KR20210094320A - System and method for vulnerability check of Internet of Things terminal for a smart factory - Google Patents

Abstract

The present invention relates to a system and a method for checking the vulnerability of an Internet of things (IoT) terminal for a smart factory, which checks the vulnerability of an IoT terminal used in a smart factory environment. The system collects the version and information of an operating system (OS) and firmware of a terminal, identifies the existence of vulnerabilities in an IoT terminal to be checked on the basis of the collected version and information and worldwide standard vulnerability code (CVE) information, and provides what vulnerabilities are present if vulnerabilities are present, thereby inducing a smart factory-built enterprise user with insufficient security experience or resources to take action against security vulnerabilities. The system comprises a vulnerability retrieval unit for checking vulnerabilities and outputting whether vulnerabilities are present.

Description

System and method for vulnerability check of Internet of Things terminal for a smart factory

The present invention relates to a system and method for checking vulnerabilities of IoT terminals for a smart factory, and more particularly, by convergence with information and communication technology (ICT) and production and manufacturing technology, which is an existing manufacturing technology, equipment and device parts in the factory are connected to each other It relates to a vulnerability inspection system and method for IoT terminals for a smart factory that can check the vulnerabilities of IoT terminals used in a smart factory environment, which is a production system that is created and communicated with each other.

Recently, the wind of manufacturing innovation around the world is strong and at the center of it is smart factory technology. Smart factory is a factory where the entire process of assembling, packaging, and inspecting machines is automatically performed. It is considered to be the core of the 4th industrial revolution, the next-generation industrial revolution achieved through convergence. In a smart factory, since all facilities and devices are connected by wireless communication, the entire process can be monitored and analyzed in real time. Smart Factory attaches Internet of Things (IoT) terminals and cameras throughout the factory to collect data, store it on a platform, and analyze it. AI detects and controls the entire process.

Despite the rapid growth of the IoT technology field, security technology in the Internet of Things environment is still in its infancy. In particular, in the case of IoT systems of SMEs without an information security officer, it is very difficult for general users to recognize external attacks, and even if they do, important information has already been leaked in most cases.

Cloud computing-based services provide users with Internet-based resources, software, and information infrastructure in the form of services. It refers to a form of distribution of cloud computing-based software that is distributed and available for use. In other words, cloud computing is a computing method in which users borrow and use IT resources (software, storage, server, network, etc.) These cloud computing-based services distribute and virtualize a large amount of computer resources and provide them to each user (or users). There are advantages to receiving services through

Therefore, as described above, despite the development of the network environment, many security threats and security requirements for IoT terminals used in the smart factory environment occur. Because it is difficult to solve security problems, analysis of security vulnerabilities is required.

Republic of Korea Patent No. 10-1915236 (2018.10.30.)

An object of the present invention is to solve the above problems, and it is a cloud (SaaS) based security service without the need for installing a separate application program. It is to provide a system and method for checking vulnerabilities of IoT terminals for smart factories that can check vulnerabilities.

Objects of the present invention are not limited to the objects mentioned above, and other objects not mentioned will be clearly understood by those of ordinary skill in the art from the following description.

In order to achieve the above object, an IoT terminal vulnerability inspection system for a smart factory according to the present invention is a system for inspecting the vulnerabilities of an IoT terminal used in a smart factory, and an IP which is an inspection target received from a user terminal through the Internet environment. (Internet protocol) A network search unit for identifying the detailed IP address used in the lower part of the address, and a port search unit for collecting open and closed port information based on the detailed IP address information received from the network search unit , an information inquiry unit for identifying which services are externally provided using a banner grabbing technology based on the port information received from the port search unit, and information received from the port search unit and the information inquiry unit Vulnerability check is performed through 1:1 matching with a large number of standard vulnerability codes (CVE, Common Vulnerabilities and Exposures) based on these data, and it is characterized by including a vulnerability inquiry unit that outputs whether vulnerabilities exist in the process.

