KR100816512B1 - Traffic monitoring/control system by using virtual private network and communication method therefor - Google Patents

Abstract

A system for monitoring/control traffic with the VPN(Virtual Private Network) and a communication method thereof are provided to control a traffic signal by connecting a plurality of traffic monitoring/controlling devices, which control traffic signal I/O(Input/Output) devices dispersed all over the county, and a central traffic monitoring/controlling server through the VPN specialized to solve security vulnerability. An authentication server(140) performs first authentication when authentication data is received from a traffic monitoring/controlling device(120) through the VPN, and generates/transmits a communication key to the traffic monitoring/controlling device when the first authentication is successful. A traffic monitoring/controlling server(150) performs second authentication when communication data is received from the traffic monitoring/controlling device through the VPN, and monitors a traffic situation and monitors/controls I/O of the traffic monitoring/controlling device by communicating with the traffic monitoring/controlling device when the second authentication is successful. An authentication database(160) stores the authentication information for the first and second authentication. The traffic monitoring/controlling device generates the communication database by using the communication key.

Description

Traffic Monitoring / Control System by Using Virtual Private Network and Communication Method Therefor}

1 is a block diagram schematically illustrating a traffic monitoring / control system using a virtual private network according to an embodiment of the present invention;

2 is a flowchart illustrating a communication method for a traffic monitoring / control system using a virtual private network according to an embodiment of the present invention;

3 is an exemplary diagram for describing a data structure according to a preferred embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

110: traffic signal input and output device 120: traffic monitoring / controller

130: Internet 140: Authentication Server

150: traffic monitoring / control server 160: authentication database

The present invention relates to a traffic monitoring / control system using a virtual private network (VPN) and a communication method therefor. More specifically, in order to centrally manage a plurality of traffic monitoring / controllers that control traffic signal input / output devices scattered throughout the country using a network, a plurality of traffic monitoring / controllers and a central monitoring / control server are provided in the virtual private network. The present invention relates to a traffic monitoring / control system and a communication method therefor for controlling traffic signals through communication with each other, and releasing security vulnerabilities through a communication method specialized for traffic control.

The traffic monitoring / control system that controls traffic signals at intersections for smooth traffic communication in the city has a standalone type that can be operated independently without central control and intelligent that can be operated and controlled as a whole. If the signal type needs to be corrected, the stand alone should go to the installation site and modify the pattern, but in the case of intelligent, all control is possible from the center.

A typical stand-alone traffic monitoring / control system is installed around an intersection and is embedded in a road at an intersection with a traffic monitoring / controller that controls the blinking of traffic lights and pedestrian traffic lights, and detects the presence or absence of a vehicle in the area and detects the detected signal. It consists of a number of detectors that output to the traffic monitor / controller.

In addition, the conventional intelligent traffic monitoring / control system is composed of a computer for signal control for transmitting the traffic signal control commands from the operator computer and the operator computer to the traffic monitoring / controller installed in each region.

Here, the signal control computer is connected to a traffic monitoring / controller installed in each region, and is connected through a modem to communicate with the traffic monitoring / controller at a low speed to collect and manage traffic information from the traffic monitoring / controller to transport traffic. Develop a plan and transmit traffic light control commands to the traffic monitor / controller in accordance with the established traffic plan.

However, as described above, a typical intelligent traffic monitoring / control system uses a separate signal line when a central signal control computer communicates at a low speed through a traffic monitoring / controller and a modem, and a high speed transmission such as video transmission is required. Since it is necessary to connect and use, there is a problem that not only increases system construction cost but also decreases communication efficiency due to low speed communication.

On the other hand, the high-speed Internet line has been established nationwide recently, and high-speed communication is possible using the high-speed Internet line anywhere in the country, so using the high-speed Internet line for intelligent traffic monitoring / control system will greatly reduce the system construction cost. It is possible to communicate at a high speed, and also excellent in terms of communication efficiency.

However, the high-speed Internet line established nationwide is an open network, and anyone who is not authorized can connect and use it, which is very vulnerable to information security, and traffic control is not authorized due to impure intentions due to the characteristics of the traffic monitoring / control system. If it is not opened to any user, there is a problem that can cause great confusion, such as the risk of a large accident occurs.

