KR100789354B1 - Method and apparatus for mataining data security on network camera, home gateway and home automation - Google Patents

Abstract

The present invention relates to a method and apparatus for maintaining security in transmitting data based on a network between a server and a client of a network camera, a home gateway, and a home automation device. A method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, the method comprising: generating and generating an attempt value of a server in response to a client connection request signal; Sending the server's challenge value to the client Receiving the client's response value from the client, Receiving the ID from the client, Computing the expected response value from the client with the password and the attempt value corresponding to the ID received from the client Comparing the response value of a client and authenticating the authentication information, generating an electronic information encryption key, generating a secret key to encrypt the electronic information encryption key, and using the secret key as an element. With symmetric key cryptographic algorithm Encrypting, transmitting an encrypted electronic information encryption key to the client, encrypting the electronic information with a symmetric key cryptographic algorithm using the electronic information encryption key as an element, and transmitting the encrypted electronic information to the client. do.

Network, security, encryption, decryption, random numbers

Description

Method and apparatus for mataining data security on network camera, home gateway and home automation             

1 is a diagram schematically showing a server and a client for transmitting and receiving data based on a network according to a preferred embodiment of the present invention.

2 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to a preferred embodiment of the present invention.

3 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to another preferred embodiment of the present invention.

4 is a schematic diagram of a server and a client for transmitting and receiving data based on a network according to another preferred embodiment of the present invention.

5 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to another preferred embodiment of the present invention.

6 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to another preferred embodiment of the present invention.

7 is a signal flow diagram illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to an exemplary embodiment of the present invention.

8 is a signal flow diagram illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to another exemplary embodiment of the present invention.

9 is a signal flow diagram illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to another embodiment of the present invention.

10 is a flowchart illustrating a process of transmitting encrypted electronic information of a client to a server according to an exemplary embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

101... Server 102a, 102b... Client

103... Encryption / decryption unit 105. Attempt value generator

107... Control unit 109. Database

111... Input / output section 113. Network

117a, 117b... Input / output sections 119a and 119b. Encryption / Decryption Department

121a, 121b... Control unit 120a, 120b. Response value generator

201... Server 203a, 203b... Client

204... Network 205... Video Information Collector                 

207... Voice information collection unit 209. User data generator

211... Automation control unit 213. Multiplex part

215... Data conversion section 217. Control

219... .Compression unit 221... Attempt value generator

223... Encryption / decryption unit 225. I / O part

229a, 229b... Input / output units 231a, 231b... Encryption / Decryption Department

232a, 232b... Response value generators 233a, 233b... Control

301... Data storage unit 401a, 401b... Attempt value generator

403a, 403b... Response value generator 405. Response value generator

501... Response value generators 502a, 502b... Attempt value generator

503a, 503b... Response value generator 601. Response value generator

602a, 602b... Attempt value generator 603a, 603b... Response value generator

The present invention relates to a method and apparatus for maintaining security in transmitting data based on a network between a server and a client of a network camera, a home gateway, and a home automation device.

In general, security can be divided into system security and network security in a network environment. System security is the security of the computers and network devices (routers, etc.) that make up the Internet, including security for operating systems, client / server applications, file systems, and so on.

Network security is the security of data transmitted over the network. The most important factor is the security of the communication protocols connecting the system. Network security refers to data protection transmitted through all communication protocols such as TELNET, FTP, HTTP, SMTP, etc., and is standardized by standards organizations because inter-operability is required due to network characteristics.

Where Ethernet is currently used, not only can data be intercepted within that subnet, there are even programs that record them.

In general, a lot of encryption methods are used to protect information about data on the network. Incorrectly designed protocols with only simple encryption can be attacked through replays. The hacker can achieve the same result by replaying the observed communication contents even if they do not know the contents of the data. Therefore, when performing encrypted communication in addition to simple encryption, data is usually encrypted including various information.

There are various encryption methods such as hash encryption method, symmetric key encryption method, and public key encryption method.

Symmetric key cryptography is a cryptographic system that knows a key that is the same as the encryption key and the decryption key, or knows one easily.

Symmetric key cryptography is E _k = D _k When two keys are the same or when one key is known, the other key can be easily known. The sender and receiver must share the key beforehand. The security of this cryptosystem depends on the key, which can be expressed as in Equation 1.

Symmetric key cryptography is a combination of simple substitution and permutation of the internal structure of the algorithm compared to public key cryptography, which leads to low computational complexity, easy implementation of appropriate cryptographic algorithms for system environments, and fast encryption / decryption. It can be easily integrated with other cryptographic techniques such as random number generators and hash functions. In the symmetric key encryption method, the encryption key size is relatively smaller than that of the public key encryption system. However, symmetric key cryptography requires the same key to be shared among information exchange parties, so that one user has to maintain many keys when exchanging information with multiple people. Representative examples of symmetric key encryption include SEED, AES (Rijndael), 3DES, GOST, IDEA, and SKIPJACK (3).

In public key method, after generating a key pair, one public key can be disclosed to the other party, and then the data can be protected or satisfied with integrity, authentication, and denial of service. That's how it is. A key pair refers to a key pair of an asymmetric encryption algorithm. If a key is encrypted, the key pair can be decrypted with only one key.

The public key scheme can be used for two purposes. First, the public key method is used for data protection since only the receiver can obtain information by decrypting when the sender encrypts and transmits it with the receiver's public key. Second, in the public key method, when the sender transmits the data encrypted with his private key, the receiver can obtain the information of the data received by the sender's public key. It can be used for the function which can block | block.

There are two keys used in public key cryptography, one for encryption and one for decryption. Therefore, in public key encryption, two key pairs (private key and public key) are generated when a key is generated for encryption. Here, the key used for encryption is a public key and the key used for decryption is a private key. In order to easily verify the authenticity of a public key, public key cryptography requires authentication of the public key through a third party before the public key is disclosed to the other party.

Hash encryption is widely used for digital signatures. In the hash encryption method, the sender signs the hash code h (M), which is the result of taking the hash function on the input M, with the secret key, and the receiver verifies it with the public key, and as a result, the hash function h (M) is applied to the received M. The authenticity of the signature is compared with the result. In addition, the hash encryption scheme may be utilized for the integrity of information. The hash encryption method can verify the integrity of information by calculating the hash code of the information to be verified and securely storing it, and then calculating the hash code and comparing the stored hash code with a value when integrity verification is needed. The hash function h is either a collision free hash function, or a strong one-way hash function (SOWHF) and a weak one-way hash function (WOWHF), depending on its safety. You can share it.

