KR101505168B1 - Adaptive gateways being able to filtering battery-exhaustive attack to wireless device and filtering method - Google Patents

Abstract

The present invention relates to an adaptive gateway having a function of filtering a battery consumption attack to a wireless device, and a filtering method at the adaptive gateway. The adaptive gateway having a function of filtering a battery consumption attack to a wireless device comprises: a normal communication object management unit for storing address information of normal communication objects which are normally allowed communications; a normal communication determination unit for determining whether a communication object is a normal communication object according to whether the address information of the communication object is stored in the normal communication object management unit when the communication object requests to communicate with a wireless device; a communication management unit for allowing communications with the wireless device when the communication object is determined as a normal communication object, and blocking communications with the wireless device when the communication object is determined as not a normal communication object but an object to be blocked; and a blocked object management unit for receiving the address information of communication objects which are determined by the wireless device as objects to be blocked, excluding the corresponding address information from the normal communication object management unit, and flexibly setting blocking time according to predetermined conditions for the relevant communication objects, wherein the communication management unit blocks communications with the wireless device in regard to the objects to be blocked for the blocking time set by the blocked object management unit.

Description

TECHNICAL FIELD [0001] The present invention relates to an adaptive gateway having a function of filtering battery energy consumption attacks of a wireless device, and a filtering method in the adaptive gateway. [0002]

The present invention relates to an adaptive gateway having a function of filtering a battery energy consumption attack of a wireless device and a filtering method in the adaptive gateway, and more particularly, To an adaptive gateway and a filtering method capable of detecting and blocking an attack that consumes battery energy from the outside.

With the development of wireless communication technology, wireless devices such as smart phones, smart pads, and notebook computers are widely used. Because these wireless devices are handheld devices, they run on battery power. Such a wireless device communicates with the outside by performing wireless communication through a gateway connected to an external communication network. The gateway performs wireless communication with the wireless device in accordance with a wireless communication method (WiFi, Bluetooth, etc.), and is connected to the outside through a wired network to mediate communication between the wireless device and the outside.

Since the wireless device operates by using the battery as a power source, the wireless device stops its operation when the battery is consumed. Therefore, to delay battery consumption as much as possible, wireless devices generally have two modes of operation. That is, when there is a communication request, a high power consumption mode (active mode) in which most of the accessory devices of the wireless device are operated and a low power consumption mode (sleep mode) It is common to provide an operation mode and operate to delay battery consumption as much as possible by switching between two operation modes according to a communication request.

Meanwhile, a battery energy consumption attack aiming at stopping the operation of the battery of the wireless device is known. This is because the wireless device continuously requests the unnecessary communication and thereby drives the operation mode of the wireless device to the high power consumption operation mode to accelerate the energy consumption It says.

As a method for blocking battery energy consumption attacks of such wireless devices, Korean Patent Laid-Open No. 10-2009-0015364 (published on Feb. 12, 2009) discloses a method for blocking a TCP based denial of service attack on a mobile device .

However, this technique has a limitation in that it assumes the TCP protocol and determines whether a denial of service is a denial-of-service attack between the base station and the mobile device using TCP-based packets.

Korean Patent Publication No. 10-2009-0015364 (published on Feb. 12, 2009)

SUMMARY OF THE INVENTION It is an object of the present invention to provide an adaptive gateway and a filtering method capable of detecting and blocking an attack from the outside for the purpose of consuming battery energy of a wireless device.

It is another object of the present invention to provide a gateway and a method capable of variably controlling a blocking time so as to prevent a case where an attack from the outside is mistaken.

It is another object of the present invention to provide a gateway and a filtering method that can actively and efficiently adjust the blocking time with probability distribution.

According to an aspect of the present invention, there is provided an adaptive gateway having a function of filtering a battery energy consumption attack of a wireless device, the gateway including: normal communication for storing address information of a normal communication object, An object management unit; A normal communication determination unit for determining whether the communication target is a normal communication object according to whether the communication target address information is stored in the normal communication target management unit when a communication request for the wireless device is generated from the communication target; A communication management unit that allows communication with the wireless device when it is determined that the communication object is a normal communication object and blocks communication with the wireless device when it is determined that the object is a non-normal communication object; And a blocking object management unit for receiving the address information of the communication object determined to be blocked by the wireless device, excluding the address information from the normal communication object management unit, and variably setting the blocking time according to a preset condition for the communication object And the communication management unit interrupts communication with the wireless device for a communication object to be blocked for a blocking time set by the blocking object management unit, Gateway.