Therefore, there is a need for a technology capable of maintaining a high degree of information security while establishing an intelligent traffic monitoring / control system using a high-speed internet line that is already established nationwide.

On the other hand, with the recent development of information security technology, technologies that can maintain high security such as IPSec (Internet Protocol Security) protocol and SSL (Secure Sockets Layer) protocol have been developed and used, but these technologies are stable but have problems such as virus infection. Or a breach of ID or password, causing serious problems, and considering the high level of security required by the traffic monitoring / control system, a typical virtual private network device designed for a general purpose protocol is required for investment / cost. There are disadvantages that are not efficient in terms of aspects, and there are disadvantages that are not specific to maintaining security in traffic monitoring / control systems.

In order to solve this problem, the present invention, in order to centrally manage a plurality of traffic monitoring / controllers for controlling traffic signal input and output devices scattered throughout the country using a network, a plurality of traffic monitoring / controllers and central traffic monitoring / Traffic control system to connect the control server via a virtual private network to control traffic signals through communication with each other, and to solve the security weakness through a communication method specialized for traffic control and provide a communication method therefor Its main purpose.

In order to achieve the above object, the present invention provides a traffic monitoring system that monitors / controls a plurality of traffic signal input / output devices through a virtual private network (VPN) constructed using the Internet. 1. A control system, comprising: an authentication server for performing first authentication upon receiving authentication data from a traffic monitoring / controller using a virtual private network, and generating a transmission key for transmission to the traffic monitoring / controller if the first authentication is successful; When the communication data is received from the traffic monitor / controller using a virtual private network, the second authentication is performed. If the second authentication succeeds, the second communication is performed with the traffic monitor / controller to monitor the traffic and control the traffic monitor / controller. Traffic monitoring / control server; And a database for storing authentication information for first and second authentications, wherein the traffic monitoring / controller generates communication data using a communication key. Provide a monitoring / control system.

In addition, according to another object of the present invention, including the authentication server, traffic monitoring / control server and authentication database (Database) to remotely monitor the traffic through a virtual private network (VPN: Virtual Private Network) that is built through the Internet A traffic monitoring / control system for controlling / controlling, the method comprising: (a) a traffic monitoring / controller being assigned an authentication key to generate authentication data; (b) the traffic monitoring / controller transmitting authentication data to the authentication server; (c) when the authentication server decrypts the authentication data to perform the first authentication and succeeds in the first authentication, generating a communication key, storing the communication key in the authentication database, and transmitting it to the traffic monitoring / controller; (d) the traffic monitoring / controller generating the communication data using the communication key and transmitting it to the traffic monitoring / control server; And (e) when the traffic monitoring / control server decrypts the communication data to perform the second authentication and succeeds in the second authentication, communicating with the traffic monitoring / controller to control the traffic signal controller. Provides a communication method for a traffic monitoring / control system using a private network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a block diagram schematically illustrating a traffic monitoring / control system using a virtual private network according to a preferred embodiment of the present invention.

Traffic monitoring / control system using a virtual private network according to a preferred embodiment of the present invention traffic signal input and output device 110, traffic monitoring / controller 120, the Internet 130, authentication server 140, traffic monitoring / control server 150 and authentication database 160.

The traffic signal input / output device 110 is a concept including various types of detectors for detecting traffic signals or vehicles or pedestrians, which are devices that are installed around a road, an intersection, a crosswalk, etc. and output a traffic signal by blinking various colors of light. As a control of the traffic monitoring / controller 120, the light for indicating a traffic signal blinks or a traffic or situation of a vehicle or a pedestrian is sensed.

The traffic signal monitoring / controller 120 is connected to the plurality of traffic signal input / output devices 110 around the traffic signal input / output device 110, where the signal output from the traffic signal input / output device 110 is monitored and the blinking is controlled. Monitoring / control device.

