KR100974296B1 - Method for Authentication and Control of Home Network Using TPM - Google Patents

Abstract

The present invention relates to a home network authentication and control method using a TPM.

To this end, the present invention transmits an access request signal to a home network system, and then accesses the home network system by checking whether a trusted computing environment is established and performing an authentication procedure using a TPM, and in a remote access device that controls the operation of home appliances. It provides a home network control method. In addition, when the access request signal is received from the remote access device, the TPM is used to establish a trusted computing environment and perform an authentication procedure, and then provide monitoring data, and according to the control data transmitted from the remote access device, A home network control method in a home gateway for controlling a device is provided. In addition, the present invention provides a method of registering a home appliance in a home network system in which a home appliance including a TPM is connected to check and register whether a trust calculation environment is established.

According to the present invention, by using the security function of the TPM, it is possible to improve the security of the home network system using a relatively low cost, the remote user can control the home appliance through a secure method.

TPM, Home Network, Remote Control, Trusted Computing Environment, Remote Meter Reading

Description

Method for Authentication and Control of Home Network Using TPM}

The present invention relates to a home network authentication and control method using a TPM (Trusted Platform Module). In particular, the present invention relates to an authentication method for an external device connected to a home network system to which a plurality of home appliances using a TPM are connected, and a control method for a home appliance using the external device. The present invention also relates to an authentication method for registering a plurality of home appliances using a TPM with a home network system.

The present invention is derived from the research conducted as part of the IT new growth engine technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development. [Task Management Number: 2006-S-041-02, Title: Security and Reliability of Next Generation Mobile Terminals] Develop common security core modules for services.

Recently, due to the rapid development of information and communication networks including the Internet and wireless communication networks, many advanced technologies using information and communication networks have been applied to various industrial fields. In particular, recently, a variety of advanced information technologies, such as the installation of a dedicated Internet line and an automatic security system, allow users to perform door control, lighting control, heating control, and home appliance control using a remote access device from the outside. Network systems are provided.

1 is a diagram schematically showing the configuration of a home network system and a remote access device.

Many home appliances, such as door locks, televisions, lighting equipment and boilers, are connected to home network systems installed in the home. And, the home network system is connected to the Internet network for the connection and remote control between home appliances.

As the home network system is connected to the Internet network as described above, the user can access the home network system through the Internet network from a remote location, and check the status and control the operation of home appliances connected to the home network system using the remote access device. Can be performed.

The home network system configured as described above may provide a lot of convenience to the user. However, if a secure security system is not provided, a user with an impure purpose may access the home network, randomly open or close a door, or leak personal information. Many problems can occur.

In order to solve such a security problem, the network security equipment used in the enterprise can be applied to the home network system, but the user has a lot of burden due to cost, installation space, operation difficulties.

In order to solve this problem, the technical problem to be achieved by the present invention is to use a security function provided by the TPM, a home network system and a remote access device, authentication method and remote access device between a plurality of home appliances and home network system It is to provide a control method of a home appliance using.

To this end, the home network control method according to an embodiment of the present invention is a method for controlling the operation of a home appliance connected to a home network system by using a remote access device including a TPM, and (a) controlling the home appliance with a home network system. Transmitting an access request signal for; (b) checking whether a trusted computing environment is established with the home network system; (c) if it is confirmed that a trusted computing environment is established, performing an authentication procedure with the home network system using previously shared encrypted data; And (d) connecting to a home network system and transmitting control data for controlling the operation of the home appliance.

In addition, the home network control method according to an embodiment of the present invention is a method for a home gateway connecting between a home network system and the Internet network to control the operation of home appliances connected to the home network system by a control command from a remote access device. A method comprising: (a) receiving an access request signal transmitted from a remote access device through an internet network; (b) performing an authentication procedure according to a trusted computing environment with the remote access device using the TPM; (c) providing the remote access device with monitoring data including a list of home appliances connected to the home network system and state information of the home appliances; And (d) transferring control data transmitted from the remote access device to the corresponding home appliance.

In addition, a method of registering a home appliance according to an embodiment of the present invention includes a method of registering a home appliance in a home network system using a TPM, including: (a) checking a connection of a home appliance including a TPM; (b) checking whether a trusted computing environment is established with the home appliance; And (c) registering the home appliance to the home appliance list of the home network system when it is confirmed that the trusted computing environment is established.

