KR102293195B1 - IoT security system according to network hierarchy structure - Google Patents

Abstract

The present invention relates to an internet of things (IoT) security system according to a hierarchical network structure. According to the present invention, the IoT security system comprises: a plurality of IoT devices transmitting/receiving packets generated while being connected to a subnetwork and generating a secret value not disclosed to the outside and a public value used in place of the secret value; a gatekeeper generating entry information by using the public values received from the plurality of IoT devices as an index, allocating the generated entry information to the plurality of IoT devices, performing verification on the packets received from the plurality of IoT devices, and changing an IP address of the IoT device included in a header of the verified packet from a real IP address to a virtual IP address to transmit the changed IP address to the IoT device; and an Internet server registering an identification name, public value, and virtual IP address received from the plurality of IoT devices, connecting communications between the IoT device and other IoT devices by providing the registered public value and virtual IP address to the IoT device to communicate with. Accordingly, when an IoT device is operated, authentication and communications of IoT devices can be provided even without a certificate requiring a secondary certification authority or a public key algorithm requiring a large computational amount.

Description

Internet of Things security system according to network hierarchy structure

The present invention relates to an IoT security system according to a network hierarchical structure, and more particularly, to an application layer (layer 5) that exchanges a symmetric key with a security technology of a network layer (layer 3) that converts a real IP address and a virtual IP address ), it relates to an IoT security system that can safely protect IoT devices by fusion of security technologies.

End-to-end security technology for IoT devices is divided into security technology in the network layer (layer 3), transport layer (layer 4), and application layer (layer 5) according to the network layer structure.

First, in the network layer, that is, layer 3, security is provided by using the Internet protocol communication security (IP security protocol, IPSec). In particular, it is recommended to use IPv6 (internet protocol version 6) as the layer 3 protocol of the Internet of Things, and IPSec is compulsorily used when IPv6 is used.

Internet of Things devices using IPv6 must manage the Security Policy Database (SPD), which is the core function of IPSec, or the SA (Security Association), which indicates which security algorithm to use and which secret key to use.

Since SPD management and SA management are technologies developed for user terminals with computing power, they are too complex to be applied to IoT devices without human intervention. Therefore, IPsec technology should be simplified.

And, in the transport layer, that is, layer 4, the Internet of Things is secured using SSL (Secure Socket Layer)/TLS (Transport Layer Security). The feature of this technology is that the secret key to secure HTTP communication is shared by applying the SSL handshake protocol at the stage before HTTP communication is made.

In this case, in the SSL handshake protocol step, the security of the IoT device is maintained by using a public key certificate. However, it is not easy to apply the public key to the IoT device due to the algorithm and size (usually using 1024 bits). In addition, the public key certificate must track whether it is secure or revocation, and provide the tracked result to the IoT device, which is almost impossible.

In addition, in the application layer, that is, layer 5, the IoT device can be protected by sharing a symmetric key end-to-end. In general, symmetric keys are shared using the Diffie-Hellman algorithm.

According to the Diffie Hellman algorithm, both devices exchange and share a public value derived from a secret value instead of their own secret value. However, the Diffie Hellman algorithm can be exposed to an attack that manipulates public values exchanged by a third party by intervening in the middle, that is, a man-in-the-middle (MITM) attack. this is required

On the other hand, communication for the Internet of Things (IoT, Internet-of-Things) or autonomous vehicles, that is, IoT-to-IoT, Vehicle-to-Vehicle (V2V), IoT-to-Vehicle (IoT2V) or Vehicle-to - The characteristics of IoT (V2IoT) communication must be approached differently in terms of security technology from the point of view of things or machines, unlike the existing human-oriented communication. In that sense, technology in terms of enhancing authentication or confidentiality that has been intervened by humans so far needs to be innovated.

The technology underlying the present invention is disclosed in Korean Patent Application Laid-Open No. 10-2016-0023368 (published on March 3, 2016).

The technical problem to be achieved by the present invention is to combine the security technology of the network layer (layer 3) that converts the real IP address and the virtual IP address and the security technology of the application layer (layer 5) that exchanges the symmetric key to create an IoT device It aims to provide an IoT security system that can safely protect

According to an embodiment of the present invention for achieving this technical problem, in an Internet of Things security system according to a network hierarchical structure, packets generated while connected to a subnetwork are transmitted and received, and a secret value that is not disclosed to the outside, and the secret A plurality of IoT devices generating a public value used in place of a value, generating entry information using the public value received from the plurality of IoT devices as an index, and sending the generated entry information to the plurality of IoT devices Allocating each, verifying the packets received from the plurality of IoT devices, changing the IP address of the IoT device included in the header of the verified packet from the real IP address to the virtual IP address, The gatekeeper transmits to the device, and registers the identification name, public value, and virtual IP address received from the plurality of IoT devices, and provides the registered public value and virtual IP address to the IoT device with which to communicate. and an internet server that connects communication between the internet device and other internet of things devices.

The IoT device may include at least any one of equipment, electronic devices, automatic vehicles, drones, and robots.

The published value may be calculated through the following equation.

는 사물인터넷 장치의 공개값이고,

는 사물인터넷 장치의 비밀값이다. here,

is the public value of the IoT device,

is the secret value of the IoT device.

