TWI425793B - Dynamic Adjustment of Operational Function of Network Gateway System and Its Adjustment Method - Google Patents

Description

Network gateway system for dynamically adjusting operation function and adjustment method thereof

The present invention relates to a network gateway system, and more particularly to a network gateway system that cooperates with a security access module to dynamically adjust operational functions and an adjustment method thereof.

In the prior art, the network gateway is mainly built between two networks to convert the data packet type and format of the two networks, so that the network devices on the two networks are network-linked.

However, different network link environments require network gateways with different functions. If the environmental conditions of the network link environment are changed, a new network gateway needs to be replaced to meet the environmental requirements. Secondly, after the network gateway is manufactured, its functions are mostly fixed. The network gateway in the market has the ability to update the firmware to improve the performance of the network gateway, but the firmware update fails. Risk of damage to the network gateway. Moreover, after the firmware is updated, the performance of the network gateway in the original network link environment is improved, instead of increasing the operation function of the network gateway in other network link environments, so the network gateway The applicability also has its limitations.

The problem to be solved by the present invention is to provide a network gateway system that can improve the operation efficiency and operation function of the network gateway without changing the circuit and the firmware.

To solve the above problems, the present invention discloses a network gateway system for dynamically adjusting an operation function, comprising: a security access module and a network gateway. The secure access module stores at least one additional functional material. The network gateway includes a component configuration module and a computing module, wherein the component configuration module is configured to configure or remove the security access module, and the computing module is electrically coupled to the component configuration module. When the security access module is configured in the component configuration module, the computing module links the secure access module and performs additional functional data when the link is successful.

In order to solve the above problems, the present invention discloses a dynamic adjustment operation function method of a network gateway device. The applicable network gateway device includes a component configuration module and an operation module electrically coupled to each other. The method comprises: configuring a secure access module in the component configuration module; using the computing module to link the secure access module through the component configuration module; and determining whether to execute the secure access module according to the link result Additional function data.

The invention is characterized in that: (1) the network gateway can add and use new functional components without any driver or firmware, so there is no risk of updating the program or firmware. (2) In different use cases, the user only needs to configure the corresponding function security access module to the network gateway, and the network gateway can drive the functional components or programs included in the security access module to Respond to different job needs. (3) When the security access module is damaged or the additional function data is abnormal, the user only needs to replace the new security access module without damaging the operation of the network gateway. (4) The system disclosed in the present invention can be combined with rights management to install different security access modules in network gateways of different units, so that the network gateway can only operate programs or components of corresponding units. (5) The identity verification mechanism for identifying the consumer financial card and the credit card may be pre-established in the secure access module, and the network gateway may perform an identity confirmation mechanism to simplify the electronic transaction behavior when configuring the secure access module. (Internet transactions, electronic payments, item rentals, etc.) identity authentication operations, and can reduce the number of data transmissions to accelerate electronic trading behavior.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The preferred embodiments of the present invention will be described in detail below with reference to the drawings.

First, please refer to FIG. 1 , which is a schematic diagram of a first system architecture of an embodiment of a network gateway system according to the present invention. In this embodiment, the network gateway system includes a security access module 20 and a network gateway device 10. The security access module 20 stores an additional function data 21, and the network gateway device 10 further includes a The component configuration module 11 and a computing module 12.

The component configuration module 11 is configured to configure or remove the security access module 20, and the component configuration module 11 and the security access module 20 are components of a corresponding structure. For example, the security access module 20 is a In the case of a chip card (for example, an RFID data card or a SAM data card), the component configuration module 11 is a chip socket or a chip configuration slot; or the security access module 20 is an external function interface card (Extend Function Card). The component configuration module 11 is an interface card socket (slot), but is not limited thereto, as long as the structures correspond to each other.

The computing module 12 is electrically coupled to the component configuration module 11 and configured to determine whether the secure access module 20 is disposed in the component configuration module 11. When the computing module 12 determines that the secure access module 20 is configured in the component configuration module 11, the component security module 20 is linked through the component configuration module 11 to perform secure access when the link is successful. Additional functional data 21 of the module 20. The network gateway 10 can run new functional services without changing internal programs, firmware and physical components.

