KR102135727B1 - Internet of things blockchain system using token and multi-phase authentication method usign the system - Google Patents

Abstract

The present invention relates to an Internet of things (IoT) blockchain system using a token and a multi-phase authentication method using the same. According to an embodiment of the present invention, an IoT blockchain system comprises: an IoT node which requests issuance of a token for authentication between devices in an IoT environment; and a gateway which generates token information according to the request of the IoT node and performs authentication for the IoT node based on the token information. The IoT node and the gateway share a one-to-one correspondence of secret parameter values. A plurality of gateways constitute a blockchain network. The plurality of gateways may share the token information through the blockchain network.

Description

IoT blockchain system using token and multi-level authentication method using it{INTERNET OF THINGS BLOCKCHAIN SYSTEM USING TOKEN AND MULTI-PHASE AUTHENTICATION METHOD USIGN THE SYSTEM}

The present invention relates to an IoT blockchain system using a token and a multi-level authentication method using the token. More specifically, multiple gateways configure a blockchain network to share token information and issue tokens to devices in the IoT environment. It relates to a system and an authentication method that enable mutual authentication.

The Internet of Things (IoT) is a technology that connects to the Internet using communication technology on objects to which various sensors are attached. IoT is applied to smart farms, smart factories, smart health, and smart homes, and is accelerating hyper-connected society. IoT technology is evolving rapidly, but due to the weight reduction of IoT devices, it has limited hardware specifications such as low power consumption, low computing power, and low memory.

IoT devices are exposed to various security threats because heterogeneous networks or standards are applied. Recently, system research using tokens for authentication, access control, etc. in the IoT environment has been conducted at home and abroad.

However, the system using the existing token has a centralized characteristic in which the central server manages the token. A centralized system can affect the security of the entire network when the security of the central server is weak, and a single point of failure that can cause difficulties in system operation if the reliability of the central server is not secured because transparency is not guaranteed. It has a single point of failure) and is not suitable for IoT environments characterized by scalability.

Republic of Korea Patent Publication No. 10-2018-0066693 (2018.06.19)

The present invention is to solve the problems as described above, a plurality of gateways on behalf of the central server constitutes a blockchain network, and by ensuring the integrity and reliability of the token for authentication, mutual authentication, confidentiality, availability, confidentiality The aim is to provide a system and authentication method that can satisfy security requirements required in IoT environments such as maintenance, scalability, and attack response.

The IoT blockchain system using the token according to an embodiment of the present invention generates token information according to the request of the IoT node and the IoT node requesting the issuance of a token for authentication between devices in the IoT environment, and the token information It includes a gateway that performs authentication on the IoT node based on, the IoT node and the gateway share a one-to-one corresponding secret parameter value, a plurality of gateways constitute a blockchain network, and a plurality of gateways are a blockchain network Token information can be shared through.

The IoT node according to an embodiment of the present invention generates a random number value to request the issuance of a token, generates a registration request message including parameter values based on the random number value, and the gateway parameter value included in the registration request message By analyzing them, it is possible to perform authentication of the IoT node for generation of token information.

According to an embodiment of the present invention, the token information includes the issued token, ID information for identifying the IoT node and the gateway, parameter values for mutual authentication of the IoT node and the gateway, and a signature for guaranteeing the gateway that issued the token. Values may be included.

The gateway that generates token information according to an embodiment of the present invention generates ID information, parameter values, signature value, and secret parameter value included in the token information as a transaction, and the generated transaction as another gateway of the blockchain network. It can be broadcast.

The IoT node according to an embodiment of the present invention generates an authentication request message including token information and transmits it to a gateway, and the gateway performs a first authentication to verify token information through a blockchain network, and the first authentication is When complete, the IoT node generates a data message for data processing and transmits it to the gateway, and the gateway can perform a second authentication to verify whether the first authentication is the completed IoT node based on the data message.

When generating an authentication request message according to an embodiment of the present invention, the IoT node generates a random number value for generating a session parameter value for second authentication, and when verification of token information is completed by the gateway, the IoT node Each of the gateways may generate a session parameter value based on a random number value.

The gateway according to an embodiment of the present invention may determine whether the first authentication has been completed by comparing the IoT node and the session parameter values respectively generated by the gateway.

