KR101317859B1 - Cluster based Information Security Method in Machine to Machine - Google Patents

Abstract

The present invention relates to a cluster-based information security method in an IoT network. The cluster-based information security method according to the present invention comprises the steps of receiving a communication request from a first device node in a cluster with a second device node in another cluster; And performing an authentication procedure with a cluster head of the other cluster according to the request, receiving, by the first device node, a response to a communication request from a second device node, and transmitting the response to the first device node and the first device node. And performing communication between the second device nodes.

Description

Cluster based Information Security Method in Machine to Machine}

The present invention relates to a cluster-based information security method in an IoT network that provides mutual authentication between devices through a cluster-based authentication procedure for secure communication between devices in an IoT network.

Recently, interest in machine to machine (M2M) is rapidly increasing in the global communication market. Mobile carriers are emphasizing M2M services in mobile virtual network operators (MVNOs) and enterprise-targeted services. At the national level, they are also building infrastructure and legal reforms to revitalize M2M-related industries. The reason why M2M is emerging is that communication is not a person but a center of things. This not only meets the needs of service providers and service providers, but also because the government's policies and technology environment are changing in favor of M2M. First, telecom operators are seeing a saturation of the existing handset market and stagnant average revenue per user (ARPU), which is driving the need for new demand to increase data sales. In particular, new business discovery in the post-communication area is becoming important, and M2M can satisfy this. In the case of M2M service providers or adopting companies, the efficient operation through cost reduction and the high value added of existing businesses are supporting the spread of M2M service.

In addition, there is a need for an efficient key management technology that can operate in a large RFID / USN (Radio Frequency Identification / Ubiquitous Sensor Network) network. For this, standardization of key management technology is very important. This security technology should mainly be applied to base stations and device / sensor nodes that collect data. In addition, it is required to define a security technology effective for the components of the RFID / USN network and to apply the security technology that can be implemented.

Through such industry research, new product lines and various services that are integrated in various industries are emerging. New security threats are emerging due to the activation of new products and services. The areas where convergence is being actively conducted include M2M for communication between devices and machines, U-Healthcare, which is a convergence of IT technology and medical technology, transmission grid based on IT, and smart grid for power distribution operation. (Smart Grid) and intelligent cars, where IT technology is linked with cars, are being converged in many fields. M2M means communication between devices, and networking between devices and devices that are prevalent in our daily lives through devices and machines. M2M communications is a new communication concept for a new business model of mobile communications that connects and provides information between computing and electronics through devices and devices. M2M communication enables the interaction between people and objects to collect various data such as location, health and temperature.

Intelligent cars integrate IT technology into vehicles through telematics / ITS research and development, providing traffic information guidance, emergency rescue, remote vehicle diagnosis, and internet services to drivers and passengers of vehicles, and thus moving business spaces of mobile offices. The field of convergence is developing. Smart Grid is converged with efficient management of power resources and information and communication information technology, and is converged as next generation power grid that is implemented to optimize the efficiency of efficient power energy resource consumption through bidirectionality and central control for power supply and supply to homes and industries. Is one area. U-Healthcare is a next-generation medical service field that provides health care and medical services through the convergence of IT field and medical service field, where the patient's health is monitored by medical staff anytime and anywhere.

As described above, when MTC (Machine Type Communication) is used, the user should be able to easily control and manage the equipment owned by the user from the outside as well as where the equipment is located. In order to build such a system, an MTC system must operate in conjunction with a backbone network, while maintaining and providing security of valuable devices and management data in the devices. However, until now, the general equipment of the usage scenario using the MTC is not designed with the communication possibility in mind and is not equipped with a security system, so it is exposed to various intrusions. In this case, a malicious user can arbitrarily control the equipment through various paths using MTC, causing serious risks, and the information inside the equipment can be exposed to the outside as well as penetrating the user's management system using the equipment. It can do a lot of damage.

The present invention has been made to solve the above problems, to provide a cluster-based information security method in the IoT network that provides secure communication between devices through mutual authentication between devices through the cluster head in the cluster in the IoT network The purpose.

In order to achieve the above object, the cluster-based information security method in the IoT network according to an embodiment of the present invention comprises the steps of receiving a communication request with a second device node in another cluster from the first device node in a cluster; And performing an authentication procedure with a cluster head of the other cluster according to the request, receiving, by the first device node, a response to a communication request from a second device node, and transmitting the response to the first device node and the first device node. And performing communication between the second device nodes.

The performing of the authentication process may include requesting authentication from a cluster head manager;

Receiving an authentication response to the authentication request, transmitting the certificate to the cluster head upon receiving the authentication response, and the cluster head receiving the certificate requests the cluster head manager for authentication; And sending, by the cluster head manager, an authentication response to the cluster head.