The traffic monitoring / controller 120 according to the preferred embodiment of the present invention is connected to the authentication server 140 and the traffic monitoring / control server 150 through a virtual private network (VPN) established through the Internet 130. Connected to the authentication server 140, and if the first authentication is successful, access the traffic monitoring / control server 150 to perform a second authentication, and then communicate with the traffic monitoring / control server 150 to perform traffic Provides information about the traffic signal to the traffic monitoring / control server 150 at the request of the monitoring / control server 150, and controls the traffic signal input and output device 110 under the control of the traffic monitoring / control server 150 do.

To this end, the traffic monitoring / controller 120 according to a preferred embodiment of the present invention, when manufactured and shipped, is assigned to the ID and authentication key using the serial number of the product and stored in a memory provided, and the first access after installation It stores the IP address of the authentication server 140, a communication method and an operation method, and the like, and when connected to the Internet 130 after being installed on-site, are assigned an IP address, it is stored in a memory having the assigned IP address. In this case, the traffic monitoring / controller 120 is connected to the Internet 130 and the assigned IP address may be a static IP address set manually, or automatically using the Dynamic Host Configuration Protocol (DHCP). The traffic monitoring / controller 120 stores the IP classification information, which is information on whether the allocated IP address is a fixed IP address or a floating IP address when the IP address is allocated. On the other hand, the ID assigned to the traffic monitoring / controller 120 and the key for authentication is also stored in the authentication database 160 by the operator.

In addition, the traffic monitoring / controller 120 according to a preferred embodiment of the present invention is installed in the field is connected to the Internet 130 and is assigned an IP address, to generate authentication data sent to the authentication server 140 and authentication request. At this time, the traffic monitoring / controller 120 encrypts the authentication data using at least one or more of the pre-stored ID, authentication key and IP address. Here, the data structure of the authentication data transmitted from the traffic monitoring / controller 120 to the authentication server 130 will be described in detail with reference to FIG. 3.

In addition, the traffic monitoring / controller 120 according to the preferred embodiment of the present invention receives and stores a communication key when the authentication succeeds as a result of performing the first authentication in the authentication server 140, and stores the information using a communication key. After generating the communication data, and transmits to the traffic monitoring / control server 150 to request a second authentication, and if the second authentication is successful, the traffic monitoring / control server 150 to communicate with the traffic monitoring / control server It operates under the control of 150. At this time, the traffic monitoring / controller 120 encrypts the communication data using at least one or more of the pre-stored ID, communication key and IP address. Here, the data structure of the communication data transmitted from the traffic monitoring / controller 120 to the traffic monitoring / control server 130 will be described in detail with reference to FIG. 3.

Meanwhile, the traffic monitoring / controller 120 may encrypt, for example, a data encryption standard (DES) in encrypting authentication data or communication data, but is not necessarily limited thereto.

The Internet 130 includes various services existing in the TCP / IP protocol and its upper layers, namely, Hypertext Transfer Protocol (HTTP), Telnet, File Transfer Protocol (FTP), Domain Name Server (DNS), and Simple Mail Transfer Protocol (SMTP). , A worldwide open computer network architecture that provides Simple Network Management Protocol (SNTP), Network File Service (NFS), and Network Information Service (NIS), traffic monitoring / controller 120, authentication server 140, and traffic. The monitoring / control server 150 is connected to each other through a virtual private network.

The authentication server 140 is implemented as a conventional network server, and performs the first authentication when the traffic monitoring / controller 120 connects for the first time.

When the authentication server 140 according to the preferred embodiment of the present invention receives authentication data from the traffic monitoring / controller 120 using a virtual private network, it performs a first authentication, and generates a communication key when the first authentication is successful. Transmit to traffic monitoring / controller 120.

At this time, since the authentication data received by the authentication server 140 from the traffic monitoring / controller 120 is encrypted by the traffic monitoring / controller 120, the authentication server 140 is the ID of the traffic monitoring / controller 120. And the authentication key is unknown. Therefore, the authentication server 140 decrypts the authentication data using the IP address of the traffic monitoring / controller 120 requesting access, all IDs and authentication keys stored in the authentication database 160, and among them, There is a successful ID and a key for authentication, and the first authentication is performed by checking whether the data structure of the decrypted authentication data conforms to a predetermined rule.