The gatekeeper may use the public value received from the IoT device as an index, and store entry information including the public value, the real IP address, and the virtual IP address in the form of an address mapping table.

When the first IoT device connected to the first subnetwork transmits a packet to the second IoT device connected to the second subnetwork,

The Internet server compares the identification name of the second IoT device received from the first IoT device with previously registered information to extract a public value and a virtual IP address of the second IoT device, and the extracted second The public value and virtual IP address of the IoT device may be transmitted to the first IoT device.

)를 생성하며, 상기 대칭키(

)는 하기의 수학식으로 산출될 수 있다. When the first IoT device receives the public value and the virtual IP address of the second IoT device, the first IoT device uses its own secret value to obtain a symmetric key (

), and the symmetric key (

) can be calculated by the following equation.

는 제2 사물인터넷 장치의 공개값을 나타내고,

는 제1 사물인터넷 장치의 비밀값을 나타낸다. here,

represents the public value of the second IoT device,

denotes a secret value of the first IoT device.

The first IoT device may encrypt an application layer payload portion of a packet to be transmitted using the calculated symmetric key, and then transmit the encrypted packet to the second IoT device.

The first gatekeeper included in the first subnetwork changes the real IP address of the first IoT device included in the header of the packet to a virtual IP address by using the stored address mapping table, and includes the changed header. The received packet may be transmitted to a second gatekeeper to which the second IoT device is connected.

The second gatekeeper extracts the virtual IP address of the second IoT device included in the header of the received packet, and uses the stored address mapping table to store the extracted virtual IP address of the second IoT device. The IP address may be changed and the packet including the changed header may be transmitted to the second IoT device.

The second IoT device,

)를 이용하여 암호화된 페이로드를 복호화하며, 상기 대칭키(

)는 하기의 수학식으로 나타낼 수 있다. The public value of the first IoT device is extracted from the received packet, and the symmetric key (

) to decrypt the encrypted payload, and the symmetric key (

) can be expressed by the following equation.

는 제1 사물인터넷 장치의 공개값을 나타내고,

는 제2 사물인터넷 장치의 비밀값을 나타낸다. here,

represents the public value of the first IoT device,

denotes a secret value of the second IoT device.

The second IoT device extracts the public value of the first IoT device from the option field of the IP header of the received packet, or the first IoT device included in the beginning of the application layer payload of the received packet. It is possible to extract the public value of the device.

The Internet server may be based on Software-Defined Networking (SDN) or Domain Name System (DNS).

When the software defined networking (SDN) is applied to the Internet server, P2P-based communication is performed between the first IoT device and the second IoT device,

The gatekeeper performs session establishment by verifying the session establishment request packet generated from the IoT device, and when the session establishment is completed, the packet generated by the first IoT device is transmitted to the packet to which the second IoT device belongs. The packet is transmitted to the second IoT device via the second gatekeeper, and the packet generated by the second IoT device is transmitted to the first IoT device via the first gatekeeper to which the first IoT device belongs. can

In the session establishment request packet, the payload portion of the application layer may be encrypted by a symmetric key generated using the secret value of the first IoT device and the public value of the second IoT device.

When the Internet server is based on the Domain Name System (DNS), the Internet server includes a plurality of affiliated servers, and includes a plurality of domain-type identification names, public values, and virtual IP addresses received from the IoT device. It is possible to connect the communication between the IoT device and the other IoT device by registering it in one of the affiliated servers of

When the first IoT device queries the Internet server about the public value and IP address of the second IoT device, the Internet server sends the public value and IP address of the second IoT device to an upper-level name server among a plurality of affiliated servers. If an address-related query is transmitted and the upper-level name server does not receive a result of the DNS query, the upper-level name server may transmit the IP address of the lower-level name server to the first IoT device to continuously perform queries and responses.

The affiliated server extracts the public value and virtual IP address of the second IoT device using the mapping entry information registered in its database, and sends the extracted public value and the virtual IP address to the first IoT device in DNS It can be delivered in the form of a response.

When communication is performed between a plurality of IoT devices connected to the same subnetwork, packets transmitted or received from the IoT device pass through the same gatekeeper, and the gatekeeper receives the packets received from the sending IoT device. can change the real IP address of the sending IoT device included in the header of the have.

The transmitting-side IoT device generates a symmetric key using its own secret value and a public value of the receiving-side IoT device, encrypts an application layer payload portion of the packet using the generated symmetric key, and receives the The side IoT device may generate a symmetric key using its own secret value and the public value of the transmitting side IoT device, and may use the generated symmetric key to decrypt the application layer payload portion of the packet.

As described above, according to the present invention, it is possible to provide authentication and communication of the IoT device without using a certificate requiring a secondary certification authority or a public key algorithm requiring too large a computational amount in the operation of the IoT device. Therefore, there is no need for security technologies such as IPSec or SSL that involve human involvement and solve authentication and security issues.

Also, according to the present invention, the public value of the IoT device is stored in the SDN control server or DNS AU server, and the public value of the IoT device can be secured through a query/response through the SDN control server or DNS AU server, so Diffie Hellman (Diffie-Hellman) It is safe from man-in-the-middle attack (MITM) because it can solve the mutual authentication problem in the symmetric key exchange technology, and it can prevent the manipulation of the public value by a third party in advance.