In addition, the user terminal transmits the IP address used by the user's Internet of Things terminal, which needs to be checked for vulnerability, to the network search unit through the Internet environment, and the vulnerability inquiry unit transmits the vulnerability information found through the vulnerability inquiry unit to the Internet environment. It is characterized in that it is transmitted to the user terminal through

In addition, it is characterized in that it further comprises a hardware tool that is connected to the Internet environment used by the IoT terminal to check the vulnerability and transmits the IP address to be checked to the network search unit without a separate input from the user terminal.

In addition, it characterized in that it further comprises an information DB for receiving and storing the identified information including the network, port, location, operating system and firmware of the IoT terminal for which the vulnerability is to be checked from the port search unit and the information inquiry unit. do.

In addition, it characterized in that it further comprises a system banner DB for storing information of the terminal, including the type and version of the operating system for identifying the information of the terminal to be inspected.

In addition, the vulnerability DB for storing vulnerability information including standard vulnerability codes (CVE, Common Vulnerabilities and Exposures) and information corresponding to standard vulnerability codes (severity, vulnerable software version, corresponding vulnerability information, references, etc.) characterized in that

In addition, the network search unit may inquire the IP address of the inspection target terminal by interworking with the global IP address management organization system based on the IP address of the inspection target terminal received from the user terminal, and through this, include countries and cities It is characterized in that the location information can be grasped.

In addition, the information inquiry unit collects system information of the terminal including the type and version of the operating system and the Internet connection state through banner grabbing technology, and identifies the collected system information and the system banner DB through comparison It is characterized in that it acquires the information of the terminal to be inspected including the possible operating system, version, type, and Internet connection status.

In addition, the information inquiry unit sends a request to the check target terminal for identification of the operating system version and type, and can additionally identify the operating system version and type by calculating the packet data arrival time (TTL) until the response. characterized by having

According to another aspect of the present invention, a method for checking vulnerabilities of an Internet of Things terminal for a smart factory is a method of checking a vulnerability of an Internet of Things terminal used in a smart factory, by receiving an IP address used by a terminal to be checked from a user terminal After passing through the inspection target selection step of delivering to the network search unit through the Internet environment, the location information collection step of identifying location information including the country and city corresponding to the IP address input from the network search unit, and the location information collection step A network search step of identifying the detailed IP address currently being used by the network search unit based on the IP address, and passing the detailed IP address in use to the port search unit, corresponding to the detailed IP address being used by the port search unit A port analysis step of confirming the port status and delivering the information to the information inquiry unit, an external service analysis stage of identifying a service provided to the outside based on the port information input from the information inquiry unit, and collection in the external service analysis stage Based on the information received from the vulnerability inquiry unit and the port service analysis stage, which identifies the terminal information including the operating system, version, and type through the information and system banner DB inquiry, and transmits the information to the vulnerability inquiry unit, the vulnerability check is performed. and includes a vulnerability inquiry step of outputting whether a vulnerability exists or not.

In addition, in the inspection target selection step, a hardware tool is connected to the Internet environment used by the inspection target terminal for vulnerability inspection, and thus the inspection target terminal is selected without a separate input process for the inspection target IP address in the user terminal. Thus, it is characterized in that the IP address used by the terminal to be inspected can be transmitted to the network search unit.

In addition, the location information collection step is characterized in that the IP address input from the network search unit is linked with the global IP address management organization system to inquire the location information of the IP address of the terminal to be inspected.

In addition, the port analysis step includes a port search step of receiving the IP address in use identified in the network search step from the port search unit and collecting open port and closed port information based on the detailed IP address in use; and The method further comprises an external port analysis step of checking whether there is a port that provides a service to the outside or allows a direct connection among the port information collected in the port search step, and stores the network and port information of the corresponding port as an information DB. do it with

In addition, the external service analysis step is characterized in that based on the port information input from the information inquiry unit, which service is provided to the outside by using a banner grabbing (Banner Grabbing) technology.

In addition, the port service analysis step performs the update step of collecting and analyzing information generated due to port service misidentification through the system banner DB inquiry and updating the system banner DB, the update step, and system banner DB inquiry Port service information that is not identified through the reanalysis step to reduce errors due to misidentification and the vulnerability check including the operating system, version, type, and Internet connection status of the terminal that can be identified through the system banner DB inquiry. It characterized in that it further comprises an information collection step of storing the information in the information DB.

