KR102096610B1 - Apparatus and method for managing communication of internet of things - Google Patents

Abstract

The communication management apparatus according to an embodiment analyzes a router switching to connect to any one of a public Internet network and an encrypted network network, a communication unit receiving packets from an IoT terminal, and an encryption level applied to the received packets. An analysis unit that does not encrypt when the analyzed encryption level meets a predefined criterion, and encrypts by applying an encryption algorithm supported by an encrypted network to the received packet when the analyzed encryption level is less than the standard. An encryption unit, and controls the switching of the router so that the encrypted packets are delivered to the destination through the encrypted network, and controls the switching of the router so that the unencrypted packets are delivered to the destination through the public Internet network. It includes a control unit.

Description

Apparatus and method for managing communication of IoT terminals {APPARATUS AND METHOD FOR MANAGING COMMUNICATION OF INTERNET OF THINGS}

The present invention relates to an apparatus and method for managing communication of an IoT terminal.

Recently, as interest in the Internet of Things (IoT) has increased, commercial services using IoT terminals have been provided. In providing commercial services, these IoT terminals can transmit and receive packets using a public Internet network.

However, IoT terminals are generally developed based on low power, light weight, or small size. Thus, in reality, various security functions are not installed in the IoT terminal. Accordingly, security issues for packets transmitted and received by IoT terminals are emerging.

Korean Patent Registration Publication, No. 10-1683051 (Registration on December 7, 2016)

The problem to be solved by the present invention is to provide a technique for improving the security of an IoT terminal.

However, the problem to be solved of the present invention is not limited to those mentioned above, and another problem not to be solved can be clearly understood by a person having ordinary knowledge to which the present invention belongs from the following description. will be.

The communication management apparatus according to an embodiment analyzes a router switching to connect to any one of a public Internet network and an encrypted network network, a communication unit receiving packets from an IoT terminal, and an encryption level applied to the received packets. The analysis unit does not encrypt the received packet when the analyzed encryption level meets a predefined criterion, and if the criterion is not satisfied, the encryption algorithm supported by the encrypted network is applied to the received packet to encrypt The encryption unit and the encrypted packet control the switching of the router to be delivered to the destination through the encrypted network network, and the unencrypted packet is switched to the router to be delivered to the destination through the public Internet network. It includes a control unit to control.

The analysis unit may analyze a packet including all or part of information identifying the Internet of Things terminal among the received packets as being below the standard.

Further, the information identifying the IoT terminal may include at least one of a media access control address (MAC address) of the IoT terminal and an Internet protocol (IP) address of the IoT terminal. You can.

In addition, the analysis unit analyzes whether the received packet is encoded in a binary manner, decodes the received packet when encoded in a binary manner, and the decoded packet is information identifying the Internet of Things terminal Including all or part of can be analyzed that the above criteria are not met.

In addition, the analysis unit may analyze that the packet including information in the form of plain text among the received packets is less than the standard.

In addition, the encrypted network network may be a TOR (The Onion Router) network.

In addition, when the encryption level applied to the received packet is analyzed to be below the reference, the communication management apparatus may further include a display unit indicating that the security of the packet analyzed to be below the reference is weak.

In addition, the communication management device further includes an input unit that receives an input from the user of the communication management device to determine whether to deliver the packet, which is analyzed to be below the standard, to the destination, and wherein the encryption unit fails to meet the standard from the user through the input unit. When receiving the input to deliver the packet analyzed as being to the destination, the packet analyzed as being below the standard is encrypted, and when the user receives input from the user not to deliver the packet analyzed as being below the reference to the destination through the input unit, It does not encrypt the packet that is analyzed to be below the reference, and the control unit controls the switching of the router so that the packet that is below the reference and is encrypted is delivered to the destination through the encrypted network, and the packet that is below the reference and is not encrypted To the destination It is possible to control the switching of the router such that the moon is blocked.

The communication management apparatus according to an embodiment analyzes a router switching to connect to any one of a public Internet network and an encrypted network network, a communication unit receiving packets from an IoT terminal, and an encryption level applied to the received packets. And an analysis unit for determining the security level of the Internet of Things terminal based on the analyzed encryption level, and the packet received from the Internet of Things terminal in which the determined security level meets a predefined criterion is not encrypted, and the determined An encryption unit for encrypting a packet received from the Internet of Things terminal, which is determined to have a security level below the standard, and controlling the switching of the router so that the encrypted packet is delivered to a destination through the encrypted network, and the encryption is not performed. Unpacked packets are targeted through the public internet network To be forwarded to a control unit for controlling the switching of the router.