 Hash function h must have four conditions: First, the hash function h must be applicable to any size input M. Second, the hash function h must yield a constant output H = h (M). Third, the hash function h should be easy to calculate H = h (M) given h and M. Fourth, given the hash function H = h (M), the inverse calculation of M must be impossible to calculate. The four conditions apply in common to the hash function h, which belongs to the most basic definition that a hash function must have.

The hash algorithm includes the MD5 algorithm. The MD5 algorithm is an improvement on the MD4 algorithm developed by Ron Rivest in 1990. It is based on a hash function designed for fast software implementation. The MD5 algorithm is designed primarily for use in digital signature applications where large files are encrypted and compressed with private (or secret) keys in public-key cryptography systems such as RSA. The MD5 algorithm is an extension of the MD4 algorithm, which is slightly slower than MD4 but more robust in structure.

Conventionally, due to the rapid development of the communication network, such as the Internet, there are advantages that many people can share information. On the contrary, there are cases where the information communication technology having such an advantage is reversely used for crime.

Conventional network cameras, home gateways, and home automation devices have been studied in which only a specific user having an identifier and a password accesses a surveillance camera terminal device installed by a user remotely and observes an operation state through a network. In fact, because unencrypted data is transmitted in the network, there is a security problem that others can observe the operating state of the surveillance camera and use it for crime.

In the conventional network-based data security maintenance method, there is a problem that the user's identifier and password are exposed to the network in an unencrypted state, and the information is leaked by being intercepted during transmission. There is a cost to get public key authentication.

Accordingly, an object of the present invention is to perform authentication and distribution / registration of an electronic information encryption key between a server and a user only with a password of a user previously secretly shared between a server and a user in a process of transmitting and receiving data through a network. Provided are a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system that can perform encryption / decryption of data transmitted and received using an information encryption key as a secret key of a symmetric key encryption algorithm.                         

Another object of the present invention is to authenticate a user by using a symmetric key cryptographic algorithm or a hash algorithm having a low computational complexity, without using a public key-based cryptographic algorithm that has a large computational complexity and a cost for receiving public key authentication. And a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system capable of performing authentication on a server.

It is another object of the present invention to provide multimedia data or control data using a symmetric key cryptographic algorithm having a low computational complexity without using a public key-based cryptographic algorithm having a large computational complexity and a high cost in receiving public key authentication. The present invention provides a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system that can distribute a symmetric key (electronic information encryption key) required for encryption / decryption.

Another object of the present invention is to use a symmetric key (electronic information encryption key) distributed by the symmetric key cryptographic algorithm in both directions to encrypt and transmit multimedia data or control data between the server and the client with the symmetric key cryptographic algorithm. The present invention provides a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system for encrypting and decrypting.

Another object of the present invention is a network camera, a home gateway, and a home that encrypts and decrypts electronic information provided by a server in a process of transmitting and receiving data through a network to prevent unauthorized unauthorized theft of unauthorized information. It is to provide a method and apparatus for maintaining data security in an automation system.

Another object of the present invention is a network camera, a home gateway that encrypts and decrypts in both directions to prevent the leakage of information when it is necessary to transmit data that needs to be kept confidential in the process of transmitting and receiving data through a network. And a method and apparatus for maintaining data security in a home automation system.

According to an aspect of the present invention, in order to achieve the above objects, in a method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, a client request for connection Generate an attempt value of the server in response to the signal, and transmit the generated attempt value of the server to the client, receive a response value of the client from the client, receive an ID from the client, a password corresponding to the ID, and the attempt Calculates a response value expected from the client by comparing with the client's response value received from the client, and if the authentication result is valid, generates an electronic information encryption key and generates a secret key for encrypting the electronic information encryption key. Secret key Encrypts the electronic information encryption key with a symmetric key encryption algorithm, transmits the encrypted electronic information encryption key to the client, encrypts the electronic information with the symmetric key encryption algorithm using the electronic information encryption key as an element, and encrypts the encrypted information. Transmit the electronic information to the client, extract the electronic information encryption key from the encrypted electronic information encryption key received by the client, and perform symmetric key decryption of the received encrypted electronic information using the extracted electronic information encryption key as an element; A method of maintaining data security based on a network camera, a home gateway and a home automation device, and a system corresponding to the method may be provided.

In a preferred embodiment, the trial value may be at least one of a random number, a sequence number, and a timestamp.

In another preferred embodiment, the response value of the client may be a hash function to which the password and the attempt value of the server are applied.

In another preferred embodiment, the response value of the client may be a hash function with a secret key to which the client's password and the server's challenge value are applied.

In another preferred embodiment, the response value of the client may be a symmetric key cryptographic algorithm to which the client's password and the server's challenge value are applied.

In another preferred embodiment, the password is the password of a client previously secretly shared between the server and the client.

In another preferred embodiment, the ID may be received at the same time or differently from the response value of the client.

In another preferred embodiment, the network camera, home gateway and home automation device based data security maintenance method may transmit a client authentication approval signal to the client.

In another preferred embodiment, the electronic information encryption key is used for symmetric key encryption and symmetric key decryption of electronic information.

In another preferred embodiment, the electronic information encryption key may be selected randomly.

In another preferred embodiment, the electronic information encryption key may be generated by updating every predetermined time or if necessary.

In another preferred embodiment, the secret key is a secret key of a symmetric key cryptographic algorithm required to encrypt the electronic information encryption key.

In another preferred embodiment, the secret key can be generated by processing the challenge value and password in a mutually agreed manner.

In another preferred embodiment, the client may generate a secret key for extracting the electronic information encryption key by decrypting the encrypted electronic information encryption key corresponding to the client authentication approval signal.

In another preferred embodiment, the secret key is a secret key of a symmetric key cryptographic algorithm.

In another preferred embodiment, the secret key may be generated by processing the server's challenge value and password in a mutually agreed manner.

