WO2019221419A1

WO2019221419A1 - Hardware security module

Info

Publication number: WO2019221419A1
Application number: PCT/KR2019/005039
Authority: WO
Inventors: 박현주; 박한나
Original assignee: 주식회사 시옷
Priority date: 2018-05-16
Filing date: 2019-04-26
Publication date: 2019-11-21
Also published as: KR20190134924A; KR102135710B1

Abstract

A hardware security module, according to an embodiment of the present invention, comprises: a connection port to be connected to an IoT electronic device; a communication interface for transmitting and receiving data to/from the IoT electronic device on the basis of an LoRa communication network; and a processor for encrypting or decrypting the data transmitted and received by the communication interface, wherein the processor comprises a plug-in management unit that installs, in the IoT electronic device, a security plug-in for transmitting and receiving the encrypted data as the IoT electronic device and the connection port are physically connected.A hardware security module, according to an embodiment of the present invention, comprises: a connection port to be connected to an IoT electronic device; a communication interface for transmitting and receiving data to/from the IoT electronic device on the basis of an LoRa communication network; and a processor for encrypting or decrypting the data transmitted and received by the communication interface, wherein the processor comprises a plug-in management unit that installs, in the IoT electronic device, a security plug-in for transmitting and receiving the encrypted data as the IoT electronic device and the connection port are physically connected.

Description

Hardware security module

The present invention relates to a hardware security module. More specifically, the present invention relates to a hardware security module that provides security services in an IoT service system using Laura communication.

The hardware security module (HSM) is a module that can process not only a large amount of information but also a self-processing by having a processor and a memory having a predetermined computing function. The hardware security module has been used in various fields in areas where user's personal information security is required due to the advantage that confidential information stored in the inside is not leaked. More specifically, since the hardware security module generates its own security key and stores the generated security key securely inside without leaking to the outside, it can maximize security when used as a digital signature means. For example, it may be used as an electronic signature means in the process of making a payment in a mobile device.

Meanwhile, LoRa communication technology has recently emerged. Lora is an abbreviation of Long Range and LoRa communication can be regarded as one of the large-scale low power long distance wireless communication technologies. Unlike conventional smart device connection environments that require high-speed, broadband networks, LoRa communication can send and receive small-scale data at low power by placing a chip on an electronic device without a separate base station or relay device. In addition, LoRa communication can provide users and developers with interoperability suitable for the Internet needs such as security, two-way communication, network mobility, localization service, and the Internet of Things (IoT) based on LoRa communication. Service systems are becoming commercially available.

However, in the process of using LoRa communication-based Internet of Things (IoT) service system, all the objects and users are identified, authenticated, and integratedly managed to use public key infrastructure (PKI) authentication. In the case of low-end hardware devices, such public key-based authentication cannot be performed properly, resulting in security problems.

Therefore, the development of a hardware security module that is secure in security and can perform simple authentication in a LoRa communication-based IoT service including all low hardware devices is required, and the present invention relates to this.

The technical problem to be solved by the present invention is to provide a hardware security module that can be applied to the security technology without changing hardware and software in the IoT (IoT) service system based on the Laura communication network including all hardware devices of low specifications The purpose.

Another object of the present invention is to provide a hardware security module capable of end-to-end encryption in an IoT service system based on a Laura communication network.

Another object of the present invention is to provide a hardware security module applicable to a low power wide area wireless network (LPWAN).

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

The hardware security module according to an embodiment of the present invention may include an access port connected to an IoT electronic device, a communication interface for transmitting and receiving data from the IoT electronic device through a LoRa communication network, and encrypting data transmitted and received by the communication interface. Or a processor that decrypts the processor, wherein the processor includes a plug-in manager that installs a security plug-in in the IoT electronic device to transmit and receive encrypted data as the IoT electronic device and the connection port are physically connected.

According to an embodiment of the present disclosure, the processor may perform encryption using at least one of ARIA, Secure Hash Algorithm (SHA), and End-to-End encryption (end to end encryption) encryption communication scheme for transmitting and receiving data to and from the IoT electronic device. It may further include wealth.

