WO2023101399A1

WO2023101399A1 - System for managing security of large amount of data

Info

Publication number: WO2023101399A1
Application number: PCT/KR2022/019175
Authority: WO
Inventors: 박한나; 정해일; 조성민
Original assignee: 주식회사 시옷
Priority date: 2021-11-30
Filing date: 2022-11-30
Publication date: 2023-06-08
Also published as: KR102376435B1

Abstract

The present invention relates to a system for managing security of a large amount of data, the method establishing a secure communication channel between internet-of-things (IoT) devices in IoT, classifying data that is transmitted and received by means of the secure communication channel as either a small amount of data or large amount of data, and, on the basis of the size, using different methods of encryption.

Description

Security processing system for large data

The present invention relates to a security processing system for large-capacity data, and more particularly, to an IoT security system capable of encrypting large-capacity data transmitted and received between devices constituting the Internet of Things at high speed.

Recently, with the rapid increase in Internet of Things (IoT) services, the security of Internet of Things (IoT) devices has become an issue. A general-purpose IoT device is equipped with open source-based software such as Python, PHP, and OpenSSL along with a hardware platform that provides various functions and services between users and objects through Internet access.

The advantage of this open source based IoT platform is that it is easy for users to add or develop various functions. However, there are threats to file confidentiality such as personal information leakage, and in particular, device cloning may be vulnerable.

Attacks on IoT devices are steadily increasing, and cases of stealing transmission data, using default accounts and passwords, and forming large-scale botnets to form DDoS attacks and damage to devices are continuously reported. .

Accordingly, although security products for IoT devices have recently been used, conventional IoT security products must be applied when designing and developing IoT devices, and products that do not reflect security during design and development have limitations in applying security in the conventional way after installation. There is a problem with that.

In addition, most IoT devices are difficult to apply security in the form of software due to lack of resources, and in the case of software security products that have been deployed and installed, they must be provided in accordance with the device development environment, so there is a limit to supporting various IoT device development environments. there is

On the other hand, the above-mentioned background art is technical information that the inventor possessed for derivation of the present invention or acquired in the process of derivation of the present invention, and cannot necessarily be said to be known art disclosed to the general public prior to filing the present invention. .

One aspect of the present invention provides an IoT security system capable of encrypting data transmitted and received through a secure communication channel by forming a secure communication channel between devices constituting the IoT.

The technical problem of the present invention is not limited to the technical problem mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

A security processing system for large-capacity data according to an embodiment of the present invention forms a secure communication channel between IoT devices constituting the Internet of Things and encrypts data transmitted and received through the secure communication channel in different ways according to the size of the data. contains the module

The secure hub module,

A channel setting unit for setting a secure communication channel between IoT devices requiring communication; and

An encryption unit for encrypting data transmitted to and received from the IoT device through a secure communication channel through a preset encryption algorithm is included.

The encryption unit,

Classifying data transmitted and received through the secure communication channel as either low-capacity data or large-capacity data,

If it is determined that the data transmitted and received through the secure communication channel is low-volume data, the reception time of the data received through the secure hub module is converted into a binary number, the converted binary number is divided into two sections, and the binary number included in the first section is divided into two sections. A first variable converted into a decimal number and a second variable obtained by converting the binary number included in the second interval into a decimal number are generated, and a first prime number closest to the first variable and a second prime number closest to the second variable are generated. setting, generating a private key and a public key using the set first and second prime numbers, and encrypting the data using the generated private key and public key.

According to one aspect of the present invention described above, a secure communication channel is formed between devices constituting the Internet of Things, and data transmitted and received through the secure communication channel may be encrypted.

1 is a block diagram showing a schematic configuration of a large data security processing system according to an embodiment of the present invention.

2 and 3 are flowcharts illustrating specific functions of the secure hub module shown in FIG. 1 .

4 is a diagram illustrating a specific example of encrypting low-capacity data.

5 is a diagram illustrating a specific example of encrypting large-capacity data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The detailed description of the present invention which follows refers to the accompanying drawings which illustrate, by way of illustration, specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable one skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different from each other but are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in another embodiment without departing from the spirit and scope of the invention in connection with one embodiment. Additionally, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the detailed description set forth below is not to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all equivalents as claimed by those claims. Like reference numbers in the drawings indicate the same or similar function throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a conceptual diagram showing a schematic configuration of a large data security processing system according to an embodiment of the present invention.

The IoT security system 1000 according to the present invention includes at least one IoT device 100, a gateway connected to the IoT device 100 to form an internal network, and connected to the IoT platform 300 to build an external network. 200 and a secure hub module 400 that is connected to the gateway and encrypts data transmitted through the internal network and the external network.

That is, the security hub module 400 is a gateway 200 to improve the security of data transmitted and received through the Internet of Things in an already built IoT environment such as the IoT device 100, the gateway 200, and the IoT platform 300. As a device installed on the ) side, it can be physically connected to the gateway 200.

2 and 3 are diagrams illustrating a detailed configuration of the secure hub module 400 .

