KR101628467B1 - Apparatus and method for transferring data in one-way - Google Patents

Abstract

The present invention relates to a one-way data transmission apparatus and a method thereof, and more particularly, to a first data transmission apparatus and a method thereof, including a first transmission / reception unit for performing data transmission / reception with an internal network; A data link switch for transmitting data transmitted from an internal network to a transmission server; An input data energy calculation unit for calculating bit energy of input data input to the transmission server; An output data energy calculation unit for calculating bit energy of output data transmitted from the transmission server to the reception server and output to the external network; A data energy comparing unit for comparing the bit energy of the input data and the bit energy of the output data; And a data processor for requesting the first transceiver to respond or retransmit the corresponding data according to a result of the data comparison.

Description

[0001] APPARATUS AND METHOD FOR TRANSFERRING DATA IN ONE-WAY [0002]

The present invention relates to a unidirectional data transmission apparatus and method thereof, and more particularly, to a unidirectional data transmission apparatus and a method thereof for preventing loss of data by comparing bit energy of input data and output data and ensuring safe transmission of data .

A network protection device (unidirectional data transmission system) for protecting a security level such as a control system can connect only unidirectional data among the data linked from the control network to the business network. However, in general, TCP-based data association is mostly bi-directional services such as receiving ACK from the other party. In order to connect data through one-way data delivery system, Processing is required. Accordingly, there is a service agent for unidirectionally linking each application service to the unidirectional data delivery system. In this unidirectional data delivery system, a transmission server and a reception server are separately configured and operated for unidirectional data association, in which a service agent is installed and operated in each server.

First, the data transmitted from the control network to the business network is transmitted to the transmission server of the one-way data delivery system, and the service agent of the transmission server performs the response processing of the corresponding data. Then, the corresponding data is transmitted to the reception server of the one-way data delivery system, and the reception server transmits the data to the application server of the corresponding data, and the response received from the application server is processed by the service agent of the reception server to complete the data transmission processing .

However, for example, the transmission server side service agent performs response processing on the data transmitted to the transmission server (the server that has transmitted the data in the control network determines that the data transmission is completed), and thereafter, The data can not be requested to be retransmitted and the corresponding data can not be written to the application server. This is caused by the fact that data can not be transmitted from the receiving server to the transmitting server of the unidirectional data transmission system, and thus the fact of data loss can not be notified or the retransmission request packet can not be transmitted.

In addition, due to the impossibility of reverse transmission of the unidirectional data transmission system, it is difficult to secure the reliability of data transmitted from the control network because the process of encrypting and authenticating data between the control network and the business network is limited. to be. In particular, an application server that receives internal information of the control network and is accessible from an external network is an easily accessible area, and is likely to be vulnerable to forgery and cyber attack of data. Therefore, it is necessary to protect data linked between the two networks Do.

In this regard, Korean Patent Publication No. 2011-0040004 discloses a " one-way data transmission system and method ".

SUMMARY OF THE INVENTION The present invention has been developed in order to solve the above-mentioned problems, and it is an object of the present invention to provide a data transmission method and a data transmission method in which, when bit energy of input data and output data is matched, And to provide a one-way data transmission apparatus for requesting retransmission and a method thereof.

It is another object of the present invention to provide a one-way data transmission apparatus for performing public key based authentication on data transmitted from a transmission server and transmitted through a reception server, and a method thereof.

According to an aspect of the present invention, there is provided a one-way data transmission apparatus including a first transmission / reception unit for transmitting / receiving data to / from an internal network; A data link switch for transmitting data transmitted from an internal network to a transmission server; An input data energy calculation unit for calculating bit energy of input data input to the transmission server; An output data energy calculation unit for calculating bit energy of output data transmitted from the transmission server to the reception server and output to the external network; A data energy comparing unit for comparing a bit energy value of the input data with a bit energy value of the output data; And a data processor for requesting the first transceiver to respond or retransmit the corresponding data according to the comparison result.

If the bit energy value of the input data matches the bit energy value of the output data as a result of the comparison by the data energy comparison unit, the data processing unit may transmit a response to the data to the first transceiver unit, When the bit energy value of the input data does not match the bit energy value of the output data, the first transmission / reception unit requests the first transmission / reception unit to retransmit the data.