Methods for managing communication of an IoT terminal performed by a communication management device include receiving a packet from the IoT terminal, analyzing an encryption level applied to the received packet, and analyzing the encryption level. If the defined criterion is satisfied, encryption is not performed, and if the analyzed encryption level is less than the criterion, an encryption algorithm supported by an encrypted network is applied to the received packet to encrypt the encrypted packet, and the encrypted packet is encrypted. And routing to be delivered to the destination through the network, and routing the unencrypted packet to be delivered to the destination through the public Internet network.

In addition, the analyzing step may analyze a packet including all or part of information identifying the Internet of Things terminal among the received packets as being below the standard.

Further, the information identifying the IoT terminal may include at least one of a media access control address (MAC address) of the IoT terminal and an Internet protocol (IP) address of the IoT terminal. You can.

In addition, the analyzing step analyzes whether the received packet is encoded in a binary manner, decodes the received packet when encoded in a binary manner, and the decoded packet identifies the IoT terminal. If all or part of the information to be included is included, it can be analyzed that the above criteria are not met.

In addition, in the analyzing step, a packet including information in plain text form among the received packets may be analyzed to be less than the standard.

In addition, when the encryption level applied to the received packet is analyzed to be below the reference, it may further include the step of indicating that the security of the packet analyzed to be below the reference is weak.

In addition, the communication management method further includes receiving a packet from the user of the communication management device, which is analyzed to be less than the reference, to be delivered to a destination, and the encrypting step comprises the user through the receiving step. When receiving the input from the user to deliver the packet analyzed to be below the reference to the destination, the packet analyzed to be below the reference is encrypted, and through the receiving step, the packet analyzed to be below the reference is delivered from the user to the destination. When receiving an input not to do so, it does not encrypt the packet analyzed to be below the reference, and the routing step controls the switching of the router so that the encrypted packet is delivered to the destination through the encrypted network while the reference is below the reference. Encryption that does not meet the above criteria If that packet may control the switching of the router such that the block being transmitted to the destination.

A computer program stored in a computer-readable recording medium according to an embodiment receives a packet from an Internet of Things terminal, analyzes an encryption level applied to the received packet, and the analyzed encryption level is a predefined criterion. If it meets, encryption is not performed. If the analyzed encryption level is less than the standard, encryption is performed by applying an encryption algorithm supported by the encrypted network to the received packet, and the encrypted packet is used to encrypt the encrypted network. Routed to be delivered to the destination through, and the unencrypted packet is programmed to perform the step of routing to be delivered to the destination through the public Internet network.

In a computer-readable recording medium storing a computer program according to an embodiment, the computer program receiving a packet from the Internet of Things terminal, analyzing the encryption level applied to the received packet, and the analyzed If the encryption level meets a predefined criterion, encryption is not performed. If the analyzed encryption level is less than the criterion, applying an encryption algorithm supported by an encrypted network to the received packet and encrypting the encrypted packet. Is routed to be routed to the destination through the encrypted network network, and the unencrypted packet is programmed to perform a route to route to the destination through the public Internet network.

According to an embodiment, a packet whose encryption level meets the criteria is delivered to a destination through a public Internet network that does not require encryption, while a packet whose encryption level does not meet the criteria is encrypted by an encryption unit and then through an encrypted network network. It can either be delivered to the destination or blocked without being delivered to the destination. Therefore, even if the packet to be transmitted by the IoT terminal is not encrypted or the encryption level is low, security in transmitting and receiving the packet can be improved.

1 is a diagram conceptually showing a network system to which a communication management apparatus according to an embodiment is applied.
FIG. 2 is a diagram conceptually showing the configuration of the encrypted network network shown in FIG. 1.
3 is a diagram conceptually showing the configuration of the communication management apparatus shown in FIG. 1.
4 is a diagram conceptually showing a criterion for analyzing an encryption level applied to a packet in the analysis unit illustrated in FIG. 2.
5 is a diagram illustrating a procedure of a communication management method according to an embodiment.
FIG. 6 is a diagram illustrating a part of the steps shown in FIG. 5 in detail.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims.

In describing embodiments of the present invention, when it is determined that a detailed description of known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to a user's or operator's intention or practice. Therefore, the definition should be made based on the contents throughout this specification.

1 is a diagram conceptually showing a configuration of a network system to which a communication management apparatus according to an embodiment is applied. However, since FIG. 1 is merely exemplary, the communication management apparatus 100 is not limited to being applied only to the network system illustrated in FIG. 1.