As shown, the secure hub module 400 transmits and receives data to and from IoT devices through a secure communication channel through a channel setting unit 410 that establishes a secure communication channel between IoT devices requiring communication and a preset encryption algorithm. It includes an encryption unit 420 that encrypts data.

At this time, the encryption unit 420 includes a data classification unit 421 that classifies data transmitted and received through the secure communication channel as either low-capacity data or large-capacity data, and encrypts the data classified as low-capacity data by the data classification unit. It includes a low-capacity data encryption unit 422 and a large-capacity data encryption unit 423 that encrypts data classified as large-capacity data by the data classification unit.

The data classification unit 421 may classify data into either low-capacity data or large-capacity data based on a preset reference data size value (eg, 10mb).

4 is a diagram showing a specific example of encrypting data in the low-capacity data encryption unit 422 .

As shown, when it is determined that data transmitted and received through the secure communication channel is low-capacity data, the low-capacity data encryption unit 422 converts the reception time of the data received through the secure hub module into a binary number, and converts the converted binary number into a binary number. Divide into two sections.

For example, when the converted binary number is an eight-digit number, the low-capacity data encryption unit 422 causes the first four binary numbers to be included in the first section, and then allows the four binary numbers to be included in the second section. If all of the converted binary numbers are odd, it may be configured to include one more binary number in the first interval. For example, when the converted binary number is a 9-digit number, 5 binary numbers from the beginning are included in the first section, and then 4 binary numbers are included in the second section.

Thereafter, the low-capacity data encryption unit 422 generates a first variable obtained by converting the binary number included in the first section into a decimal number and a second variable obtained by converting the binary number included in the second section into a decimal number, and A first prime number closest to a second prime number and a second prime number closest to a second variable are set, a private key and a public key are generated using the set first prime number and the second prime number, and the generated private key and public key are use to encrypt the data.

The mass data encryption unit 422 encrypts relatively large amounts of data such as images and videos.

In one embodiment, as shown in FIG. 5 , the bulk data encryption unit 422 may divide the bulk data into a plurality of seed blocks and encrypt each of the divided seed blocks through a preset block cipher algorithm.

Here, the preset block cipher algorithm may be the SEED standardization algorithm, which is a block cipher algorithm in which the input/output processing basic unit (block size) is 128 bits, the size of the input key is 128 bits, and the number of rounds is 16 rounds, but is not limited thereto. Various block encryption algorithms that have been widely used may be applied.

In some other embodiments, the bulk data encryption unit 422 encrypts the bulk data with another encryption method.

To this end, the mass data encryption unit 422 includes a region of interest setting unit and a conversion unit.

The region of interest setting unit sets a region to be encrypted among the entire regions of the captured image as the region of interest.

That is, the region-of-interest setting unit performs image analysis on large-volume data in the form of an image, and detects a characteristic part requiring encryption among the entire region of the original image, so that the conversion unit to be described later partially encrypts only the set region and requests data processing. It is possible to reduce the amount of computation and time to be performed.

To this end, in one embodiment, the region of interest setting unit extracts a plurality of objects constituting the original image, sets an object corresponding to a pre-learned object among the plurality of extracted objects as a feature object, and sets the feature object It is characterized in that the region of interest is set to be included.

In one embodiment, the region of interest setting unit extracts a feature vector from the captured image, inputs the extracted feature vector as an input value of an artificial neural network that has been trained in advance, and selects a plurality of objects included in the captured image based on the output value. can be distinguished. Since the object detection method using such an artificial neural network is a technique widely used in the image processing field, a detailed description thereof will be omitted.

In one embodiment, the ROI setting unit may set the ROI using a histogram of image data.

The histogram is information representing the distribution of contrast values for pixels of an image.

The ROI setting unit may generate an entire histogram of pixels constituting the captured image and a partial histogram of a predetermined region of the captured image.

The region of interest setting unit separates the original image into R, G, and B channels, and for each of the separated channels, the horizontal axis represents the contrast value of a 256 gray level image with a brightness deviation of 256, and the vertical axis represents the frequency of each contrast value. A histogram representing can be created. Since a specific method for generating a histogram is a known technique, further detailed description will be omitted.

The ROI setting unit may select a convolution filter for extracting the ROI using the full histogram and partial histogram of the original image.

A convolution filter is a matrix composed of arbitrary pixel sizes used to process a reference image, which is an image corresponding to a region of interest in a reference frame, with various effects, and is also called an image kernel or a convolution kernel. The region of interest setting unit stores various types of convolution filters, and may include, for example, blurring, sharpening, outlining, and embossing convolution filters. In addition to this, the image processing device 100 may further include various types of convolution filters set by the user or collected from external devices.

The ROI setting unit may generate an output image by applying a convolution filter to the photographed image. Specifically, the region of interest setting unit may store convolution filters composed of a 3X3 matrix, and a numerical value may be set for each convolution filter for each matrix element. For example, values of 1, 0, 1, 0, 1, 0, 1, 0, 1 may be sequentially set from the top left of the convolution filter.