In the multi-step authentication method using an IoT blockchain system using a token according to an embodiment of the present invention, the IoT node requests the issuance of a token for authentication between devices in the IoT environment as a gateway, the gateway of the IoT node Generating token information according to the request, transmitting the token information generated to the IoT node, the IoT node generates an authentication request message containing the token information and transmits it to the gateway, and the gateway transmits the token information through the blockchain network Step of performing the first authentication to verify and when the first authentication is completed, the IoT node generates a data message for data processing and transmits it to the gateway, and the gateway is an IoT node that has completed the first authentication based on the data message. Comprising the step of performing a second authentication to verify, IoT nodes and gateways may share the corresponding secret parameter value on a one-to-one basis.

In the step of requesting the issuance of the token according to an embodiment of the present invention, the IoT node may generate a random number value to request the issuance of the token, and may generate a registration request message including parameter values based on the random number value. .

In the step of generating token information according to an embodiment of the present invention and transmitting the token information, the gateway may analyze the parameter values included in the registration request message to perform authentication of the IoT node for generation of token information. have.

In the step of generating token information and transmitting the token information according to an embodiment of the present invention, the gateway that generated the token information uses the ID information, parameter values, signature value and secret parameter value included in the token information as a transaction. You can create and broadcast the generated transaction to other gateways in the blockchain network.

In the step of performing the first authentication according to an embodiment of the present invention, when generating an authentication request message, the IoT node generates a random number value for generating a session parameter value for the second authentication, and token information by the gateway When the verification for is completed, each of the IoT node and the gateway may generate a session parameter value based on the random number value.

In the step of performing the second authentication according to an embodiment of the present invention, it is possible to determine whether the first authentication is the completed IoT node by comparing the gateway parameter values generated by the gateway and the IoT node, respectively.

On the other hand, according to an embodiment of the present invention, it is possible to provide a recording medium readable by a computer recording a program for executing the above-described method on a computer.

According to the system provided as an embodiment of the present invention and an authentication method using the same, by constructing a blockchain network with a plurality of gates to perform multi-level authentication using tokens, securing transparency and reliability of the IoT environment, and single It can solve the problem of branch failure and maintain the scalability characteristic of IoT environment while ensuring stability and security.

In addition, since the reliability of the above-described token is secured during the authentication process, devices in the IoT environment can continuously perform authentication with the gateway without re-issuance of the token as long as the token issuance is performed, and other gateways on the blockchain network. Transient authentication can be easily performed.

1 is a block diagram of an IoT blockchain system using a token according to an embodiment of the present invention.
2 is a conceptual diagram showing an authentication process of an IoT blockchain system using a token according to an embodiment of the present invention.
3 is a conceptual diagram showing a token issuing process of an IoT blockchain system using a token according to an embodiment of the present invention.
4 is a sequence diagram showing a token issuing process of an IoT blockchain system using a token according to an embodiment of the present invention.
5 is a block diagram showing token information of an IoT blockchain system using a token according to an embodiment of the present invention.
6 shows a transaction structure of an IoT blockchain system using tokens according to an embodiment of the present invention.
7 is a conceptual diagram illustrating a first authentication process of an IoT blockchain system using a token according to an embodiment of the present invention.
8 is a sequence diagram illustrating a first authentication process of an IoT blockchain system using a token according to an embodiment of the present invention.
9 is a sequence diagram showing a second authentication process of an IoT blockchain system using a token according to an embodiment of the present invention.
10 and 11 are source codes showing a man-in-the-middle attack scenario of an IoT blockchain system using tokens according to an embodiment of the present invention.
12 is a source code and a result showing a security verification scenario of an IoT blockchain system using a token according to an embodiment of the present invention.
13 is a flowchart of a multi-step authentication method using an IoT blockchain system using tokens according to an embodiment of the present invention.

Terms used in the specification will be briefly described, and the present invention will be described in detail.

The terminology used in the present invention has been selected, while considering the functions in the present invention, general terms that are currently widely used are selected, but this may vary according to the intention or precedent of a person skilled in the art or the appearance of new technologies. In addition, in certain cases, some terms are arbitrarily selected by the applicant, and in this case, their meanings will be described in detail in the description of the applicable invention. Therefore, the term used in the present invention should be defined based on the meaning of the term and the contents of the present invention, rather than a simple term name.