In addition, in the vulnerability inquiry step, the data (eg, network, port, location, operating system) of the information DB collected through the above steps is matched with a large amount of vulnerability codes corresponding to the data of the vulnerability DB through 1:1 matching. The first step of performing a vulnerability check, the second step of performing a vulnerability check by comparing all items in the vulnerability DB, not the vulnerability corresponding to the data, when a vulnerability cannot be found in the first step, and After performing the first check step or the second check step, it characterized in that it further comprises a result output step of outputting the detailed information on the vulnerability check and all information of the steps in a synthesis.

The IoT terminal vulnerability check system for a smart factory according to the present invention collects the Internet of Things terminal internal operating system (OS) and firmware version and information, and based on this, the world standard vulnerability code (Common Vulnerabilities and Exposures, hereinafter referred to as "CVE") Based on the information, it identifies the existence of security vulnerabilities in the IoT terminal to be inspected, and if there are vulnerabilities, provides information on the vulnerabilities, so that users of smart factory construction companies lacking security experience or resources can take various forms. It has the effect of inducing measures against vulnerabilities in the security of IoT terminals.

In addition, the IoT terminal vulnerability inspection system for a smart factory according to the present invention provides a security service based on a cloud (SaaS) that provides a software service on the web or online, so that the user can use the security service without installing a program directly on his or her computer. When you need it, it has the effect of being able to receive service through the Internet as soon as you need it.

1 is a block diagram of an Internet of Things (IoT) terminal vulnerability check system for a smart factory according to the present invention.
2 is a flowchart sequentially illustrating a method for checking vulnerabilities of an IoT terminal for a smart factory according to the present invention.

Advantages and features of the present invention, and methods of achieving them, will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the technical field to which the present invention belongs It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

Detailed contents for carrying out the present invention will be described in detail with reference to the accompanying drawings below. Regardless of the drawings, like reference numbers refer to like elements, and "and/or" includes each and every combination of one or more of the recited items.

The terminology used herein is for the purpose of describing the embodiments, and is not intended to limit the present invention. As used herein, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular.

1 is a block diagram of an IoT terminal vulnerability inspection system for a smart factory according to the present invention, and FIG. 2 is a flowchart sequentially illustrating a method for inspecting an IoT terminal vulnerability for a smart factory according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The Internet of Things terminal vulnerability inspection system for a smart factory according to an embodiment of the present invention is a web server (S), a network search unit 100, a port search unit 200, an information inquiry unit 300, a vulnerability inquiry unit ( 400 ), information DB 500 , system banner 600 , and vulnerability DB 700 .

The network search unit 100 receives the IP (Internet protocol, hereinafter referred to as "IP") address, which is an inspection target, received from the user terminal U through the Internet environment, through the web server S, and receives the IP address. Identify the detailed IP address currently used in the lower level, receive the detailed IP address from the network search unit 100 in the port search unit 200, and collect information on open and closed ports based on this do.

The information inquiry unit 300 receives the port information collected from the port search unit 200, and uses a banner grabbing technology based on the received port information to determine which services are provided to the outside. Thus, the vulnerability inquiry unit 400 receives the information collected from the port search unit 200 and the information inquiry unit 300, and based on this, a large amount of standard vulnerability codes (CVE, Common Vulnerabilities and Exposures) and The point is to perform a vulnerability check through 1:1 matching, and in this process, output the presence or absence of a vulnerability to the user terminal U to induce the user to take action corresponding to the vulnerability of the IoT terminal.

More specifically, first, the network search unit 100 receives the IP address of the IoT terminal to be inspected from the user terminal U through the Internet environment.

Here, the user terminal (U) is a terminal including a personal computer or a smart phone, such as a personal computer or office computer, and is the inspection target to the web server (S) through an application service operated in a cloud (SaaS) environment The IP address of the IoT terminal is transmitted, and the IP address of the IoT terminal is transmitted from the web server S to the network search unit 100 .

Software as a Service (hereinafter referred to as "SaaS") refers to an application service operated in a cloud environment.

SaaS can be used anywhere, when you need it, you pay for it, and there is no need to install software on your PC or corporate server.

