KR100455126B1 - Home network system providing security function - Google Patents

Abstract

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a home network system having a security function. In particular, the home gateway / home server provides a security service for various types of different digital devices on a home network. The objective is to enable intrusion prevention and intrusion detection. The present invention for this purpose is a home network system in which a plurality of digital devices are connected to the home gateway 310, using the middleware such as UPnP to check the information of the digital devices connected to the inside of the home network and remote security server 320 ), The security engine 311 for downloading and updating an optimized security module such as a coping module and a configuration for a security vulnerability or an attack method of the digital devices identified above is connected to the home gateway ( It is characterized in that the configuration provided in 310.

Description

Home network system with security function {HOME NETWORK SYSTEM PROVIDING SECURITY FUNCTION}

The present invention relates to a home network, and more particularly, to a home network system having a security function.

In general, a security environment of an enterprise network includes a firewall 110 for intrusion prevention and an intrusion detection system IDS 120 for intrusion detection, as shown in the configuration of FIG. 1.

The firewall 110 that blocks intrusion primarily blocks illegal access from an external network according to a corporate security policy.

In addition, since the firewall 110 is not able to prevent all types of attacks, the intrusion attempt passing through the firewall 110 is detected by the IDS 120. IDS 120 is largely divided into network type IDS and host IDS.

Recently, as various home appliances are commercialized as digital devices, a home network environment in which all devices in the home are connected to a single network using UPnP / Ethernet, 802.11 b / a, Bluetooth, LnCP (HnCP), and the like as shown in FIG. This is gradually spreading.

When the home network environment is established, not only can wired / wireless devices be connected to each other in the home to operate or send data, but also various digital devices in the home can be operated from outside the network.

Recently, in the security of the corporate network environment, the network traffic from the outside to prevent the security incidents by internal users as well as organically configure the firewall and IDS intrusion prevention and intrusion detection to effectively respond to illegal intrusions Of course, traffic on the internal intranet is also monitored.

Therefore, the security of the corporate network environment requires the monitoring of a lot of traffic, and since most of the connected devices on the corporate network are PCs or servers, many types of intrusions on them may put a heavy load on intrusion prevention and intrusion detection. do.

However, it is difficult to have a large-scale security equipment in a home network environment, and resources of a home gateway / home server are limited. Also, a home network environment is different from a corporate network environment.

Therefore, as the home network is proliferating, the risk of intrusion into the home network is increasing. Therefore, the security of the home network should be considered. However, even if the security of the home network is similar to that of the corporate network environment, It is unreasonable to apply it to home network security.

By the way, the devices connected to the home network have PCs, but most digital devices provide limited functions and services, so the external intrusion method is limited and the need for monitoring the internal network is relatively small.

Therefore, a more efficient security method can be implemented in a home gateway / home server environment with limited resources.

In order to solve the problems of the present invention, the home gateway can be implemented by specifying the firewall and intrusion detection (IDS) functions in accordance with the security environment of the home network so as not to lose the security environment of the home network. An object of the present invention is to provide a home network system having a security function created to reduce and improve security performance.

That is, an object of the present invention is to provide an intrusion prevention and intrusion detection of a home network effectively with limited resources by providing a security service that meets the characteristics of various types of different digital devices on a home network in a home gateway / home server. have.

1 is a configuration diagram showing a security system of a general corporate network.

2 is a block diagram of a general home network system.

Figure 3 is a block diagram showing a home network system for an embodiment of the present invention.

4 is an operation flowchart showing a security module configuration in an embodiment of the present invention.

5 is an operation flowchart showing a security module optimization process in an embodiment of the present invention.

6 is a flowchart illustrating an operation of executing a security function in an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

310: home gateway 311: security engine

320: security server

The present invention provides a home network system in which a plurality of digital devices are connected to a home gateway / home server in order to achieve the above object, by using middleware such as UPnP to check the information of digital devices connected inside the home network and A security engine that accesses a security server and downloads and updates an optimized security module such as a response module and a configuration for a security vulnerability or an attack method of the digital devices identified above to the home gateway / home server. It is characterized by comprising a configuration.

The type of digital devices can be checked manually.

The downloaded security module is a security module optimized according to types of devices, firmware or OS. For example, in the case of a PC, the security module is optimized according to the identification of the type of OS, OS version, patch or service pack. .

The security engine is configured to optimize security performance by determining policies and services of different intrusion blocking and intrusion detection for access from the outside.

The security engine executes different intrusion prevention and intrusion detection processes according to each packet's destination for external packets, so that other security tools such as virus prevention / remediation as well as optimized intrusion prevention and intrusion detection can be executed. Characterized in that configured to optimize.

The remote security server is characterized in that it is configured to update the information on the security of the various types of digital devices from time to time and to download at the request of the security engine of the home gateway / home server (310).

Hereinafter, the present invention will be described in detail with reference to the drawings.

The home network of the present invention requires a home gateway or a home server equipped with a security engine. In the embodiment of the present invention, a home gateway will be described.

3 is a block diagram of a home network system according to an exemplary embodiment of the present invention. In the home network system in which a plurality of digital devices are connected to the home gateway 310, the home network system uses middleware such as UPnP. Check the information of the digital devices connected inside the network and access the remote security server 320 to optimize the security module, such as coping module and configuration for security vulnerabilities or attack methods of the digital devices identified above. A security engine 311 for downloading and updating is provided in the home gateway 310.

The remote security server 320 updates the security information of various types of digital devices from time to time and stores them in a database, and downloads the security information updated at the request of the security engine 311 mounted in the home gateway 310. Configure to

The security engine 311 is configured to execute firewall and intrusion detection (IDS) functions.