That is, when the authentication server 140 receives the authentication data from the traffic monitoring / controller 120 and receives a connection request, the authentication server 140 includes all IDs and all authentications stored in the IP address of the traffic monitoring / controller 120 and the authentication database 160. If decryption is attempted using the key, the decryption is not successful, or the decryption is successful, but the structure of the decrypted authentication data is not appropriate (that is, the traffic monitor / controller corresponding to the information included in the authentication data). 120) has an IP address different from the IP address or an ID that has been successfully decrypted or has an ID or authentication key different from the ID or authentication key). Deny access.

On the other hand, when performing the first authentication, the authentication server 140 checks the IP classification information among the information included in the decrypted authentication data, and in the case of the dynamic IP address, the corresponding traffic monitoring / controller 120 has the same ID. If re-authentication is requested with an IP address, another IP address of the same ID, or the same IP address of another ID, it is preferable to output a warning message. That is, since the traffic monitoring / controller 120 is a device that is always operated and always connected, the IP address is hardly changed even when a dynamic IP address is allocated and used.

Accordingly, the traffic monitor / controller 120 having the same ID and the same IP address reconnects to request reauthentication or the traffic monitor / controller 120 having the same ID but has a different IP address requests a connection or has a different ID. When the traffic monitor / controller 120 using the same IP address requests the connection, it is likely that the connection is due to an illegal connection or an error. Therefore, it is preferable to notify the operator by outputting a warning message.

In addition, when performing the first authentication, the authentication server 140 checks the authentication server access counter among the information included in the decrypted authentication data to alert the user even when the same traffic monitor / controller 120 is connected more than once. It is preferable to output. That is, if the same traffic monitor / controller 120 accesses multiple times as a result of checking the authentication server access counter, a warning message may be output to block such an illegal access attempt because it may be a hacking attack by replay. It is desirable to.

In addition, as described above, the authentication server 140 performs a first authentication, and when the first authentication is successful, the authentication server 140 uses a communication key to be used when the traffic monitoring / controller 120 communicates with the traffic monitoring / control server 150. It generates and transmits to the traffic monitoring / controller 120, and stores the IP address, ID, communication key and IP classification information of the traffic monitoring / controller 120 in the authentication database 160.

The traffic monitoring / control server 150 is implemented as a conventional network server, and when the traffic monitoring / controller 120 is connected, performs a second authentication to communicate with the traffic monitoring / controller 120 and the traffic monitoring / controller 120 To control.

The traffic monitoring / control server 150 according to the preferred embodiment of the present invention performs a second authentication upon receiving communication data from the traffic monitoring / controller 120 using a virtual private network, and if the second authentication succeeds, traffic monitoring. Communicate with / controller 120 to control traffic monitoring / controller 120.

At this time, since the communication data received by the traffic monitoring / control server 150 from the traffic monitoring / controller 120 is encrypted by the traffic monitoring / controller 120, the traffic monitoring / control server 150 is a traffic monitoring / control server 150. The ID of the controller 120 and the communication key are unknown. Accordingly, the traffic monitoring / control server 150 checks the ID and communication key corresponding to the IP address of the traffic monitoring / controller 120 requesting access from the authentication database 160, and checks the IP address, ID and communication key. The second authentication is performed by decrypting the communication data using the same, and confirming whether the data structure of the decrypted communication data conforms to a predetermined rule.

That is, when the traffic monitoring / control server 150 receives communication data from the traffic monitoring / controller 120 and receives a connection request, the traffic monitoring / control server 150 checks the IP address of the traffic monitoring / controller 120 and the corresponding IP checked in the authentication database 160. If the structure of the decrypted communication data is not appropriate (i.e., the information contained in the communication data is different from the IP address of the traffic monitoring / controller 120) Or when there is an ID or authentication key that is different from the ID or communication key used for decryption) and outputs that the second authentication has failed, and rejects the connection of the corresponding traffic monitoring / controller 120.

In addition, as described above, the traffic monitoring / control server 150 performs communication with the traffic monitoring / controller 120 when the second authentication is performed by performing the second authentication, and the traffic monitoring / controller 120 Communication to collect information from the traffic monitoring / controller 120 or control the traffic monitoring / controller 120 to control the traffic flow.

2 is a flowchart illustrating a communication method for a traffic monitoring / control system using a virtual private network according to a preferred embodiment of the present invention.