According to the present invention, all data packets are transmitted through a gatekeeper to which the sending or receiving IoT device is connected, and the gatekeeper converts the real IP address of the sending IoT device included in the packet into a virtual IP address. Since it is changed and delivered, it is possible to prevent the actual IP address from being exposed to the outside. In addition, when a specific IoT device is attacked from the outside, information about the purpose of the specific IoT device can be obtained through a traffic analysis attack, but the actual IP address and the externally exposed virtual IP address are different from each other, which can make traffic analysis attacks difficult.

1 is a configuration diagram for explaining an IoT security system according to an embodiment of the present invention.
2 is a flowchart illustrating a synchronization method using the IoT security system according to an embodiment of the present invention.
3 is a flowchart illustrating a method of performing authentication and communication using an IoT communication system according to an embodiment of the present invention.
4 is a flowchart illustrating a method of performing authentication and P2P communication using an SDN-based IoT security system according to an embodiment of the present invention.
5 is a flowchart illustrating a method of performing authentication and communication between IoT devices using a DNS-based IoT security system according to an embodiment of the present invention.
FIG. 6 is a view for explaining step S510 shown in FIG. 5 .
7 is a flowchart illustrating a method of performing authentication and communication between IoT devices connected to the same network according to an embodiment of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. In this process, the thickness of the lines or the size of the components shown in the drawings may be exaggerated for clarity and convenience of explanation.

In addition, the terms described below are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of the user or operator. Therefore, definitions of these terms should be made based on the content throughout this specification.

Hereinafter, an IoT security system according to an embodiment of the present invention will be described with reference to FIG. 1 .

1 is a configuration diagram for explaining an IoT security system according to an embodiment of the present invention.

As shown in FIG. 1 , according to an embodiment of the present invention, the IoT security system includes a plurality of IoT devices 110 , 120 , 130 , 140 , gatekeepers 210 , 220 , 230 , 240 , and an Internet server 300 .

First, the IoT devices 110 , 120 , 130 , and 140 represent devices that transmit and receive data between things using the wireless Internet in a state in which a sensor and a module for bus communication are built-in, and analyze and process the data. Here, the IoT devices 110 , 120 , 130 , and 140 include equipment, electronic devices, automatic vehicles, drones, and robots.

The IoT devices 110 , 120 , 130 , and 140 generate their own 16-bit secret value, and derive and calculate a public value from the generated secret value.

Then, the IoT devices 110 , 120 , 130 , and 140 provide the generated public value to a gatekeeper to which they belong to be assigned an IP address. In other words, IP addresses are not randomly allocated, but are managed by grouping adjacent numbers according to a certain rule. is assigned by sending In this case, the plurality of IoT devices 110 , 120 , 130 , and 140 provide the generated public values to the gatekeepers 210 , 220 , 230 , and 240 . Then, the gatekeepers 210, 220, 230, and 240 use the received public value as a matching number for the address information of the IoT device.

Next, the IoT devices 110 , 120 , 130 , and 140 generate packets. A packet includes a header and a data part. Here, the header includes the IP address of the IoT device that transmits the packet and the IP address of the IoT device that receives the packet, and the option field further includes the public value of the sending-side IoT and the public value of the receiving-side IoT. .

In other words, it includes the IP addresses and public values of the IoT devices 110 , 120 , 130 , and 140 that transmit packets, and the IP addresses and public values of the IoT devices 110 , 120 , 130 and 140 that receive packets. In addition, in order to maintain the security of transmitted and received packets, the IoT devices 110 , 120 , 130 , and 140 encrypt the payload portion of the packet using a symmetric key.

Meanwhile, in the embodiment of the present invention, an IoT device transmitting a packet among a plurality of IoT devices 110, 120, 130, 140 is referred to as a first IoT device 110, and an IoT device receiving a packet is referred to as a second IoT device ( 120) is called. In addition, the network to which the first IoT device 110 is connected is a first sub-network, and the network to which the second IoT device 120 is connected is a second sub-network. The network is different.

The gatekeepers 210, 220, 230, and 240 are installed in each of a plurality of sub-networks, and packets transmitted from a plurality of IoT devices 110, 120, 130, and 140 connected to the internal sub-network and a plurality of IoT devices connected to an external sub-network ( 110, 120, 130, 140), and performs conversion and verification of the IoT IP address included in the received packet.

In other words, when receiving an address assignment request signal from the IoT devices 110, 120, 130, 140 connected to the corresponding sub-network, the gatekeepers 210, 220, 230, 240 generate entry information for the corresponding IoT devices 110, 120, 130, 140. Here, the entry information includes public values received from the corresponding IoT devices 110 , 120 , 130 , and 140 , and an actual IP address and a virtual IP address. Then, the gatekeepers 210 , 220 , 230 , and 240 store the generated entry information in an Address Mapping Table (AMT), and allocate the generated entry information to the corresponding IoT devices 110 , 120 , 130 , and 140 .

Accordingly, the IoT devices 110, 120, 130, and 140 maintain the data structure of [secret value, public value, virtual IP address, and real IP address], and the gatekeepers 210, 220, 230 and 240 provide data of [public value, virtual IP address, and real IP address]. Since the structure is maintained, the IoT devices 110 , 120 , 130 , 140 and the gatekeepers 210 , 220 , 230 , and 240 are synchronized.