The operation and the effect of the embodiment of the present invention constructed as described above will be described with reference to FIGS. 4 to 6.

4 is an operation flowchart showing a security module configuration, FIG. 5 is an operation flowchart showing a security module optimization process, and FIG. 6 is an operation flowchart showing a security function execution process.

First, the security engine 311 mounted on the home gateway 310 supports UPnP, Jini, and the like, and automatically recognizes information of digital devices on a home network supporting UPnP or Jini and stores the list in a database.

If other digital devices on the home network that do not support UPnP, Jini, or the like, the security engine 311 pre-downloads the list from the remote security server 320 and stores the list in a database. By using the access to the security engine 311 to manually select the list.

The security information that the security engine 311 downloads from the remote security server 320 and stores in the database includes a list of digital home devices that are secured and information about digital devices that are currently connected to the home gateway 311. , Model, firmware and version), and a list of network address pairs. If the PC is on a home network, the PC includes information such as an OS, an OS version, a security patch, and a service pack.

Thereafter, when there are new or upgraded digital devices in the home network, the security engine 311 updates the list of devices on the home network and connects to the remote security server 320 by SSL or VPN. Download the security module for the devices in a pop way and save it in the database.

In addition, the remote security server 320 frequently updates the security module for new devices or a newly discovered network intrusion method, etc., and the home gateway 310 registered when the security module for the corresponding devices is updated. It can also be downloaded and updated by the push to the security engine 311.

Accordingly, the security engine 311 performs an intrusion blocking and intrusion detection function using the optimized security module as a basic configuration.

In addition, in order to optimize the security of devices that do not support UPnP and Jini functions, the user may access the security engine 311 through PC (PC) and select an external network access function and a service provided for each device as a list. . For example, you can set up FTP, telnet, and HTTP services for PCs on your home network, and externally access to digital TVs.PVRs and digital air conditioners can only be accessed from certain external control ports. Can be set to enable.

Therefore, in the above process, the security engine 311 is configured in an optimized state according to the downloaded security module and configuration.

If the configuration or the connected devices are changed, the security engine 311 performs the same process as above to perform security module optimization.

This minimizes the resources required for intrusion prevention and intrusion detection. For example, if intrusion prevention is blocking the PC's telnet service, the IDS of the security engine 311 can exclude the detection module of the intrusion method through the telnet service, and the digital TV can If the firewall is blocked, the security engine 311 can exclude the intrusion detection module related to the digital TV from IDS. If the firmware of the PVR is upgraded and the existing security bug is resolved, the detection module for the intrusion is detected. Can be excluded.

In addition, the security engine 311 operates in association with a network address or physical port in the home network. That is, the security engine 311 may operate intrusion blocking and intrusion detection by dividing the ports not only in software but also in hardware in some cases. This is the same when using a network address translator (NAT) in the home gateway 310.

For example, the firewall checks the destination of the packet from the outside according to the configuration of the security engine 311, and executes intrusion blocking according to the security policy. That is, as shown in the operation flowchart of FIG. 6, when the packet destination is a specific device, if the packet wants to access a service that is not supported according to the configuration, the packet may be dropped. Therefore, various services such as PC may be used. This can avoid wasting resources to inspect packets destined for their destination.

In addition, the intrusion detection system (IDS) needs to check the destination address of the packet and check only the intrusion to the corresponding device. In addition, in the case of most digital appliances that provide only limited functions and network services compared to PCs, intrusion methods are also very limited, so optimized IDS functions are much simpler than current IDSs. In addition, the amount of signatures used in the analysis is reduced so that resources can be minimized.

For example, assuming that there are two PCs PC1 and PC2 on the home network, the PC PC1 blocks the telnet service and the PC2 allows the PC. The firewall simply drops the packet if it is for telnet access, eliminating the need for intrusion detection for telnet access to the PC (PC2). In addition, assuming a digital device configured to only be turned on and off from the outside, packets destined for the digital device are prevented from accessing other than the on / off operation at the firewall, and only a simple IDS function is performed. Save.

Meanwhile, the operation of the home gateway 310 has been described above, but the same operation is performed even when the home server is connected.

As described in detail above, the present invention can maximize the effects of intrusion prevention and intrusion detection in a home gateway / home server with limited resources by providing a security function specific to a home network when a device change or a new security module is upgraded. It has an effect.

In addition, the present invention can also be applied to other security fields, such as virus blocking / treatment.

Claims (6)

In a home network system to which a plurality of digital devices are connected, Using middleware to check the information of digital devices connected inside the home network and access the remote security server to download and update the optimized security information on the security vulnerabilities or intrusion methods of the digital devices identified above A home network system with a security function, comprising a security engine provided in a home gateway / home server. The method of claim 1, wherein the security engine Security function characterized in that the list is pre-downloaded from the remote security server and stored in the database so that the user can manually select a list of other digital devices on the home network that do not support UPnP or Jini. One home network system. The method of claim 1, wherein the security engine Configured to optimize security performance such as intrusion prevention, intrusion detection, and antivirus / remediation by determining different intrusion prevention and intrusion detection policies and services by referring to security information downloaded from a remote security server for external access. Home network system with a security function, characterized in that. The method of claim 1, wherein the remote security server A home network system having a security function, characterized in that the security information of various types of digital devices is updated from time to time and configured to download at the request of a security engine. The method of claim 1 or 4, wherein the security server It is configured to update security module about new devices or newly discovered network intrusion method from time to time, and to download and update by pushing method to registered security engine when security module for relevant devices is updated. A home network system equipped with a security function. The method of claim 1 or 4, wherein the security information is Security Home network system with a security function, characterized in that the device-related information, such as a list of digital home devices, information (digits, firmware, version, etc.) of the digital devices, a list of network address pairs.