Here, in the case where a communication message of a kind not previously stored from the communication object is received more than the preset number of times, the wireless device judges the communication object as a blocking object that is not a normal communication object and notifies the address information To the blocking object management unit.

In addition, it is preferable that the blocking object management unit again stores the address information of the blocking object in the normal communication object management unit after the blocking time has elapsed.

It is preferable that the blocking object management unit sets the blocking time to increase in accordance with the number of times that the communication object determined as the blocking object is determined as the blocking object.

The blocking object management unit may be configured to change the blocking time by comparing the communication request distribution of the communication object with the communication request distribution of the normal communication in the middle of the blocking time.

에 의해 계산하고(여기서,

는 평상시의 정상적인 통신에 대한 단위 시간당 통신 횟수), 계산된 확률값이 일정값 이하인 경우 차단 시간을 감소시키는 것이 바람직하다.The blocking object management unit may periodically check the blocking time and if the cumulative time T for which no communication request is made during the blocking time is greater than or equal to a predetermined value, Probably not

(Where < RTI ID = 0.0 >

Is the number of times of communication per unit time for normal normal communication), and if the calculated probability value is less than a predetermined value, it is preferable to reduce the blocking time.

·

에 의해 계산하고, 계산된 확률값이 일정값 이하인 경우 차단 시간을 증가시키도록 구성할 수도 있다.In addition, when the number of times of communication (X) filtered and checked periodically in the middle of the blocking time is equal to or greater than a predetermined value, the blocking object management unit may set the communication time X times during the cumulative time (T) The probability of

·

And the blocking time may be increased when the calculated probability value is less than or equal to a predetermined value.

According to another aspect of the present invention, there is provided a method for filtering a battery energy consumption attack of a wireless device in an adaptive gateway as described above, the method comprising: a first step of storing address information of a normal communication object to be normally communicated; A second step of determining whether the communication object is a normal communication object according to whether the address information of the communication object is stored in advance when a communication request for the wireless device occurs from the communication object; A third step of allowing communication with the wireless device when it is determined that the communication object is a normal communication object and blocking communication with the wireless device when it is determined that the object is a normal object to be blocked; And a fourth device for receiving the address information of the communication object determined to be blocked by the wireless device and excluding the address information from the address information of the normal communication object and variably setting the blocking time according to a preset condition for the communication object, Wherein the third step includes blocking communication with the wireless device for a communication object to be blocked during the set blocking time, wherein the adaptive gateway filters the battery energy consumption attack of the wireless device. to provide.

The present invention can provide an adaptive gateway and a filtering method capable of detecting and blocking an attack from the outside for the purpose of battery energy consumption of a wireless device.

In addition, the present invention can provide a gateway and a method capable of variably controlling a blocking time so as to prevent a case where an attack from the outside is mistaken.

Further, the present invention provides a gateway and a filtering method that can actively and efficiently adjust the blocking time by probability distribution.

1 is a diagram illustrating a connection relationship between an adaptive gateway 100 (hereinafter referred to as a gateway) and a wireless device 200 having a function of filtering a battery energy consumption attack of a wireless device according to the present invention.
2 is a diagram illustrating an internal structure of a gateway 100 and a wireless device 200 according to the present invention.
FIG. 3 is a diagram illustrating an embodiment of a filtering method performed in the gateway 100 and the wireless device 200 according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a connection relationship between an adaptive gateway 100 (hereinafter referred to as a gateway) and a wireless device 200 having a function of filtering a battery energy consumption attack of a wireless device according to the present invention.

1, a gateway 100 is located between an external communication requestor and a wireless device 200 and transmits and receives data to and from the wireless device 200 by wireless communication (for example, WiFi, Bluetooth, etc.) The requestor performs a function of mediating communication between a wireless device and an external communication requestor by transmitting and receiving data through a wired network-based network. Since the general function of the gateway 100 is well known in the prior art, detailed description thereof will be omitted.

The wireless device 200 is a device that operates based on a battery such as a smart phone or a notebook computer. The wireless device 200 performs wireless communication with the gateway 100 and communicates with the outside through the gateway 100 . Since general functions of the wireless device 200 are well known in the prior art, detailed description thereof will be omitted.

The gateway 100 according to the present invention is further characterized by a function and means for detecting and blocking a battery energy consumption attack on the wireless device 200 in addition to the general function of the gateway described above. The device 200 further includes a function of determining a blocking target that is not a normal communication target, which will be described in detail below.

1 (a) shows a case where the wireless device 200 is in a low power consumption mode (sleep) in which only the control communication signal is transmitted / received to / from the gateway 100, and FIG. 1 (b) Quot; active mode "

1 (a), since the wireless device 200 does not perform communication with the outside, the power consumption is minimized. In the case of FIG. 1 (b), the wireless device 200 is connected to the gateway 100 Since it is in a state of performing communication with the outside, the power consumption is the maximum.