According to another aspect of the present invention, in a method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, the server may correspond to a connection request signal of a client. Generate an attempt value and send the generated server's attempt value to the client, receive a client's response value from the client, receive an ID from the client, receive a client's challenge value from the client and correspond to the ID The response value expected from the client is calculated using the password and the attempt value of the server, and the authentication value is compared with the response value of the client received from the client. Cline And a server authentication approval signal from the client, generate an electronic information encryption key corresponding to the server authentication approval signal, generate a secret key to encrypt the electronic information encryption key, and convert the electronic information encryption key into a symmetric key encryption. Encrypting with an algorithm and transmitting the encrypted electronic information encryption key to the client, encrypting the electronic information with a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the encrypted electronic information to the client, Extracting the electronic information encryption key from the received encrypted electronic information encryption key, and extracting the electronic information by performing symmetric key decryption of the received encrypted electronic information using the extracted electronic information encryption key as an element Camera, Home Gateway, and Home Auto It is possible to provide a device-based data security maintenance method and a system corresponding to the method.

In a preferred embodiment, the attempt value of the server and the attempt value of the client may be at least one of a random number, a sequence number, and a timestamp.

In another preferred embodiment, the server's response and the client's response may be a hash function with a password and a secret key to which the server's challenge is applied.

In another preferred embodiment, the response value of the server and the response value of the client may be a hash function to which a password and an attempt value of the server are applied.

In another preferred embodiment, the response value of the server and the response value of the client may be a symmetric key cryptographic algorithm to which a password and an attempt value of the server are applied.

In another preferred embodiment, the password is the password of a client previously secretly shared between the server and the client.

In another preferred embodiment, the ID and the challenge value of the client may be received simultaneously or differently from the response value of the client.

In another preferred embodiment, the server authentication approval signal is a result of the client comparing the response value of the server by calculating a response value expected from the server using a password corresponding to the ID and the client's challenge value.

In another preferred embodiment, the electronic information encryption key may be generated by the client.

In another preferred embodiment, the client can generate a secret key of a symmetric key cryptographic algorithm required to encrypt the electronic information encryption key.

In another preferred embodiment, the electronic information encryption key may be selected randomly.

In another preferred embodiment, the electronic information encryption key may be generated by updating every predetermined time or if necessary.

Next, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to a method and apparatus for maintaining security in transmitting data based on a network between a server and a client of a network camera, a home gateway, and a home automation device.

A computer which is a terminal device of the client may be connected to a network via wired / wireless, and a personal mobile communication terminal may be connected to a wireless network .

The client uses the terminal device By connecting to the server of home gateway and home automation device, it is possible to receive data such as video, audio and electronic device status of user's home, work place, etc., and to control electronic devices by sending control signal to the server. have.

For example, if the user wants to control the heating of the house from the outside, the client connects to the server of the home gateway and the home automation device using a terminal device, performs an authentication procedure, and then transmits a desired control signal to the outside of the house. I can regulate heating. In addition, the client may access the server of the network camera, the home gateway, and the home automation device to check the video, audio, and electronic device status of the home through the network camera. In this case, the authentication and data transmission and reception between the server and the client must be accompanied by encryption and decryption for the security of personal information.

1 is a diagram schematically illustrating a server and a client for transmitting and receiving data based on a network according to an exemplary embodiment of the present invention.

Referring to FIG. 1, in a server and a client transmitting and receiving data based on a network, the server 101 includes an encryption / decryption unit 103, a trial value generation unit 105, a control unit 107, and a database 109. And an input / output unit 111, and the clients 102a, 102b, hereinafter referred to as 102, and the input / output units 117a, 117b, hereinafter referred to as 117, and the encryption / decryption unit 119a, 119b, hereinafter referred to as 119). And response value generators 120a and 120b (hereinafter referred to as 120) and controllers 121a and 121b and referred to as 121 below. In this case, the server 101 and the client 102 are connected to each other through a network 113. The network network 113 includes both wired and wireless network networks.

The encryption / decryption units 103 and 119 encrypt a required data among data transmitted and received between the server 101 and the client 102 or decrypt the encrypted data again. Here, the encryption method may use a symmetric key encryption algorithm such as SEED, AES (Rijndael), 3DES.

The attempt value generator 105 generates a trial value (Cha_S) of the server required for the client authentication procedure in response to the access request signal of the client 102. Here, the attempt value Cha_S may be a random number, a sequence number, a timestamp, or the like.                     

The response value generator 120 generates a response value Res_C of the client corresponding to the attempt value Cha_S of the server in a method promised between the server and the client. Here, the method promised between the server and the client may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

The database 109 stores electronic information, user information, and the like. Here, the electronic information may include image data, audio data, home automation control data, electronic device state information, and the like.

The input / output units 111 and 117 convert and transmit / receive data between the server 101 and the client 102 so that they can be moved through the network network 113.

The controllers 107 and 121 control the input / output units 111 and 117, the encryption / decryption units 103 and 119, the trial value generation unit 105, the response value generation unit 120, the database 109, and the like. Play a role.

The client should access the server of the network camera, the home gateway, and the home automation device to perform the authentication procedure.

Authentication between the server and the client according to a preferred embodiment of the present invention may be performed firstly using a hash algorithm with a secret key. A process of performing an authentication procedure using the hash function with the secret key will be described in detail with reference to FIG. 7.

Second, authentication between the server and the client can be performed using a hash algorithm. A process of performing an authentication procedure using the hash function will be described in detail with reference to FIG. 8.

Third, the authentication between the server and the client can be performed using a symmetric key cryptographic algorithm. A process of performing an authentication procedure using the symmetric key cryptographic algorithm will be described in detail with reference to FIG. 9.

In the authentication between the server and the client according to the preferred embodiment of the present invention, the process of authenticating the client by the server is essential, and the process of authenticating the server by the client is optional.

2 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to a preferred embodiment of the present invention.

Referring to FIG. 2, the server 201 of the network camera, the home gateway, and the home automation device includes an image information collecting unit 205, an audio information collecting unit 207, a user data generating unit 209, and an automation control unit 211. And a multiplex unit 213, a data converter 215, a controller 217, a compressor 219, a trial value generator 221, an encryption / decryption unit 223, and an input / output unit 225. .

The image information collecting unit 205 takes an external image and outputs the captured image information. The image information collecting unit 205 may be configured as a CCD camera or a video camera.

The voice information collecting unit 207 recognizes an external voice and outputs recognized voice information. The voice information collecting unit 207 includes a microphone.

The user data generator 209 recognizes and outputs information such as an external text, signal, and electronic device status.                     

The automation control unit 211 serves to control and process data for home automation.