The region-of-interest setting unit calculates an output value of the corresponding pixel by performing a convolution operation with a convolution filter with any one pixel constituting the reference image and pixels adjacent to the corresponding pixel, and may set the region of interest using the calculated output value.

For example, the ROI setting unit may compare a previously stored reference value with an output value calculated for each pixel, select a pixel having an output value most similar to the reference value, and set an area within a predetermined radius based on the selected pixel as the ROI.

The conversion unit rearranges all pixels included in the ROI set by the ROI setting unit, and encrypts the original and changed locations of the rearranged pixels using a blockchain.

The conversion unit may move the pixels in the region of interest to a position different from the original position by using a predetermined jigsaw pattern. Alternatively, the conversion unit may rearrange each pixel in an arbitrary position other than a predetermined pattern.

Thereafter, the conversion unit generates a private key based on the pixel size of the region of interest, generates a public key based on the generated private key, and transaction information indicating a changed position of a pixel included in the region of interest from the original position. Converts to a hash value using a hash function, and generates a digital signature for the transaction information by encrypting the hash value using the private key. A specific function of the conversion unit will be described later.

In an embodiment, the conversion unit generates a third variable by counting the number of pixels on the horizontal axis of the region of interest, and generates a fourth variable by counting the number of pixels on the vertical axis of the region of interest.

The conversion unit sets a prime number closest to the third variable as a third prime number, sets a prime number closest to the fourth variable as a fourth prime number, and uses the set third and fourth prime numbers to generate the private key. and generating the public key.

That is, the conversion unit may encrypt the region of interest in which positions of pixels are rearranged through an asymmetric encryption method.

This private key-public key generation method uses the RSA encryption algorithm, and since the RSA encryption algorithm is a widely publicized technology, a detailed public key generation process will be omitted.

In this case, the conversion unit transmits the generated public key to other IoT devices through a secure channel, and when the IoT devices receive the encrypted data, they can decrypt it using the public key received from the conversion unit.

In another embodiment, the conversion unit generates a first histogram for the captured image and a second histogram for the region of interest, analyzes the first histogram, sets a brightness value with the highest frequency as a first variable, and sets the first histogram to the first histogram. 2 The histogram is analyzed, the brightness value having the highest frequency is set as a second variable, and the private key and the public key are generated using the set first and second prime numbers.

In this case, when the first variable and the second variable have the same brightness value, the conversion unit 300 resets a brightness value having a higher next-order frequency in the second histogram as a second variable.

In particular, the conversion unit according to the present invention holds the transmission process of the data until the number of image data to be encrypted is accumulated and stored by a predetermined number, and then confirms that the number of encrypted image data is accumulated and stored by a predetermined number. , variable data representing characteristics of the accumulated and stored data group is set, and the image data is encrypted based on the set variable data.

To this end, the conversion unit bundles the accumulated and stored collected data into data groups, extracts data groups to be transmitted, sets variable data according to the characteristics of the extracted data groups, and creates transformed data that connects the set variable data to each collected data. The generated transformed data is converted into a hash value through a hash function and registered in the blockchain network.

In this case, the conversion unit according to the present invention generates variable data based on the reference value received from the manager terminal, and converts the image data into a hash value based on the variable data, so that security of the image data can be improved.

That is, even if a third party other than the user obtains the image data from the middle, it is difficult to verify the original data because the pixels of the region of interest, which is the core feature of the image data, are rearranged. Because it is newly generated every time by the characteristic, it has the advantage that it is difficult to find out the private key and public key from the outside.

Such technology may be implemented as an application or implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer readable recording medium may include program instructions, data files, data structures, etc. alone or in combination.

Program instructions recorded on the computer-readable recording medium may be those specially designed and configured for the present invention, or those known and usable to those skilled in the art of computer software.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like.

Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter or the like as well as machine language codes such as those produced by a compiler. The hardware device may be configured to act as one or more software modules to perform processing according to the present invention and vice versa.

Although the above has been described with reference to embodiments, it will be understood that those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention described in the claims below. You will be able to.

Claims

A secure processing system for large amounts of data, including a secure hub module that forms a secure communication channel between IoT devices constituting the Internet of Things and encrypts data transmitted and received through the secure communication channel in different ways according to the size of the data.
According to claim 1,

The secure hub module,

A channel setting unit for setting a secure communication channel between IoT devices requiring communication; and

An encryption unit for encrypting data transmitted to and received from an IoT device through a secure communication channel through a preset encryption algorithm, a system for processing large-capacity data security.
According to claim 2,

The encryption unit,

a data classification unit that classifies data transmitted and received through the secure communication channel as either low-capacity data or large-capacity data; and

When it is determined that the data transmitted and received through the secure communication channel is large-capacity data, a large-capacity data encryption unit that divides the large-capacity data into a plurality of blocks and encrypts each of the divided blocks using a preset block cipher algorithm, A secure processing system for large amounts of data.