Referring to FIG. 1, the network system 10 includes a communication management device 100, at least one Internet of Things terminal 200, an Internet of Things management server 300, and a network of networks 400 and 500. Here, the network networks 400 and 500 include a public Internet network 400 and an encrypted network network 500.

The Internet of Things terminal 200 may be a sensor device, a lighting device, or a photographing device for photographing the surroundings. The IoT terminal 200 generates a packet and transmits it to the outside (eg, an IoT management server 300 or a smart device possessed by a user of the IoT terminal 200) through a network 400,500, or A packet including a control command may be received from the outside through the network 400 and 500 and operated according to the control command. In the packets to be transmitted and received, information identifying the Internet of Things terminal 200 (for example, a media access control address (MAC address) of the Internet of Things terminal 200) or the Internet protocol of the Internet of Things terminal 200 (internet protocol, IP) address)), information related to the control of the IoT terminal 200, information (ID / password) used to access the IoT terminal 200, etc. may be included, but is not limited thereto.

The IoT terminal 200 may transmit the above-described packets without encryption, or transmit by encoding (for example, encoding in a binary method) or by encrypting based on various encryption algorithms.

The IoT management server 300 is a server that manages these IoT terminals 200 while exchanging packets with at least one IoT terminal 200. The Internet of Things management server 300 may be implemented in a personal computer (PC) or a server (eg, cloud server).

The IoT management server 300 may receive and receive packets from the IoT terminal 200 through the network 400 and 500, and then monitor and manage the IoT terminal 200 based on these packets. In addition, the Internet of Things management server 300 may transmit a packet including a control command to control the Internet of Things terminal 200 through the network 400,500.

Among the network networks 400 and 500, the public Internet network 400 means a general Internet network. Looking at the public Internet network 400, encryption or decryption of a packet to be transmitted / received is not performed in the public Internet network 400 itself.

On the other hand, looking at the encrypted network 500, the encrypted network 500 has the characteristic of anonymity. Anonymity here means that privacy and security are guaranteed by making it impossible to analyze traffic online or track IP addresses.

The encrypted network 500 performs encryption or decryption of a packet to be transmitted / received. 2 conceptually illustrates such an encrypted network network 500. Referring to Figure 2, the encrypted network 500 is composed of a plurality of nodes (501). Each node 501 is connected to each other 502, and encryption or decryption may be performed at each node. In one embodiment, the encrypted network network 500 may be a TOR (The Onion Router) network. Since the TOR network itself is a known technology, a detailed description thereof will be omitted. In addition, it is only an example that the encrypted network network 500 is a TOR network, and it is not excluded that it may be any other encrypted network network (eg, a virtual private network (VPN)).

 Referring back to FIG. 1, the communication management device 100 is disposed between the Internet of Things terminal 200 and the Internet of Things management server 300. The communication management device 100 may receive a packet from the Internet of Things terminal 200 and deliver it to the Internet of Things Management Server 300, wherein the Internet of Things is managed through the public Internet network 400 according to the encryption level applied to the packet. It can be controlled to be delivered to the server 300 or delivered to the Internet of Things management server 300 through the encrypted network 500. In addition, the communication management apparatus 100 may deliver the packet to the IoT terminal 200 when the packet is transmitted from the Internet of Things management server 300, and if the received packet is encrypted or encoded, decryption or decoding is performed. It can be transmitted to the Internet of Things terminal (200).

The communication management device 100 serves as a gateway. Hereinafter, the communication management device 100 will be described in more detail.

3 is a diagram conceptually showing the configuration of the communication management device 100 shown in FIG. 1, but the configuration of the communication management device 100 shown in FIG. 3 is only exemplary, and thus the communication management device 100 ) Is not limited to the configuration shown in FIG. 3.

First, the communication management apparatus 100 may be implemented by a memory storing instructions programmed to perform a function described below and a microprocessor executing such instructions.

Referring to FIG. 3, the communication management apparatus 100 includes a router 110, a communication unit 120, an analysis unit 130, an encryption unit 150, and a control unit 170, and a firewall unit ( 140), a decoding unit 160, a display unit 180, and an input unit 190 may be further included.

First, the router 110 may have the same configuration as a commonly used router and may be implemented in hardware or software. The router 110 may route packets received from the IoT terminal 200 to either the public Internet network 400 or the encrypted network 500 under the control of the control unit 170 to be described later.