According to the present invention, it is possible to establish a trusted computing environment between a remote access device, a home network system, a home network system, and a home appliance by using a security function of a TPM, thereby securing a home network system at a relatively low cost. There is an effect to improve the sex. In addition, a user located at a remote location may access a home network system using a remote access device, thereby providing convenience for controlling or upgrading a home appliance through a secure method.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms “… unit”, “… unit”, “module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

2 is a diagram schematically showing the configuration of a home network system and a remote access device using a TPM according to an embodiment of the present invention.

An authentication and control system using a TPM according to an embodiment of the present invention includes a remote access device 110 including a TPM 112, an internet network 120, a home gateway 130 including a TPM 132, and a home network. A number of household appliances including a system 140 and a TPM.

The remote access device 110 is a mobile communication terminal such as a notebook, PDA, mobile phone, etc. used by a user who wants to control a plurality of home appliances connected to the home network system 140 to access the Internet network 120. The remote access device 110 includes a TPM 112 to improve security according to an embodiment of the present invention.

TPM is a microcontroller that handles key security-related functions such as hardware random number generation, key generation and management for data encryption / decryption, remote attestation, and provisioning protected storage.

The home gateway 130 is a gateway that connects to an external network including the Internet network 120 and the home network system 140. The home gateway 130 manages access to the home network system 140 from the outside and accesses the home network system 140. A plurality of connected home appliances 150, 160, 170, and 180 perform a function of managing the connection to the outside. The plurality of home appliances 150, 160, 170, and 180 may be controlled by the home network system 140 after being registered with the home gateway 130.

After the remote access device 110 performs an authentication procedure with the home gateway 130, the remote access device 110 connects to the home network system 140 and checks the home appliance 150, 160, 170, 180 connected to the home network system 140. Control can be performed. Here, the home gateway 130 includes a TPM 132 to perform an authentication procedure with the remote access device 110 and to register the home appliances 150, 160, 170, and 180 according to an embodiment of the present invention.

In addition, according to an embodiment of the present invention, the plurality of home appliances 150, 160, 170, and 180 connected to the home network system 140 also include TPMs 152, 162, 172, and 182, respectively. The home appliances 150, 160, 170, and 180 may be registered in the home network system 140 by performing an authentication procedure with the home gateway 130 using the TPMs 152, 162, 172, and 182.

According to an embodiment of the present invention, the TPM-equipped devices 110, 130, 150, 160, 170, and 180 may establish a trusted computing environment. The trusted computing environment is an environment that trusts each other among devices and considers it to operate safely without hacking or intrusion of an application running on each device.

For example, if the authentication and control system according to the embodiment of the present invention satisfies the trusted computing environment, each of the home appliances 150, 160, 170, 180, the home gateway 130, and the remote access device 110 may be installed. It is assumed that the encrypted data that the application uses in the authentication process is not exposed to users with impure purposes.

In FIG. 2, the TPMs 112, 132, 152, 162, 172, and 182 are separate devices, and are connected to the remote access device 110, the home gateway 130, and the home appliances 150, 160, 170, and 180, respectively. Although shown, the TPMs 112, 132, 152, 162, 172, 182 are actually located inside the remote access device 110, the home gateway 130, and the home appliance 150, 160, 170, 180. It is composed.

3 is a diagram schematically illustrating the internal structure of a remote access device, a home gateway, and a home appliance including a TMP therein according to an embodiment of the present invention.

The remote access device 110, the home gateway 130, and the plurality of home appliances 150, 160, 170, and 180 according to an embodiment of the present invention are commonly used as an input / output module 310, a control module 320, and a memory module. 330, TPM 340, and data storage module 350.

Indeed, the remote access device 110, the home gateway 130, and the plurality of home appliances 150, 160, 170, 180 further include a plurality of modules for processing each unique function. It will be omitted for convenience.

The input / output module 310 is a part that processes data transmission and reception with the Internet network 120 or the home network system 140.

That is, the input / output module 310 included in the remote access device 110 is connected to the Internet network 120, transmits an access request signal for access to the home network system 140, and connects to the home gateway 130. Sending and receiving encrypted data for mutual authentication between the two, and after connecting to the home network system 150, receiving monitoring data indicating the status of the home appliances (150, 160, 170, 180), data for control or upgrade It serves to transmit.

In addition, the input / output module 310 included in the home gateway 130 is connected to the internet network 120 and the home network system 140 to transmit and receive an access request signal, encryption data, monitoring data, and control / upgrade data. Play a role.

The input / output module 310 included in each of the home appliances 150, 160, 170, and 180 transmits a connection request signal for connection to the home network system 140, and mutually communicates with the home gateway 130. It transmits and receives encrypted data for authentication, transmits monitoring data to the home network system 140, or receives control / upgrade data transmitted through the home network system 140.