When the traffic monitoring / controller 120 is manufactured and shipped, an ID and a key for authentication are assigned, set in the traffic monitoring / controller 120, and stored in the authentication database 160 (S202). At this time, when the installation of the traffic monitoring / controller 120 is completed, the IP address of the authentication server 140 is stored in the traffic monitoring / controller 120 so that the access to the authentication server 140.

The traffic monitoring / controller 120 set by allocating an ID and an authentication key is installed at a site and connected to the Internet 130 to set an IP address, and whether the set IP address is a fixed IP address or a dynamic IP address. That is, the IP classification information is stored (S204).

As described above, when the installation is completed, the traffic monitoring / controller 120 encrypts and generates authentication data using its IP address, ID, and authentication key (S206), and the IP of the authentication server 140. The address is confirmed and the authentication data is transmitted to the authentication server 140 (S208).

Receiving the authentication data, the authentication server 140 transmits the authentication data to check the IP address of the traffic monitoring / controller 120 requesting authentication, and the IP address, all IDs stored in the authentication database 160, and all the authentication information. Attempts to decrypt the authentication data using the key (S210). If the decryption is successful, the first authentication is performed by checking the format of the decrypted authentication data (S212).

The authentication server 140 checks whether the first authentication is successful (S214), and cannot decrypt the authentication data using the corresponding IP address and all IDs and all authentication keys stored in the authentication database 160, or the authentication data. If the first authentication fails due to incorrect information as a result of checking the structure, the first authentication fails, the traffic monitoring / controller 120 refuses access (S216), and decrypts the authentication data to format the authentication data. As a result of confirming that the first authentication is successful because there is no wrong information, a communication key is generated and stored in the authentication database 160 (S218), and the communication key is transmitted to the traffic monitoring / controller 120 (S220). At this time, the authentication server 140 transmits the IP address of the traffic monitoring / control server 150 together with the communication key so that the traffic monitoring / controller 120 can access the traffic monitoring / control server 150.

The traffic monitoring / controller 120 receiving the communication key from the authentication server 140 after the first authentication succeeds generates and encrypts the communication data using its IP address, ID, and the received communication key (S222). It transmits to the central control server 150 (S224).

The central control server 150 receiving the communication data checks the IP address of the traffic monitoring / controller 120 requesting the connection by sending the communication data to confirm the ID and the communication key for the corresponding IP address in the authentication database 160. Thereafter, the communication data is decrypted using the IP address, the ID and the communication key (S226).

The central control server 150 decrypting the communication data performs a second authentication by checking the structure of the decrypted communication data (S228).

The traffic monitoring / control server 150 checks whether the second authentication is successful (S230), and if there is wrong information as a result of checking the structure of the communication data, outputting that the second authentication failed, Rejects the access of the traffic monitoring / controller 120 (S232). If the second authentication is successful because there is no wrong information as a result of confirming the structure of the communication data, the traffic monitoring / controller 120 normally communicates with the traffic monitoring / controller 120. The controller 120 is controlled (S234).

Meanwhile, in FIG. 2, after the traffic monitoring / controller 120 and the traffic monitoring / control server 150 succeed in the second authentication, the traffic monitoring / control server 150 normally communicates without performing an additional authentication procedure. Although illustrated and described as controlling the monitoring / controller 120, the present invention is not limited thereto. Whenever the traffic monitoring / controller 120 and the traffic monitoring / control server 150 perform communication, the same authentication as the above-described second authentication is performed. It is desirable to perform communication only if the authentication is successful by performing the procedure.

As described above, using the traffic monitoring / control system using a virtual private network according to a preferred embodiment of the present invention and a communication method therefor, the traffic monitoring / controller 120 and the traffic monitoring / control server 150 that is successfully authenticated By directly communicating with each other through an encrypted packet, it is possible to control a traffic signal by constructing a wide virtual virtual network using a new communication protocol suitable for a traffic monitoring / control system.

3 is an exemplary diagram for describing a data structure according to a preferred embodiment of the present invention.