The multiplex unit 213 selects and outputs data desired by a user from multimedia data input such as the image information collecting unit 205, the audio information collecting unit 207, and the user data generating unit 209. To perform. In addition, the multiplex unit 213 selects the control data transmitted from the user and transmits the selected control data to the automation control unit 211. Here, the control data is home automation device control data sent by the user.

The data converter 215 decodes the multimedia data output from the multiplex unit 213 using a decoding method and transmits the multimedia data to the compression unit 219 if necessary.

The compressor 219 compresses the video, audio, and user data converted and transmitted by the data converter 215.

The attempt value generator 221 generates a trial value Cha_S of a server required for user authentication. Here, a random number, a sequence number, a timestamp, or the like may be used as the trial value Cha_S.

The encryption / decryption unit 223 encrypts and decrypts input data. Here, the encryption / decryption unit 223 may use a symmetric key encryption algorithm for encryption and decryption.

The input / output unit 225 transforms the data encrypted by the encryption / decryption unit 223 into a packet such as TCP / IP, and transmits it to the user through the network 204 or the input transmitted through the network 204. The data is transformed into a data format for encryption and decryption and transmitted to the encryption / decryption unit 223.

The controller 217 is connected to the data converter 215, the compressor 219, the trial value generator 221, and the encryption / decryption unit 223 to provide server-side control status information or to provide a user identifier, a password, and the like. By using the to control the authentication to confirm the response value (Res_C) of the user can be performed to control the devices.

Clients 203a, 203b (hereinafter referred to as 203) of network cameras, home gateways, and home automation devices are referred to as input / output units 229a, 229b, hereinafter referred to as 229, and encryption / decryption sections 231a, 231b, 231 below. ), Response value generators 232a and 232b (hereinafter referred to as 232), and control units 233a and 233b (hereinafter referred to as 233).

Since the input / output unit 229 is as described above, a description thereof will be omitted.

The encryption / decryption unit 231 decrypts the electronic information encrypted by the server 201 using a symmetric key encryption algorithm. In addition, the encryption / decryption unit 231 performs a function of encrypting a control signal for home automation and transmitting it to the server 201.

The response value generator 232 generates a response value Res_C of the client 203 corresponding to the attempt value Cha_S of the server in a method promised between the server and the client. Here, the method promised between the server 201 and the client 203 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.                     

The controller 233 controls the input / output unit 229, the encryption / decryption unit 231, and the response value generator 232. The client terminal device accesses the established web server 201 and monitors the operation status of the video, audio, and data generating device desired by the user by using the identifier and password, and controls the home appliance. It is connected to the network 204 by a modem, a dedicated line, etc., and it is also possible to use a portable computer such as a laptop and a personal mobile communication terminal.

In this case, it is assumed that the client 203 pre-installs a utility that can decrypt the encrypted data transmitted from the server 201 and execute it in real time.

3 is a diagram illustrating a configuration of a data security system in a network camera, a home gateway, and a home automation device according to another exemplary embodiment of the present invention.

Referring to FIG. 3, a network camera, a home gateway, and a home automation system include a server 201, a network 204, and a client 203. Each component and a portion overlapping with those described with reference to FIG. 2 will be omitted.

The server 201 further includes a data storage unit 301 in a component as shown in FIG. 2. The data storage unit 301 stores multimedia data encrypted by the encryption / decryption unit 223 of the server in a storage device such as an external memory or a hard disk. Here, the encrypted data is transmitted in real time through the network 204, but is stored in the data storage unit 301 and can be retrieved at any time when the user needs the data.                     

4 is a diagram schematically showing a server and a client for transmitting and receiving data based on a network according to another exemplary embodiment of the present invention.

Referring to FIG. 4, the server further includes a response value generator 405, and the client 102 includes a trial value generator 401a, 401b, 401 hereinafter and a response value generator 403a, 403b,. (Hereinafter referred to as 403). Descriptions of parts that overlap with the parts described with reference to FIG. 1 will be omitted.

The response value generator 405 generates a response value Res_S of the server corresponding to the attempt value Cha_C of the client in a method promised between the server 101 and the client 102. Here, the method promised between the server 101 and the client 102 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

The attempt value generator 401 generates a trial value (Cha_C) of the client required for server authentication. The attempt value Cha_C may be a random number, a sequence number, a timestamp, or the like.

The response value generator 403 generates a response value Res_C of the client corresponding to the attempt value Cha_S of the server in a method promised between the server 101 and the client 102. Here, the method promised between the server 101 and the client 102 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

5 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to another preferred embodiment of the present invention.                     

Referring to FIG. 5, the server 201 further includes a response value generator 501, and the client 203 includes a trial value generator 502a, 502b, 502, and a response value generator 503a. , 503b or less, referred to as 503). Each component and a portion overlapping with those described with reference to FIG. 2 will be omitted.

The response value generator 501 generates a response value Res_S of the server corresponding to the attempt value Cha_C of the client in a method promised between the server 201 and the client 203. Here, the method promised between the server 201 and the client 203 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

The attempt value generation unit 502 generates a trial value (Cha_C) of the client required for server authentication. The attempt value Cha_C may be a random number, a sequence number, a timestamp, or the like.

The response value generator 503 generates a response value Res_C of the client corresponding to the attempt value Cha_S of the server in a method promised between the server 201 and the client 203. Here, the method promised between the server 201 and the client 203 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

6 is a diagram showing the configuration of a data security system in a network camera, a home gateway, and a home automation device according to another preferred embodiment of the present invention.

Referring to FIG. 6, the server 201 further includes a response value generator 601, and the client 203 includes a trial value generator 601a, 601b, 601 and a response value generator 603a. , 603b, hereinafter referred to as 603). For the respective components, portions that overlap with those described with reference to FIG. 3 will be omitted.

The response value generator 601 generates a response value Res_S of the server corresponding to the attempt value Cha_C of the client in a method promised between the server 201 and the client 203. Here, the method promised between the server 201 and the client 203 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

The attempt value generator 602 generates a trial value (Cha_C) of the client required for server authentication. The attempt value Cha_C may be a random number, a sequence number, a timestamp, or the like.

The response value generator 603 generates a response value Res_C of the client corresponding to the attempt value Cha_S of the server in a method promised between the server 201 and the client 203. Here, the method promised between the server 201 and the client 203 may be a hash algorithm, a hash algorithm, and a symmetric key encryption algorithm with a secret key.