The battery energy consumption attack refers to the continuous generation of an unnecessary communication request to exhaust the battery of the wireless device 200 to induce the state as shown in FIG. 1 (b) 200 detects a battery energy consumption attack and blocks the battery energy consumption attack.

2 is a diagram illustrating an internal structure of a gateway 100 and a wireless device 200 according to the present invention.

Referring to FIG. 2, the gateway 100 includes a normal communication object management unit 110, a normal communication determination unit 120, a communication management unit 130, and a blocking object management unit 140. 2, only the configuration of the gateway 100 related to the present invention is shown, and the general function of the gateway 100 is omitted.

The normal communication object management unit 110 stores address information of a normal communication object to be normally communicated. Here, the normal communication object means an external communication requestor recognized as an object of normal communication among external communication requestors for transmitting and receiving data to / from the wireless device 200 through the gateway 100 as shown in FIG. The address information of the normal communication object may be information such as an IP address, a MAC address, an e-mail address, an SNS account, and the like.

The normal communication determination unit 120 determines whether or not a communication request for the wireless device is generated from the communication object, based on whether the address information of the communication object is stored in the normal communication object management unit 110 Function.

The normal communication determination unit 120 determines whether the address information of the communication object in which the communication request is generated exists in the address information of the normal communication object stored in the normal communication object management unit 110, If it does not exist, it is judged as a block object. Here, the term " normal communication object " means a communication object in which communication with the wireless device 200 is allowed, and an object to be blocked means an object in which communication with the wireless device 200 is not permitted.

The communication management unit 130 permits communication with the wireless device 200 when the normal communication determination unit 120 determines that the communication target is the normal communication target and determines that the wireless device 200 ) Of the mobile terminal. The method of allowing and blocking communication is well known in the art and is not a direct object of the present invention, so a detailed description thereof will be omitted.

The blocking object management unit 140 receives the address information of the communication object determined to be blocked by the wireless device 200, excludes the address information from the normal communication object management unit 110, And performs a function of setting the cutoff time to be variable.

When the communication message of a type not previously stored from the communication object is received more than the preset number of times, the wireless device 200 determines that the communication object is a block object that is not a normal communication object and blocks the address information of the communication object To the object management unit 140.

For this purpose, the wireless device 200 stores a type of normal communication message, that is, a type of communication message that does not cause a problem even if communication is allowed, and receives a communication message of a type not stored from the communication object for a predetermined number of times or more, The communication object is judged to be a blocking object. Here, the communication message refers to a command, a control signal, a message, and the like for communication received from the gateway 100 and may be, for example, an input / output command, a device on / off command, Whether or not the communication messages are normal communication messages or abnormal communication messages are compared with the normal communication message types stored in advance.

Since the wireless device 200 performs communication only with the communication object permitted to communicate in the gateway 100, the wireless device 200 determines whether or not the wireless device 200 is to be blocked based on the communication message type. That is, And detects a case of requesting unauthorized communication among the communication objects stored in the management unit 110. [ For example, a normal communication object having normal address information may be illegally exploited by hacking or hacking to transmit an illegal communication message, and the wireless device 200 may block the communication message by filtering the communication message.

However, in order to prevent a case where a communication message is mistakenly transmitted due to a mistake and is judged to be a blocking object, it is preferable that the blocking object is determined only when a communication message type that is not continuously stored for a predetermined number of times or more is received.

If the wireless device 200 determines that the wireless device 200 is to be blocked, the wireless device 200 transmits the address information of the communication object to the blocking object management unit 140 of the gateway 100, The address information is excluded from the normal communication object management unit 110, and the blocking time is variably set according to a preset condition for the communication object. Then, the communication management unit 130 interrupts the communication with the radio device 200 with respect to the communication object to be blocked during the blocking time set by the blocking object management unit 140. [

The present invention is characterized in that the blocking time is set variably and dynamically without being set to a fixed value. As described above, when a communication message of a type that is not stored due to a mistake is transmitted from a communication object having address information stored by the operation of the wireless device 200 and the gateway 100, Is excluded from the communication object management unit 110, the communication object can no longer be communicated. This is a problem of false positives (misdirected as an attack even though it is not an attack), and the blocking time is set variable, adaptively, and dynamically to minimize the side effects.

After the blocking time has elapsed, the blocking object management unit 140 stores the blocking object address information in the normal communication object management unit 110 again. Therefore, after the blocking time has elapsed, the blocking object is again classified as a normal communication object, and communication is performed as described above.