When a certain part of the specification "includes" a certain component, this means that other components may be further included instead of excluding other components unless otherwise specified. In addition, terms such as “node” described in the specification mean a unit that processes at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software. In addition, when a part is "connected" to another part in the specification, this includes not only "directly connected" but also "connected with other components in between".

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present invention in the drawings, parts irrelevant to the description are omitted, and like reference numerals are assigned to similar parts throughout the specification.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an IoT blockchain system using a token 10 according to an embodiment of the present invention, and FIG. 2 is an IoT blockchain system using a token 10 according to an embodiment of the present invention It is a conceptual diagram showing the authentication process.

Referring to FIG. 1, an IoT blockchain system using a token 10 according to an embodiment of the present invention, an IoT node 100 requesting issuance of a token 10 for authentication between devices in an IoT environment And a gateway 200 generating token information according to the request of the IoT node 100 and performing authentication for the IoT node 100 based on the token information.

For example, the IoT node 100 is a device subject for transmitting and receiving data in an IoT environment, and is capable of wireless communication such as Wi-Fi, Bluetooth, and a device that can be controlled by a user. do. The gateway 200 is a relay device that allows a plurality of devices and a local area network (LAN) to be interconnected.

1 and 2, in the IoT blockchain system using the token 10 according to an embodiment of the present invention, a plurality of gateways 200 replace the blockchain network on behalf of the central server of the IoT environment. Configuration, the plurality of gateways 200 may share token information through a blockchain network.

At this time, the blockchain can be said to be a digital public ledger or distributed ledger that is conceptually strong in anonymity and security by keeping the ledger that records transaction information distributed by each member and updating the ledger when a new transaction occurs. .

Blockchain has a structure in which each block is connected. The block consists of a header part and a body part, and the header part has a hash value of the previous block, so that a chain can be formed. The body part stores transaction information so that members can share transaction information.

The blockchain network means an aggregate that creates the above-mentioned block (i.e. ledger that records transaction information) through transactions between members, and shares the generated blocks. The structure of the block and transaction of the blockchain network configured as an embodiment of the present invention will be described in more detail with reference to FIG. 6.

Through the sharing of token information through the blockchain network, integrity of the token 10 is guaranteed, and all gateways 200 on the blockchain network can trust the token 10. In addition, as described above, when all the gateways 200 on the blockchain network trust the token 10 (ie, to secure the reliability of the token 10), the token issued from the IoT node 100 ( 10) The authentication process with the gateway 200 may be performed by continuously reusing it. That is, the authentication process of the IoT node 100 can be efficiently performed once the token 10 is issued once, without generating and issuing the token 10 every time for the authentication of the IoT node 100.

Hereinafter, an authentication process of the IoT blockchain authentication system will be described in more detail with reference to FIGS. 3 to 9.

(1) In the registration step of the IoT node 100, the registration token 10 is issued by the gateway 200 to perform authentication of the device, and the registration token issued by the gateway 200 constituting the blockchain network ( The process of broadcasting the information in 10) will be described. (2) In the first authentication step of the IoT node 100, a process of performing authentication through the registration token 10 and generating a session parameter value between the IoT node 100 and the gateway 200 will be described. (3) In the second authentication step of the IoT node 100, a process of performing message authentication and integrity guarantee function using a session parameter generated by the IoT node 100 and the gateway 200 will be described.

(1) IoT node registration step

3 is a conceptual diagram illustrating a process for issuing a token 10 of an IoT blockchain system using a token 10 according to an embodiment of the present invention.

According to an embodiment of the present invention, in order for the IoT node 100 to communicate with other devices in the IoT environment, device authentication with the gateway 200 is required first. To this end, the IoT node 100 must own the token 10 registered in the gateway 200. As shown in FIG. 3, the IoT node 101 registers with the gateway 200 to own the token 10. You can request. That is, the registration request of the IoT node 100 refers to requesting the issuance of the token 10 for authentication between devices in the IoT environment.

In the system according to an embodiment of the present invention, the notation of the protocol may follow [Table 1]. Hereinafter, the authentication process will be described according to the notation defined according to [Table 1].