Then, upon receiving the packet from the first IoT device 110 , the first gatekeeper 210 extracts the real IP address of the first IoT device 110 included in the header of the packet. Then, the first gatekeeper 210 changes the extracted real IP address to a virtual IP address using pre-stored entry information, and then transmits the changed packet to the second IoT device 120 .

On the other hand, the packet transmitted from the first gatekeeper 210 is transferred to the second gatekeeper 220 installed in the second subnetwork. Then, the second gatekeeper 220 extracts the virtual IP address of the second IoT device 120 included in the header of the received packet. Then, the second gatekeeper 220 changes the extracted virtual IP address to a real IP address using the previously stored mapping entry information, and transmits the changed packet to the second IoT device 120 .

In other words, packets transmitted or received from the plurality of IoT devices 110, 120, 130, 140 pass through the corresponding gatekeepers 210, 220, 230, 240, and the gatekeepers 210, 220, 230, and 240 convert the real IP addresses included in the received packets to virtual IP addresses. to broadcast. On the other hand, when some other external device operates as a calling device and the IoT devices 110 , 120 , 130 , and 140 operate as a called device, the external device enters the subnetwork using entry information of the called device. That is, in order to communicate with the IoT devices 110 , 120 , 130 , 140 connected to the corresponding subnetwork, the gatekeepers 210 , 220 , 230 , and 240 can be accessed using the virtual IP address. Therefore, the gatekeepers 210, 220, 230, and 240 first verify reliability before delivering the entered packets to the corresponding IoT devices 110, 120, 130, and 140, and transmit the packets that have passed the verification to the corresponding IoT devices 110.120, 130, and 140.

Finally, the Internet server 300 extracts the IP addresses of the corresponding IoT devices 110, 120, 130, 140 using the identification names and public values of the IoT devices 110, 120, 130, and 140, and extracts the IP addresses of the extracted IoT devices 110, 120, 130, and 140. The IoT devices 110, 120, 130, and 140 are communicated using

In detail, even if an external device knows only the identification name of the corresponding IoT device 110, 120, 130, 140 to which the packet is to be sent, the Internet of Things device (110, 120, 130, 140) and the Internet server (300) can be connected through communication by the Internet server 300 must be mutually synchronized.

To this end, first, the IoT devices 110 , 120 , 130 , and 140 transmit information that can be disclosed to the outside among the entry information allocated from the gatekeepers 210 , 220 , 230 , and 240 to the Internet server 300 . Then, the Internet server 300 registers the received publicly available information. Here, the publicly available information includes an identification name, a public value, and a virtual IP address.

When the first IoT device 110 that transmits the packet knows only the identification name of the second IoT device 120 that receives the packet in a state in which registration is completed, and transmits the packet, the first IoT device 110 ) requests the public value and IP address of the second IoT device 120 from the Internet server 300 . Then, the Internet server 300 extracts a public value and an IP address matching the identification name of the second IoT device 120 using the pre-registered information. Then, the Internet server 300 transmits the extracted public value and IP address of the second IoT device 120 to the first IoT device 110 .

On the other hand, the method of extracting the IP address corresponding to the name of the IoT device in order to perform communication between the IoT devices is a technology using software-defined networking (SDN) and a domain name system (DNS). classified by the technology used. The first method extracts the public value and IP address of the second IoT device 120 requested by the first IoT device 110 using an identification name, and discloses the extracted second IoT device 120 . When attempting to establish a connection between the first IoT device and the second IoT device using the value and IP address, the SDN control system serves as a central control device.

On the other hand, the second method is a method of extracting the IP address of the second IoT device 120 using the query/reply protocol of the DNS control system. In other words, the first IoT device 110 requests the public value and IP address of the second IoT device 120 while knowing the domain name of the second IoT device 120 . Then, DNS control The system extracts a public value and IP address matching the domain name of the second IoT device 120 through a query/response with a plurality of affiliated servers.

Meanwhile, when the first IoT device 110 and the second IoT device 120 perform peer-to-peer (P2P) communication, SDN technology is used. In addition, when the first IoT device 110 is a client and the second IoT device 120 operates as a server, the DNS technology is used in Internet communication in a client/server method.

Hereinafter, a method of synchronizing between an IoT device, a gatekeeper, and an Internet server using the IoT security system according to an embodiment of the present invention will be described with reference to FIG. 2 .

2 is a flowchart illustrating a synchronization method using the IoT security system according to an embodiment of the present invention.

In FIG. 2 , a synchronization method using the first IoT device 110 connected to the first sub-network will be described for convenience of understanding. That is, the second IoT device 120 , the third IoT device 130 , and the fourth IoT device 140 perform the gatekeepers 220 , 230 , 240 and the Internet server in the same manner as the first IoT device 110 . Synchronize with 300

First, the first IoT device 110 according to an embodiment of the present invention generates a secret value and a public value (S210).

라고 가정한다. 제1 사물인터넷 장치(110)는 외부에 공개하지 않고 자신만이 알 수 있는 16bit 크기의 비밀값(

)을 생성한다. 그 다음, 제1 사물인터넷(110)은 생성된 비밀값(

)으로부터 동일한 크기를 가지는 공개값(

)을 하기의 수학식 1을 통해 유도 계산한다. For example, the identification name of the first IoT device 110 is

Assume that The first IoT device 110 has a 16-bit secret value (

) is created. Then, the first Internet of Things 110 generates a secret value (

) from the public value (

) is derived and calculated through Equation 1 below.