3A shows the data structure of authentication data. The traffic monitoring / controller 120 generates and encrypts authentication data for authentication using an IP address, ID, and authentication key. The structure of the encrypted authentication data is shown as 'Header' +. It may consist of fields such as 'Encryption Packet Data' + 'Checksum'. At this time, the encrypted packet data may include fields such as 'command' + 'ID' + 'IP address' + 'authentication server access counter' + 'IP identification information' + 'data'.

3B shows a data structure of communication data. The traffic monitoring / controller 120 receiving the communication key from the authentication server 140 generates and encrypts the communication data for communication using the IP address, ID, and the communication key. The structure of the encrypted communication data is shown in FIG. As described above, the header field may include fields such as 'Header' + 'Encryption Packet Data' + 'Checksum'. At this time, the encrypted packet data may include fields such as 'command' + 'ID' + 'IP address' + 'traffic monitoring / control server access counter' + 'data'.

Here, the 'checksum' field is inserted to verify the integrity of data, and an error verification algorithm such as cyclic redundancy checking (CRC) may be used, but is not limited thereto. In addition, the 'authentication server access counter' field is a value having an association with the number of times of accessing the authentication server 140 according to a predetermined rule, and the 'traffic monitoring / control server access counter' field is connected to the traffic monitoring / control server 150. A value having an association according to the number of times of access and a predetermined rule, and is information for checking whether the traffic monitoring / controller 120 abnormally accesses the authentication server 140 or the traffic monitoring / control server 150. It can change regularly (for example, in increments of '1'). In the present invention, the 'authentication server access counter' and 'traffic monitoring / control server access counter' fields are provided, and the value of the corresponding field is regularly changed every time the connection is made, so that the corresponding server can be checked, thereby preventing hacking attempt by replay. Can be.

Accordingly, the traffic monitoring / controller 120 uses the IP address, ID and authentication key in the 'command' + 'ID' + 'IP address' + 'authentication server counter' + 'IP identification information' + 'data' field. To generate 'encrypted packet data' of authentication data by using encryption or 'IP', 'ID' + 'IP address' + 'traffic monitoring / control access counter' + 'data' fields using IP address, ID and communication key. To generate 'encrypted packet data' of communication data, which is encrypted by exclusively ORing the IP address, ID and authentication key or IP address, ID and communication key (XOR: eXclusive OR). As an encryption algorithm, data encryption rules may be used as described above, but are not necessarily limited thereto.

In addition, when the authentication server 140 and the traffic monitoring / control server 150 perform the first authentication and the second authentication, respectively, the authentication server 140 and the traffic monitoring / control server 150 respectively check whether the information of each of the above-described data structures is appropriate, and thus the first authentication and the first authentication are performed. 2 Perform authentication.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, it is possible to communicate directly between a traffic monitoring / controller and a traffic monitoring / control server which has been successfully authenticated, and by communicating with each other through an encrypted packet, a new concept of communication specialized in a traffic monitoring / control system By using the protocol, a virtual private network with a wide concept can be built to collect traffic information and control traffic signals.

In addition, it is possible to build a traffic monitoring / control system by building a virtual private network using the already built Internet network, it can significantly reduce the cost required to build a traffic monitoring / control system.

In addition, it is possible to solve the security weakness by communicating the security problems that may occur by building and using a traffic monitoring / control system using an open Internet network by using an encryption method specific to the traffic monitoring / control system.

In addition, by using a communication protocol and an encryption method specialized for a traffic monitoring / control system, the communication protocol and encryption method commonly used in a virtual private network may not be used, and thus it may not be complicated or expensive to construct. .

Claims (14)