Therefore, there is no need to spend money and time to install the software, and since the software is centrally managed, there is no need for users to upgrade or patch the software one by one.

In addition, in the user terminal U, the user may input the IP address of the inspection target through an application service (eg, web) and deliver the IP address of the inspection target to the network search unit 100, but The IP address of the inspection target is sent to the network search unit 100 by connecting a hardware tool to the Internet environment used by the IoT terminal and selecting the corresponding inspection target terminal on the application service without a separate input from the user terminal (U). can be transmitted.

Next, the network search unit 100 may inquire the IP address of the inspection target terminal by interworking with the global IP address management organization system based on the IP address of the inspection target terminal received from the user terminal (U), Through this, location information including countries and cities can be grasped.

IP address resources are allocated for each country around the world and can be used within the allocated resources.

In addition, the network search unit 100 performs a network search in order to identify detailed IP addresses used under a plurality of IP addresses based on the IP addresses of the terminals to be inspected.

The search range of the network search is limited to a total of 256.

The range that can be input to one IP address is 256, which is standardized as a worldwide standard.

As an embodiment of the network search, if a network search is performed for an IP address corresponding to 1.1.1.0, a network search from 1.1.1.0 to 1.1.1.255 is performed.

Therefore, only the currently used IP address is extracted separately, and the unused IP address is not checked when checking for vulnerabilities later, thereby preventing unnecessary resource waste.

Next, the port search unit 200 receives the detailed IP address currently used from the network search unit 100, and based on this, information about open ports and closed ports for the purpose of providing services and direct connection to the outside collect

If a service is provided to the outside or there is a port allowing a direct connection, the corresponding network information (eg, the currently used IP address) and the corresponding port information are stored in the information DB 500 .

The information DB 500 receives and stores the identified information including the network, port, location, operating system and firmware of the IoT terminal for which the vulnerability is to be checked from the port search unit 200 and the information inquiry unit 300 . It is a database that

Next, the information inquiry unit 300 receives port information that can be directly connected from the outside from the port search unit 200, and uses a banner grabbing technology based on the received port information to determine which service is available. Find out if it is provided externally.

The banner grabbing technology is a method of scanning system information through a notice displayed when a direct connection to various remote services is performed.

The information inquiry unit 300 collects system information of the terminal including an operating system type and version, and an Internet connection state through the banner grabbing technology, and collects the system information and the system banner DB 600 . Through the comparison of , information of the terminal to be inspected, including an identifiable operating system, version, type, and Internet connection state, is obtained and stored in the information DB 500 .

The information DB 500 configures and stores the information collected through the port search unit 200 and the information inquiry unit 300 as data in a form that can be compared with the vulnerability DB 700 .

The system banner DB 600 is a database in which terminal information is stored, including the type and version of the operating system for identifying information on the terminal to be inspected.

In addition, the information inquiry unit 300 sends a request to the check terminal T for identification of the operating system version and type, and calculates the packet data arrival time (TTL) until the response to determine the operating system version and the type. It is characterized by being able to additionally identify the type.

Next, the vulnerability inquiry unit 400 performs 1:1 matching with the vulnerability DB 700 based on the data of the information DB 500 collected by the port search unit 200 and the information inquiry unit 300 . Vulnerability check through

The vulnerability DB 700 is a vulnerability including standard vulnerability code (Common Vulnerabilities and Exposures, hereinafter referred to as "CVE") and information corresponding to the standard vulnerability code (severity, vulnerable software version, corresponding vulnerability information, references, etc.) A database in which information is stored.

When the contents corresponding to the data (network, port, location, operating system, etc.) of the information DB 500 are checked against the vulnerability DB 700, if a vulnerability is found, information about the corresponding vulnerability (severity, weak software version) , corresponding vulnerability information, references, etc.) is synthesized by the information performed by the user terminal (U) through the web server (S) and the result is outputted.