)은 자신만이 알고 있고 외부에 공개되지 않는 값이고, 공개값(

)은 외부에 공개되는 값으로 비밀값(

)을 대신하여 사용된다. where the secret value (

) is a value known only to you and not disclosed to the outside, and a public value (

) is a value that is disclosed to the outside and a secret value (

) is used instead of

)을 제1 게이트키퍼(210)에 전달한다. Next, the first IoT device 110 transmits an address assignment request signal to the first gatekeeper 210 installed in the first subnetwork. At this time, the first IoT device 110 transmits the generated public value (

) to the first gatekeeper 210 .

Upon receiving the address assignment request signal, the first gatekeeper 210 generates entry information for the first IoT device 110 and transmits the generated entry information to the first IoT device 110 (S220). .

)을 이용한다. In other words, the first gatekeeper 210 authenticates the identification name of the first IoT device 110 , and when authentication is completed, a real IP address and a virtual IP address for the first IoT device 110 are generated. . Then, the generated real IP address and virtual IP address are stored in the address mapping table. In this case, the first gatekeeper 210 sets an index, that is, a matching number, so that information on the real IP address and virtual IP address of the first IoT device 110 stored in the address mapping table can be easily retrieved. The matching number is not newly generated by the first gatekeeper 210, but a public value (

) is used.

That is, the first gatekeeper 210 generates new entry information related to an address with respect to the first IoT device 110 and stores the generated entry information in the form of an address mapping table as shown in Table 1 below.

Distinguished name Matching number (public value) virtual IP address real IP address

), 비밀값(

), 공개값(

), 가상 IP 주소(

), 실재 IP주소(

)]의 데이터구조를 갖는다. Next, the first gatekeeper 210 transmits the generated entry information to the first IoT device 110 . For this reason, the first IoT device 110 [identification name (

), secret value (

), the public value (

), the virtual IP address (

), real IP address (

)] data structure.

Then, the first IoT device 110 transmits the address-related information to the Internet server 300 and registers it (S230).

In this case, the Internet server 300 is based on one technology selected from a technology using software-defined networking (SDN) and a technology using a domain name system (DNS).

), 공개값(

) 및 가상 IP 주소(

)를 SDN기반의 인터넷 서버(300)에 송신하여 등록시킨다. First, when registering address-related information in the SDN-based Internet server 300 , the first IoT device 110 provides an identification name (

), the public value (

) and virtual IP address (

) is transmitted to the SDN-based Internet server 300 and registered.

라고 가정한 상태에서 DNS를 기반으로 하는 인터넷 서버(300)에 주소 관련 정보를 등록할 경우, 제1 사물인터넷 장치(110)는 식별명칭(

) 공개값(

) 및 가상 IP 주소(

)를 DNS기반의 인터넷 서버(300)에 송신하여 등록시킨다.On the other hand, the wholesaler identification name of the first IoT device 110 is

When registering address-related information in the DNS-based Internet server 300 under the assumption that

) public value (

) and virtual IP address (

) is transmitted to the DNS-based Internet server 300 and registered.

The Internet server 300 having completed registration transmits a registration completion signal to the first IoT device 110 .

When synchronization is completed between the IoT device, the gatekeeper, and the Internet server using steps S210 to S230, a communication connection between the device and the device may be established.

Hereinafter, a communication method using an IoT communication system according to an embodiment of the present invention will be described with reference to FIG. 3 .

3 is a flowchart illustrating a method of performing authentication and communication using an IoT communication system according to an embodiment of the present invention.

First, the first IoT device 110 is synchronized with the first gatekeeper 210 and the Internet server 300 using steps S210 to 230 described above, and the second IoT device 120 is synchronized with the second gatekeeper 220 and the Internet server 300 . In addition, the Internet server 230 is based on one technology selected from among SDN and DMS use technologies.

Then, as shown in FIG. 3 , the first IoT device 110 discloses the second IoT device 120 to deliver a packet to the second IoT device 120 connected to another sub-network. The value and IP address information are requested and received from the Internet server 300 (S310).

In other words, in a state where only the identification name of the second IoT device 120 is known, the first IoT device 110 sends the public value and IP address of the second IoT device 120 to the Internet server 300 . request. Then, the Internet server 300 extracts the registered public value and virtual IP address using the received identification name of the second IoT device 120 , and then uses the extracted public value and the virtual IP address as the first Internet of Things (IoT) address. to the device 110 .

이고, 제2 사물인터넷 장치(120)의 식별명칭은

라고 가정한다. 제1 사물인터넷 장치(110)는 제2 사물인터넷 장치(120)의 식별명칭(

)을 이용하여 인터넷 서버(300)에 주소에 관한 질의요청신호를 송신한다. For example, the identification name of the first IoT device 110 is

and the identification name of the second IoT device 120 is

Assume that The first IoT device 110 is an identification name of the second IoT device 120 (

) to transmit a query request signal regarding the address to the Internet server 300 .