At this time, the blocking time can be set variably, adaptively and dynamically in the following manner.

As a first method, the blocking object management unit 140 can set the blocking time to increase in accordance with the number of times that the communication object determined as the blocking object is determined as the blocking object.

For example, the blocking time is set to the initial value F _a for the specific address a and communication between the communication target of the address a and the wireless device 200 is interrupted during the blocking time. After the blocking time has elapsed, the address a is stored again in the normal communication object management unit 110 so that communication can be normally performed. Then, if the address a is judged to be the block object again, the blocking time (second time) is increased as Fa <--- Fa * Fa, for example. After the communication is blocked for the increased blocking time, the address a is stored again in the normal communication object management unit 110 to perform communication. If the address a is judged to be blocked again, the blocking time can be increased in the same manner as above. At this time, for example, if it is determined that the third block is to be blocked, the corresponding address a may be permanently blocked (Fa <- ∞).

As a second method, the blocking object management unit 140 may use a method of changing the blocking time by comparing the communication request distribution of the communication object with the normal communication request distribution in the middle of blocking time.

 That is, if the communication request is less frequently than the normal time during the blocking time, the blocking time is reduced, and if the communication request is much higher than usual, the blocking time can be increased. As a method for comparing the communication request distribution blocked during the blocking time with the normal communication request distribution, for example, a method of predicting the normal communication number using the Poisson distribution can be used.

A method for estimating the number of normal communications using the Poisson distribution is as follows.

라 하고, 차단 시간 동안에 통신 요청 없이 경과한 최근 누적 시간을 T라 할 때, 시간 T동안 통신이 발생하지 않을 확률은

이고 시간 T 동안 통신이 X회 발생할 확률은

·

가 된다.The number of communications per unit time for existing normal communication

, And the latest cumulative time that has elapsed without a communication request during the blocking time is T, the probability that communication will not occur during time T is

And the probability of X times of communication during time T is

·

.

Based on this, the blocking time can be adjusted adaptively and variably.

에 의해 계산하고(여기서,

는 평상시의 정상적인 통신에 대한 단위 시간당 통신 횟수), 계산된 확률값이 일정값(예컨대 30%) 이하인 경우 차단 시간을 감소시킬 수 있다. First, the blocking object management unit 140 periodically inspects the interception time period, and if the cumulative time T for which there is no communication request is greater than or equal to a predetermined value (for example, T> 1 minute) Probability that no communication will occur during

(Where &lt; RTI ID = 0.0 &gt;

The number of communications per unit time for normal normal communication), and the blocking time can be reduced if the calculated probability value is less than or equal to a certain value (e.g., 30%).

The decrease in the cutoff time can be reduced to a certain rate (e.g., the cutoff time * 0.1) or a decrease (e.g., a cutoff time * 0.01 / calculation probability) in inverse proportion to the calculated probability value.

·

에 의해 계산하고, 계산된 확률값이 일정 기준(예컨대 2%) 이하인 경우 차단 시간을 증가시킬 수 있다.In addition, when the number of times of communication (X) filtered and checked periodically in the middle of the blocking time is more than a predetermined value (for example, X> 1), the blocking object management unit (140) The probability of communication occurring X times during the cumulative time (T)

·

And the blocking time can be increased if the calculated probability value is less than or equal to a certain criterion (for example, 2%).

The increase in the cutoff time can be increased by a certain percentage (for example, the cutoff time * 0.1) or increased in inverse proportion to the calculated probability value (for example, the cutoff time * 0.001 / calculation probability).

FIG. 3 is a diagram illustrating an embodiment of a filtering method performed in the gateway 100 and the wireless device 200 according to the present invention.

Referring to FIG. 3, the gateway 100 stores address information of a normal communication object, which is a communication target to be normally allowed to communicate with the normal communication object management unit 110 (S100).

In this state, when the communication request for the wireless device 100 is generated from the external communication object, the normal communication determination unit 120 of the gateway 100 transmits the address information of the communication object to the normal communication object management unit 110 in advance It is determined whether the communication is a normal communication object (S110).

The communication management unit 130 permits communication with the wireless device 200 when it is determined that the communication object is a normal communication object, and interrupts communication with the wireless device 200 when it is determined that the object is not a normal communication object (S120 ).

If communication is determined to be a normal communication object, an external communication requester communicates data with the wireless device 200 through the gateway 100. During the communication, the wireless device 200 When the blocking object is detected (S130), the wireless device 200 transmits the address information of the communication object determined to be blocked to the blocking object management unit 140 of the gateway 100 (S140). At this time, the detection of the blocking object can be detected by the communication message type as described above.