In addition, the data processor may request data retransmission of a predetermined number of times or less in response to a data retransmission request from the first transceiver, and when the data is not transmitted to the reception server after a predetermined number of times, It is determined as an error (Error).

The data processing unit may transmit error data to the data link switch unit when it is determined that there is a network error, and the data link switch unit may transmit the received error data to the by-pass link unit.

The apparatus may further include an alarm generation unit for outputting a maintenance notification signal for checking the status of the one-way data transmission apparatus when the error data is transmitted to the bypass link unit.

The server further includes a security module for encrypting and decrypting output data output from the reception server.

The security module may further include: a random number generator for generating a random number; A password and an authentication policy management unit for managing a password and an authentication policy; A verification unit verifying an application server ID transmitted from an application server of the external network; A private key generation unit for generating a private key; A shared key generation unit for generating a shared key; A key management unit for managing a shared key; An encryption / decryption unit decrypting the public key transmitted from the application server with a private key, encrypting the output data including the random number transmitted from the application server and the generated random number using the public key transmitted from the application server, and transmitting the output data; And an electronic signature and verification unit for generating and verifying the encrypted output data as digital signature data.

The apparatus may further include a second transmitting / receiving unit for transmitting / receiving data to / from the external network.

According to another aspect of the present invention, there is provided a one-way data transmission method comprising: performing transmission and reception of data with an internal network by a second transceiver; Transmitting data transmitted from an internal network to a transmission server by a data link switching unit, calculating bit energy of input data input to the transmission server by an input data energy calculation unit, Calculating bit energy of output data transmitted from the transmission server to the reception server by the output data energy calculation unit and output to the external network; Comparing a bit energy value of the input data with a bit energy value of the output data by a data energy comparing unit; and a data processing unit, responsive to the comparison result, for responding to or retransmitting the data to the first transmitting / And a step of requesting a request.

In addition, when the bit energy value of the input data matches the bit energy value of the output data in the step of requesting the first transceiver to respond or retransmit the data according to a result of the data comparison, And transmits a response to the corresponding data to the first transmission / reception unit. When the bit energy value of the input data does not match the bit energy value of the output data, the first transmission / reception unit is requested to retransmit the data .

The step of requesting the first transceiver to respond or retransmit the data according to a result of the data comparison may include requesting data retransmission of a predetermined number of times or less when requesting data retransmission to the first transceiver, And if the data is not transmitted to the reception server by the first transmission / reception unit after the preset number of times, it is determined as a network error.

If it is determined that a network error occurs in the step of requesting the first transceiver to respond or retransmit the data according to a result of the data comparison, the data link change unit transmits the error data to the data link change- And transmitting the error data to the by-pass link unit.

In addition, if it is determined as a network error, error data is transmitted to the data link change-over unit, and after the step of transmitting the received error data to the by-pass link unit, the data link change- When the data is transmitted, an alarm generating unit outputs a maintenance notification signal for checking the status of the one-way data transmission apparatus.

The one-way data transmission apparatus and method according to the present invention having the above-described structure compares the bit energy of the input data and the output data and transmits a response of the corresponding data if they match, It is possible to prevent loss of data and guarantee secure transmission of data.

In addition, according to the present invention, data transmitted from a transmission server and transmitted through a reception server performs authentication based on a public key, thereby preventing forgery and corruption of data.

1 is a block diagram illustrating a configuration of a one-way data transmission apparatus according to the present invention.
2 is a detailed block diagram of a security module used in a one-way data transmission device according to the present invention.
FIG. 3 is a view for explaining a key exchange method between the security module according to FIG. 2 and an application server of an external network.
4 is a flowchart illustrating a procedure of a one-way data transfer method according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to facilitate a person skilled in the art to easily carry out the technical idea of the present invention. . First, in adding reference numerals to the constituents of the drawings, it is to be noted that the same constituents are denoted by the same reference symbols as possible even if they are displayed on different drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a one-way data transmission apparatus and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

The one-directional data transmission apparatus according to the present invention is located between an internal network and an external network, blocks data inflow from the internal network, and transmits data from the internal network to the external network in a unidirectional manner. That is, the data of the internal network transmitted in this way is transmitted to the application server of the external network, and the administrator can access the application server and browse the data.

The present invention is an invention for efficiently blocking the cyber attack from the external network and reliably maintaining the data association between the internal network and the external network, which will be described in detail below.