)을 이용하여 등록되어 있는 공개값(

) 및 가상 IP 주소(

)를 추출한 다음, 추출된 공개값(

) 및 가상 IP 주소(

)를 제1 사물인터넷 장치(110)에게 전달한다. Then, the Internet server 300 receives the identification name (

) registered public value (

) and virtual IP address (

), then the extracted public value (

) and virtual IP address (

) to the first IoT device 110 .

Next, the first IoT device 110 generates a packet in which the payload portion is encrypted, and transmits the generated packet to the first gatekeeper 210 (S320).

In general, the daughter secret key is exchanged with the Diffie-Hellman algorithm in order to establish encrypted communication between the device and the device. Since the conventional Diffie-Hellman algorithm is vulnerable to attack by a third party, in the embodiment of the present invention, a symmetric key is generated using a public value to prevent an attack by a third party in advance. The payload part of the packet is encrypted using the symmetric key.

In detail, first, the first IoT device 110 generates a symmetric key using Equation 2 below.

는 제2 사물인터넷 장치의 공개값이고,

는 제1 사물인터넷 장치의 비밀값이다. here,

is the public value of the second IoT device,

is a secret value of the first IoT device.

)생성이 완료되면, 제1 사물인터넷 장치(110)는 패킷의 헤더에 주소에 관한 정보를 입력하고, 생성된 대칭키를 이용하여 페이로드 부분을 암호화한다. Symmetric key (

) when the generation is completed, the first IoT device 110 inputs information about the address to the header of the packet, and encrypts the payload part using the generated symmetric key.

), 제2 사물인터넷 장치의 가상 IP 주소(

), 제1 사물인터넷 장치의 공개값(

)을 탑재하는 옵션1 및 제2 사물인터넷 장치의 공개값(

)을 탑재하는 옵션 2를 포함한다.Meanwhile, in the header of the packet, the real IP address (

), the virtual IP address of the second IoT device (

), the public value of the first IoT device (

) of option 1 and second Internet of Things devices equipped with

), including option 2 to mount.

The generated packet is transmitted to the first gatekeeper 210 . Then, the first gatekeeper 210 changes the header value of the received packet, and broadcasts the changed packet toward the second IoT device 120 (S330).

The first gatekeeper 210 extracts the public value and the real IP address of the first IoT device 110 from the received packet. In addition, the first gatekeeper 210 obtains the virtual IP address of the first IoT device 110 from a pre-stored address mapping table by using the extracted public value. Next, the first gatekeeper 210 changes the real IP address of the first IoT device 110 included in the header of the packet to the obtained virtual IP address.

The packet transmitted in S330 first arrives at the second gatekeeper 220 installed in the subnetwork to which the second IoT device 120 is connected. Then, the second gatekeeper 220 changes the header value of the received packet, and transmits the changed packet to the second IoT device 120 (S340).

In order to access a specific IoT device 110 , 120 , 130 , 140 , it is necessary to first pass through the gatekeepers 210 , 220 , 230 , 240 to which the corresponding IoT device 110 , 120 , 130 , and 140 are connected. That is, the packet broadcast from the first gatekeeper 210 passes through the second gatekeeper 220 before reaching the second IoT device 120 . At this time, by verifying the received packet, the second gatekeeper 220 distinguishes whether the packet delivered to the second IoT device 120 contains malicious or aggressive nature, thereby protecting the IoT device from hacker attacks. protect

When the verification is completed, the second gatekeeper 220 extracts the public value and virtual IP address of the second IoT device 120 included in the header of the packet. Then, the second gatekeeper 220 acquires the real IP address of the second IoT device 120 using the extracted public value. The second gatekeeper 220 changes the virtual IP address of the second IoT device 120 included in the packet header to the real IP address obtained, and then transfers the changed packet to the second IoT device 120 . do.

The second IoT device 120 receiving the packet decrypts the payload portion of the encrypted packet (S350).

In other words, the second IoT device 120 extracts the public value of the first IoT device from the received packet. In this case, the second IoT device 120 extracts the public value of the first IoT device from the option field included in the header of the received packet, or the first IoT device included in the beginning of the application layer payload of the packet. Extract the public value of the device.

Then, the second IoT device 120 calculates a symmetric key using Equation 3 below.

는 제1 사물인터넷 장치의 공개값이고,

는 제2 사물인터넷 장치의 비밀값이다. here,

is a public value of the first IoT device,

is a secret value of the second IoT device.

Then, the second IoT device 120 decrypts the payload portion of the packet using the calculated symmetric key.

The IoT security system according to an embodiment of the present invention can promote authentication between the device and the device by a symmetric key generated using the public value of the IoT device, and the gatekeeper uses the public value It relays to finally arrive at the receiving-side IoT device. In this case, if the public value is manipulated due to a hacker attack, the manipulated packet cannot be delivered to the receiving-side IoT device by the gatekeeper. Therefore, the IoT security system according to the embodiment of the present invention can simplify authentication and enhance confidentiality.

Hereinafter, a P2P communication method using an SDN-based IoT security system according to another embodiment of the present invention will be described in more detail with reference to FIG. 4 .

4 is a flowchart illustrating a method of performing authentication and P2P communication using an SDN-based IoT security system according to another embodiment of the present invention.