The blocking object management unit 140 of the gateway 100 excludes the received address information from the normal communication object address information stored in the normal communication object management unit 110 and sets the blocking time according to a preset condition (S150).

Thereafter, the communication management unit 130 interrupts the communication with the radio device 200 for the communication object to be intercepted during the set interrupting time, and adaptively and dynamically adjusts the intercepting time in the same manner as described above (S160).

100 ... Gateway
110 ... Normal communication object management unit
120 ... normal communication determination unit
130 ... communication management unit
140 ... Blocking target management section
200 ... wireless devices

Claims (8)

An adaptive gateway having a capability to filter battery energy consumption attacks of a wireless device,
A normal communication object management unit for storing address information of a normal communication object which is a communication object to normally allow communication;
A normal communication determination unit for determining whether the communication target is a normal communication object according to whether the communication target address information is stored in the normal communication target management unit when a communication request for the wireless device is generated from the communication target;
A communication management unit that allows communication with the wireless device when it is determined that the communication object is a normal communication object and blocks communication with the wireless device when it is determined that the object is a non-normal communication object; And
The wireless communication device according to claim 1, further comprising: a blocking object management unit that receives address information of a communication object determined as a blocking object from the wireless device, excludes the address information from the normal communication object management unit, and variably sets a blocking time according to a preset condition for the communication object;
Lt; / RTI &gt;
The communication management unit,
Wherein the blocking object management unit blocks communication with the wireless device for a communication object that is a blocking object during a blocking time set by the blocking object management unit,
Wherein the blocking object management unit comprises:
The communication request distribution of the communication object is compared with the distribution of the communication request at the normal time in the middle of the blocking time to vary the blocking time,
If the cumulative time (T) during which no communication request is made during the blocking time is greater than or equal to a preset value, the probability that the blocking object will not cause the communication during the cumulative time (T)

(Where &lt; RTI ID = 0.0 &gt;

The number of communication times per unit time for normal normal communication), the blocking time is reduced when the calculated probability value is less than a predetermined value,
If the filtered number of communications (X) is more than a certain value, the probability of occurrence of X times during the cumulative time (T)

·

And the blocking time is increased when the calculated probability value is less than or equal to a predetermined value. The adaptive gateway according to claim 1,
The method according to claim 1,
When a communication message of a type not previously stored from the communication target is received more than the preset number of times, the wireless device determines that the communication target is a blocking target that is not a normal communication target, Wherein the controller is further configured to transmit the power to the management unit.
The method according to claim 1,
Wherein the blocking object management unit stores the blocking object address information again in the normal communication object management unit after the blocking time has elapsed, the filtering object management unit filtering the battery energy consumption attack of the wireless device.
The method according to claim 1,
Wherein the blocking object management unit comprises:
And setting a blocking time to be increased in accordance with the number of times that the communication object determined as the blocking object is determined as a blocking object.
delete delete delete 6. A method for filtering battery energy consumption attacks of a wireless device in an adaptive gateway according to any one of claims 1 to 4,
A first step of storing address information of a normal communication target which is a communication target to normally allow communication;
A second step of determining whether the communication object is a normal communication object according to whether the address information of the communication object is stored in advance when a communication request for the wireless device occurs from the communication object;
A third step of allowing communication with the wireless device when it is determined that the communication object is a normal communication object and blocking communication with the wireless device when it is determined that the object is a normal object to be blocked; And
A fourth step of receiving the address information of the communication object determined as a blocking object from the wireless device and excluding the address information from the address information of the normal communication object and variably setting the blocking time according to a preset condition for the communication object,
Lt; / RTI &gt;
In the third step,
The communication with the wireless device is blocked for the communication object to be blocked during the set blocking time,
In the fourth step,
The communication request distribution of the communication object is compared with the distribution of the communication request at the normal time in the middle of the blocking time to vary the blocking time,
If the cumulative time (T) during which no communication request is made during the blocking time is greater than or equal to a preset value, the probability that the blocking object will not cause the communication during the cumulative time (T)

(Where &lt; RTI ID = 0.0 &gt;

The number of communication times per unit time for normal normal communication), the blocking time is reduced when the calculated probability value is less than a predetermined value,
If the filtered number of communications (X) is more than a certain value, the probability of occurrence of X times during the cumulative time (T)

·

And the blocking time is increased when the calculated probability value is less than or equal to a predetermined value. A method for filtering a battery energy consumption attack of a wireless device in an adaptive gateway.

Images