The communication unit 120 receives a packet from the IoT terminal 200 or transmits a packet to the IoT terminal 200. The communication unit 120 may be implemented by a wired communication module or a wireless communication module.

The analysis unit 130, the firewall unit 140, the encryption unit 150, the decryption unit 160, and the control unit 170 execute memory and memory for storing commands programmed to perform the functions described below. It can be implemented by a microprocessor.

Looking at the analysis unit 130 first, the analysis unit 130 may analyze the encryption level applied to the packet received from the IoT terminal 200. Based on the result of the analysis, the analysis unit 130 determines the encryption level for the corresponding packet itself or the encryption level of the IoT terminal 200 itself that transmitted the corresponding packet, and then transmits the information about the encryption level to the control unit 170 (Analysis result) can be delivered. However, hereinafter, it will be described on the premise that the analysis unit 130 determines the encryption level for the packet itself and transmits the analysis result to the control unit 170. To this end, the analysis unit 130 may include a packet sniffing module that monitors the packets received by the communication unit 120.

FIG. 4 illustrates a criterion (reference) by which the analysis unit 130 determines the encryption level applied to the packet. Looking in more detail with reference to Figure 4, the analysis unit 130 is based on whether the packet received from the Internet of Things terminal 200 includes any of the criteria shown in FIG. In addition, it is possible to analyze whether the encryption level for the corresponding packet meets or exceeds the criteria. In addition, even if the criteria are not met, it can be analyzed that the encryption level is relatively high and the case is relatively low according to the criteria. According to this, if the encryption level of the packet meets the criteria, it may be classified as upper, and even if the encryption level of the packet is less than the standard, it may be classified as middle or lower according to the determination criteria. . However, as shown in FIG. 4, the encryption level is classified into three of upper, middle, and lower, and the criterion is only exemplary, and may be two or four or more encryption levels, and the criterion is also illustrated. Can be different.

Looking in more detail, for example, the analysis unit 130 may analyze whether a transport layer security or various other encryption algorithms are applied to packets received from the Internet of Things terminal 200. In this case, the analysis unit 130 may analyze that the encryption level applied to the corresponding packet meets a predefined criterion, and the analysis unit 130 may classify the encryption level at this time. .

On the other hand, the analysis unit 130 includes all of the information (media access control address (MAC address) of the Internet of Things) in which the packet received from the IoT terminal 200 identifies the IoT terminal 200. B. It may analyze whether it includes all or part of the Internet protocol (IP) address of a part or the Internet of Things (Internet Protocol), and in this case, the analysis unit 130 analyzes that the encryption level is less than a predefined standard. It can be done, and the encryption level at this time can be classified as medium.

For example, if the packet includes all or part of the MAC address and all or part of these MAC addresses match predefined information, the analysis unit 130 does not meet the predefined criteria for the encryption level applied to the packet. It can be analyzed as being. Here, the part of the MAC address may be 2 bytes or 3 bytes of the end of the MAC address indicating the manufacturer of the Internet of Things terminal 200 among the MAC addresses, but is not limited thereto.

Here, the MAC address or IP address included in the packet may be encoded in a binary manner. Accordingly, the analysis unit 130 analyzes whether the packet received from the Internet of Things terminal 200 is encoded in a binary manner, and if it is encoded in a binary manner, can decode it, and defines the decoded information in advance The above-described analysis can be performed by matching the information.

Alternatively, the analysis unit 130 may analyze whether the information included in the packet is in the form of plain text, and in this case, the analysis unit 130 may analyze that the encryption level applied to the packet is less than a predefined standard. It is possible to classify the encryption level at this time as below.

In more detail, first, plain text refers to information in human readable form. Looking at this as a basis, for example, when the packet includes information related to the control of the Internet of Things terminal 200 (commands such as ON, OFF, SET, GET, etc. for the Internet of Things terminal 200) in the form of such plain text, analysis The unit 130 may analyze that the encryption level applied to the corresponding packet is less than the standard. Or the information that the packet is used to access the Internet of Things (200) terminal (ID or password of the Internet of Things (200), the manufacturer or product name of the Internet of Things (200), or the user name of the Internet of Things (200) When including a password, etc.) in the form of plain text, the analysis unit 130 may analyze that the encryption level applied to the corresponding packet is less than the standard.

However, the method in which the analysis unit 130 analyzes the encryption level applied to the packet in the above manner is only an example, and the technology for analyzing the encryption level by other methods is not excluded.