1 is a block diagram illustrating a configuration of a one-way data transmission apparatus according to the present invention.

1, the one-way data transmission apparatus 100 according to the present invention includes a first transmission / reception unit 110, a data link transfer unit 120, an input data energy calculation unit 130, a transmission server 140a An output data energy calculation unit 150, a data energy comparison unit 160, a data processing unit 170, a bypass link unit 173, an alarm generation unit 175, a security module unit 180 and a second transceiver 190.

The first transmission / reception unit 110 performs data transmission / reception with the internal network 10.

The data link switching unit 120 transmits data transmitted from the internal network 10 to the transmission server 140a.

The input data energy calculation unit 130 calculates the bit energy of the input data input to the transmission server 140a. Here, the bit energy means a signal size often used for comparison between digital communication systems.

The transmission server 140a transmits the input data transmitted from the internal network 10 to the reception server 140b.

The reception server 140b receives the output data transmitted from the transmission server 140a.

Here, the input data and the output data are the same data. For convenience of description, data input to the transmission server 140a is defined as input data, and data output from the transmission server 140b is defined as output data.

The output data energy calculation unit 150 calculates the bit energy of output data transmitted from the transmission server 140a to the reception server 140b and output to the external network 20. [

The data energy comparison unit 160 compares the bit energy of the input data and the bit energy of the output data. That is, the data energy comparison unit 160 compares the bit energy value of the input data calculated through the input data energy calculation unit 130 with the bit energy value of the output data calculated through the output data energy calculation unit 150 do.

The data processor 170 requests the first transceiver 110 to respond to the data or to retransmit the data according to the comparison result. If the bit energy value of the input data matches the bit energy value of the output data as a result of the comparison by the data energy comparison unit 170, the data processing unit 170 transmits a response to the corresponding data to the first transmission / reception unit 110, And the bit energy of the output data does not coincide with the bit energy of the output data, the first transmission / reception unit 110 is requested to retransmit the data.

In addition, when requesting data retransmission by the first transmission / reception unit 110, the data processing unit 170 requests data retransmission of a predetermined number of times or less. However, after a predetermined number of times, the first transmission / 140b, it is determined as a network error (Error). That is, assuming that the data processing unit 170 deletes the number of data retransmission requests three times, if the data is not transmitted to the reception server 140b or the response processing is not performed in the reception server 140b even in two or more retransmission requests, And transmits the error data to the bypass link unit 173 through the data link switch unit 120. [

The bypass link unit 173 receives error data transmitted from the data link switch unit 120.

When the error data is transmitted to the bypass link unit 173, the alarm generating unit 175 outputs a check notification signal for checking the status of the one-way data transmission apparatus. The alarm generating unit 175 outputs a check alarm signal to notify the system administrator to check the server status of the one-way data transfer apparatus. Accordingly, the alarm generating unit 175 can restore the server by the system administrator and perform one-way link switching or the like.

The security module 180 encrypts and decrypts output data output from the receiving server 140b. At this time, the encryption uses the secret key shared by the security module 180 and the application server of the external network 20 and exchanges the shared key. This will be described in detail with reference to FIG. 2 and FIG. 3 which will be described later.

The second transceiver 190 performs data transmission / reception with the external network 20.

FIG. 2 is a diagram illustrating a detailed configuration of a security module used in a one-way data transferring apparatus according to the present invention. FIG. 3 is a diagram for explaining a key exchange method between a security module according to FIG. to be.

Referring to FIG. 2, the security module 180 according to the present invention encrypts and decrypts output data output from the reception server 140a.

To this end, the security module 180 includes a random number generator 181, an encryption and authentication policy unit 182, a verification unit 183, a public key and private key generation unit 184, a shared key generation unit 185, A key management unit 186, an encryption / decryption unit 187, and an electronic signature and verification unit 188.

The random number generation unit 181 generates a random number.

The encryption and authentication policy management unit 182 manages policies relating to encryption and authentication. The application server 21 delivers the algorithm defined by the encryption and authentication policy management unit 182 to the application server 21 of the external network 20 and the application server 21 updates and uses the policy in the password and authentication policy database.

The verification unit 183 verifies the application server ID transmitted from the application server 21 of the external network 20. [

The public key and private key generation unit 184 generates a private key. The public key and private key generation unit 184 generates a public key and a private key based on the policy of the encryption and authentication policy management unit. At this time, the generated public key is disclosed.