According to an embodiment of the present disclosure, the processor may include a device authentication unit configured to authenticate the IoT electronic device and a device connection manager configured to manage a connection through a LoRa communication network of the IoT electronic device that has been authenticated by the device authentication unit. It may further include.

According to an embodiment of the present disclosure, the processor may further include a server manager configured to manage an external server connected to the IoT electronic device through a LoRa communication network.

According to an embodiment of the present disclosure, the communication interface may further include a communication converter configured to convert communication data transmitted by the IoT electronic device into LoRa communication data.

According to one embodiment, according to the type of communication module embedded in the IoT electronic device, further comprises any one or more of a secure Lora (LoRa) communication unit, a secure serial communication unit and a secure LPWAN communication unit, the secure Lora (LoRa) communication unit, Data transmitted and received through at least one of a secure serial communication unit and a secure LPWAN communication unit through a LoRa communication network may be encrypted or decrypted by the processor.

According to an embodiment of the present disclosure, the communication interface may further include a secure Ethernet communication unit and a Power Over Ethernet port for Ethernet communication.

According to an embodiment, the communication interface receives encrypted data from the device authentication server for transmitting an authentication code to the IoT electronic device through a LoRa communication network, and the processor receives the encrypted data received by the communication interface. By decrypting the data, the device authentication unit may perform authentication of the IoT electronic device based on the data decrypted by the processor.

According to an embodiment of the present disclosure, the connection port may be an IC card or a port based on a universal serial bus (USB) standard.

According to the present invention, a security technology can be applied to a LoRa communication network including all low-end hardware devices without changing hardware and software, and the time and cost associated with applying the security technology through a change in hardware and software can be avoided. There is a saving effect.

In addition, there is an effect that can be applied and converged in various IoT systems using one hardware security module.

In addition, the hardware security module can further provide a more secure LoRa network-based IoT service system by using end-to-end encryption.

In addition, since various communication data may be changed into LoRa communication data, an electronic device having various communication modules may be applied to an IoT service system based on a LoRa communication network.

Effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram illustrating a configuration of a Laura communication network-based IoT system to which a hardware security module according to an embodiment of the present invention can be applied.

2 is a diagram schematically illustrating a configuration of a hardware security module according to an embodiment of the present invention.

3 is a flowchart illustrating a method of authenticating an IoT electronic device by a hardware security module according to an embodiment of the present invention using a Laura communication network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only the embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the technical field to which the present invention belongs. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. In addition, the terms defined in the commonly used dictionaries are not ideally or excessively interpreted unless they are specifically defined clearly. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase.

As used herein, “comprises” and / or “comprising” refers to a component, step, operation and / or element that is one or more of the other components, steps, operations and / or elements. It does not exclude existence or addition.

Meanwhile, IoT is an abbreviation of the Internet of Things (IoT), and refers to a physical network in which an object equipped with a sensor and a communication chip can automatically send and receive real-time data without human intervention. In the Internet of Things environment, devices with built-in sensors or communications (Internet of Things) can connect to the Internet to collect information around you, exchange information with other devices, and make appropriate decisions. The Internet of Things (IoT) is based on Bluetooth, near field communication (NFC), sensor data, and low power wide area wireless communication technologies.

In the following description, the Internet of Things (IoT) and Machine-to-Machine (M2M) radios can be implemented using a LoRa communication network, one of the low power wide area wireless communication technologies, and millions of wireless sensor nodes can be connected to the gateway. The IoT service system 10 will now be described.

FIG. 1 is a diagram illustrating a configuration of an IoT service system 10 based on a Laura communication network 200 to which a hardware security module may be applied according to an embodiment of the present invention.

First, referring to FIG. 1, the IoT service system 10 based on the Laura communication network 300 according to an embodiment of the present invention is for processing a plurality of sensors and a large amount of asynchronous processes. 200, a LoRa communication network 300, a LoRa repeater 350, a LoRa server 400, and an external server 500 may be included.

The IoT electronic device 200 is a device to which the Internet of Things (IoT) technology is applied and may be a low power electronic device capable of operating for a long time with battery power. Accordingly, the IoT electronic device 200 may be provided with a low power wireless communication module such as a LoRa communication module to conserve power.