[Table 1]

4 is a sequence diagram showing a process of issuing a token 10 of an IoT blockchain system using a token 10 according to an embodiment of the present invention, and FIG. 5 is a token 10 according to an embodiment of the present invention It is a block diagram showing token information of IoT blockchain system using.

The IoT node 100 according to an embodiment of the present invention includes ID information NID 3 for identifying each IoT node 100, and the gateway 200 ID information for identifying each of the gateway 200 It may include a GID (2). In addition, in the construction stage of the system according to an embodiment of the present invention, the IoT node 100 and the gateway 200 may share the secret parameter value Xgn corresponding to the one-to-one.

The secret parameter value Xgn according to an embodiment of the present invention refers to a parameter value shared by one gateway 200 corresponding to one IoT node 100 to generate a token 10. By utilizing the secret parameter value Xgn, the gateway 200 determines whether the legitimate IoT node 100 has requested to issue the token 10, and the IoT node 100 determines whether the legitimate gateway 200 has sent the token 10. Can be confirmed.

Referring to FIG. 4, the IoT node 100 according to an embodiment of the present invention may first generate a random number value r, and generate a parameter value MI to ensure the integrity of the ID information NID 3 to be transmitted. Next, the IoT node 100 generates a parameter value MN to safely transmit the generated random number r to the gateway 200, and a parameter value RMI to safely transmit the parameter value MI to the gateway 200. Can. The IoT node 100 may generate a registration request message including the above-described parameter values, and request to issue a token 10 (ie, request registration) by transmitting the generated registration request message to the gateway 200. have.

Referring to FIG. 4, the gateway 200 according to an embodiment of the present invention checks a timestamp in a registration request message transmitted from the IoT node 100 and then compares a random number value r included in the registration request message r'can be extracted. In addition, the gateway 200 may extract the parameter value MI from the parameter values RMI and MN, and generate the parameter value MI' with the secret parameter value Xgn and the extracted random number value r'.

The gateway 200 according to an embodiment of the present invention may perform authentication of the IoT node 100 by comparing the parameter value MI and the parameter value MI'. That is, the gateway 200 analyzes and compares parameter values included in the registration request message transmitted from the IoT node 100 to determine whether token 10 issuance is requested from the legitimate IoT node 100. . When the normal authentication for the IoT node 100 is completed according to the above-described process (ie, if it is determined that the token 10 is issued from the legitimate IoT node 100), the gateway 200 is a token that allows normal registration. It is possible to generate information and transmit a registration permission message together with the token 10 to the IoT node 100.

5, according to an embodiment of the present invention, token information according to an embodiment of the present invention includes token ID information TID (1) for identifying the issued token 10, ID information for identifying the IoT node 100 NID (3), ID information for identifying the gateway 200 GID (2), parameter values for mutual authentication of the IoT node 100 and the gateway 200 e( 4) and a parameter value x(5), a signature value S(6) for ensuring the gateway 200 that issued the token 10 may be included.

Referring to FIG. 4, when the IoT node 100 according to an embodiment of the present invention receives a registration permission message from the gateway 200, checks a timestamp in the registration permission message, and then displays the parameter value e( 4) and x can be used to extract the parameter value y. In addition, the IoT node 100 may generate the parameter value y'using the parameter value MI and the secret parameter value Xgn generated at the time of the registration request.

The IoT node 100 according to an embodiment of the present invention may compare the parameter value y and the parameter value y'to confirm that the token 10 is sent by the legitimate gateway 200 and store token information. That is, the IoT node 100 may determine whether the token 10 has been issued from the legitimate gateway 200 by analyzing and comparing the token information transmitted from the gateway 200 and the parameter values included in the registration permission message. have.

6 shows the transaction structure of the IoT blockchain system using the token 10 according to an embodiment of the present invention.

The gateway 200 that generates token information according to an embodiment of the present invention includes ID information (1,2,3), parameter values (4,5) and signature value (6) and secret parameters included in the token information. Values can be generated as transactions, and the generated transactions can be broadcast to other gateways 200 in the blockchain network. That is, the gateway 200 can share token information with other gateways 200 on the blockchain network, thereby securing the reliability of the token 10, thereby allowing the IoT node 100 to other gateways on the network. It may be possible to perform the authentication with the (200) transient.