The control module 320 is a part of the remote access device 110, the home gateway 130, and the plurality of home appliances 150, 160, 170, and 180 that process unique functions assigned to each device. That is, the control module 320 of the remote access device 110 performs an authentication process with the home gateway 130 and control of the home appliances 150, 160, 170, and 180 using the home network system 150. . In addition, the control module 320 of the home gateway 130 performs an authentication process with the remote access device 110 and the home appliance 150, 160, 170, 180. In addition, the control module 320 of each of the home appliances 150, 160, 170, and 180 serves to process unique functions (door control, lighting control, heating control, and home appliance control) by the received control data. .

The memory module 330 temporarily stores various data generated by data processing in the control module 320. It also serves to store applications for performing authentication processing procedures and performing unique functions assigned to devices.

The TPM 340 is connected to the control module 320 and serves to build a trusted computing environment. That is, the TPM 340 transmits and receives encrypted data between the remote access apparatus 110, the home gateway 130, and the home appliances 150, 160, 170, and 180 to perform a mutual authentication procedure. The TPM 340 stores the data used for the mutual authentication procedure in the data storage module 350.

The data storage module 350 stores a key and encryption data for encryption / decryption, and performs a protected storage function. Accordingly, data stored in the data storage module 350 may be protected without being exposed to users with impure purposes. The data storage module 350 may reside in a storage device external to the TPM.

As described above, in the authentication and control system in which the TPM 340 is used, a user located at a remote location is connected to the home network system 140 using the remote access device 110, and then a plurality of home appliances 150, 160, 170, 180 can be controlled.

4 is a flowchart illustrating a method of accessing a home network system using a remote access device and controlling a home appliance connected to the home network system according to an embodiment of the present invention.

A user who is located at a remote location and wants to access the home network system 140 accesses the Internet network 120 using the remote access device 110 and then uses the home appliance 130 through the Internet network 120 to the home gateway 130. 150, 160, 170, 180 transmits the access request signal for the connection (S410).

The home gateway 130 receiving the access request signal through the internet network 120 determines whether the remote access device 110 that has transmitted the access request signal satisfies the trusted computing environment. Remote Attestation to 110) is performed. Here, the remote meter reading function is a function of checking whether or not the other device equipped with the TPM satisfies the trusted computing environment in the device equipped with the TPM (S420).

When it is confirmed that the remote access device 110 satisfies the trusted computing environment (S430), the remote access device 110 performs a remote reading from the home gateway 130 (S440).

When the remote access device 110 determines that the home gateway 130 satisfies the trusted computing environment, the remote access device 110 and the home gateway 130 determine that the remote computing device 110 is operating in the trusted computing environment (S450).

When it is confirmed that the remote access device 110 and the home gateway 130 operate in a trusted computing environment, the remote access device 110 and the home gateway 130 perform mutual authentication procedures.

The mutual authentication procedure is that the remote access device 110 performs the authentication procedure for the home gateway 130, and the home gateway 130 performs the authentication procedure for the remote access device 110. At this time, before performing mutual authentication, the remote access apparatus 110 and the home gateway 130 should store shared encryption data in advance. Shared encrypted data is stored in the data storage module 350.

Here, as a security algorithm for performing the mutual authentication procedure, various algorithms such as a public key algorithm, a secret key algorithm, a hash algorithm, and the like may be used.

When the mutual authentication between the remote access device 110 and the home gateway 130 is successful according to the mutual authentication procedure, the remote access device 110 connects to the home network system 140 through the home gateway 130. At this time, the control authority for the plurality of home appliances 150, 160, 170, 180 connected to the home network system 140 is obtained (S470).

And, by receiving and displaying the monitoring data for the home appliance connected to the home network system 140, and generates the control data according to the control request input from the user and transmits to the corresponding home appliance, thereby controlling the function of the home appliance.

In this case, the user may use the remote access device 110 to upgrade the firmware or software mounted in the home appliances 150, 160, 170, and 180 (S480).

Here, the upgrade of the firmware or software may be used for the upgrade of the home appliance in the vendor or manufacturer of the home appliance. In other words, when an upgrade is required, the seller or manufacturer of the home appliance does not visit the customer's home, but acquires the control authority of the home appliance through the Internet through the implementation of the present invention, thereby upgrading the firmware or software. It can be done safely.

As described above, in order to control the home appliances 150, 160, 170, and 180 through the remote access device 110, the home network system 140 is configured in advance, and the configured home network system. A plurality of home appliances 150, 160, 170, 180 should be registered at 140.