The shared key generation unit 185 generates a shared key.

The key management unit 186 manages the shared key.

The encryption / decryption unit 187 decrypts the public key transmitted from the application server 21 with the private key, and then outputs the output data including the random number transmitted from the application server 21 and the generated random number to the application server 21 Encrypts it with the public key and transmits it.

The digital signature and verification unit 188 generates and verifies the encrypted output data as digital signature data.

3, the key exchange method using the security module unit 180 configured as described above will be described. First, the application server 21 transmits its own unique ID (IDA), a public key (KAU) (NA) is generated through an internal random number generating unit and encrypted with the public key (KOU) of the security module unit 180 including 'timestamp1', and transmitted to the security module unit 180. The security module 180 decrypts the received private key with its own private key and verifies the ID of the application server 21 through the digital signature and verification unit 188. The security module 180 verifies the random number No) is generated and transmitted by encrypting the random number NA received from the application server 921 with the public key KAU of the application server 21 including the newly generated 'timestamp2'. Thereafter, the application server 21 encrypts the random number (No) received from the security module 180 with the public key KOU of the security module 180 and transmits it with 'timestamp 3'. The security module 180 generates a shared key KS and a timestamp 4 through the shared key generator 185 and transmits the shared key KS and the timestamp 4 to the application server 21, And use it for data encryption and decryption. The encrypted data is signed through the digital signature and verification unit 188, wherein the digital signature scheme uses a verified method such as ECKCDSA, and the encryption uses a method such as SEED or ARIA that has been verified by the National Intelligence Service. At this time, the block cipher length is 128 bits or more for security, and the hash function is also SHA-256 or more.

On the other hand, the application server 21 verifies the signed data, decrypts the data, and transfers the decrypted data to an internal application program. During the above process, the process of encryption and authentication system operation such as key generation and exchange is processed at the time of initial setting of the one-way data transmission device, and the procedure of key update and the like is performed according to the policy in the future.

4 is a flowchart illustrating a procedure of a one-way data transfer method according to the present invention.

Referring to FIG. 4, the one-way data transmission method according to the present invention uses the one-way data transmission apparatus described above, and a duplicate description will be omitted.

First, data is received from the internal network (S100).

next. The bit energy of the input data input to the transmission server is calculated (S110).

Next, the bit energy value of the input data is transmitted to the data energy comparison unit (S111)

Next, the bit energy of the output data input to the reception server is calculated (S120).

Next, the bit energy value of the output data is transmitted to the data energy (S121).

Next, it is determined whether the bit energy value of the input data matches the bit energy value of the output data (S130).

If the bit energy value of the input data matches the bit energy value of the output data, a response to the corresponding data is transmitted to the first transceiver at step S140.

Next, if the bit energy value of the input data does not match the bit energy value of the output data as a result of the comparison, the first transmission / reception unit is requested to retransmit the data (S150).

Next, when data retransmission is requested to the first transmission / reception unit, data retransmission is requested less than a predetermined number of times (S151).

If the data is not transmitted to the reception server by the first transmission / reception unit after a predetermined number of times, it is determined as a network error and error data is generated in step S160.

Next, a check alarm signal is generated based on the error data (S170).

Next, server recovery is performed (S180).

Next, one-way link switching is performed (S190).

As described above, the one-way data transmission apparatus and method according to the present invention compares the bit energy of input data and output data and, if they match, transmits a response of the corresponding data, and if not, transmits data to the transmission server that transmitted the input data By requesting, it is possible to prevent loss of data and ensure secure transmission of data.

In addition, according to the present invention, data transmitted from a transmission server and transmitted through a reception server performs public key based authentication, thereby preventing forgery and falsification of data.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications, and variations will be apparent to those skilled in the art without departing from the scope of the appended claims. As will be understood by those skilled in the art.