Referring to FIG. 6, the gateway 200 issuing the registration token 10 of the IoT node 100 according to an embodiment of the present invention is token information issued to other gateways 200 forming a blockchain Token ID information included in TID(1), gateway ID information GID(2), IoT node ID information NID(3), parameter values (4,5), and signature value S(6) to be used in the first authentication step The secret parameter value Xgn can be configured and broadcast in the form of a transaction. Through this, the gateways 200 constituting the blockchain network can share which IoT node 100 is registered and which token 10 is owned by the IoT node 100.

(2) the first authentication step of the IoT node

7 is a conceptual diagram showing a first authentication process of an IoT blockchain system using a token 10 according to an embodiment of the present invention, and FIG. 8 is using a token 10 according to an embodiment of the present invention It is a sequence diagram showing the first authentication process of the IoT blockchain system.

According to an embodiment of the present invention, when device authentication between the IoT node 100 and the gateway 200 is completed, the IoT node 100 and the gateway 200 for security in the process of transmitting and receiving data of the IoT node 100 A first certification process is needed to confirm the authenticity of each other. Referring to FIG. 7, in the first authentication step, the IoT node 101 requests authentication to one gateway 200 constituting a blockchain network using the registration token 10, and the IoT node 101 in the blockchain network ) And the gateway 200 may be understood as a process of performing device authentication.

Referring to FIG. 8, the IoT node 100 according to an embodiment of the present invention first generates a parameter value MN to safely transmit the random number value r to the gateway 200, and a random number for generating a thin line parameter value SP You can generate the value n. The IoT node 100 may generate a parameter value IN to safely transmit the generated random number n to the gateway 200, and may generate an authentication request message including the above-described parameter values. The IoT node 100 may request the first authentication by sending the generated authentication request message to the gateway 200. At this time, the authentication request message may include token information issued by the IoT node 100.

Referring to FIG. 8, the gateway 200 according to an embodiment of the present invention checks a timestamp in an authentication request message transmitted from the IoT node 100 and then blocks the registration token information transmitted from the IoT node 100 It can be verified through the network. At this time, verification through the blockchain network may be performed by the gateway 200 searching for the secret parameter value Xgn of the IoT node 100. In addition, random values r and n may be extracted from parameter values included in the authentication request message, and random numbers m may be generated using the extracted random values r and n.

After completing the verification of the token information and generating the random number value m, the gateway 200 may generate and store the session parameter value SP. Here, the session parameter value SP is a parameter value used in the second authentication step of the IoT node 100 to be described later, and refers to a parameter value shared by the gateway 200 and the IoT node 100 through the first authentication. After the session parameter value SP is generated as described above, the gateway 200 generates a parameter value GM for safely transmitting the random number value m, and authentication including the parameter value GM and the parameter value Z of [Table 1]. The completion message may be transmitted to the IoT node 100.

Referring to FIG. 8, the IoT node 100 according to an embodiment of the present invention checks a timestamp in an authentication completion message transmitted from the gateway 200 and then generates it using the parameter value Z, token information, and timestamp By comparing the parameter value Z', it can be confirmed that it is a message transmitted from the legitimate gateway 200. In the case of the message transmitted from the legitimate gateway 200, the IoT node 100 may extract the parameter value m from the authentication completion message, and generate and store the session parameter value SP using the parameter values m and n.

Through the above-described process, the first authentication step corresponding to the mutual authentication process of the IoT node 100 and the gateway 200 may be performed by itself without a central server. At this time, the IoT node 100 and the gateway 200 may generate a session parameter value based on the random number value exchanged through the first authentication step, which may be used in the second authentication step described later.

(3) 2nd authentication stage of IoT node

9 is a sequence diagram showing a second authentication process of the IoT blockchain system using the token 10 according to an embodiment of the present invention.

When the first authentication step according to an embodiment of the present invention is completed, the IoT node 100 may start communication to transmit and receive data to and from the gateway 200. At this time, the IoT node 100 and the gateway 200 may use the data to be transmitted and the session parameter values generated in the first authentication step to generate hash data that can be generated only by each other. Using this hash data, the IoT node 100 and the gateway 200 can mutually confirm that the authentication is completed and transmit and receive data at the same time, and this process is referred to as a second authentication step.

Referring to FIG. 9, the IoT node 100 according to an embodiment of the present invention may generate a parameter value D that guarantees the authentication and integrity of a message using the session parameter value SP, and the parameter value D and data. The included data message may be transmitted to the gateway 200.