Conversely, if the link fails, the computing module 12 runs the original functional service.

2 is a schematic diagram of a second system architecture of an embodiment of the network gateway system of the present invention. In this embodiment, the network gateway 10 further includes a storage module 13 in which more than one system function data 131 is stored. This system function data 131 is read and executed when the network gateway 10 is started.

However, when the security access module 20 is disposed in the component configuration module 11 of the network gateway 10, the computing module 12 links the secure access module 20, and has different execution modes according to the link result. described as follows:

(1) When the computing module 12 fails to link the secure access module 20, the computing module 12 does not read the additional function data 21, and moreover, the computing module 12 executes the original network gateway 10 System function data 131.

(2) When the computing module 12 links the secure access module 20 successfully, and the system function data 131 and the additional function data 21 are different data types, the computing module 12 executes the system function data 131 and attached according to requirements. Functional data 21.

(3) When the computing module 12 links the secure access module 20 successfully, and the system function data 131 and the additional function data 21 are the same data type, the computing module 12 analyzes the system function data 131 and the additional function data 21 Version, choose one to read and execute. For example, when the data version of the system function data 131 is newer than the data version of the additional function data 21, the operation module 12 reads and executes the system function data 131. On the other hand, when the data version of the additional function data 21 is newer than the data version of the system function data 131, the arithmetic module 12 reads and executes the additional function data 21.

(4) When the secure access module 20 is not disposed in the component configuration module 11, the system function data 131 is read and executed by the computing module 12.

When the computing module 12 links the secure access module 20, the secure access module 20 is authenticated. There are several types of authentication modes (but not limited to them, and related authentication modes are also available), as explained below:

(1) Please refer to FIG. 3A, which is a schematic diagram of a first authentication mode of an embodiment of the network gateway system of the present invention. The secure access module 20 includes additional functional data 21 and identification data 22, and the identification data 22 records the device code (or wafer code) of the secure access module 20. The storage module 13 of the network gateway 10 stores a device identification table 132 in which a plurality of device codes (ie, device codes of the secure access module 20 of the network gateway 10) are recorded. During the operation of the computing module 12 and authentication of the secure access module 20, the computing module 12 analyzes and matches the identification data 22 by using the device identification table 132. When the matching is successful, the computing module 12 determines that the link is successful, Read and execute the additional function data 21. Otherwise, the link is determined to have failed. In addition, the device identification table 132 further records one function usage authority data corresponding to each identification data 22. The network gateway device 10 can activate the corresponding function service according to the category to which the person belongs and the work unit.

Example (Functional Service Planning): The A unit includes the A1 area, the A2 area, and the A3 area. Each area is configured with a network gateway G1, a network gateway G2, and a network gateway G3. However, the network equipment in the A1 area requires the function data F1 and the function data F2. The network equipment in the A2 area needs the function data F2 and the function data F3, and the network equipment in the A3 area needs the function data F3. At this time, the secure access module 20 having the function data F1 and the function data F2 is disposed in the network gateway G1, and the secure access module 20 having the function data F2 and the function data F3 is disposed in the network gateway. The device G2 configures the secure access module 20 having the function data F3 in the network gateway G3. At this time, the network gateway G1 can run the function data F1 and the function data F2, but does not have the ability to run the function data F3; the network gateway G2 can run the function data F2 and the function data F3, but does not have The ability to run the function data F1; the network gateway G3 can run the function data F3, but does not have the ability to run the function data F1 and the function data F2. In this way, the functions and usage rights of the network gateway 10 of each area can be restricted.