100: One-way data transmission device
110: first transmission / reception unit 120: data link transfer unit
130: Input data energy calculation unit 140a:
140b: reception server 150: output data energy calculation unit
160: Data energy comparing unit 170: Data processing unit
173: bypass link unit 175: alarm generating unit
180: Security module module 190: Second transmission /

Claims (13)

A one-way data transmission apparatus including a transmission server and a reception server,
A first transmission / reception unit for transmitting / receiving data to / from an internal network;
A data link switch for transmitting data transmitted from an internal network to the transmission server;
An input data energy calculation unit for calculating bit energy of input data input to the transmission server;
An output data energy calculation unit for calculating bit energy of output data transmitted from the transmission server to the reception server and output to the external network;
A data energy comparing unit for comparing a bit energy value of the input data with a bit energy value of the output data; And
A data processor for requesting the first transceiver to respond or retransmit the corresponding data according to the comparison result;
Wherein the one-way data transmission apparatus comprises: The method according to claim 1,
Wherein the data processing unit transmits a response to the data to the first transmitting and receiving unit when the bit energy value of the input data matches the bit energy value of the output data as a result of the comparison by the data energy comparing unit, And requests retransmission of data to the first transceiver unit when the bit energy value of the data does not match the bit energy value of the output data. The method according to claim 1,
Wherein the data processing unit requests data retransmission of a predetermined number of times or less when requesting data retransmission to the first transceiver unit, and when the data is not transmitted from the first transceiver unit to the receiving server after a predetermined number of times, Error). ≪ / RTI > The method of claim 3,
Wherein the data processing unit transmits error data to the data link switch unit when it is determined to be a network error, and the data link switch unit transmits the received error data to the by-pass link unit. . 5. The method of claim 4,
Further comprising an alarm generation unit for outputting a maintenance notification signal for checking the status of the one-way data transmission apparatus when the error data is transmitted to the bypass link unit. The method according to claim 1,
And a security module for encrypting and decrypting the output data output from the reception server. The method according to claim 6,
The security module unit,
A random number generator for generating a random number;
A password and an authentication policy management unit for managing a password and an authentication policy;
A verification unit verifying an application server ID transmitted from an application server of the external network;
A private key generation unit for generating a private key;
A shared key generation unit for generating a shared key;
A key management unit for managing a shared key;
An encryption / decryption unit decrypting the public key transmitted from the application server with a private key, encrypting the output data including the random number transmitted from the application server and the generated random number using the public key transmitted from the application server, and transmitting the output data; And
An electronic signature and verification unit for generating and verifying the encrypted output data as digital signature data;
Wherein the one-way data transmission apparatus comprises: The method according to claim 1,
And a second transmission / reception unit for performing data transmission / reception with the external network. A one-way data transmission method by a one-way data transmission apparatus including a transmission server and a reception server,
Transmitting and receiving data to and from the internal network by the first transceiver;
Transmitting data transmitted from an internal network to the transmission server by a data link switching unit;
Calculating a bit energy of input data input to the transmission server by an input data energy calculation unit;
Calculating bit energy of output data transmitted from the transmission server to the reception server by the output data energy calculation unit and output to the external network;
Comparing a bit energy value of the input data with a bit energy value of the output data by a data energy comparison unit;
Requesting, by the data processing unit, a response or retransmission of the data to the first transceiver unit according to a result of the comparison;
And transmitting the one-way data. 10. The method of claim 9,
In response to the data comparison result, in the step of requesting the first transceiver to respond or retransmit the corresponding data,
And transmits a response to the corresponding data to the first transceiving unit when the bit energy value of the input data matches the bit energy value of the output data, And if the bit energy values do not match, requesting the first transceiver to retransmit the data. 10. The method of claim 9,
Wherein the step of requesting the first transceiver to respond or retransmit the data according to a result of the data comparison comprises:
When the first transmission / reception unit requests data retransmission, requests data retransmission of a predetermined number of times or less. If the first transmission / reception unit does not transmit data to the reception server after a predetermined number of times, it is determined as a network error To the one-way data transmission method. 12. The method of claim 11,
In response to the data comparison result, in the step of requesting the first transceiver to respond or retransmit the corresponding data,
And transmitting the error data to the data link switch unit when the network error is determined, and the data link switch unit transmits the received error data to the by-pass link unit. . 13. The method of claim 12,
When it is determined that a network error has occurred, the error data is transmitted to the data link change-over unit, and the data link change-over unit transmits the received error data to the by-pass link unit,
Wherein when the error data is transmitted to the bypass link unit, an alarm notifying signal for checking the status of the one-way data transmission apparatus is output by the alarm generating unit.

Images