

1 illustrates a dynamic access control system for IoT security using forgery detection according to an embodiment of the present invention;
2 is a diagram illustrating a dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention;
FIG. 3 illustrates a process of terminating the IPSec VPN tunnel of FIG. 2 after connection.

For a better understanding of the present invention, a preferred embodiment of the present invention will be described with reference to the accompanying drawings. The embodiments of the present invention may be modified into various forms, and the scope of the present invention should not be construed as being limited to the embodiments described in detail below. The present embodiments are provided to enable those skilled in the art to more fully understand the present invention. Therefore, the shapes and the like of the elements in the drawings can be exaggeratedly expressed to emphasize a clearer description. It should be noted that in the drawings, the same members are denoted by the same reference numerals. Detailed descriptions of well-known functions and constructions which may be unnecessarily obscured by the gist of the present invention are omitted.

1 is a diagram illustrating a dynamic access control system for IoT security using forgery detection according to an embodiment of the present invention.

1, a dynamic access control system (hereinafter, referred to as "dynamic access control system") 100 for IoT security using forgery detection according to an embodiment of the present invention includes IoT For providing the service, it can provide firmware forgery and falsification for security enhancement, secure connection through mutual authentication, and network level access control.

The dynamic access control system 100 can provide an IoT network security solution in a heterogeneous network environment between the IoT device 10 located in the IoT device network environment and the IoT server 20 located in the IoT service network environment. That is, the dynamic access control system 100 detects and verifies the forgery and tampering of the firmware of the terminal 150 to secure the integrity of the terminal 150 connected through the wired / wireless communication network.

The terminal 150 is connected through a wired / wireless network and can be installed in any type of device capable of installing wired / wireless communication, for example, a smart phone, a tablet computer, a wearable device, a desktop computer, .

The IoT device 10 includes a CCTV, a thermal sensor, a door knock sensor, a temperature controller, a water level detector, a septic tank sensor, a gas meter, a smart meter, and a water meter. The IoT server 20 collects various data transmitted from the IoT device 10 and provides the IoT service.

The dynamic access control system 100 includes an IoT DCU 110, an IoT security G / W 120, an IPSec G / W 130, and an IoT security management server 140.

The IoT DCU (Data Collecting Unit) 110 is connected to one or more IoT devices 10 in the IoT device network to perform data collection and transmission functions. Here, the IoT device network may include a plurality of IoT DCUs 110 connected to and managed by one or more IoT devices 10.

In particular, the IoT DCU 110 generates a security posture agent (SPA) for extracting the DNA code of the terminal 150 as forgery detection information to perform forgery detection on the terminal 150 Quot;). As described above, the SPA is provided in the IoT DCU 110 located at the endpoint managing the IoT device 10, thereby enabling forgery detection and verification of the terminal 150 at the terminal.

The SPA extracts a DNA code unique to the terminal 150 based on the binary hashing of the terminal 150. At this time, the SPA collects and extracts unique information (e.g., file name, last modified date, size, authority, path, file hash value, etc.) of the system file from the terminal 150 to generate a DNA code.

Accordingly, the IoT security management server 140, which will be described later, compares the previously registered DNA code with the DNA code of the extracted terminal 150 to control the network access when the terminal 150 is contaminated.

The IoT security G / W 120 and the IPSec G / W 130 function as a gateway for securing a secure connection path by interconnecting heterogeneous network environments between the IoT device network and the IoT service network.

For this purpose, the IoT security G / W 120 and the IPSec G / W 130 are configured to communicate with each other while maintaining the security state between the IoT device network and the IoT service network through the Internet, which is a public network, To establish a virtual private network (VPN) to secure mutual connection paths. The IPSec G / W 130 corresponds to a commercial gateway provided with an infrastructure for building a virtual private network.

At this time, the IoT security G / W 120 and the IPSec G / W 130 apply the encryption technology and the tunneling technology in the communication between the IoT device network and the IoT service network.

First, encryption technology encrypts data before transmitting data on the transmitting side and decrypts the encrypted data on the receiving side when data is exchanged between the IoT device network and the IoT service network via the Internet.

For example, the encryption technology may be applied to DES (Data Encryption Standard), Triple-DES, RC4 / 5, AES (Advanced Encryption Standard), CAST, and SEED.

Next, the tunneling technology enables data transmission / reception between the IoT device network and the IoT service network as a dedicated line through a virtual security tunnel on the Internet.

For example, the tunneling technology can be applied to Internet Protocol Security (IPSec), Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), Layer 2 Forwarding It is preferable to use an IPSec technology that specifies a method for encrypting the data.

As described above, the IoT security gateway 120 and the IPSec gateway 130 form an 'IPSec VPN tunnel' to secure a secure connection path.