Referring to FIG. 9, the gateway 200 according to an embodiment of the present invention checks a timestamp in a data message transmitted from the IoT node 100 and then holds the data and the gateway 200 from the IoT node 100 Using the session parameter value SP, a parameter value D'that is compared to the parameter value D can be generated. The gateway 200 compares the parameter value D and the parameter value D'and confirms that the message is from the legitimate IoT node 100. That is, when the parameter value D and the parameter value D'are different from each other, the gateway 200 determines that the message is caused by an invalid IoT node (ie, an IoT node in which the first authentication has not been completed). It may be determined to be a message by the node 100 (ie, the IoT node 100 in which the first authentication is completed).

If it is determined that the first authentication is a message by the IoT node 100, the gateway 200 generates a control message for the IoT node 100 and a parameter value MCM that guarantees message authentication and integrity. It can be transmitted to the IoT node 100.

Referring to FIG. 9, the IoT node 100 according to an embodiment of the present invention checks a timestamp in a control message transmitted from the gateway 200 and then holds the data and the IoT node 100 from the gateway 200 The session parameter value SP may be used to generate a parameter value MCM' that is in contrast to the parameter value MCM. The IoT node 100 compares the parameter value MCM and the parameter value MCM' and confirms that the message is by the legitimate gateway 200.

Through the second authentication step according to the above, it is possible to check whether or not data is transmitted and received by a legitimate device that has completed the first authentication in the process of transmitting and receiving data between the IoT node 100 and the gateway 200, and guarantees the integrity of the message itself. Can.

Hereinafter, with reference to FIGS. 10 to 12, the result of confirming the stability of the security threat through the attack scenario for the system according to an embodiment of the present invention will be described in detail.

10 and 11 are source codes showing a man-in-the-middle attack scenario of the IoT blockchain system using the token 10 according to an embodiment of the present invention.

Because the IoT environment uses wireless communication, an attacker is vulnerable to a man-in-the-middle attack by spoofing or manipulating data disguised as two devices in the IoT environment. In order to confirm whether the system according to an embodiment of the present invention is safe for such man-in-the-middle attack, a simulation in which a scenario for man-in-the-middle attack is applied was performed.

Referring to (a) of FIG. 10, an attacker attempted an attack that disguised as an IoT node and forged a registration request message to transmit to the gateway 200. However, since the attacker's disguised IoT node and the gateway 200 according to an embodiment of the present invention have different secret parameter values Xgn shared with each other, the parameter values MI are inconsistent, thereby preventing an attack by an intermediate person.

Referring to (b) of FIG. 10, an attacker attempted an attack that disguised as a gateway and forged the registration token 10 and the registration permission message and transmitted it to the IoT node 100. However, the IoT node 100 and the attacker's camouflage gateway according to an embodiment of the present invention have different secret parameter values Xgn and random number r, which are different from each other, so that the parameter values y are inconsistent, thereby preventing an attack by a man. have.

Referring to (a) of FIG. 11, an attacker attempted an attack disguised as an IoT node for which registration has been completed by forging the registration token 10 and transmitting the forged registration token 10 to the gateway 200. However, according to an embodiment of the present invention, the gateway 200 receiving the forged registration token 10 checks the token information through the blockchain network, and is forged by the token information confirmed through the blockchain network. By confirming that it is a token, it is possible to prevent an attack by an intermediate person.

Referring to (b) and (c) of FIG. 11, an attacker attempted an attack that intercepts and modulates a data message between the IoT node 100 and the gateway 200. However, it is possible to prevent an attack by a man-in-the-middle by checking whether the data is falsified by the gateway 200 through a parameter value D corresponding to a hash data value that guarantees message authentication and integrity according to an embodiment of the present invention.

As described above, the system according to an embodiment of the present invention can effectively prevent man-in-the-middle attacks that may occur in the IoT environment throughout the entire process of registration and authentication.

12 is a source code and a result showing a security verification scenario of an IoT blockchain system using a token 10 according to an embodiment of the present invention.

The security verification according to an embodiment of the present invention was performed through formal verification of the FDR by specifying protocol procedures of the system in Casper language. The protocol description in the Casper language shown through (a) of FIG. 12 specifies the overall procedure of the protocol.