In a traffic monitoring / control system for remotely monitoring / controlling a traffic monitoring / controller monitoring / controlling a plurality of traffic signal input / output devices through a virtual private network (VPN) constructed using the Internet, An authentication server configured to perform first authentication upon receiving authentication data from the traffic monitor / controller using the virtual private network, and generate a communication key and transmit the generated communication key to the traffic monitor / controller; When receiving communication data from the traffic monitoring / controller using the virtual private network, second authentication is performed, and when the second authentication is successful, communication with the traffic monitoring / controller is performed to monitor a traffic situation and to monitor the traffic monitoring / controller. Traffic monitoring / control server for monitoring / controlling the input and output of the controller; And An authentication database (DB) for storing authentication information for the first authentication and the second authentication Including, The traffic monitoring / controller Traffic monitoring / control system using a virtual private network, characterized in that for generating the communication data using the communication key. The method of claim 1, The traffic monitoring / controller encrypts the authentication data using one or more of an ID, an authentication key, and an IP address, and the authentication server encrypts one or more of the ID, the authentication key, and the IP address. Traffic monitoring / control system using a virtual private network, characterized in that for decrypting the authentication data using. The method of claim 1, The traffic monitoring / controller encrypts the communication data using one or more of an ID, the communication key and an IP address, and the traffic monitoring / control server is one or more of the ID, the communication key and the IP address. Traffic monitoring / control system using a virtual private network, characterized in that for decrypting the communication data using a dog. The method of claim 2, wherein the ID and the authentication key, When the traffic monitoring / controller is shipped, the traffic monitoring / controller is assigned and set as the traffic monitoring / controller and stored in the authentication database. The method of claim 2 or 3, wherein the IP address, The fixed IP or the dynamic IP, the traffic monitoring / controller traffic monitoring / control system using a virtual private network, characterized in that for storing the IP classification information when the fixed IP or the floating IP is assigned. The method of claim 2, wherein the authentication server, When the access request is received from the traffic monitoring / controller, the IP address of the traffic monitoring / controller is checked, and all IDs and all authentication keys stored in the authentication database are decrypted using the ID and the authentication key. Traffic monitoring / control system using a virtual private network. The method of claim 2, wherein the authentication data, And a header, an encryption packet data, and a checksum, wherein the encryption packet data is an encrypted packet data including the command, the ID, the IP address, IP classification information, an authentication server access counter, and data. Traffic monitoring / control system using a virtual private network. According to claim 3, The traffic monitoring / control server, The access request is received from the traffic monitoring / controller, and the IP address of the traffic monitoring / controller is checked to decrypt an ID and a communication key for the IP address stored in the authentication database using the ID and the communication key. Traffic monitoring / control system using a virtual private network. The method of claim 3, wherein the communication data, And a header, an encryption packet data, and a checksum, wherein the encryption packet data is a packet data in which the command, the ID, the IP address, a traffic monitoring / control server access counter, and the data are encrypted. Traffic monitoring / control system using virtual private network. In a traffic monitoring / control system that remotely monitors / controls a virtual private network (VPN), which includes an authentication server, a traffic monitoring / control server, and an authentication database, a traffic monitoring / controller is constructed through the Internet. In the method of performing communication, (a) the traffic monitoring / controller receiving an authentication key and generating authentication data; (b) the traffic monitoring / controller transmitting the authentication data to the authentication server; (c) the authentication server decrypting the authentication data to perform a first authentication and, if the first authentication is successful, generating a communication key, storing the communication key in the authentication database, and transmitting it to the traffic monitoring / controller; (d) the traffic monitoring / controller generating communication data using the communication key and transmitting the communication data to the traffic monitoring / control server; And (e) when the traffic monitoring / control server decrypts the communication data to perform a second authentication and succeeds in the second authentication, communicating with the traffic monitoring / controller to control the traffic signal controller; Communication method for a traffic monitoring / control system using a virtual private network comprising a. The method of claim 10, wherein the method is After step (c), (c1) if the authentication server fails the first authentication, outputting a failure of the first authentication, and further comprising the step of denying access to the traffic monitor / controller. Communication method for monitoring / control system. The method of claim 10, wherein in step (c), When the traffic monitoring / controller uses a floating IP address, the authentication server, if the IP address is changed for the traffic monitoring / controller of the same ID, notifies the operator that the IP address has changed. Communication method for traffic monitoring / control system used. The method of claim 10, wherein the method is After step (e), and (f) if the authentication server fails the second authentication, outputting a failure of the second authentication, and denying access to the traffic monitor / controller. Communication method for traffic monitoring / control system. The method of claim 10, wherein in step (e), The traffic monitoring / control server performs the second authentication every time the communication data is received from the traffic monitoring / controller, the communication method for a traffic monitoring / control system using a virtual private network.

Images