5 is a flowchart illustrating an authentication method for a home appliance registered in a home network system according to an embodiment of the present invention.

A user who configures the home network system 140 connects a new home appliance to the home network system 110 (S510).

When the new home appliance is connected, the home network system 140 performs a remote meter reading to check whether the connected home appliance satisfies the trusted computing environment (S520). When it is confirmed that the connected household appliance satisfies the trusted computing environment (S530), the household appliance performs remote meter reading to the home gateway 130 (S540).

As the home appliance confirms that the home gateway 130 satisfies the trusted computing environment, if all remote meter readings between the home gateway 130 and the home appliance are successful (S550), the home gateway 130 determines the home appliance 130. Register to the home appliance list of the home network system 140 (S560).

Here, after a successful remote meter reading between the home gateway 130 and the home appliances, prior to registering the home appliance in the list of home appliances of the home network system 140, the TPM is used between the home gateway 130 and the home appliances. It can also be set to perform a mutual authentication process.

After the registration procedure for the home appliance is completed, when the access request signal from the remote access device 110 is transmitted, the home gateway 130 lists the home appliance of the home network system 140 including the newly connected home appliance. To the remote access device 110.

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a view schematically showing the configuration of a home network system and a remote access device;

2 is a diagram briefly showing the configuration of a home network system and a remote access device using a TPM according to an embodiment of the present invention;

3 is a view schematically illustrating the internal structure of a remote access device, a home gateway, and a home appliance including a TMP therein according to an embodiment of the present invention;

4 is a flowchart illustrating a method of accessing a home network system using a remote access device and controlling a home appliance connected to the home network system according to an embodiment of the present invention;

5 is a flowchart illustrating an authentication method for a home appliance registered in a home network system according to an embodiment of the present invention.

Claims (9)

delete In the method for controlling the operation of the home appliance connected to the home network system using a remote access device including a Trusted Platform Module (TPM), (a) transmitting an access request signal for controlling the home appliance to the home network system; (b) confirming whether a trust computing environment is established between the home gateway including the TPM in the home network system, and establishing the trust computing environment between the remote access device and the home network system. Checking whether there is; (c) if it is confirmed that the trusted computing environment is established, performing an authentication procedure with the home network system using previously encrypted data; And (d) connecting to the home network system and transmitting control data for controlling the operation of the home appliance Home network control method comprising a. The method of claim 2, Step (b) is, (b1) checking, by the remote access device, whether a trust computing environment of the home gateway is satisfied; (b2) checking, by the home gateway, whether the remote access device satisfies the trusted computing environment; And (b3) if it is confirmed that both the remote access device and the home gateway satisfy the trust operation environment, determining that the trust operation environment is established between the home network system and the home network system. Home network control method comprising a. The method of claim 2, Step (c) is, And performing the authentication procedure using the encrypted data stored in the TPM and the encrypted data stored in the TPM of the home gateway. The method of claim 2, Step (d) is, (d1) connecting to the home network system; (d2) receiving and displaying monitoring data including state information of the home appliance; And (d3) generating and transmitting control data including a control command for the selected home appliance; Home network control method comprising a. delete A method of controlling a home appliance connected to a home network system by a home gateway connecting between a home network system and an internet network by a control command from a remote access device, (a) receiving an access request signal transmitted from the remote access device through the Internet network, wherein the access request signal includes a connection request to a home appliance connected to the home network system; (b) using the TPM included in the home gateway, confirming whether or not a trusted computing environment is established between the TPM included in the remote access device, and then establishing a trusted computing environment with the remote access device. If it is determined that the service is established, performing an authentication procedure with the remote access device using the encrypted data stored in the TPM of the home gateway and the encrypted data stored in the TPM of the remote access device; (c) providing monitoring data including a list of home appliances connected to the home network system and status information of the home appliances to the remote access device; And (d) transmitting control data transmitted from the remote access device, wherein the control data includes a control command for the selected home appliance to a corresponding home appliance; Home network control method comprising a. In the home appliance registration method in a home network system using a TPM (Trusted Platform Module), (a) checking a connection of the home appliance including the TPM; (b) checking whether a trusted computing environment is established between the home appliance; And (c) if it is confirmed that the trusted computing environment is established, registering the home appliance to a home appliance list of the home network system. Home appliance registration method comprising a. The method of claim 8, Between step (b) and step (c), When it is confirmed that a trust computing environment is established between the home appliance and the home appliance, a mutual authentication procedure with the home appliance is performed using the encrypted data stored in the TPM and the encrypted data stored in the TPM of the home appliance. Steps to perform Home appliance registration method further comprising.

Images