For example, the A unit includes the A1 area, the A2 area, and the A3 area. Each of the areas is provided with an access sensor, and each access sensor is connected to a network gateway 10. When the staff of the A unit opens the A1 area and the A2 area for the B unit personnel to enter and exit freely, only one security access module 20 needs to be configured in the network gateway 10, and the security access module 20 includes the B unit authentication mechanism. Data and additional function data 21, when the B unit personnel go to the A1 area or the A2 area, the access control sensor of the A1 area or the A2 area will sense the certification card of the B unit personnel, and cooperate with the network gateway 10 to complete the authentication. The card's authentication behavior, the network gateway 10 will initiate additional functional information 21 to provide related functional services. Conversely, when the B unit personnel travels to the A3 area, the sensor in the A3 area will sense the authentication card of the B unit personnel, but the B unit personnel do not have the authority to enter the A3 area, so the network gateway 10 will determine when authenticating. The B unit personnel are not allowed to enter the A3 area, and the related additional function data 21 is not activated.

Moreover, the network gateway 10 is one of the servo devices 30 at the rear end of the chain, which provides the aforementioned device identification table 132 to the network gateway 10.

(2) Please refer to FIG. 3B, which is a schematic diagram of a second authentication mode of the embodiment of the network gateway system of the present invention. In this embodiment, the security access module 20 includes an identification code generation module 23, and the operation module 12 includes an identification logic 133. When the computing module 12 authenticates the secure access module 20, the identification code generating module 23 is executed to obtain an identification data, and the identification data is analyzed by the identification logic data 133 to determine whether to execute the additional functional data 21.

Example (Key Authentication Mechanism): The network gateway 10 includes a certificate key data that drives the secure access module 20 while providing authentication key data to the identification code generation module 23. The ID generation module 23 generates a response code corresponding to the key, and the operation module 12 analyzes the response code by using the identification logic 133 to determine whether the linked security access module 20 can be used by the network gateway 10. . When the computing module 12 determines that the linked secure access module 20 is correct and can be used, the additional functional data 21 included in the secure access module 20 is enabled; otherwise, the computing module 12 determines the linked The secure access module 20 is incorrect and cannot be used by the network gateway 10, i.e., the additional functional data 21 included in the secure access module 20 is not enabled.

Moreover, the network gateway 10 is a servo device 30 at the back end of the chain that provides the aforementioned identification logic 133 (or further including authentication key data) to the network gateway 10.

After the computing module 12 analyzes the identification data, an analysis result is transmitted to the servo device 30, and the servo device 30 analyzes the analysis result to transmit the function usage authority data corresponding to the identification data to the computing module 12, so that the computing module 12 It is determined whether or not to execute the additional function data 21 based on the function usage authority data.

Moreover, the function usage permission data record has the activation function permission, and the operation module 12 executes the permission function data according to the function to execute the partial function unit of the additional function data 21, which corresponds to the authority of the identification data, that is, the network gateway 10 can Use the permission of the additional function data 21.

(3) Please refer to FIG. 3C, which is a schematic diagram of a third authentication mode of the embodiment of the network gateway system of the present invention. The embodiment is different from the authentication mode shown in FIG. 3A and FIG. 3B. The difference is that the security access module 20 further includes a device identification module 24, and the network gateway device 10 further includes a device profile 134. When the secure access module 20 is powered by the network gateway 10, the device identification module 24 is executed. The device identification module 24 identifies the device data 134, determines whether the installed network gateway 10 meets the specifications of the executable security access module 20, and determines whether to open the additional function data 21 for the operation module according to the determination result. 12 read and execute. This prevents the secure access module 20 from being stolen and placed in any of the network gateways 10, so that the additional functional data 21 of the secure access module 20 is prevented from being used arbitrarily, and at the same time, the purpose of the rights control is achieved.

In addition, the network gateway 10 can be configured with a plurality of component configuration modules 11 for simultaneously arranging a plurality of secure access modules 20, and the network gateway 10 can simultaneously run a plurality of additional functional data 21 to provide A variety of additional feature services. The configuration mode of the single component configuration module 11 is similar to that of the configuration mode.

4A is a schematic diagram of a dynamic adjustment operation function of the embodiment of the network gateway 10 of the present invention. Please refer to FIG. 1 to FIG. 3C at the same time for understanding, and the method is as follows:

A secure access module 20 is disposed in the component configuration module 11 (step S110). As described above, the component configuration module 11 and the security access module 20 are components of a corresponding structure. For example, when the security access module 20 is a chip card (eg, an RFID data card, a SAM data card), the component The configuration module 11 is a chip socket or a chip configuration slot; or the security access module 20 is an external function interface card (Extend Function Card), and the component configuration module 11 is an interface card socket (slot), but Not limited to this, as long as the structure corresponds to each other.