First, the first IoT device 110 and the second IoT device 120 generate a secret value and a public value, respectively. Then, the first IoT device 110 and the second IoT device 120 transmit an address assignment request signal to the corresponding first gatekeeper 210 and the second gatekeeper 220, and accordingly, the first It is assumed that virtual IP addresses and real IP addresses are allocated from the gatekeeper 210 and the second gatekeeper 220 .

Next, as shown in FIG. 4 , the first IoT device 110 queries the Internet server 300 for the public value and IP address of the second IoT device 120 , and information therefor is received (S410).

), 비밀값(

), 공개값(

), 가상 IP 주소(

), 실재 IP주소(

)]의 데이터 구조를 포함하고 있고, 제1 게이트기퍼(210)는 수신된 공개값 및 할당된 주소 정보를 주소 매핑 테이블에 저장한 상태라고 가정한다. In other words, the first IoT device 110 receives an address assigned from the first gatekeeper 210 and [identification name (

), secret value (

), the public value (

), the virtual IP address (

), real IP address (

)], and it is assumed that the first gatekeeper 210 stores the received public value and the allocated address information in the address mapping table.

인 제2사물인터넷 장치(120)에게 패킷을 송신하고자 할 경우, 제1 사물인터넷 장치(110)는 제2사물인터넷 장치의 식별명칭(

)을 인터넷서버(300)에 전달하여 공개값 및 IP주소를 요청한다. And, the first IoT device 110 has an identification name

When a packet is to be transmitted to the second IoT device 120, the first IoT device 110 provides an identification name (

) to the Internet server 300 to request a public value and an IP address.

)에 매칭되는 공개값(

) 및 가상 IP 주소(vIP_

)를 추출한 다음, 추출된 공개값(

) 및 가상 IP 주소(

)를 제1 사물인터넷 장치(110)에 응답형식으로 전달한다.Then, the Internet server 300 uses the registration information stored in the database to identify the name (

) matching public values (

) and virtual IP address (vIP_

), then the extracted public value (

) and virtual IP address (

) to the first IoT device 110 in the form of a response.

When step S410 is completed, the first IoT device 110 generates a symmetric key, and uses the generated symmetric key to generate and transmit a packet in which the payload portion is encrypted (S420).

)과 자신의 비밀값(

)을 이용하여 대칭키(

)를 생성한다. The first IoT device 110 generates a symmetric key using Equation (2). That is, the public value of the second IoT device 120 received from the Internet server 300 (

) and its secret value (

) using the symmetric key (

) is created.

, D.IP= vIP_

, Op.1=

, Op.2=

]로 구성된다.Then, the first IoT device 110 encrypts the payload portion of the packet using the generated symmetric key. At this time, the header of the packet includes address information, [S.IP= rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] is composed of

, D.IP= vIP_

, Op.1=

, , Op.2=

]로 변경한 다음, 제2 사물인터넷 장치(120)가 접속되어 있는 제2 게이트키퍼(220) 방향으로 브로드캐스팅한다. Then, the generated packet is transmitted to the second IoT device 120 as a destination. The transmitted packet arrives at the first gatekeeper 210 . Then, the first gatekeeper 210 sets the header of the packet to [S.IP=vIP_

, D.IP= vIP_

, Op.1=

, , Op.2=

], and then broadcast in the direction of the second gatekeeper 220 to which the second IoT device 120 is connected.

, D.IP= rIP_

, Op.1=

, , Op.2=

]로 변경한다. 그리고, 변경된 패킷을 실질적으로 rIP_

를 사용하는 제2 사물인터넷 장치(120)에 전달한다. The broadcast packet arrives at the second gatekeeper 220 via the Internet in a conventional manner. Then, the second gatekeeper 220 verifies the security of the arrived packet, and sets the header of the packet to [S.IP=vIP_

, D.IP= rIP_

, Op.1=

, , Op.2=

change to ]. And, the changed packet is effectively rIP_

is transmitted to the second IoT device 120 using

Then, the second IoT device 120 decodes the payload portion of the received packet and determines whether to accept the session request ( S430 ).

) 을 추출한다. 그리고, 제2 사물인터넷 장치(120)는 패킷에 포함된 페이로드의 시작 부분에서 제1 사물인터넷 장치의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. In other words, the second IoT device 120 receives the public value ( (

) is extracted. Then, the second IoT device 120 sets the public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)과 자신의 비밀값(

)을 상기의 수학식 3에 대입하여 대칭키(

)를 산출한다. As a result of the comparison, if the two values are the same, the second IoT device 120 sets the extracted public value (

) and its secret value (

) by substituting Equation 3 above, the symmetric key (

) is calculated.

Then, the second IoT device 120 decrypts the payload portion using the generated symmetric key.

When it is determined to accept the session request in step S430, the second IoT device 120 generates and transmits a response packet for accepting the session request (S440).

At this time, the packets transmitted and received after the time of accepting the session request use the symmetric key calculated by encryption/decryption in steps S410 and 430 as they are.

)를 이용하여 응답 패킷의 페이로드 부분을 암호화한다. 그리고, 응답 패킷의 헤더에는 [S.IP= rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]를 포함한다. That is, the second IoT device 120 generates a symmetric key (

) to encrypt the payload part of the response packet. And, in the header of the response packet, [S.IP= rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] is included.