According to an embodiment, the IoT electronic device 200 may be connected to a plurality of sensor devices, and the data specified through the sensor device according to the request of the external server 500 may be transferred to the external server 500 through the LoRa communication network 300. ) Can be sent.

In addition, the IoT electronic device 200 controls the activation state of the sensor device according to a predetermined time, and acquires terminal specific information (eg, serial number, ID, etc.) and sensor data from the sensor device while the sensor device is activated. Receives and transmits to the external server 500 through the LoRa communication network 300, and receives the setting data for setting the sensor device from the external server 500 to the IoT electronic device 200.

In addition, since the IoT electronic device 200 uses the LoRa communication network 300 capable of broadband communication, the IoT electronic device 200 may include an electronic device requiring far communication than an electronic device disposed in a specific building or space.

The LoRa communication network 300 includes a LoRa base station (not shown) and a LoRa repeater 350. It may be made of various Internet communication relay devices such as LoRa server (400).

The external server 500 may provide an IoT application installed in a user terminal (not shown) using the IoT service system 10, and accordingly, a user may use the IoT electronic device 200 using the LoRa communication network 300. ) Can be controlled.

Up to now, the configuration of the IoT service system 10 based on LoRa communication network 300 to which a hardware security module according to an embodiment of the present invention can be applied was briefly described. Hereinafter, the IoT service system 10 will be described. ) Will be described in detail the configuration of the hardware security module 100 to secure.

2 is a diagram schematically illustrating a configuration of a hardware security module 100 according to an embodiment of the present invention.

2, the software configuration of the hardware security module 100 may include a communication interface 110, a processor 120, and a connection port 130.

The access port 130 provided in the hardware security module 100 may be physically connected to the IoT electronic device 200 to install a security plug-in. According to an embodiment, the connection port 130 may be formed of an IC card or a port of various Universal Serial Bus (USB) standards, and thus may be physically connected to various kinds of IoT electronic devices 200.

On the other hand, the security plug-in provided by the hardware security module 100 is a component of each of the IoT service system 10 based on the LoRa communication network 300 to transmit and receive data securely based on the LoRa communication network 300. It is a program that provides security functions. According to an embodiment, the security plug-in is embedded software in the IoT electronic device 200 to which the communication interface 110 is secured through an access port of the LoRa communication network 300 or the hardware security module 100. It can be installed in the form.

Accordingly, the IoT electronic device 200 may perform functions provided by the communication interface 110 and the processor 120 of the hardware security module 100 through the security plug-in, and the hardware security module 100 will be described below. The functions performed by each of the components are performed through the components of the IoT service system 10 based on the LoRa communication network 300 (eg, the IoT electronic device 200, the LoRa server, and an external server). Can be.

Meanwhile, the communication interface 110 of the hardware security module may exchange communication data with the IoT service system 10 based on the LoRa communication network 300 and the LoRa communication network 300. According to an embodiment, even if the hardware security module 100 does not have an access port 130, a schedule capable of wireless communication with the IoT service system 10 based on the LoRa communication network 300 through the communication interface 110 is provided. The security plug-in for security of the IoT electronic device 200 may be installed within the range, or may be connected to the IoT electronic device 200 through the access port 130 to set and release the security of the IoT electronic device 200.

The processor 120 of the hardware security module 100 controls the overall functions of the hardware security module 100 and at least can provide security services in the IoT service system 10 based on the LoRa communication network 300. It may include one computing device. The computing device may be, for example, a general-purpose central computing unit (CPU), a programmable device device (CPLD, FPGA), a custom semiconductor computing unit (ASIC), or a microcontroller chip implemented for a specific purpose.

According to an embodiment, the processor 120 may encrypt or decrypt data transmitted and received by the communication interface 110. In order to perform the encryption and decryption functions of the processor 120, the processor 120 may install a security plug-in in the IoT electronic device 200 when the connection port 130 of the hardware security module 100 is physically connected. The management unit 121 may be included.