The computing module 12 is used to link the secure access module 20 through the component configuration module 11 (step S120). The computing module 12 is electrically coupled to the component configuration module 11 and is configured to determine whether the secure access module 20 is disposed in the component configuration module 11. When the computing module 12 determines that the secure access module 20 is configured When the module 11 is configured, the module 11 is configured to securely access the module 20 through the component configuration module 11.

Based on the link result, it is determined whether or not to execute the additional function material 21 of one of the secure access modules 20 (step S130). There are different execution modes depending on the link result, as explained below:

(1) when the computing module 12 successfully links the secure access module 20, the additional function data 21 of the secure access module 20 is executed; otherwise, when the computing module 12 fails to link the secure access module 20, The computing module 12 does not read the additional function data 21, and moreover, the computing module 12 executes the original system function data 131 of the network gateway 10.

(2) When the computing module 12 links the secure access module 20 successfully, and the system function data 131 and the additional function data 21 are different data types, the computing module 12 executes the system function data 131 and attached according to requirements. Functional data 21.

(3) When the computing module 12 links the secure access module 20 successfully, and the system function data 131 and the additional function data 21 are of the same data type, the computing module 12 analyzes the system function data 131 and the additional function data 21 The version of the data, from which one reads and executes.

Please refer to FIG. 4B as a schematic diagram of the data version comparison of the embodiment of the network gateway 10 of the present invention. The computing module 12 compares the data versions of the system function data 131 and the additional function data 21 to determine whether the data version of the additional function data 21 is newer (step S150).

When the data version of the system function data 131 is newer than the data version of the additional function data 21, the arithmetic module 12 reads and executes the system function data 131 (step S151).

On the other hand, when the data version of the additional function data 21 is newer than the data version of the system function data 131, the arithmetic module 12 reads and executes the additional function data 21 (step S152).

(4) When the secure access module 20 is not disposed in the component configuration module 11, the system function data 131 is read and executed by the computing module 12.

Please refer to FIG. 4C, FIG. 4D, FIG. 4E and FIG. 4F for the authentication diagram of the embodiment of the network gateway 10 of the present invention. During the operation of the security module 20 by the computing module 12, the security access module 20 is authenticated as follows:

The secure access module 20 is authenticated by the computing module 12 (step S161). There are several types of authentication modes (but not limited to them, and related authentication modes are also available), as explained below:

The first authentication method: the operation module 22 reads the identification data 22 of one of the secure access modules 20 (step S171). Referring to FIG. 4D and FIG. 3A simultaneously, the secure access module 20 includes additional functional data 21 and identification data 22, and the identification data 22 records the device code (or wafer code) of the secure access module 20. The storage module 13 of the network gateway 10 stores a device identification table 132 in which a plurality of device codes (ie, device codes of the secure access module 20 of the network gateway 10) are recorded.

The identification data 22 is analyzed by the arithmetic module 12 based on the device identification table 132 (step S172). During the operation of the computing module 12 and authentication of the secure access module 20, the computing module 12 analyzes and matches the identification data 22 using the device identification table 132. Regardless of the analysis and matching results, the calculation result is recorded by the arithmetic module 12 as the authentication result (step S173).

The second authentication method: Referring to FIG. 4E and FIG. 3B simultaneously, the security access module 20 includes an identification code generation module 23, and the operation module 12 includes an identification logic data 133. When the computing module 12 authenticates the secure access module 20, the computing module 12 executes the identification code generating module 23 to obtain an identification data (step S181). The computing module 12 then analyzes the identification data using an identification logic 133 (step S182). Finally, the analysis result is formed by the arithmetic module 12 to form an authentication result (step S183).