The cluster head is characterized in that any one of the device nodes belonging to the cluster is selected.

The cluster head is selected based on the weight of the device node.

The cluster head manager is characterized in that any one of the cluster heads selected from each cluster is selected.

In addition, the cluster-based information security method according to another embodiment of the present invention provides the new device from a cluster head of another cluster in the same device domain as the predetermined cluster according to a connection request of a new device node connected to a predetermined cluster. Receiving a request for authentication of a node, authenticating the new device node through a cluster head of the predetermined cluster according to the request, and authenticating the cluster head of the other cluster according to the request; And in the cluster and in another cluster, the new device node communicating with the cluster head of the given cluster.

The authentication request step may include the step of the new device node connecting to the cluster head of the predetermined cluster, and the cluster head of the predetermined cluster requesting the network head to the cluster head of the other cluster according to the connection request. And receiving an authentication request for the new device node from the cluster head of the other cluster.

The authentication may include requesting identification of the new device node from the cluster head of the predetermined cluster and requesting identification of the cluster head of the other cluster from the cluster heads of the predetermined cluster and the other cluster. Receiving authentication information, requesting certificate values of the cluster head of the new device node and the other cluster to the cluster heads of the predetermined cluster and the other cluster, respectively, and the cluster heads of the predetermined cluster and the other cluster; Receiving a corresponding certificate value from each, and transmitting the security key to the cluster heads of the predetermined cluster and other clusters.

As described above, the cluster-based information security method according to the present invention enables secure communication between devices by mutual authentication between devices through a cluster head in a cluster in the IoT network.

In addition, the present invention provides the reliability and safety between the two devices that communicate by the cluster head authenticated from the authentication server as well as the authentication device for the communication request device in the IoT communication network. As described above, the present invention uses a certificate of the authentication server for secure authentication in the wireless network, so that not only the communication request device but also the device responding to the request are authenticated from the authentication server, thereby enabling more reliable and secure communication.

1 is a block diagram of an IoT communication network to which a cluster-based information security method is applied in an embodiment of the present invention.
FIG. 2 is a flowchart illustrating an authentication process between two device nodes according to a cluster-based information security method in the IoT network of FIG. 1.
3 is a block diagram illustrating an IoT communication network to which a cluster-based information security method according to another embodiment of the present invention is applied.
4 is a flowchart illustrating a device authentication process according to a cluster-based information security method in the IoT network of FIG.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The cluster-based information security method in the IoT network according to the present invention can be applied to various industrial fields, but in the present specification, as a basis for configuring a cluster between vehicles in the field of VANETs (Vehicular Ad-hoc NETworks) through an intelligent vehicle. The configuration will be described as an example.

1 is a block diagram of an IoT communication network to which a cluster-based information security method according to an embodiment of the present invention is applied. The Machine to Machine (M2M) of the present invention is configured on a cluster basis.

As shown in FIG. 1, the IoT communication network according to the present invention forms a cluster through clustering, and the cluster includes the device nodes 101, 102, 201, 202, 301, and 302 and the cluster head 100. , 200, 300).

The device nodes 101, 102, 201, 202, 301, and 302 are member nodes located in a cluster, and are composed of devices such as mobile terminals, mobile machines, and vehicle terminals.

The cluster heads 100, 200, and 300 manage and authenticate device nodes located in the cluster and are unique to each cluster. In addition, the cluster heads 100, 200, and 300 ensure mutual trust through authentication between cluster heads when entering a cluster from another cluster.

The storage of the cluster heads 100, 200, and 300 stores a node identifier (Node_ID), a node type (Type_of_node), a lift time, a mobility, a weight, and a weight for each node as shown in Table 1. do.

Node ID Type of node Lifetime Mobility Weight Node 1 Member of Cluster A 4000 High 7 Node 2 CH of Cluster A 4100 Low 8 Node 3 Gateway of Cluster A, B 2500 Middle 5 Node 4 CH of Cluster B 4200 Low 9 Node 5 Member of Cluster B 3000 High 6 Node 7 Gateway of Cluster B 2000 Middle 5 Node 8 Gateway of Cluster C 2500 Middle 6 Node 9 CH of Cluster C 3900 Low 8 Node 10 Member of Cluster C 2800 High 5

In the cluster heads 100, 200, and 300, one device node among the device nodes in the cluster is selected according to the weight of the weight by the device node. For example, as in the cluster head selection algorithm of Table 2, the node having the largest weight among the device nodes in the cluster is selected as the cluster head. The condition of the weight includes functions that can vary the amount of energy remaining and certificate management for authentication.