In the initial connection, the IPSec VPN tunnel is connected to the IOT security G / W 120 and the IPSec G / W 130 in a state where transmission of application data (i.e., App data) of the terminal 150 is blocked.

Thereafter, the IoT security G / W 120 requests authentication to the IoT security management server 140 using the DNA code of the terminal 150 transmitted from the IoT DCU 110, According to the result of the authentication, it is possible to connect the application data of the IPSec VPN tunnel to be able to transmit data, or to block the IPSec VPN tunnel. As the DNA code of the terminal 150 is extracted and forged and detected and verified, the terminal 150 is dynamically controlled in order to secure integrity for using the IoT service.

Here, the IPSec G / W 130 may request authentication of the terminal 150 to the IoT security management server 140 instead of the IoT security gateway 120. However, considering that it is a commercial gateway, It is preferable that the IoT security G / W 120, which is easy to install the solution, requests authentication of the terminal 150 to the IoT security management server 140 as described above.

In addition, since the IoT security G / W 120 collectively manages the plurality of IoT DCUs 110, each of the plurality of IoT DCUs 110 requests the IoT security management server 140 to authenticate the terminal 150 The IoT security G / W 120 requests authentication of the terminal 150 to the IoT security management server 140 as described above.

Meanwhile, the IoT security G / W 120 performs dynamic access control using the 'rule' parameter as shown in Table 1 below. That is, the IOT security G / W 120 performs dynamic access control through connection or disconnection setting for each IP address of the IoT DCU 110.

<rule to-tunnel = "host-to-host">
<src> ipv4 (172.30.4.251) </ src>
<dst> ipv4 (172.30.4.250) </ dst>
</ rule>

<rule from-tunnel = "host-to-host">
<src> ipv4 (172.30.4.250) </ src>
<dst> ipv4 (172.30.4.251) </ dst>
</ rule>

<rule>
<src> ipv4 (0.0.0.0/0) </ src>
<dst> ipv4 (0.0.0.0/0) </ dst>
</ rule>

The IoT security management server 140 authenticates the DNA code authentication request of the IoT security G / W 120 and transmits a dynamic access control command to the IoT security G / W 120. At this time, the IoT security management server 140 compares the previously registered DNA code with the DNA code transmitted from the IoT security G / W 120 to detect whether the terminal 150 is forged or not.

The IOT security G / W 120 performs dynamic access control for the terminal 150 according to the dynamic access control command transmitted from the IoT security management server 140.

To this end, the IoT security management server 140 registers and manages security information for each terminal 150.

Specifically, the IoT security management server 140 collects and manages the DNA code of the terminal 150 through the IoT security G / W 120. At this time, the IoT security management server 140 also manages the update information of the DNA code after registering the DNA code of the terminal 10.

The IoT security management server 140 receives the access log of the connection setup of the IPSec VPN tunnel and the blocking setting of the IPSec VPN tunnel as the log data of the dynamic access control result of the terminal 150 And manages the error log (error log).

In addition, the IOT security management server 140 manages terminal and network connection information. Herein, the terminal and network connection information includes information such as OS version information of the terminal 150 in which the application is installed, information on the current access point of the logged-in terminal 150, a host name and the like, , Directory information such as a window system directory, network interface information that is activated or deactivated, and the like.

The IoT security management server 140 manages application information provided to the terminal 150 through the IoT service network. Here, the application information is managed in the form of a package, and includes a policy related to the application information.

2 is a diagram illustrating a dynamic access control method for IoT security using forgery detection according to an embodiment of the present invention.

First, the IoT security management server 140 registers terminal and access information with respect to the terminal 150, and registers the DNA code extracted by the IoT DCU 110 (S201).

The IPSec GW 130 connects the IPSec VPN tunnel with the IoT security gateway 120 in a state that the App data transmission is blocked (S203) when the terminal 150 requests connection (S202). At this time, the IoT DCU 110 extracts the DNA code of the terminal 150 and provides it to the IoT security G / W 120 (S204).

Thereafter, the IOT security G / W 120 requests the IoT security management server 140 to authenticate the DNA code of the terminal 150 (S205).

Then, the IoT security management server 140 compares the predetermined DNA code with the DNA code transmitted from the IoT security G / W 120 to detect and verify whether the terminal 150 has been tampered with (S206).

The IPSec GW 130 operates as follows with the IOT security G / W 120 according to the authentication result returned from the IOT security management server 140 (S207, S208).

If the authentication succeeds (S208), the IPSec G / W 130 connects the IPSec VPN tunnel with the IoT security G / W 120 in a state where App data transmission is possible (S209). At this time, the IoT device 10 and the IoT server 20 become mutually capable of IoT data transmission / reception, and the terminal 150 can access the IoT network through dynamic access control.

On the other hand, if the IPSec GW 130 fails to authenticate (S208), the IPSec VPN gateway 130 closes the IPSec VPN tunnel by blocking the IoT security gateway 120 and the IPSec VPN tunnel.