Example (Key Authentication Mechanism): The network gateway 10 includes a certificate key data that drives the secure access module 20 while providing authentication key data to the identification code generation module 23. The ID generation module 23 generates a response code corresponding to the key, and the operation module 12 analyzes the response code by using the identification logic 133 to determine whether the linked security access module 20 can be used by the network gateway 10. .

However, as shown in FIG. 4F, when the network gateway 10 links the servo device 30 at the back end, step S173 further includes: transmitting the analysis result to the servo device 30 by the operation module 12 (step S191). The analysis result transmitted by the network gateway 10 is analyzed by the servo device 30 to transmit the function usage authority data corresponding to the identification data to the operation module 12 (step S192). Finally, the function usage authority data is used by the computing module 12 to form an authentication result (step S193).

Regardless of the authentication mode, the computing module 12 records the authentication result to form a link result (step S162).

In addition, when the network gateway 10 links the servo device 30 at the back end, and the computing module 12 decides to execute the additional function data 21, the computing module 12 performs the additional function data according to the function usage authority data transmitted by the servo device 30. 21 local functional unit.

In the above, it is merely described that the present invention is an embodiment or an embodiment of the technical means for solving the problem, and is not intended to limit the scope of implementation of the present invention. That is, the equivalent changes and modifications made in accordance with the scope of the patent application of the present invention or the scope of the invention are covered by the scope of the invention.

10. . . Network gateway

11. . . Component configuration module

12. . . Computing module

13. . . Storage module

131. . . System function data

132. . . Equipment identification table

133. . . Identification logic

134. . . Device data

20. . . Secure access module

twenty one. . . Additional function data

twenty two. . . Identification data

twenty three. . . Identification code generation module

twenty four. . . Device identification module

30. . . Servo device

1 is a schematic diagram showing a first system architecture of an embodiment of a network gateway system of the present invention;

2 is a schematic diagram showing a second system architecture of an embodiment of the network gateway system of the present invention;

3A is a schematic diagram showing a first authentication mode of an embodiment of the network gateway system of the present invention;

3B is a schematic diagram showing a second authentication mode of the embodiment of the network gateway system of the present invention;

3C is a schematic diagram showing a third authentication mode of the embodiment of the network gateway system of the present invention;

4A is a schematic diagram showing a method for dynamically adjusting operation functions of an embodiment of a network gateway according to the present invention;

4B is a schematic diagram showing a comparison of data versions of an embodiment of the network gateway of the present invention;

4C, 4D, 4E and 4F are schematic diagrams showing the authentication of the embodiment of the network gateway of the present invention.

10. . . Network gateway

11. . . Component configuration module

12. . . Computing module

20. . . Secure access module

twenty one. . . Additional function data

Claims (27)