In addition, the processor 120 may include an encryption unit 123 that encrypts and decrypts data transmitted and received by the IoT electronic device 200 to the IoT service system 10 based on the LoRa communication network 300. According to an embodiment, the encryption unit 123 may perform encryption using at least one of ARIA, Secure Hash Algorithm (SHA), and End-to-End encryption (end to end encryption) encryption communication scheme.

More specifically, the encryption unit 123 may encrypt any information transmitted or received by the IoT electronic device 200 with each component of the IoT service system 10 based on the LoRa communication network 300. . For example, when the security plug-in provided by the processor 120 of the hardware security module 100 uses an end-to-end encryption scheme, the IoT electronic device 200 may move to a LoRa server 400. The encrypted request information for using the communication network can be transmitted.

In addition, the encryption unit 123 provides an ARIA encryption communication method, which is a national standard 128-bit block encryption algorithm, so that the IoT service system 10 encrypts information more efficiently using the LoRa communication network 300. Or SHA encryption, another national standard 160-bit block encryption algorithm, to encrypt information. In addition to the above-described encryption algorithm, the encryption unit 123 may provide various national standard algorithms to each component of the IoT service system 10 that can provide an information security service using a LoRa communication network. In the case of an encryption communication scheme provided to the electronic device 200, a lightweight encryption communication scheme may be provided in consideration of hardware and software capabilities of the IoT electronic device 200.

Meanwhile, the processor 120 of the hardware security module 100 may include a device authenticator 125 that performs authentication of the IoT electronic device 200 to install a security plug-in. According to an embodiment, the device authenticator 127 may perform authentication of the IoT electronic device 200 using the device authentication server 600, and a detailed description of a method of performing authentication will be described later.

The processor 120 of the hardware security module 100 may include a device connection manager 127 that manages a connection through a LoRa communication network of IoT electronic devices 200 that have been authenticated by the device authenticator 127. have. This is the case where the hardware security module 100 is applied to the LoRa server 400 or the external server 500, and the IoT electronic device 200 uses the LoRa communication network 300 to provide a LoRa server. When accessing the 400 or the external server 500, the device connection manager 127 may check an authentication code of the IoT electronic device 200 to control the access of the device through the LoRa communication network 300. have.

In addition, in addition to the access management of the IoT electronic device 200, the processor 120 of the hardware security module 100 is connected to the LoRa server 400 and the external server 500 connected through the LoRa communication network 300. It may include a server management unit 129 for managing). For example, the server manager 129 may be executed in each server device to manage whether the LoRa server 400 and the external server 500 use the IoT service system 10 using a correct encryption communication method. Can be. In addition, the server manager 129 analyzes the information received by the IoT electronic device 200 from the external server 500, the external server 500 is authenticated communication security based on the LoRa communication network 300 If the server is not authenticated, the access of the server can be controlled.

Meanwhile, in order for the processor 120 to perform a communication data security service through the LoRa communication network 300, the communication interface 110 uses the LoRa communication data as communication data transmitted by the IoT electronic device 200. It may include a communication conversion unit 111 to convert.

More specifically, in the case of the IoT electronic device 200 that does not use the LoRa communication module, the hardware security module 100 of the hardware security module 100 may be used to use the IoT service system 10 based on the LoRa communication network 300. A security plug-in based on a LoRa network provided by the processor 120 may be installed. Accordingly, the IoT electronic device 200 may exchange information by using the communication converter 111 provided by the hardware security module 100.

According to an embodiment, when the IoT electronic device 200 transmits serial communication data, the communication conversion unit 111 may convert the serial communication data into LoRa communication data. In addition, when the communication conversion unit 111 transmits low power broadband wireless communication (LPWAN) data similar to the LoRa communication of the IoT electronic device 200, the communication conversion unit 111 may convert the data into LoRa communication data, thereby causing IoT electronics. The device 200 may be provided with a security service regardless of a specific specification for using the IoT service system 10 based on the LoRa communication network 300.

In addition, in order to perform the function of the communication conversion unit 111, the communication interface 110 of the hardware security module 100 is secured according to the type of communication module built in the IoT electronic device 200. The communication unit 113, the secure serial communication unit 115, and the secure LPWAN communication unit 117 may be included.