Referring to FIG. 3 again, the firewall 140 transmits the packet to the destination (for example, the Internet of Things management server 300 or a user's smart device) through the public Internet network 400 or the encrypted network. The policy for whether to transmit to the destination through the network 500 is stored. For example, in the policy stored in the firewall unit 140, a packet whose encryption level meets a predefined criterion is transmitted to a destination through the public Internet network 400, and the packet that does not meet the aforementioned criteria is an encrypted network network 500. It may be to block the transmission to or through the destination.

The encryption unit 150 is a module that encrypts packets received from the Internet of Things terminal 200. The encryption unit 150 may perform encryption by applying an encryption algorithm supported by the encrypted network 500 to a packet, which may be, for example, an algorithm used in a TOR network or a VPN, but is not limited thereto. no.

On the other hand, as described above, the analysis unit 130 may determine the encryption level for the packet itself received from the IoT terminal 200, but unlike this, the IoT terminal 200 itself transmitting the corresponding packet according to an embodiment You can determine the encryption level. In the latter, the encryption unit 1450 may not perform encryption on all packets received from the Internet of Things terminal 200, which is determined to match the encryption level with a predefined criterion, and the encryption level is a predefined criterion. Encryption may be performed on all packets received from the IoT terminal 200 determined to be insufficient.

The decryption unit 160 is a component that decrypts an encrypted packet, and the algorithm used for decryption may be, for example, an algorithm used in a TOR network or a VPN, but is not limited thereto.

The control unit 170 controls the switching operation of the router 110. For example, the control unit 170 may control the switching operation of the router 110 so that a packet encrypted by the encryption unit 150 may be delivered to a destination through the encrypted network 500 because the encryption level is less than the standard. , It controls the switching operation of the router 110 so that the unencrypted packet because the encryption level meets the standard can be delivered to the destination through the public Internet network 400. Alternatively, according to an embodiment, the control unit 170 may block a packet that does not meet the encryption level from being delivered to a destination when there is input from a user.

Therefore, according to an embodiment, a packet that satisfies the criterion of encryption level is delivered to a destination through a public Internet network where encryption is unnecessary, whereas a packet having a criterion of encryption level is encrypted by the encryption unit 150 and encrypted. Delivery to a destination through a network or delivery to a destination may be blocked. Therefore, even if the packet to be transmitted by the IoT terminal is not encrypted or the encryption level is low, security in transmitting and receiving the packet can be improved.

On the other hand, according to the above, it is described that the control unit 170 may control the packet to be delivered to the destination through the encrypted network 500 after encryption of the corresponding packet is performed when the encryption level applied to the packet is less than the standard. . That is, if the encryption level is less than the standard, if they are classified as middle or lower, they can all be processed in the same way.

However, unlike this, if the encryption level applied to the packet is classified as low and medium according to an embodiment, encryption for the packet is performed and then transmitted to the destination through the encrypted network 500. When the encryption level applied to the packet is less than the standard and is classified as below, the transmission of the packet to the destination may be controlled to be blocked.

The display unit 180 is configured to display an image or text. The display unit 180 may display a predetermined inquiry matter to a user of the communication management device 100. For example, the query displayed on the display unit 180 indicates that the security of the packet is vulnerable when the encryption level of the packet received from the IoT terminal 200 is less than the standard, and the packet is directed to the destination. It may be a query of whether to deliver, but is not limited thereto.

The input unit 190 may receive his intention from a user of the communication management device 100. For example, the input unit 190 may be implemented as a button that can be operated by a user, or may be implemented in the form of a touch screen together with the display unit 180. Alternatively, in the form of an application in a separate smartphone owned by the user It may be implemented as, but is not limited thereto.

In response to the query of the display unit 180 to inquire whether to deliver a packet with low security to the destination, the input unit 190 may receive a user's intention as to whether to deliver or not. If, through the input unit 190, the user expresses his intention to deliver the packet to the destination, the encryption unit 150 encrypts the packet, and the encrypted packet is encrypted network network 500 under the control of the control unit 170 ) To the destination.

However, if the user expresses intention not to deliver the packet to the destination through the input unit 190, the packet may be blocked without being delivered to the destination under the control of the control unit 170.

However, the display unit 180 queries the user and the input unit 190 receives input from the user, depending on the embodiment (manual mode) or not (automatic mode). If not, the control unit 170 may automatically block the packet from being delivered to the destination when the above conditions are satisfied (automatic mode).