7 to 10 are signal flow diagrams illustrating a process of transmitting and receiving data based on a network between a server and a client of a network camera, a home gateway, and a home automation apparatus according to an exemplary embodiment of the present invention.

Referring to FIGS. 7 to 10, terms used in a process of encrypting and decrypting in a process of authenticating and transmitting and receiving data between a server and a client based on a network are as follows.

Cha_S: Server's challenge value provided by server to client                     

Res_S: Client's response value provided by client to server

Cha_C: Client's challenge value provided by client to server

Res_C: Response value of server provided by server to client

D: Electronic Information (Multimedia Data, Control Data)

RN _S : Server generated random number

RN _C : random number generated by client

f: promised machining function between server and client

H: Hash Function

HMAC: Hash Function with Secret Key

HMAC _K : Secret key applied to hash function with secret key

g: symmetric-key encryption algorithm

g ^-1 : symmetric key decoding algorithm

ID: identifier of the client

Password: Client's Password

K _A : Secret key of symmetric key cryptography when authentication is based on symmetric key crypto algorithm

K _D : Secret key of symmetric key encryption algorithm to be used for encryption / decryption of electronic information (electronic information encryption key, session key)

K _S : Secret key of symmetric key encryption algorithm to be used for encryption / decryption of electronic information encryption key (session key)

ESK: Electronic information encryption key (session key, K _D ) encrypted with symmetric key encryption algorithm

E: encrypted electronic information

FIG. 7 is a signal flowchart illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to an exemplary embodiment of the present invention.

Referring to FIG. 7, a server, which is a network camera, a home gateway, and a home automation device, authenticates a client using a hash algorithm accompanied by a secret key based on a password of a client previously shared with the client. Check).

In addition, the server generates an electronic information encryption key (session key, K _D ) necessary for encrypting / decrypting electronic information using a symmetric key encryption algorithm and encrypts the electronic information encryption key (ESK) encrypted using the symmetric key encryption algorithm. Send (distribute) to the client. Thereafter, the server and the client encrypt and transmit the multimedia data or the control data transmitted to each other using the electronic information encryption key (session key, K _D ) as the secret key of the symmetric key encryption algorithm.

First, when the client transmits a connection request signal to the server (step 701), the server receives the connection request signal.

The server generates a random value (RN _S ) of the server attempt value (Cha_S) to be provided to the client in response to the access request signal (step 703) and transmits it to the client (step 705). Here, in addition to the random number, the attempt value Cha_S of the server may use a sequence number, a timestamp, and the like.

The client receiving the attempt value (Cha_S) of the server secretly has a secret key (HMAC _K ) necessary for generating the response value (Res_C) of the client using a hash algorithm with a secret key between the server and the client. The existing password (Password) is processed as it is, or processed (f) in the manner promised between the server and the client (step 707). Here, the processing (f) may include an attempt value (Cha_s) of the server and an identifier (ID) of the client.

Thereafter, the client selects and manipulates the values (Cha_S, ID, Password) shared between the server and the client in the manner promised between the server and the client. Here, the attempt value (Cha_S (RN _S )) and the password of the server must be included. Thereafter, the client generates the response value Res_C of the client corresponding to the attempt value Cha_S of the server by applying the processed value f to the hash algorithm with the secret key HMAC _K and the secret key. (Step 709).

The formula for generating the response value Res_C of the client may be expressed as Equation 2 as follows.

The client transmits a response value (Res_C) and a client identifier (ID) of the client corresponding to the attempt value (Cha_S) of the server provided to the client to the server (step 711), and the server responds to the client. Res_C and a client identifier (ID) are received. Here, the client may transmit the identifier (ID) to the server with a time difference.

The server calculates the hash value by applying the user's password, identifier (ID) and the attempt value (Cha_S) provided by the server to the client to the hash algorithm with the secret key in the same way as the client did. The client authentication procedure is performed in comparison with the response value Res_C (step 713).

The server sends a client authentication failure message to the client if the comparison result is invalid.

After client authentication of the server is confirmed, the server randomly selects the electronic information encryption key (session key) K _D of the symmetric key cryptographic algorithm to be used for encryption / decryption of the electronic information ( _D ) (step 715). do. Thereafter, the server selects and processes (f) the electronic information encryption key (session key) K _D from among the values (Password, ID, Cha_S) shared between the server and the client in the manner promised between the server and the client. A secret key K _S of the symmetric key cryptographic algorithm required for encryption using the symmetric key cryptographic algorithm is generated (step 716).

After performing the step 716, and the server electronic information, the cipher key (session key) (K _D), the symmetric key a private key of the symmetric key encryption algorithm necessary to encrypt the encryption algorithm of Electronics, Information and the encryption key (session key) with a K _S The encryption g of (K _D ) is performed (step 717) and transmitted to the client (step 719) together with the client authentication acknowledgment signal. The server may separately transmit the client authentication approval signal. Here, the server may newly generate, encrypt and transmit an electronic information encryption key (session key) K _D for encrypting the electronic information D at every predetermined time and if necessary. The equation for encrypting the electronic information encryption key (session key) K _D may be expressed as in Equation 3 below.

After the client receives the encrypted electronic information encryption key (session key) K _D , the client generates K _S in the same method generated by the server (step 720), and then decrypts the symmetric key encryption algorithm (g ^{−). 1} ), an electronic information encryption key (session key) K _D is extracted (step 721). Here, the decoding equation may be expressed as Equation 4.

The server performs the encryption (g) of the electronic information (D) to be transmitted to the client using the electronic information encryption key (session key) K _{D as} a secret key of the symmetric key encryption algorithm (step 723). E) is sent to the client (step 725). Here, the encryption formula can be expressed as Equation 5 below.

The client receives the encrypted electronic information E and decrypts the symmetric key encryption algorithm (g ^-1 ) using the electronic information encryption key (session key) K _D extracted in step 721 to encrypt the electronic information. Electronic information D is extracted from step (E) (step 727). Here, the decoding equation may be expressed as in Equation 6.

8 is a signal flow diagram illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to another exemplary embodiment of the present invention.

Referring to FIG. 8, the server and the client perform mutual authentication (confirmation) using a hash algorithm based on a password of a client previously secretly shared between the server and the client. In other words, the server authenticates (confirms) the client using a hash cipher algorithm based on the client's password that is previously secretly shared between the server and the client. The server is authenticated (confirmed) using a hash encryption algorithm based on the shared client's password.