In addition, data transmitted and received through the secure LoRa communication unit 113, the secure serial communication unit 115, and the secure LPWAN communication unit 117 and the LoRa communication network 300 may be encrypted or decrypted by the processor 120. Can be.

In addition, the communication interface 110 may include a secure Ethernet communication unit 119 for Ethernet communication, and accordingly, the hardware security module 100 may include a PoE port (Power Over Ethernet port). have. Here, the PoE (Pover of Ethernet) is a technology for transmitting a data signal and power at the same time, in the case of the IoT electronic device 200 to receive the LoRa communication data and power for operating the device at the same time through the PoE port. have.

As such, as the communication interface 110 of the hardware security module 100 includes various communication modules and physical communication ports, it is related to the specification of each component of the LoRa communication network 300 based IoT service system 10. The same security service can be provided without.

In addition, since the hardware security module 100 is physically connectable, the security service can be selectively applied to the IoT electronic device 200 desired by the user, so that the user can enjoy a more secure IoT service.

So far, each component of the hardware security module 100 according to an embodiment of the present invention has been described, and in the following, an IoT electronic device using the hardware security module 100 with a description pending from the description of the device authentication unit 125 ( The authentication method of 200 will be described in detail.

3 is a flowchart illustrating a method of authenticating the IoT electronic device 200 using the LoRa communication network by the hardware security module 100 according to an embodiment of the present invention.

First, the hardware security module 100 encrypts the authentication code request signal (S110). This is a step of encrypting the authentication code request signal itself. Since the authentication code request signal includes information on the IoT electronic device 200 to be described later, the authentication code request signal itself is encrypted for security reasons.

The hardware security module 100 relays a procedure for issuing an authentication code for authenticating the IoT electronic device 200 from the device authentication server 600. That is, the hardware security module 100 receives the authentication code from the device authentication server 600 and transmits the authentication code to the IoT electronic device 200. According to an embodiment, the hardware security module 100 relays the IoT electronic device 200 and the device authentication server 600 device in cooperation with a terminal capable of installing an application, and the authentication code signed by the IoT electronic device 200. To receive and store it.

The authentication code request signal encrypted by the hardware security module 100 may include at least one of a message type, a message length, a serial number, a gateway ID, a unique ID, and a password of the IoT electronic device 200.

In more detail with respect to the components included in the authentication code request signal, the message type is a value set in the first byte of every request signal or response signal is a value that identifies what type of authentication code request signal. Here, the message type is a type of signal. That is, the value is set in the first byte of the authentication code request signal, the type of the signal can be distinguished according to the set value.

The message length is the total message size minus the message type and the message length. The authentication code request signal includes various other information including the message type and the message length, and the message length corresponds to the size and message length corresponding to the message type in the size, that is, the size of all information included in the authentication code request signal. It may be the size minus the size. For example, if the size of the message type is 1 byte, the size of the message length itself is 4 bytes, and the size of the entire message is 85 bytes, the message length may be 80 bytes. Here, the size of the entire message is the size of the authentication code request signal.

The serial number is a unique number of the IoT electronic device 200. Each IoT electronic device 200 capable of short-range wireless communication or wired communication with the hardware security module 100 includes one unique number. The hardware security module 100 may receive and store a serial number that is a unique number of the IoT electronic device 200 before encrypting the authentication code request signal. Accordingly, the hardware security module 100 may generate an authentication code request signal including a stored serial number.

The gateway ID is an ID of a gateway that performs short-range wireless communication or wired communication with the IoT electronic device 200. That is, in the present invention, the gateway ID may be a LoRa repeater 200 ID, and the IoT electronic device 200 stores the signed authentication code received from the device authentication server 600 and then uses the gateway. Certified by According to an embodiment, the gateway may be installed for each region. For example, the gateway may be installed in a specific building, and the IoT electronic device 200 needs to be authenticated by the gateway in order to communicate with the gateway in the specific building. Accordingly, the gateway ID may be an ID of a gateway that communicates with the IoT electronic device 200 in a space where the IoT electronic device 200 will be used.