Accordingly, the IoT terminal vulnerability check system for the smart factory of the present invention, including the configuration as described above, is a system for checking the vulnerabilities of the IoT terminal used in the smart factory environment, and includes an operating system (OS) and firmware inside the terminal. It collects version and information, and based on this, it identifies the existence of vulnerabilities in the IoT terminal to be inspected based on the worldwide standard vulnerability code (CVE) information, and if there are vulnerabilities, it provides what vulnerabilities there are to provide information on security. It induces security vulnerability measures of smart factory construction enterprise users who lack experience or resources.

Next, a method for checking vulnerabilities of IoT terminals for a smart factory according to an embodiment of the present invention having the above-described configuration will be described.

First, the inspection target selection step receives the IP address used by the inspection target terminal (Internet of Things terminals such as CCTV, IP camera, and router) from the user terminal (U) and delivers it to the network search unit 100 through the Internet environment. step (S10).

In addition, the inspection target selection step connects a hardware tool to the Internet environment used by the inspection target terminal for vulnerability inspection, so that the inspection target IP address is not separately inputted in the user terminal (U), and the corresponding inspection is performed. By selecting a target terminal, it is possible to transmit the IP address used by the target terminal to the network search unit 100 .

Next, the location information collection step is a step (S20) of identifying location information including the country and city corresponding to the IP address input from the network search unit 100 (S20).

In the location information collection step, the IP address input from the network search unit 100 is linked with the global IP address management organization system to inquire the location information of the IP address of the terminal to be inspected.

Next, after the location information collection step, the network search unit 100 determines the detailed IP address currently being used based on the IP address, and transfers the detailed IP address in use to the port search unit 200 It is a network search step (S30).

Next, the port analysis step is a step of confirming the port state corresponding to the detailed IP address being used by the port search unit 200 , and transmitting the corresponding information to the information inquiry unit 300 .

In the port analysis step, the port search unit 200 receives the IP address in use identified in the network search step and starts a port search, and information on open ports and closed ports based on the detailed IP address in use In the port search step (S40) of collecting It further includes an external port analysis step of storing (S60) the network and port information of the corresponding port as the information DB (500) when allowed.

If an IP address that does not provide a service from the outside or does not allow a direct connection cannot attempt an external hacking attack, it is determined that it is not subject to inspection (S190).

Next, the external service analysis step is a step of identifying a service provided to the outside based on the port information received from the information inquiry unit 300 .

In the external service analysis step, based on the port information input from the information inquiry unit 300, it is determined which service is provided to the outside by using a banner grabbing technology.

In the port service analysis step, through the information collected in the external service analysis step and the system banner DB 600 inquiry (S70), the terminal information including the operating system, version, and type is identified (S80), and the information is returned to the vulnerability inquiry unit. It is a step of forwarding to (400).

The port service analysis step is an update step (S100) of collecting and analyzing (S90) information generated due to port service non-identification through the system banner DB 600 inquiry (S70) and updating the system banner DB 600 (S100) And performing the update step (S100), the reanalysis step (S70) and the system banner DB (600) of re-analyzing the port service information that is not identified through the system banner DB 600 inquiry to reduce errors due to misidentification Collect information that can perform vulnerability check, including operating system, version, type, and Internet connection status of the terminal that can be identified through inquiry (S110), and combine network, port, location, operating system, and firmware information to create the information DB It further includes an information collection step of storing (S120) in (500).

In addition, in the step S110 of collecting information capable of performing the vulnerability check, the identification of the operating system, version, and type sends a request to the check terminal T, and packet data arrival time until response It is possible to identify the operating system, version, and type through (TTL) calculation.

In the step of storing (S120) the network, port, location, operating system, and firmware information in the information DB 500 in combination, the information collected while performing the above steps can be compared with the vulnerability DB 700 data. As shown in Table 1, it is configured and stored.

Next, the vulnerability inquiry step is a step of performing a vulnerability check based on information received from the vulnerability inquiry unit 400 ( S130 ), and outputting whether a vulnerability exists.

In the vulnerability inquiry step, the vulnerability check is performed by 1:1 matching the data of the information DB 500 collected through the above steps with a large amount of vulnerability codes corresponding to the data of the vulnerability DB 700 . If a vulnerability cannot be found in the secondary check step (S140) and the first check step (S140), the vulnerability check is performed by comparing it with all items in the vulnerability DB 700, not the vulnerability corresponding to the data (S160). After performing the secondary check step (S170) and the first check step (S140) or the second check step (S170), the detailed information on the vulnerability check and all information of the steps are synthesized and outputted. S180) is further included.