z : Ch(z)
send Join (v, x);
ClusterHead := x
End
else begin
send Ch(v)
Ch(v):= true;
ClusterHead := v;
Cluster (v) := {v}
End
end;
Repeat-On receiving ClusterHead (u)
Begin
if (w_u>w_ClusterHead) then begin
send Join (v, u);
ClusterHead := u;
if Ch(v) then Ch(v) := false
end
end;Procedure Initialize:
Begin
If {z∈ (v): w _z > w _v ∧Ch (z)} ≠ Ø
then begin
x: =

z: Ch (z)
send Join (v, x);
ClusterHead: = x
End
else begin
send Ch (v)
Ch (v): = true;
ClusterHead: = v;
Cluster (v): = {v}
End
end;
Repeat-On receiving ClusterHead (u)
Begin
if (w _u > w _ClusterHead ) then begin
send Join (v, u);
ClusterHead: = u;
if Ch (v) then Ch (v): = false
end
end;

In the present specification, the selection of the cluster head based on the weight is described as an example, but the present invention is not limited thereto.

The cluster head also generates a cluster key and distributes it to all device nodes belonging to the cluster. The cluster key is encrypted with the system public key and distributed to device nodes that are cluster members. The device node has a pair of public and private keys, and has a Certification Authority (CA) for key management, which is responsible for binding and periodic updating of keys. The CA has a pair of public and private keys, and the public key is distributed to other mode device nodes, and the certificate is signed and distributed with the private key. If a device node of the device node is no longer trusted or goes out of network area, the public key of the device node is revoked.

In the cluster head manager 200 that manages the cluster heads, one of the cluster heads is selected by the cluster head manager selection algorithm of Table 3.

{z:Ch(z)};
send Select (v, x);
ControlClusterHead :=x
End
else begin
send Ch(v)
Ch(v) := true;
ControlClusterHead := v;
Cluster (v) := {v}
End
End;Procedure CCH Selection:
Begin
if Ch (v)
then if z = v
then Cluster (v): = Cluster (v) ∪ {u}
else if u ∈ Cluster (v)
then Cluster (v): = Cluster (v) ＼ {u}
else if ControlClusterHead: = u then
if {z∈ (v): w _z > w _v ∩Ch (z)} ≠ Ø
then begin
x: =

{z: Ch (z)};
send Select (v, x);
ControlClusterHead: = x
End
else begin
send Ch (v)
Ch (v): = true;
ControlClusterHead: = v;
Cluster (v): = {v}
End
End;

2 is a flowchart illustrating an authentication process between two device nodes according to a cluster-based information security method in an IoT network according to the present invention. Here, a case where the device node S 101 of the cluster A wants to communicate with the device node X 301 of the cluster C will be described as an example.

Referring to FIG. 2, the device node S 101 of the cluster A requests the cluster head A 100 of the cluster A to communicate with the device node X 301 (S101).

When the cluster head A 100 receives the communication request from the device node S 101, the cluster head A 100 requests an authentication to the cluster head manager 200 belonging to the cluster B (S102).

The cluster head manager 200 transmits an authentication response to the authentication request of the cluster head A 100 (S103). The cluster head manager 200 generates a certificate including a session key for the communication requested by the device node S 101 and transmits the certificate to the device node S 101 in an authentication response.

When the cluster head A 100 receives an authentication response from the cluster head manager 200, the cluster head A 100 transmits a certificate to the cluster head C 300 (S104).

The cluster head C 300, which has received the certificate from the cluster head A 100, requests authentication from the cluster head manager 200 (S105).

The cluster head manager 200 transmits an authentication response to the authentication request of the cluster head C 300 (S106).

The cluster head C 300 transmits authentication information to the device node X 301 (S107). The authentication information includes an identifier (ID), a certificate, a communication request message, and the like of the device node S 101 which has requested communication.

The device node X 301 transmits an acknowledgment for the authentication information received through the cluster head C 300 to the device node S 101 (S108). The device node X 301 establishes a session based on the authentication information.

The device node S 101 communicates with the device node X 301 (S109).

As described above, the cluster-based information security method of the present invention provides reliable and secure communication through verification and authentication of the cluster head CH by the cluster head manager CCH. The process of verifying and authenticating the cluster head by the cluster head manager is represented by a formula as shown in Table 4.

CH verification by CCH

CH authentication by CCH

Here, the definitions of the marked symbols are shown in Table 5.

sign Explanation sign Explanation ID _A Node A's identity CH _A Cluster head of cluster A Time current time cert _A Authentication belonging to node A K _{A +} Node A's Public Key K _{A -} Node A's Secret Key e Certification Expiration Time Nonce _A Nonce issued on node A Request request E _A Encrypt with A

3 is a block diagram illustrating an IoT communication network to which a cluster-based information security method is applied according to another embodiment of the present invention, and FIG. 4 is a device authentication process according to the cluster-based information security method in the IoT communication network of FIG. 3. One flow chart.