The unique ID is an ID of a chip mounted in the IoT electronic device 200. The unique ID is information generated by the IoT electronic device 200 and is a result of hashing a result of applying a salt to a serial number of the IoT electronic device 200 in which the chip is mounted. Each IoT electronic device 200 has a serial number which is a unique number, and the salt may be a value set by the user so that the relationship between the serial number and the unique ID is not exposed. In other words, the application of the salt is to perform a logical operation with the serial number on a user-specified value, for example, the salt value '1234'. Unique ID is the result of hashing the result of the logical operation of the salt value and the serial number. The logical operation may be at least one of and, or, xor, and nand.

The IoT electronic device 200 password is a value to be input when storing the signed authentication code received by the IoT electronic device 200 in the step of transmitting an authentication code storage response signal, which will be described later. The IoT electronic device 200 may store the signed authentication code by inputting the same password as the password of the IoT electronic device 200 included in the authentication code request signal when the signed authentication code is stored.

Referring back to FIG. 3, the hardware security module 100 transmits an encrypted authentication code request signal to the device authentication server 600 (S120).

Next, the device authentication server 600 decrypts the encrypted authentication code request signal received from the hardware security module 100 (S130). Accordingly, the device authentication server 600 may recognize that the signal transmitted by the hardware security module 100 is a signal for requesting an authentication code through a message type included in the authentication code request signal.

The device authentication server 600 generates an authentication code including some information from the authentication code request signal transmitted from the hardware security module 100 (S140). According to an embodiment of the present disclosure, the device authentication server 600 is a server of an authority that is qualified to generate an authentication code. The device authentication server 600 may generate an authentication code, and detailed description of specific information included in the authentication code will be described later.

The authentication code generated by the device authentication server 600 is signed to generate a signed authentication code (S150). According to an embodiment, since the authentication code itself generated by the device authentication server 600 may be duplicated, the device authentication server 600 may sign the authentication code. The signed authentication code may mean that the device authentication server 600 directly generates an authentication code, and signing the authentication code by the device authentication server 600 may mean that the authentication code includes signature-related data.

Next, the device authentication server 600 encrypts the signed authentication code (S160). The device authentication server 600 may encrypt the authentication code signed by an encryption algorithm included in the authentication code, and the signed authentication code may be encrypted and managed for security.

The hardware security module 100 receives an encrypted signed authentication code from the device authentication server 600 (S170). In addition, in addition to the signed authentication code, the hardware security module 100 may also receive a result code, an authentication code size, and a password of the IoT electronic device 200 taking the hash.

More specifically, the result code may be a value indicating whether the device authentication server 600 device has received the encrypted authentication code request signal from the hardware security module 100 without error. In addition, the authentication code size may mean the size of the authentication code itself, for example, the size of the authentication code may be 1000 bytes. In addition, the password of the IoT electronic device 200 taking the hash is a result of taking a hash function on the password of the IoT electronic device 200 described above. 600 may transmit.

The hardware security module 100 decrypts the encrypted signed authentication code (S180). Since the authentication code itself includes an encryption algorithm that is information of how the authentication code is encrypted, the signed authentication code encrypted using the encryption algorithm can be decrypted.

After decrypting the signed authentication code, the hardware security module 100 checks the signed authentication code and transmits an authentication code storage request signal to the IoT electronic device 200 (S190). The process of verifying the signed authentication code may be performed by the hardware security module 100 by comparing the information included in the authentication code with the information included in the authentication code request signal. For example, since both the authentication code request signal and the authentication code include a unique ID, the hardware security module 100 may check whether the unique IDs are the same.

On the other hand, the authentication code storage request signal is a message type, message length, authentication code size, authentication code, IoT electronic device 200 information request command information, IoT electronic device 200 password, hashed IoT electronic device 200 password , And session IDs.

The message type is a value set to the first byte of every request signal or response signal and identifies a type of the authentication code request signal. Here, the message type is a type of signal. That is, the value is set in the first byte of the authentication code request signal, the type of the signal can be distinguished according to the set value.

The authentication code size refers to the capacity of the certificate itself. For example, the authentication code size may be 1000 bytes, and the authentication code is an authentication code generated by the device authentication server 600.