As described above, according to an embodiment, a packet that satisfies the criterion of the encryption level is delivered to a destination through a public Internet network that does not require encryption, whereas a packet whose criterion level is not the criterion is encrypted by the encryption unit to be encrypted. Delivery to a destination through a network network or delivery to a destination may be blocked. Therefore, even if the packet to be transmitted by the IoT terminal 200 is not encrypted or the encryption level is low, security in transmitting and receiving the packet may be improved.

Meanwhile, FIG. 5 is a diagram illustrating a procedure of a communication management method according to an embodiment. The method illustrated in FIG. 5 may be performed by the communication management apparatus 100 illustrated in FIG. 3. In addition, since the procedure of the method illustrated in FIG. 5 is merely exemplary, it is not limited to that illustrated in FIG. 5.

Referring to FIG. 5, a step in which the communication unit 120 of the communication management apparatus 100 receives a packet from the Internet of Things terminal 200 is performed (S110).

In addition, the step of analyzing the encryption level applied to the received packet by the analysis unit 130 of the communication management apparatus 100 is performed (S200).

In addition, if the encryption level analyzed in step S200 meets a predefined criterion, encryption is not performed, and if the encryption level is less than a predefined criterion, encryption is performed by an encryption algorithm supported by the encrypted network 500. (S300).

In addition, in step S300, the encrypted packet is transmitted to the destination through the encrypted network 500, the controller 170 routes the router 110, and the unencrypted packet is sent to the destination through the public Internet network 300. The step of routing the controller 110 so that the controller 170 is transmitted is performed (S400).

Here, steps S200 to S400 will be described in more detail with reference to FIG. 6.

6 is a view showing in more detail steps S200 to S400 of the procedure shown in FIG. 5. Referring to FIG. 6 together with FIG. 5, steps S210 to S230 shown in FIG. 6 are further subdivided steps S200 shown in FIG. 5, and steps S310 to S320 shown in FIG. 6 are steps shown in FIG. 5 Step S300 is further subdivided, and steps S410 to S420 illustrated in FIG. 6 are subdivided steps S400 illustrated in FIG. 5.

In step S210, the analysis unit 130 may detect (sniffing) data included in the packet. To this end, the analysis unit 130 may include a packet sniffing module, as described above.

In step S220, the analysis unit 130 may determine the encryption level applied to the packet by comparing it with a judgment criterion (reference). The determination criteria may be those illustrated in FIG. 4, but are not limited thereto.

Specifically, in step S220, the analysis unit 130 based on whether the packet received from the IoT terminal 200 includes any of the judgment criteria shown in FIG. 4 or matches with any of the judgment criteria. It is possible to analyze whether the encryption level for a packet meets or falls short of the criteria. In addition, even if the criteria are not met, it can be analyzed that the encryption level is relatively high and the case is relatively low according to the criteria.

Looking in more detail, for example, the analysis unit 130 may analyze whether a transport layer security or various other encryption algorithms are applied to packets received from the Internet of Things terminal 200. In this case, the analysis unit 130 may analyze that the encryption level applied to the corresponding packet meets a predefined criterion (S230).

If it is analyzed that the encryption level meets the criteria, the encryption unit 140 does not perform encryption on the corresponding packet (S310). In addition, the control unit 170 may control the switching operation of the router 110 so that the corresponding packet can be delivered to the destination through the public Internet network 400 (S410).

On the other hand, the analysis unit 130 includes all of the information (media access control address (MAC address) of the Internet of Things) in which the packet received from the IoT terminal 200 identifies the IoT terminal 200. B. It may analyze whether it includes all or part of the Internet protocol (IP) address of a part or the Internet of Things (Internet Protocol), and in this case, the analysis unit 130 analyzes that the encryption level is less than a predefined standard. can do.

For example, when a packet includes all or part of a MAC address and all or part of these MAC addresses match predefined information, the analysis unit 130 does not satisfy a predefined criterion for the encryption level applied to the packet. It can be analyzed as being. Here, the part of the MAC address may be 2 bytes or 3 bytes of the end of the MAC address indicating the manufacturer of the Internet of Things terminal 200 among the MAC addresses, but is not limited thereto.

Here, the MAC address or IP address included in the packet may be encoded in a binary manner. Accordingly, the analysis unit 130 analyzes whether the packet received from the Internet of Things terminal 200 is encoded in a binary manner, and if it is encoded in a binary manner, can decode it, and defines the decoded information in advance The above-described analysis can be performed by matching the information.