The protocol specification in the Casper language shown through (b) of FIG. 12 is a part for describing the requirements of the protocol. Referring to (b) of FIG. 12, Secret indicates that the IoT node 100 shares the secret parameter value Xgn and the random number value r with the gateway 200. In addition, the Agreement indicates that the IoT node 100 authenticates the gateway 200 through data, random values m and r.

12(c) shows the result of verifying the protocol using the FDR after specifying the protocol through the Casper language and completing the compilation with CSP. Referring to (c) of FIG. 12, it can be confirmed that “Finished: Passed” is output, which means that it is safe for each part described in the specification.

13 is a flowchart of a multi-step authentication method using an IoT blockchain system utilizing a token 10 according to an embodiment of the present invention.

Referring to FIG. 13, in the multi-level authentication method using an IoT blockchain system using a token 10 according to an embodiment of the present invention, the IoT node 100 authenticates between devices in an IoT environment as a gateway 200 Requesting the issuance of the token 10 for S100, the gateway 200 generating token information according to the request of the IoT node 100, and transmitting the token information generated to the IoT node 100 (S200), the IoT node 100 generates an authentication request message including token information and transmits it to the gateway 200, and the gateway 200 performs the first authentication for verifying the token information through the blockchain network When the step S300 and the first authentication are completed, the IoT node 100 generates a data message for data processing and transmits it to the gateway 200, and the gateway 200 completes the first authentication based on the data message. It includes a step (S400) of performing a second authentication to verify whether the IoT node 100, IoT node 100 and the gateway 200 may share the corresponding secret parameter value on a one-to-one basis.

In the step of requesting the issuance of the token 10 according to an embodiment of the present invention (S100), the IoT node 100 generates a random number value to request the issuance of the token 10, and a parameter based on the random number value A registration request message including values may be generated.

In the step of generating token information according to an embodiment of the present invention and transmitting token information (S200), the gateway 200 analyzes parameter values included in the registration request message, thereby generating an IoT node for generating token information The authentication of (100) can be performed.

In step S200 of generating token information and transmitting token information according to an embodiment of the present invention, the gateway 200 that generated the token information includes ID information (1, 2, 3) included in the token information. , The parameter values (4,5) and the signature value (6) and the secret parameter value can be generated as a transaction, and the generated transaction can be broadcast to other gateways (200) in the blockchain network.

In the step of performing the first authentication according to an embodiment of the present invention (S3100), when generating an authentication request message, the IoT node 100 generates a random number value for generating a session parameter value for the second authentication, , When verification of the token information is completed by the gateway 200, each of the IoT node 100 and the gateway 200 may generate a session parameter value based on a random number value.

In the step (S400) of performing the second authentication according to an embodiment of the present invention, the first authentication is performed by the gateway 200 comparing the session parameter values generated by the IoT node 100 and the gateway 200, respectively. It may be determined whether or not the IoT node 100 is completed.

With respect to the method according to an embodiment of the present invention, the contents of the above-described system may be applied. Therefore, with respect to the method, descriptions of contents identical to those of the above-described system are omitted.

On the other hand, according to an embodiment of the present invention, it is possible to provide a recording medium readable by a computer recording a program for executing the above-described method on a computer. In other words, the method described above can be written in a program executable on a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable medium. Further, the structure of the data used in the above-described method can be recorded on a computer-readable medium through various means. A recording medium that records an executable computer program or code for performing various methods of the present invention should not be understood as including temporary objects such as carrier waves or signals. The computer-readable medium may include a storage medium such as a magnetic storage medium (eg, ROM, floppy disk, hard disk, etc.), optical read media (eg, CD-ROM, DVD, etc.).

The above description of the present invention is for illustration only, and those skilled in the art to which the present invention pertains can understand that the present invention can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts should be interpreted to be included in the scope of the present invention. .