The IoT electronic device 200 information request command information is obtained by the hardware security module 100 taking a hash by logically calculating a client type and an arbitrary value previously stored in the hardware security module 100. That is, the IoT electronic device 200 information request command information is Hash (client type | arbitrary value). Here, the random value is a random number randomly generated by the current time or the hardware security module 100. Taking a value or taking a hash function means doing a hash. Taking a hash by logically computing a first value and a second value or taking a hash function means doing a hash (first value | second value).

The password of the IoT electronic device 200 taking the hash is a result of taking the hash function on the password of the IoT electronic device 200.

The session ID is an ID calculated by applying the hash function to the result of the logical operation of the hardware security module 100 by using the transaction ID, the serial number, the client type, and an arbitrary value. The random value is a time at which the session ID is generated or a random number randomly generated by the hardware security module 100.

The IoT electronic device 200 stores the signed authentication code received and transmits the authentication code storage response signal to the hardware security module 100 (S191). According to an embodiment, the authentication code storage response signal may include a message type, a message length, and a result code.

The message type is a value set in the first byte of every request signal or response signal and identifies a type of the authentication code request signal. The message type may be a signal type. That is, the value is set in the first byte of the authentication code storage response signal, the type of the signal can be distinguished according to the set value.

The message length is the message size minus the message type and the message length from the total message size, where size is the size. The authentication code store response signal includes a variety of other information, including the message type and the message length. The message length is the size of all information included in the authentication code store response signal, that is, the size and message length corresponding to the message type in the size. It may mean the size minus the size corresponding to. For example, if the size of the message type is 1 byte, the size of the message length itself is 4 bytes, and the size of the entire message is 85 bytes, the message length may be 80 bytes. Here, the size of the entire message is the size of the authentication code storage response signal.

The result code is a code indicating whether the authentication code was saved without error. For example, if the result code is 0, this may mean that the authentication code is stored in the IoT electronic device 200 without error.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

Claims

An access port connected to the IoT electronic device;

A communication interface for transmitting and receiving data from the IoT electronic device through a LoRa communication network; And

A processor for encrypting or decrypting data transmitted and received by the communication interface; Including;

The processor,

A plug-in manager configured to install, on the IoT electronic device, a security plug-in for transmitting and receiving encrypted data as the IoT electronic device and the connection port are physically connected;

Hardware security module comprising a.
The method of claim 1,

The processor,

An encryption unit configured to encrypt data transmitted / received with the IoT electronic device using at least one of ARIA, Secure Hash Algorithm (SHA), and end-to-end encryption encryption method;

Hardware security module further comprising.
The method of claim 1,

A device authenticator configured to authenticate the IoT electronic device; And

A device connection manager configured to manage a connection through a LoRa communication network of the IoT electronic device that has been authenticated by the device authenticator;

Hardware security module further comprising.
The method of claim 1,

The processor,

A server manager configured to manage an external server connected to the IoT electronic device through a LoRa communication network;

Hardware security module further comprising.
The method of claim 1,

The communication interface,

A communication converter converting communication data transmitted by the IoT electronic device into LoRa communication data;

Hardware security module further comprising.
The method of claim 1,

The communication interface,

According to the type of communication module embedded in the IoT electronic device,

Further comprising at least one of a secure Lora (LoRa) communication unit, secure serial communication unit and secure LPWAN communication unit,

Data transmitted and received through at least one of the secure LoRa communication unit, secure serial communication unit, and secure LPWAN communication unit and the LoRa communication network is encrypted or decrypted by the processor.

Hardware security module.
The method of claim 1,

Is connected to the communication interface,

Secure Ethernet communication unit and Ethernet over Ethernet communication (Power Over Ethernet port);

Hardware security module further comprising.
The method of claim 2,

The communication interface receives encrypted data from the device authentication server for transmitting an authentication code to the IoT electronic device through a LoRa communication network,

The processor decrypts the encrypted data received by the communication interface,

The device authentication unit performs authentication of the IoT electronic device based on the data decrypted by the processor.

Hardware security module.
The method of claim 1,

The connection port is a hardware security module, which is a port conforming to an IC card or a universal serial bus (USB) standard.