In addition, the server generates an electronic information encryption key (session key, K _D ) necessary for encrypting / decrypting the electronic information (D) using a symmetric key encryption algorithm, and encrypts the electronic information encryption key using the symmetric key encryption algorithm. Send (distribute) (ESK) to clients. Thereafter, the server and the client encrypt and transmit the electronic information D transmitted to each other using the electronic information encryption key (session key, K _D ) as the secret key of the symmetric key encryption algorithm.

First, when the client transmits a connection request signal to the server (step 801), the server receives the connection request signal.

In response to the access request signal, the server generates a random value RN _S of the server's challenge value Cha_S provided to the client (step 803), and transmits it to the client (step 805). Here, in addition to the random number, the attempt value Cha_S of the server may use a sequence number, a timestamp, and the like.

Upon receiving the attempt value (Cha_S) of the server, the client selects and processes the values (Cha_S, ID, and Password) shared between the server and the client in a promised manner between the server and the client, and applies a hash algorithm. The response value Res_C is generated (step 807). Here, the attempt value Cha_S (RN _S ) and the password must be included.

Equation for generating the response value (Res_C) of the client can be expressed as shown in Equation 7.

The client generates a random value (RN _C ) of the client's challenge value (Cha_C) that the client provides to the server (step 809).

The client transmits the client's response value Res_C, the client identifier ID, and the client's challenge value Cha_C corresponding to the server's challenge value Cha_S provided to the client to the server (step 811). Thereafter, the server receives the client's response value Res_C, the client identifier ID, and the client's challenge value Cha_C. Here, the attempt value (Cha_C) and the identifier (ID) of the client may be transmitted to the server with a time difference from the response value (Res_C) of the client.

The server calculates the hash value by applying the user's password, identifier (ID) and the attempt value (Cha_S) provided by the server to the client to the hash algorithm in the same way as the client did, and the response value (Res_C) received from the client. In step 813, the client authentication procedure is performed.                     

After the server performs the client authentication, the client selects and processes the values (Cha_S, Cha_C, ID, Password) shared between the server and the client in a promised way between the server and the client in order to authenticate the server to the client. In step 815, the server generates a response value Res_S corresponding to the client attempt value Cha_C to which the hash algorithm is applied (step 815), and transmits it to the client (step 817). Here, the trial value Cha_C and the password of the client must be included.

Equation for generating the response value (Res_S) of the server can be expressed as shown in Equation 8.

The client receiving the response value (Res_S) of the server is the same method that the server performed the password (Password), the identifier (ID), the attempt value (Cha_S) of the server and the attempt value (Cha_C) provided by the client to the server In step 819, a hash value is calculated by applying the hash algorithm, and the server is authenticated by comparing with the response value Res_S received from the server (step 819).

After performing the authentication, the client sends a server authentication approval signal to the server (step 821).

Hereinafter, since steps 823 to 835 overlap with those described with reference to FIG. 7, description thereof will be omitted.

9 is a signal flow diagram illustrating a process of encrypting and transmitting electronic information transmitted between a server and a client, which are a network camera, a home gateway, and a home automation device, according to another exemplary embodiment of the present invention.

9, the server and the client perform mutual authentication (confirmation) by using a symmetric key encryption algorithm. That is, the server authenticates (confirms) the client using a symmetric key cryptographic algorithm, and the client authenticates (confirms) the server using a symmetric key cryptographic algorithm.

The client generates an electronic information encryption key (session key) necessary for encrypting / decrypting the electronic information D using the symmetric key encryption algorithm and registers the encrypted electronic information encryption key with the server using the symmetric key encryption algorithm. Thereafter, the server and the client encrypt and transmit the electronic information D transmitted to each other using a symmetric key encryption algorithm using the electronic information encryption key.

First, the client transmits an access request signal to the server (step 901). The server receives the access request signal.

In response to the access request signal, the server generates a random value RN _S of the server's attempt value Cha_S provided to the client (step 903), and transmits it to the client (step 904). Here, in addition to the random number, the attempt value Cha_S of the server may use a sequence number, a timestamp, and the like.

Upon receiving the attempt value (Cha_S) of the server, the client secretly secrets the secret key (K _A ) of the symmetric key encryption algorithm required to use the symmetric key encryption algorithm to generate the response value (Res_C) of the client. In step 905, a password (Password) that is stored in the server or the server and the client is processed (f) as promised. Here, the processing (f) may include an attempt value (Cha_S) of the server and an identifier (ID) of the client.

The client selects and processes (f) at least one of Cha_s, ID, and Password, which are values shared between the server and the client, in a promised manner between the server and the client. Here, the attempt value (Cha_S) of the server must be included. Thereafter, the client encrypts (g) an encryption method of a symmetric key encryption algorithm using the generated secret key K _A to obtain a response value Res_C of the client corresponding to the attempt value Cha_S of the server. Create (step 907).

Equation for generating the response value (Res_C) of the client can be expressed as shown in equation (9).

The client generates a random value RN _C of the client's challenge value Cha_C that the client provides to the server (step 909). Here, in addition to the random number, the attempt value Cha_S of the client may use a sequence number, a timestamp, and the like.

The client transmits (step 911) the client's response value Res_C, the client identifier ID, and the client's attempt value Cha_C corresponding to the server's challenge value Cha_S provided by the server to the server. The client may transmit the client identifier ID and the client attempt value Cha_C to the server at a time difference from the client response value Res_C. The server receives the response value Res_C of the client, the client identifier ID, and the attempt value Cha_C of the client. The server generates the secret key K _A of the symmetric key cryptographic algorithm required to perform decryption (g ⁻¹ ) of the symmetric key cryptographic algorithm with respect to the response value Res_C of the received client. Create (step 913).

The server performs decryption (g ^-1 ) of the symmetric key cryptographic algorithm by using the generated secret key K _A for the received response value Res_C of the client as the secret key of the symmetric key cryptographic algorithm. In step 914, the client authenticates the client by checking whether the data is selected and processed in the promised manner with respect to the value shared between the client and the client. The decoding (g ⁻¹ ) equation may be expressed as in Equation 10.