As shown in FIG. 3, the IoT communication network divides an area communicating between devices into a device domain and a network domain, and two clusters are configured as a group between other devices in the device domain. The cluster head A 600 of the network domain is an authentication server existing on the network, and is responsible for registration and management of all devices. The gateway node relays the connection with the configuration of the external network or another cluster when a connection is needed from the configuration of the external network or another cluster. When attempting to communicate with device nodes in an external network or other cluster, a device node in proximity to the external network or other cluster is selected as the gateway node.

The new device node 401 enters the cluster C in the device domain and requests a connection to the cluster head C 400 of the cluster C (S201).

The cluster head C 400 requests a network domain connection to the cluster head B 500 of the cluster B (S202).

The cluster head B 500 requests the cluster head A 600 to authenticate the new device node 401 (S203).

The cluster head A 600 requests identification of the new device node from the cluster head C 400 (S204).

In addition, the cluster head A 600 requests identification of the cluster head B 500 (S205).

The cluster head C 400 transmits authentication information about the new device to the cluster head A 600 (S206).

The cluster head B 500 transmits authentication information of the cluster head B 500 to the cluster head A 600 (S207).

The cluster head A 600 requests certificate values from the cluster head C 400 and the cluster head B 500, respectively (S208 and S209). Here, the certificate value is a private key such as a password.

The cluster head C 400 and the cluster head B 500 transmit the certificate values of the new device node 401 and the cluster head B 500 at the request of the cluster head A 600 to the cluster head A 600. Are transmitted to (S210 and S211).

The cluster head A 600 checks the certificate value transmitted from the cluster head C 400 and the cluster head B 500, and then transmits a security key value to the cluster head C 400 and the cluster head B 500, respectively. (S212, S213). In other words, the cluster head A 600 transmits a WEP key to be used for communication using EAP-TLS together with the identified information when the cluster head C 400 and the cluster head B 500 are identified as legitimate users. .

The cluster head C 400 communicates with the new device node 401 (S214). As described above, as the cluster head C 400 and the cluster head B 500 are authenticated by the cluster head A 600 which is an authentication server, the new device node 401 and the cluster head C 400 are authenticated. Can securely communicate in clusters B and C using the WEP key. The WEP key is used only until the connection between the two devices is terminated, and a new key is allocated to communicate with the next connection.

101, 102, 201, 202, 301, 302, 401: device node
100, 300, 400, 500, 600: cluster head
200: cluster head manager

Claims (8)

Receiving a communication request from a first device node in a cluster with a second device node in another cluster;
Performing an authentication procedure with a cluster head of the other cluster according to the communication request;
Receiving, by the first device node, a response to the communication request from the second device node;
And performing communication between the first device node and the second device node.
The method of claim 1, wherein the performing of the authentication procedure comprises:
Requesting authentication from the cluster head manager,
Receiving an authentication response to the authentication request;
Sending a certificate to the cluster head upon receiving the authentication response;
The cluster head receiving the certificate requesting an authentication from the cluster head manager;
And the cluster head manager transmitting an authentication response to the cluster head.
The method of claim 2, wherein the cluster head,
Cluster-based information security method in the IoT network, characterized in that any one of the device nodes belonging to the cluster is elected.
The method of claim 3, wherein the cluster head,
Cluster-based information security method in the IoT network, characterized in that the elected based on the weight of the device node.
The method of claim 3, wherein the cluster head manager,
Cluster-based information security method in the IoT network, characterized in that any one of the cluster heads elected from each cluster is elected.
Receiving an authentication request for the new device node from a cluster head of another cluster in the same device domain as the given cluster according to a connection request of a new device node connected to a given cluster;
Authenticating the new device node through the cluster head of the predetermined cluster according to the authentication request, authenticating the cluster head of the other cluster;
And the new device node communicating with the cluster head of the predetermined cluster in the predetermined cluster and another cluster according to the authentication.
The method of claim 6, wherein the authentication request step,
The new device node requesting to connect to the cluster head of the predetermined cluster;
Requesting, by the cluster head of the predetermined cluster, a network domain connection to the cluster head of the other cluster according to the connection request;
And receiving an authentication request for the new device node from the cluster head of the other cluster.
The method of claim 6, wherein the authentication step,
Requesting identification of the new device node from the cluster head of the predetermined cluster and requesting identification of the cluster head of the other cluster;
Receiving authentication information from cluster heads of the predetermined cluster and another cluster;
Requesting certificate values of the new device node and the cluster head of the other cluster to the cluster heads of the predetermined cluster and the other cluster, respectively;
Receiving corresponding certificate values from cluster heads of the predetermined cluster and another cluster, respectively;
And transmitting a security key to cluster heads of the predetermined cluster and another cluster.

Images