1: Token ID information 2: Gateway ID information
3: IoT node ID information 4: parameter value e
5: parameter value x 6: signature value
10: token
100: IoT node
200: gateway

Claims (14)

In the IoT blockchain system using tokens,
An IoT node requesting the issuance of a token for authentication between devices in an IoT environment; And
It generates a token information according to the request of the IoT node, and includes a gateway for authenticating the IoT node based on the token information,
Regarding the IoT node and the gateway, the IoT node checks whether the token received from the gateway is a token sent by a legitimate gateway, and the gateway responds one-to-one so as to check whether a legitimate IoT node has requested to issue a token. Shared secret parameter values,
A plurality of gateways constitute a blockchain network, and the plurality of gateways share the token information through the blockchain network, an IoT blockchain system.
According to claim 1,
The IoT node generates a random number value to request the issuance of the token, and generates a registration request message including parameter values based on the random number value,
The gateway is an IoT blockchain system characterized by performing authentication of an IoT node for generation of the token information by analyzing parameter values included in the registration request message.
According to claim 1,
In the token information,
IoT block characterized by including the issued token, ID information for identifying the IoT node and the gateway, parameter values for mutual authentication of the IoT node and the gateway, and a signature value for guaranteeing the gateway that issued the token. Chain system.
The method of claim 3,
The gateway that generated the token information generates ID information, parameter values and signature values and the secret parameter value included in the token information as a transaction, and broadcasts the generated transaction to other gateways of the blockchain network ( Broadcast) IoT blockchain system.
According to claim 1,
The IoT node generates an authentication request message including the token information and transmits it to the gateway, and the gateway performs a first authentication to verify the token information through the blockchain network,
When the first authentication is completed, the IoT node generates a data message for data processing and transmits it to the gateway, and the gateway is configured to verify whether the first authentication is the completed IoT node based on the data message. 2 IoT blockchain system characterized by performing authentication.
The method of claim 5,
When generating the authentication request message, the IoT node generates a random number value for generating a session parameter value for the second authentication,
When the verification of the token information is completed by the gateway, each of the IoT node and the gateway generates the session parameter value based on the random number value.
The method of claim 6,
The gateway is an IoT blockchain system characterized by determining whether the first authentication is an completed IoT node by comparing session parameter values generated by the IoT node and the gateway, respectively.
In the multi-level authentication method using the IoT blockchain system using tokens,
An IoT node requesting a gateway to issue a token for authentication between devices in an IoT environment;
Generating, by the gateway, token information at the request of the IoT node, and transmitting the generated token information to the IoT node;
Generating, by the IoT node, an authentication request message including the token information and transmitting it to the gateway, the gateway performing a first authentication verifying the token information through a blockchain network; And
When the first authentication is completed, the IoT node generates a data message for data processing and transmits it to the gateway, and the gateway is configured to verify whether the first authentication is the completed IoT node based on the data message. 2 including performing the authentication,
With respect to the IoT node and the gateway, the IoT node can check whether the token received from the gateway is a token sent by a legitimate gateway, and the gateway responds one-to-one to confirm whether a legitimate IoT node has requested to issue a token. Multi-factor authentication method characterized in that it shares the secret parameter value.
The method of claim 8,
In the step of requesting the issuance of the token,
The IoT node generates a random number value to request the issuance of the token, and generates a registration request message including parameter values based on the random number value,
In the step of generating the token information, and transmitting the token information,
A multi-step authentication method, characterized in that the gateway performs authentication of an IoT node for generation of the token information by analyzing parameter values included in the registration request message.
The method of claim 8,
In the token information,
Multi-factor authentication characterized by including the issued token, ID information for identifying the IoT node and the gateway, parameter values for mutual authentication of the IoT node and the gateway, and a signature value for guaranteeing the gateway that issued the token. Way.
The method of claim 10,
In the step of generating the token information, and transmitting the token information,
The gateway that generated the token information generates ID information, parameter values and signature values and the secret parameter value included in the token information as transactions, and broadcasts the generated transactions to other gateways of the blockchain network ( Broadcast) multi-factor authentication method.
The method of claim 8,
In the step of performing the first authentication,
When generating the authentication request message, the IoT node generates a random number value for generating a session parameter value for the second authentication,
When verification of the token information is completed by the gateway, each of the IoT node and the gateway generates the session parameter value based on the random number value.
The method of claim 12,
In the step of performing the second authentication,
A multi-step authentication method characterized in that the gateway determines whether the first authentication has been completed by comparing the session parameter values generated by the IoT node and the gateway, respectively.
A computer-readable recording medium in which a program for implementing the method of any one of claims 8 to 13 is recorded.

Images