After the server performs the client authentication, the server generates a response value Res_S corresponding to the client attempt value Cha_C by the encryption (g) method of the symmetric key encryption algorithm in order to receive the server's authentication (step 915). To the client (step 917). Here, the server's response value is selected and processed by the client in advance and in a manner promised by the client such as the client's attempt value, user identifier (ID), client password, and the server's attempt value, which are values shared between the server and the client. Can be.

Equation for generating the response value (Res_S) of the server can be expressed as shown in Equation 111 as follows.

The client receives the server's response value (Res_S), performs a decryption (g ^-1 ) of the symmetric key encryption algorithm, extracts Cha_C, and compares the extracted Cha_C with the client's attempt value (Cha_C) sent to the server. Perform server authentication (step 919). The decoding (g ⁻¹ ) equation may be expressed as in Equation 12.

After authenticating the server, the client randomly selects an electronic information encryption key (session key) K _D (step 920) and shares the values (Password, ID, Cha_S) between the server and the client. (Cha), among the Cha_C), are selected and processed by the method promised between the server and the client (f) to generate the secret key (K _S ) of the symmetric key cryptographic algorithm required to encrypt the electronic information encryption key using the symmetric key cryptographic algorithm. 921).

After performing step 921, the client sets the electronic information encryption key (session key) to K _S as the secret key of the symmetric key encryption algorithm required for encrypting the electronic information encryption key (session key) K _D with the symmetric key encryption algorithm. Encryption (g) of (K _D ) is performed (step 922) and transmitted to the server (step 923). The client may newly generate, encrypt, and transmit an electronic information encryption key (session key) K _D for encrypting an image or data at any predetermined time and if necessary. Here, the equation for encrypting the electronic information encryption key (session key) K _D may be expressed as in Equation (13).

After receiving the encrypted electronic information encryption key (ESK), the server generates K _S in the same promised method generated by the client (step 924), and then decrypts the symmetric key encryption algorithm (g ^-1 ). Then, the electronic information encryption key (session key) K _D is extracted (step 925). Here, the decoding equation may be expressed as in Equation 14.

Since the steps 927 to 931 of transmitting the electronic information D to the client from the server overlap with the parts described with reference to FIG. 7, description thereof will be omitted.

10 is a flowchart illustrating a process of transmitting encrypted electronic information of a client to a server according to an exemplary embodiment of the present invention.

Referring to Figure 10, and the server electronic information, the cipher key (session key) (K _D), the symmetric key a private key of the symmetric key encryption algorithm necessary to encrypt the encryption algorithm of Electronics, Information and the encryption key (session key) with a K _S ( K _D ) is encrypted (g) and transmitted (step 1001) to the client along with the client authentication acknowledgment.

After receiving the encrypted electronic information encryption key (session key) K _D , the client generates K _S in the same promised method generated by the server (step 1002), and then decrypts the symmetric key encryption algorithm ( g ^-1 ) to extract the electronic information encryption key (session key) K _D (step 1003). Here, the decoding equation may be expressed as in Equation 15.

The client performs the encryption (g) of the data (D) to be transmitted to the server (step 1005) using the electronic information encryption key (session key) K _{D as} a secret key of the symmetric key encryption algorithm (step 1005). Is transmitted to the server (step 1007). Here, the encryption formula can be expressed as in Equation 16 below.

After the server receives the encrypted data E, the server performs decryption (g ⁻¹ ) of the symmetric key encryption algorithm using the electronic information encryption key (session key) K _D (step 1009) to encrypt the encrypted data ( Data D is extracted from E). Here, the decoding equation is as shown in Equation 17.

The server then processes the extracted data D (step 1011).

The present invention is not limited to the above embodiments, and many variations are possible by those skilled in the art within the spirit of the present invention.

According to the present invention, in the process of transmitting and receiving data through a network, the server and the user can perform authentication and distribution / registration of an electronic information encryption key only with a password of a user previously secretly shared between the server and the user, and the electronic information encryption. A method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system capable of performing encryption / decryption of data transmitted and received using a key as a secret key of a symmetric key encryption algorithm can be provided.                     

According to the present invention, an authentication and server for a user using a symmetric key cryptographic algorithm or a hash algorithm having a low computational complexity without using a public key-based cryptographic algorithm having a large computational complexity and a high cost in receiving a public key authentication. A method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system capable of performing authentication on a network can be provided.

According to the present invention, encryption / multimedia data or control data, etc., using a symmetric key cryptography algorithm having a large computational complexity and a low computational complexity without using a public key-based cryptographic algorithm, which is expensive to receive public key authentication, Provided are a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system capable of distributing symmetric keys (electronic information encryption key and session key) required for decryption.

According to the present invention, by using the symmetric key (electronic information encryption key, session key) distributed by the symmetric key encryption algorithm, the multimedia data or control data between the server and the client can be encrypted and transmitted by the symmetric key encryption algorithm in both directions The present invention provides a method and apparatus for maintaining data security in a network camera, a home gateway, and a home automation system that encrypts and decrypts a network.

According to the present invention, a network camera, a home gateway, and a home automation system encrypts and decrypts electronic information provided by a server in both directions in order to prevent unauthorized unauthorized theft of electronic information provided by a server in a process of transmitting and receiving data through a network. A method and apparatus for maintaining data security in a system can be provided.                     

According to the present invention, a network camera, a home gateway, and a home, which encrypt and decrypt in both directions to prevent the leakage of information when data that needs to be kept confidential must be transmitted in the process of transmitting and receiving data through a network. A method and apparatus for maintaining data security in an automation system can be provided.