In addition, the analysis unit 130 may analyze whether the information included in the packet is in the form of plain text, and in this case, the analysis unit 130 may analyze that the encryption level applied to the packet is less than a predefined standard. have.

In more detail, first, plain text refers to information in human readable form. Looking at this as a basis, for example, when the packet includes information related to the control of the Internet of Things terminal 200 (commands such as ON, OFF, SET, GET, etc. for the Internet of Things terminal 200) in the form of such plain text, analysis The unit 130 may analyze that the encryption level applied to the corresponding packet is less than the standard. Or information that the packet is used to access the Internet of Things (200) (ID or password of the Internet of Things (200), the manufacturer or product name of the Internet of Things (200), or the user name of the Internet of Things (200) When including a password, etc.) in the form of plain text, the analysis unit 130 may analyze that the encryption level applied to the corresponding packet is less than the standard.

If it is analyzed that the encryption level applied to the packet is less than the reference, the encryption unit 140 may encrypt the packet (S320). Here, the encryption algorithm applied to the packet may be, for example, an algorithm used in a TOR network or a VPN, but is not limited thereto. Then, the control unit 170 may control the switching operation of the router 110 so that the encrypted packet can be delivered to the destination through the encrypted network network 500 (S420). However, according to an embodiment, when the encryption level applied to the packet is less than the standard, it can be controlled such that the delivery to the destination itself is blocked without being controlled to be delivered to the destination through the encrypted network 500 as described above. It is like one.

On the other hand, the communication management method according to an embodiment includes substantially the same technical idea as that for the communication management device 100 described above, so that the communication management device 100 has already been described, and uses it. Duplicate description will be omitted.

On the other hand, the communication security method according to an embodiment is implemented in the form of a computer readable recording medium storing a computer program programmed to perform a procedure included in the method, or a computer program stored in the computer readable recording medium. It can be implemented in the form.

The above description is merely illustrative of the technical spirit of the present invention, and those of ordinary skill in the art to which the present invention pertains will be capable of various modifications and variations without departing from the essential quality of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

100: communication management device
200: Internet of things terminal
300: Internet of Things management server

Claims (18)