If a vulnerability is found in the first check step (S140), it is determined that there is a vulnerability, and a check step (S150) is performed for information that has not been checked for vulnerability due to technical reasons such as a system error or duplicate queue processing among the collected information.

If a vulnerability is found in the second check step (S170), it is determined that there is a vulnerability, but detailed information about the vulnerability item is provided, and if no vulnerability is found, it is determined that there is no vulnerability.

As described above, the IoT terminal vulnerability inspection system for a smart factory according to the present invention collects the internal operating system (OS) and firmware version and information of the IoT terminal, and based on this, the world standard vulnerability code (CVE) information It identifies the existence of security vulnerabilities in the IoT terminals to be inspected, and if there are vulnerabilities, provides information on the vulnerabilities, so that users of smart factory construction companies lacking security experience or resources can use various types of IoT terminals. It is possible to induce measures against vulnerabilities for security.

In addition, by providing cloud (SaaS)-based security services that provide software services on the web or online, when users need security services without installing programs directly on their computers, services can be provided through the Internet as soon as necessary. do.

Although the embodiments of the present invention have been described with reference to the above and the accompanying drawings, those of ordinary skill in the art to which the present invention pertains can practice the present invention in other specific forms without changing the technical spirit or essential features. You can understand that there is Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

U : User terminal S : Web server
T: check terminal 100: network search unit
200: port search unit 300: information inquiry unit
400: vulnerability inquiry unit 500: information DB
600: System banner DB 700: Vulnerability DB

Claims (16)