A network gateway system for dynamically adjusting an operation function, comprising: a security access module storing at least one additional function data; and a network gateway device comprising: a component configuration module for providing The security access module is configured or removed from the component configuration module; and a computing module is electrically coupled to the component configuration module. When the security access module is configured in the component configuration module, The computing module links the secure access module, and when the link is successful, the additional function data is executed without changing the internal program, the firmware and the physical component, and if the link fails, the operation is performed. The module runs the original functional service. The network gateway system of claim 1, wherein the network gateway further comprises a storage module, and at least one system function data is stored in the storage module. The network gateway system of claim 2, wherein the computing module reads and executes the system function data. The network gateway system of claim 2, wherein the computing module reads and executes the system function data when the link fails. The network gateway system of claim 2, wherein the system function data and the additional function data are the same data type, and the computing module analyzes the system function data and the data version of the additional function data, Choose from one to read and execute. The network gateway system as described in claim 5, wherein When the data version of the system function data is new to the data version of the additional function data, the operation module reads and executes the system function data. The network gateway system of claim 5, wherein the computing module reads and executes the additional functional data when the data version of the additional functional data is new to the data version of the system functional data. The network gateway system of claim 1, wherein when the computing module links the secure access module, the secure access module is authenticated to determine whether to execute the additional functional data. The network gateway system of claim 8, wherein the security access module further comprises an identification data, the network gateway further comprising a storage module for storing a device identification table, the operation When the module authenticates the secure access module, the device identification table is used to analyze the identification data to determine whether to execute the additional function data. The network gateway system of claim 9, further comprising a servo device linking the network gateway, the network gateway obtaining the device identification table provided by the servo device. The network gateway system according to claim 9, wherein the device identification table further records one function usage authority data corresponding to each identification data. The network gateway system of claim 8, wherein the security access module comprises an identification code generation module, the operation module further comprising an identification logic data, the operation module authenticating the security storage When the module is taken, the identification code generating module is executed to obtain an identification data, and the identification data is analyzed by using the identification logic data to determine whether to perform the additional Functional data. The network gateway system of claim 12, further comprising a servo device that links the network gateway, the network gateway obtaining the identification logic data provided by the servo device. The network gateway system according to claim 12, wherein the computing module analyzes the identification data, and transmits an analysis result to a servo device linked to the network gateway, the servo device analyzing the The analysis result is used to transmit the function usage permission data corresponding to the identification data to the operation module, so that the operation module determines whether to execute the additional function data according to the function usage authority data. The network gateway system of claim 14, wherein the computing module executes the additional function data, and further performs the local function of the additional function data corresponding to the permission to identify the data according to the function usage authority data. unit. The network gateway system of claim 1, wherein the security access module further comprises a device identification module, the network gateway further comprising a device data, the security access module configuration When the component is configured, the device is powered to execute the device identification module, and the device identification module identifies the device data to determine whether the operation module reads the additional function data. A method for dynamically adjusting a function of a network gateway device, the network gateway device comprising a component configuration module and a computing module electrically coupled to each other, the method comprising: configuring a security access module to Component configuration module; Using the computing module to link the security access module through the component configuration module; and determining whether to execute an additional function data of the security access module according to the link result, and if not, not changing the internal program, In the case of firmware and physical components, the additional functional data is executed, and if not, the computing module runs the original functional service. The method of claim 17, wherein the network gateway further comprises a storage module, and at least one system function data is stored in the storage module, wherein the method further comprises the step of: utilizing the operation mode The group reads and executes the system function data. The method of claim 17, wherein the network gateway further comprises a storage module, and at least one system function data is stored in the storage module, wherein the method further comprises the following steps: when the operation mode When the group successfully links the security access module, the additional function data is executed; and when the computing module fails to link the security access module, the system function data stored by the storage module is read. The method of claim 17, wherein the network gateway further comprises a storage module, and at least one system function data is stored in the storage module, wherein the method further comprises the following steps: when the operation mode When the group successfully links the security access module, the computing module is used to analyze the system function data and the data version of the additional function data, and select and execute it. The method of claim 20, wherein the system works When the data version of the data is new to the data version of the additional function data, the computing module reads and executes the system function data. The method of claim 20, wherein the computing module reads and executes the additional functional data when the data version of the additional functional data is new to the data version of the system functional data. The method of claim 17, wherein the step of using the computing module to link the secure access module to the module includes: authenticating the secure access module by using the computing module; And document the certification results to form the link results. The method of claim 23, wherein the network gateway further comprises a storage module for recording a device identification table, and the step of authenticating the secure access module by using the computing module comprises: utilizing The computing module reads the identification data of the security access module; the computing module analyzes the identification data according to the device identification table; and the analysis module records the analysis result as the authentication result. The method of claim 23, wherein the secure access module further comprises an identification code generating module, and the step of authenticating the secure access module by using the computing module comprises: The group executes the identification code generating module to obtain an identification data; the computing module analyzes the identification resource by using an identification logic data And the calculation result is formed by the operation module to form the certification result. The method of claim 25, wherein the step of forming, by the computing module, the analysis result to form the authentication result comprises: transmitting, by the computing module, the analysis result to the link network gate device a servo device; the analysis result is analyzed by the servo device to transmit the function usage permission data corresponding to the identification data to the operation module; and the operation module uses the permission data to form the authentication result. The method of claim 25, wherein the step of determining whether to execute the additional function data of the secure access module according to the link result comprises: when the computing module decides to execute the additional function data The local functional unit of the additional function data corresponding to the authority to identify the data is executed according to the function usage permission data.