FIG. 3 illustrates a process of terminating the IPSec VPN tunnel of FIG. 2 after connection.

The IoT DCU 110 extracts the DNA code of the terminal 150 every predetermined period and provides it to the IoT security G / W 120 (S251, S252). At this time, the IOT security G / W 120 periodically requests the IoT security management server 140 to compare the DNA code of the terminal 150 (S253).

Thereafter, the IOT security management server 140 compares the previously registered DNA code with the DNA code transmitted from the IoT security G / W 120 (S254). At this time, the IoT security management server 140 confirms whether the comparison result of the DNA code is identical and the service is terminated (S254, S255), and whether there is change information in the application (S256). Here, the IoT security management server 140 performs the process after step S252 again if the comparison result of the DNA code is consistent and the service is in progress (S254, S255). If the comparison result of the DNA code does not match (S254), the IoT security management server 140 terminates the connection of the IPSec VPN tunnel through the IPSec G / W 130 (S262).

Meanwhile, if there is change information in the application (S256), the IOT security management server 140 requests update of the application of the terminal 150 through the IOT security G / W 120 (S257, S258).

Thereafter, the IoT DCU 110 extracts the DNA code of the terminal 150 and provides it to the IoT security G / W 120 (S259) after updating the application of the terminal 150 (S258). At this time, the IOT security G / W 120 requests the IoT security management server 140 to update the DNA code (S260).

When the IoT security management server 140 updates the DNA code (S261), the IoT security G / W 120 and the IPSec G / W 130 terminate the connection of the IPSec VPN tunnel (S262).

It will be apparent to those skilled in the art that various modifications and equivalent arrangements may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Accordingly, it is to be understood that the present invention is not limited to the above-described embodiments. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims. It is also to be understood that the invention includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

10: IoT device 20: IoT server
110: IoT DCU 120: IoT security G / W
130: IPSec G / W 140: IoT security management server
150: terminal

Claims (13)

An IoT DCU (Data Collecting Unit) for extracting a DNA code which is information on forgery detection of the terminal;
An IoT security management server for performing forgery detection and verification of the terminal by comparing it with previously registered DNA code according to an authentication request of the DNA code; And
An IoT security G / W for connecting the IPSec G / W and the IPSec VPN tunnel in a state in which the application data can be transferred according to the authentication result of the DNA code;
A dynamic access control system for IoT security using forgery detection.
The method according to claim 1,
The IoT DCU includes:
IoT device Dynamic access control system for IoT security using forgery detection to collect and transmit data connected to one or more IoT devices in the network.
The method according to claim 1,
The IoT DCU includes:
And a security posture agent (SPA) for extracting a DNA code of the terminal. The dynamic access control system for IoT security using forgery detection is provided.
The method of claim 3,
The security posture agent includes:
A dynamic access control system for IoT security using forgery detection in which unique information of the system file of the terminal is collected and extracted based on binary hashing to generate the DNA code.
The method according to claim 1,
The IoT security G / W includes:
A dynamic access control system for IoT security using forgery detection in which the IPSec G / W and an IPSec VPN tunnel are connected in a state in which application data transmission of the terminal is blocked at an initial connection.
The method according to claim 1,
The IoT security G / W includes:
A dynamic access control system for IoT security using forgery detection to perform dynamic access control through connection or disconnection setting for each IP address of the IoT DCU.
The method according to claim 1,
The IoT security G / W is a dynamic access control system for IoT security using forgery detection that performs dynamic access control using rule parameters.
Extracting a DNA code, which is falsification detection information of the terminal, when the terminal makes a connection request;
Performing a forgery detection and verification of the terminal by comparing the DNA code with a previously registered DNA code according to an authentication request of the DNA code; And
Connecting an IPSec VPN tunnel in a state in which application data can be transferred according to an authentication result of the DNA code;
A dynamic access control method for IoT security using forgery detection.
9. The method of claim 8,
Wherein the performing step comprises:
A dynamic access control method for IoT security using forgery detection to connect IPSec VPN tunnels with application data transmission blocked.
9. The method of claim 8,
Extracting a DNA code of the terminal periodically and comparing the extracted DNA code with the previously registered DNA code;
A dynamic access control method for IoT security using forgery detection.
11. The method of claim 10,
Checking whether there is application change information when the service is completed, and proceeding to update the application of the terminal;
A dynamic access control method for IoT security using forgery detection.
12. The method of claim 11,
Performing an update on the pre-registered DNA code after the update progress step;
A dynamic access control method for IoT security using forgery detection.
9. The method of claim 8,
Wherein the extracting step comprises:
A dynamic access control method for IoT security using forgery detection, wherein the DNA code is generated by collecting and extracting unique information of a system file of the terminal based on binary hashing.

Images