As a system to check the vulnerabilities of IoT terminals used in smart factories,
a network search unit for identifying a detailed IP address used in a lower level of an IP (Internet protocol) address, which is an inspection target, received from a user terminal through an Internet environment;
a port search unit for collecting open port and closed port information based on the detailed IP address information received from the network search unit;
an information inquiry unit for identifying which services are provided to the outside using a banner grabbing technology based on the port information received from the port search unit;
Based on the information received from the port search unit and the information inquiry unit, a vulnerability check is performed through 1:1 matching with a large number of standard vulnerability codes (CVE, Common Vulnerabilities and Exposures), and in this process, the presence of vulnerabilities is output. Internet of Things terminal vulnerability check system for smart factory, characterized in that it comprises a; vulnerability inquiry unit.
According to claim 1,
The user terminal transmits the IP address used by the user's Internet of Things terminal requiring vulnerability check to the network search unit through the Internet environment,
The vulnerability inquiry unit transmits the vulnerability information found through the vulnerability inquiry unit to the user terminal through the Internet environment.
According to claim 1,
For the smart factory, characterized in that it further comprises a hardware tool that is connected to the Internet environment used by the IoT terminal to check the vulnerability and transmits the IP address to be checked to the network search unit without a separate input from the user terminal. Internet of Things (IoT) terminal vulnerability inspection system.
According to claim 1,
Smart characterized in that it further comprises an information DB for receiving and storing the identified information including the network, port, location, operating system and firmware of the IoT terminal for which the vulnerability is to be checked from the port search unit and the information inquiry unit. Internet of Things (IoT) terminal vulnerability inspection system for factories.
According to claim 1,
Internet of Things terminal vulnerability check system for smart factory, characterized in that it further comprises a system banner DB in which information of the terminal is stored, including the type and version of the operating system for identifying the information of the terminal to be inspected.
According to claim 1,
It further comprises a vulnerability DB for storing vulnerability information including standard vulnerability codes (CVE, Common Vulnerabilities and Exposures) and information corresponding to standard vulnerability codes (severity, vulnerable software version, corresponding vulnerability information, references, etc.) Internet of Things (IoT) terminal vulnerability inspection system for smart factories.
According to claim 1,
The network search unit can inquire the IP address of the inspection target terminal in conjunction with the global IP address management organization system based on the IP address of the inspection target terminal received from the user terminal, and through this, the location including the country and city Internet of Things (IoT) terminal vulnerability check system for smart factories, characterized in that information can be grasped.
6. The method of claim 5,
The information inquiry unit collects system information of the terminal including the type and version of the operating system and the Internet connection status through banner grabbing technology, and compares the collected system information with the system banner DB, so that identification is possible. An IoT terminal vulnerability inspection system for a smart factory, characterized in that it acquires information of the inspection target terminal including the operating system, version, type, and Internet connection status.
According to claim 1,
The information inquiry unit sends a request to the corresponding inspection target terminal for identification of the operating system version and type, and it is possible to additionally identify the operating system version and type by calculating the packet data arrival time (TTL) until the response. Internet of Things (IoT) terminal vulnerability check system for smart factories.
In the method of checking the vulnerability of the IoT terminal used in the smart factory,
an inspection target selection step of receiving an IP address used by the inspection target terminal from the user terminal and transmitting the received IP address to a network search unit through an Internet environment;
a location information collection step of identifying location information including a country and a city corresponding to the IP address input from the network search unit;
a network search step of identifying the detailed IP address currently being used by the network search unit based on the IP address after the location information collection step, and transferring the detailed IP address in use to the port search unit;
a port analysis step of confirming a port state corresponding to the detailed IP address being used by the port search unit, and transmitting the corresponding information to the information inquiry unit;
an external service analysis step of identifying an externally provided service based on the port information received from the information inquiry unit;
a port service analysis step of identifying information about the terminal including the operating system, version, and type through the information collected in the external service analysis step and system banner DB inquiry, and delivering the information to a vulnerability inquiry unit; and
A vulnerability checking method for an IoT terminal for a smart factory, comprising: a vulnerability check step of performing a vulnerability check based on the information received from the vulnerability inquiry unit and outputting whether a vulnerability exists.
According to claim 1,
In the inspection target selection step, by connecting a hardware tool to the Internet environment used by the inspection target terminal for vulnerability inspection,
Internet of Things (IoT) terminal vulnerability check method for a smart factory that can transmit the IP address used by the check target terminal to the network search unit by selecting the check target terminal without going through a separate input process for the check target IP address in the user terminal .
According to claim 1,
The location information collection step is an Internet of Things terminal vulnerability checking method for a smart factory in which the IP address input from the network search unit is linked with the global IP address management organization system to inquire the location information of the IP address of the terminal to be checked.
According to claim 1,
The port analysis step is
a port search step of receiving the IP address in use identified in the network search step from the port search unit and collecting open port and closed port information based on the detailed IP address in use; and
An external port analysis step of checking whether there is a port that provides a service to the outside or allows a direct connection among the port information collected in the port search step, and stores the network and port information of the corresponding port as an information DB; How to check the vulnerabilities of IoT terminals for factories.
According to claim 1,
In the external service analysis step, based on the port information input from the information inquiry unit, a method of checking vulnerabilities of IoT terminals for smart factories to identify which services are provided externally using banner grabbing technology.
According to claim 1,
The port service analysis step is,
an update step of collecting and analyzing information generated due to port service misidentification through the system banner DB inquiry and updating the system banner DB;
a reanalysis step of performing the update step and reanalyzing the port service information not identified through the system banner DB inquiry to reduce errors due to misidentification; and
For a smart factory further comprising; an information collection step of storing in the information DB information that can perform a vulnerability check, including the operating system, version, type, and Internet connection status of the terminal that can be identified through the system banner DB inquiry How to check the vulnerabilities of IoT terminals.
According to claim 1,
The vulnerability inquiry step is
Primary check of performing vulnerability check through 1:1 matching of data (eg, network, port, location, operating system) of the information DB collected through the above steps with a large amount of vulnerability codes corresponding to the data in the vulnerability DB step;
a second check step of performing a vulnerability check by comparing all items in the vulnerability DB, not the vulnerability corresponding to the data, when a vulnerability cannot be found in the first check step; and
After performing the first check step or the second check step, the detailed information about the vulnerability check and the result output step of outputting all information of the above steps in a synthesis; IoT terminal vulnerability check method for a smart factory further comprising a.

Images