Claims (30)

A method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, Generating an attempt value of a server in response to a connection request signal of the client and transmitting the generated challenge value to the client; Receiving a response value and an ID of the client from the client, respectively; Calculating a response value expected from the client using the password corresponding to the ID and the attempt value, and comparing the authentication value with the response value of the client received from the client; If the authentication result is valid, generating a secret key for encrypting the electronic information encryption key; Encrypting the electronic information encryption key generated using the secret key as an element by a symmetric key encryption algorithm and transmitting the encrypted information to the client; And Encrypting the electronic information using a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the same to the client, The client extracts the electronic information by performing symmetric key decryption of the received encrypted electronic information using the electronic information encryption key extracted from the received encrypted electronic information encryption key as an element; How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The attempt value is generated by at least one of a random number, a sequence number, and a timestamp. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The response value of the client is a result generated to correspond to the password and the attempt value of the server using a hash algorithm. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The response value of the client is a result generated corresponding to the password of the client and the attempt value of the server using a hash algorithm with a secret key. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The response value of the client is a result generated to correspond to the client's password and the server's attempt value using a symmetric key encryption algorithm. How to maintain data security based on network cameras, home gateways and home automation devices. The method according to any one of claims 3 to 5, The password is a password of a client previously secretly shared between the server and the client. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The ID may be received at the same time or differently from the response value of the client. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The method of maintaining data security based on the network camera, home gateway, and home automation device Transmitting a client authentication approval signal to the client Containing more How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The electronic information encryption key is used for symmetric key encryption and symmetric key decryption of electronic information. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The electronic information encryption key is randomly selected How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The electronic information encryption key is generated by updating every predetermined time or if necessary How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, The secret key is a secret key of a symmetric key cryptographic algorithm required to encrypt the electronic information encryption key. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 1, wherein the secret key is generated by processing the trial value and the password in a mutually agreed method. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 8, The client decrypts the encrypted electronic information encryption key corresponding to the client authentication approval signal to generate a secret key for extracting the electronic information encryption key; How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 14, The secret key is a secret key of a symmetric key cryptographic algorithm. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 14, The secret key is generated by processing the server's attempt value and password in a mutually agreed manner. How to maintain data security based on network cameras, home gateways and home automation devices. A method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, Generating an attempt value of a server according to a connection request signal of the client and transmitting the generated attempt value to the client; Receiving a response value, an ID, and an attempt value of the client from the client, respectively; Calculating a response value expected from the client using a password corresponding to the ID and an attempt value of the server, and comparing and authenticating the response value with the client's response received from the client; If the authentication result is valid, generating a response value of the server and transmitting the response value to the client; Generating a secret key to encrypt the electronic information encryption key when a server authentication approval signal is received from the client; Encrypting the electronic information encryption key with a symmetric key encryption algorithm using the secret key as an element, and transmitting the encrypted information to the client; And Encrypting the electronic information using a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the same to the client, The client extracts the electronic information by performing symmetric key decryption of the received encrypted electronic information using the electronic information encryption key extracted from the received encrypted electronic information encryption key as an element; How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 17, The attempt value of the server and the attempt value of the client are generated by at least one of a random number, a sequence number, and a timestamp. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 17, The response value of the server and the response value of the client are result values corresponding to the password and the attempt value of the server using any one of a hash algorithm, a hash algorithm with a secret key, and a symmetric key encryption algorithm. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 19, The password is a password of a client previously secretly shared between the server and the client. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 17, The server authentication acknowledgment signal is a result of the client comparing the response value of the server by calculating a response value expected from the server using a password and an attempt value of the client. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 17, The electronic information encryption key is randomly selected How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 22, The electronic information encryption key is generated by updating every predetermined time or if necessary How to maintain data security based on network cameras, home gateways and home automation devices. A method for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, Generating an attempt value of a server according to a connection request signal of the client and transmitting the generated attempt value to the client; Receiving a response value, an ID, and an attempt value of the client from the client, respectively; Generating a secret key for decrypting a symmetric key cryptographic algorithm with respect to the response value received from the client; Authenticating the client by decrypting the response value using the secret key; If the authentication result is valid, generating a response value of the server corresponding to the attempt value of the client and transmitting the response value to the client; If an encrypted electronic information encryption key is received from the client, extracting the electronic information encryption key by decrypting a symmetric key encryption algorithm; Encrypting the electronic information using a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the same to the client, The client compares the attempt value of the extracted client with the attempt value of the transmitted client by decrypting the symmetric key encryption algorithm with respect to the response value of the received server, performs server authentication, and if the authentication result is valid, Transmitting encrypted electronic information encryption keys How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 24, The electronic information encryption key generated by the client How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 25, The client generates a secret key of a symmetric key cryptographic algorithm required to encrypt the electronic information encryption key How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 24, The attempt value of the server and the attempt value of the client are generated by at least one of a random number, a sequence number, and a timestamp. How to maintain data security based on network cameras, home gateways and home automation devices. The method of claim 24, The response value of the server and the response value of the client are generated to correspond to the password corresponding to the ID and the attempt value of the server using any one of a hash algorithm, a hash algorithm with a secret key, and a symmetric key encryption algorithm. Value How to maintain data security based on network cameras, home gateways and home automation devices. A system for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, A memory in which a program is stored; A processor coupled to the memory to execute the program Including but not limited to: The processor by the program, Generating an attempt value of a server in response to a connection request signal of the client and transmitting the generated challenge value to the client; Receiving a response value and an ID of the client from the client, respectively; Calculating a response value expected from the client using the password corresponding to the ID and the attempt value, and comparing the authentication value with the response value of the client received from the client; If the authentication result is valid, generating a secret key for encrypting the electronic information encryption key; Encrypting the electronic information encryption key generated using the secret key as an element by a symmetric key encryption algorithm and transmitting the encrypted information to the client; And Encrypting the electronic information using a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the same to the client, The client extracts the electronic information by performing symmetric key decryption of the received encrypted electronic information using the electronic information encryption key extracted from the received encrypted electronic information encryption key as an element; A network camera, a home gateway and a home automation device based data security maintenance system, characterized in that for executing. A system for securing network-based data transmission between a server and a client of a network camera, a home gateway, and a home automation device, A memory in which a program is stored; A processor coupled to the memory to execute the program Including but not limited to: The processor by the program, Generating an attempt value of a server according to a connection request signal of the client and transmitting the generated attempt value to the client; Receiving a response value, an ID, and an attempt value of the client from the client, respectively; Calculating a response value expected from the client using a password corresponding to the ID and an attempt value of the server, and comparing and authenticating the response value with the client's response received from the client; If the authentication result is valid, generating a response value of the server and transmitting the response value to the client; Generating a secret key to encrypt the electronic information encryption key when a server authentication approval signal is received from the client; Encrypting the electronic information encryption key with a symmetric key encryption algorithm using the secret key as an element, and transmitting the encrypted information to the client; And Encrypting the electronic information using a symmetric key encryption algorithm using the electronic information encryption key as an element, and transmitting the same to the client, The client extracts the electronic information by performing symmetric key decryption of the received encrypted electronic information using the electronic information encryption key extracted from the received encrypted electronic information encryption key as an element; A network camera, a home gateway and a home automation device based data security maintenance system, characterized in that for executing.

Images