A router that switches to connect to any one of the public Internet network and the encrypted network network;
A communication unit that receives packets from the Internet of Things terminal;
An analysis unit that analyzes an encryption level based on whether a transport layer security or an encryption algorithm is applied to the received packet or an analysis result of information included in the packet;
If the analyzed encryption level is above a predefined threshold level, the received packet is not encrypted. If it is below a predefined threshold level, encryption is performed by applying an encryption algorithm supported by the encrypted network to the received packet. Boo,
The encrypted packet controls the switching of the router to be delivered to the destination through the encrypted network network, and the unencrypted packet includes a control unit to control the switching of the router to be delivered to the destination through the public Internet network. doing
Communication management device. According to claim 1,
The analysis unit,
A packet including all or part of the information identifying the Internet of Things terminal among the received packets is analyzed to be less than the predefined threshold level
Communication management device. According to claim 2,
The information identifying the Internet of Things terminal,
And at least one of a media access control address (MAC address) of the Internet of Things terminal and an Internet protocol (IP) address of the Internet of Things terminal.
Communication management device. According to claim 2,
The analysis unit,
It analyzes whether the received packet is encoded in a binary manner,
If the received packet is encoded in binary format, decode it.
When the decoded packet includes all or part of the information identifying the IoT terminal, it is analyzed to be below the predefined threshold level
Communication management device. According to claim 1,
The analysis unit,
Among the received packets, packets containing plain text information are analyzed to be below the predefined threshold level.
Communication management device. According to claim 1,
The encrypted network network,
TOR (The Onion Router) network
Communication management device. According to claim 1,
When the encryption level applied to the received packet is analyzed to be below the predefined threshold level, the display unit further indicates that the security of the packet analyzed to be below the predefined threshold level is weak.
Communication management device. According to claim 1,
The communication management device,
It further includes an input unit that receives input from the user of the communication management device whether or not to deliver a packet analyzed to be below a predetermined threshold level to a destination,
The encryption unit,
Upon receiving an input from the user to deliver a packet analyzed to be below the predefined threshold level to the destination through the input unit, the packet analyzed to be below the predefined threshold level is encrypted, and the user receives the input packet from the user through the input unit. When receiving an input not to deliver a packet analyzed to be below a defined threshold level, the packet analyzed to be below the predefined threshold level is not encrypted.
The control unit,
Packets encrypted below the predefined threshold level are controlled by the router to be delivered to the destination through the encrypted network, and packets that are below the predefined threshold level and are not encrypted are blocked from being delivered to the destination. To control the switching of the router as much as possible
Communication management device. A router that switches to connect to any one of the public Internet network and the encrypted network network;
A communication unit that receives packets from the Internet of Things terminal;
The encryption level is analyzed based on whether a transport layer security or an encryption algorithm is applied to the received packet or an analysis result of information included in the packet, and the security level of the Internet of Things terminal is determined based on the analyzed encryption level. An analysis unit to determine,
A packet received from the Internet of Things terminal having the determined security level above a predetermined threshold level is not encrypted, and an encryption unit for encrypting a packet received from the Internet of Things terminal determined to have the determined security level below a predetermined threshold level,
The encrypted packet controls the switching of the router to be delivered to the destination through the encrypted network network, and the unencrypted packet includes a control unit to control the switching of the router to be delivered to the destination through the public Internet network. doing
Communication management device. A method for managing communication of an Internet of Things terminal performed by a communication management device,
Receiving a packet from the Internet of Things terminal;
Analyzing an encryption level based on whether a transport layer security or an encryption algorithm is applied to the received packet or an analysis result of information included in the packet;
If the analyzed encryption level is above a predefined threshold level, the received packet is not encrypted. If the analyzed encryption level is below a predefined threshold level, an encryption algorithm supported by an encrypted network is added to the received packet. Applying and encrypting,
And routing the encrypted packet to be delivered to a destination through the encrypted network, and routing the unencrypted packet to be delivered to a destination through a public Internet network.
Communication management methods. The method of claim 10,
The analyzing step,
A packet including all or part of the information identifying the Internet of Things terminal among the received packets is analyzed to be less than the predefined threshold level
Communication management methods. The method of claim 11,
The information identifying the Internet of Things terminal,
And at least one of a media access control address (MAC address) of the Internet of Things terminal and an Internet protocol (IP) address of the Internet of Things terminal.
Communication management methods. The method of claim 11,
The analyzing step,
It analyzes whether the received packet is encoded in a binary manner,
If the received packet is encoded in binary format, decode it.
When the decoded packet includes all or part of the information identifying the IoT terminal, it is analyzed to be below the predefined threshold level
Communication management methods. The method of claim 10,
The analyzing step,
Among the received packets, packets containing plain text information are analyzed to be below the predefined threshold level.
Communication management methods. The method of claim 10,
When the encryption level applied to the received packet is analyzed to be below the predefined threshold level, further comprising the step of indicating that the security of the packet analyzed to be below the predefined threshold level is vulnerable.
Communication management methods. The method of claim 10,
The communication management method,
Further comprising the step of receiving input from the user of the communication management device whether or not to deliver the packet analyzed to be below the predefined threshold level to the destination,
The encrypting step,
When the user receives an input to deliver a packet analyzed to be below the predefined threshold level to the destination through the receiving step, the packet analyzed to be below the predefined threshold level is encrypted, and through the receiving step, When a user receives an input not to deliver a packet analyzed to be below the predefined threshold level to a destination, the packet analyzed to be below the predefined threshold level is not encrypted.
The routing step,
Packets encrypted below the predefined threshold level are routed to be delivered to the destination through the encrypted network, and packets encrypted below the predefined threshold level are routed to be blocked from being delivered to the destination.
Communication management methods. Step of receiving a packet from the Internet of Things terminal and
Analyzing an encryption level based on whether a transport layer security or an encryption algorithm is applied to the received packet or an analysis result of information included in the packet;
If the analyzed encryption level is above a predefined threshold level, the received packet is not encrypted. If the analyzed encryption level is below a predefined threshold level, an encryption algorithm supported by an encrypted network is added to the received packet. Applying and encrypting,
The encrypted packet is programmed to perform routing to route to the destination through the encrypted network, and the unencrypted packet to route to the destination through the public Internet network.
A computer program stored on a computer readable recording medium. Step of receiving a packet from the Internet of Things terminal and
Analyzing an encryption level based on whether a transport layer security or an encryption algorithm is applied to the received packet or an analysis result of information included in the packet;
If the analyzed encryption level is above a predefined threshold level, the received packet is not encrypted. If the analyzed encryption level is below a predefined threshold level, an encryption algorithm supported by an encrypted network is added to the received packet. Applying and encrypting,
The encrypted packet is programmed to perform routing to route to the destination through the encrypted network, and the unencrypted packet to route to the destination through the public Internet network.
A computer readable recording medium storing a computer program.

Images