, vIP_

, Op.1=

, Op.2=

]로 변경한 다음, 제1 사물인터넷 장치(110)가 접속되어 있는 제1 게이트키퍼(210) 방향으로 브로드캐스팅한다. Then, the generated packet is transmitted to the first IoT device 110 as a destination. The transmitted packet arrives at the second gatekeeper 200 . Then, the second gatekeeper 220 sets the header of the packet to [S.IP=vIP_

, vIP_

, Op.1=

, Op.2=

], and then broadcast in the direction of the first gatekeeper 210 to which the first IoT device 110 is connected.

, rIP_

, Op.1=

, Op.2=

]로 변경한다. 그리고, 변경된 패킷을 실질적으로 rIP_

를 사용하는 제1 사물인터넷 장치(110)에 전달한다. The broadcast packet arrives at the first gatekeeper 210 via the Internet in a conventional manner. Then, the first gatekeeper 210 verifies the security of the arrived packet, and sets the header of the packet to [S.IP=vIP_

, rIP_

, Op.1=

, Op.2=

change to ]. And, the changed packet is effectively rIP_

is transmitted to the first IoT device 110 using

Then, the first IoT device 110 decodes the payload portion of the received packet (S450).

) 을 추출한다. 그리고, 제1 사물인터넷 장치(110)는 패킷에 포함된 페이로드의 시작 부분에서 제2 사물인터넷 장치의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. In other words, the first IoT device 110 receives the public value ( (

) is extracted. Then, the first IoT device 110 sets the public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)과 자신의 비밀값(

)을 상기의 수학식 2에 대입하여 대칭키(

)를 산출한다. 그리고 제1 사물인터넷 장치는 산출된 대칭키를 이용하여 패킷의 페이로드부분을 복호화한다. If the two values are the same as a result of the comparison, the first IoT device 110 sets the extracted public value (

) and its secret value (

) by substituting in Equation 2 above, the symmetric key (

) is calculated. Then, the first IoT device decrypts the payload portion of the packet using the calculated symmetric key.

When the acceptance response to the session request is completed, the first IoT device 110 and the second IoT device 120 perform two-way P2P communication (S460).

)를 이용하여 페이로드 부분이 암호화된 패킷을 생성하여 전송하면, 전송된 패킷은 소속된 제1 게이트키퍼(210)에 도달하지 않고 제2 사물인터넷 장치(120)가 소속되어 있는 제2 게이트키퍼(220)에 도달한다. 그러면, 제2 게이트키퍼(220)는 수신된 패킷에 대한 검증 및 주소변환 과정을 수행한 다음, 패킷의 헤더값이 변경된 패킷을 제2 사물인터넷 장치(120)에게 전달한다. 그러면, 제2 사물인터넷 장치(120)는 대칭키(

)를 이용하여 페이로드 부분이 암호화된 패킷을 복호화한다. That is, the first IoT device 110 uses a symmetric key (

) to generate and transmit a packet whose payload part is encrypted, the transmitted packet does not reach the first gatekeeper 210 to which it belongs, but to the second gatekeeper to which the second IoT device 120 belongs. (220) is reached. Then, the second gatekeeper 220 performs verification and address conversion on the received packet, and then transmits the packet in which the header value of the packet is changed to the second IoT device 120 . Then, the second IoT device 120 uses the symmetric key (

) to decrypt the packet whose payload part is encrypted.

)를 이용하여 페이로드 부분이 암호화된 패킷을 생성하여 전송하면, 전송된 패킷은 소속된 제2 게이트키퍼(220)에 도달하지 않고 제1 사물인터넷 장치(110)가 소속되어 있는 제1 게이트키퍼(210)에 도달한다. 그러면, 제1 게이트키퍼(210)는 수신된 패킷에 대한 검증 및 주소변환 과정을 수행한 다음, 패킷의 헤더값이 변경된 패킷을 제1 사물인터넷 장치(110)에게 전달한다. 그러면, 제1 사물인터넷 장치(110)는 대칭키(

)를 이용하여 페이로드 부분이 암호화된 패킷을 복호화한다. Similarly, the second IoT device 120 uses a symmetric key (

) is used to generate and transmit a packet whose payload part is encrypted, the transmitted packet does not reach the second gatekeeper 220 to which it belongs, but to the first gatekeeper to which the first IoT device 110 belongs. (210) is reached. Then, the first gatekeeper 210 performs verification and address conversion on the received packet, and then transmits the packet in which the header value of the packet is changed to the first IoT device 110 . Then, the first IoT device 110 uses the symmetric key (

) to decrypt the packet whose payload part is encrypted.

Hereinafter, a communication method of an IoT device capable of application layer security based on DNS according to another embodiment of the present invention will be described in more detail with reference to FIGS. 5 and 6 .

5 is a flowchart illustrating a method of performing authentication and communication between IoT devices using a DNS-based IoT security system according to another embodiment of the present invention.

First, the first IoT device 110 and the second IoT device 120 generate a secret value and a public value, respectively. Then, the first IoT device 110 and the second IoT device 120 transmit an address assignment request signal to the corresponding first gatekeeper 210 and the second gatekeeper 220, and accordingly, the first It is assumed that virtual IP addresses and real IP addresses are allocated from the gatekeeper 210 and the second gatekeeper 220 .

Then, as shown in FIG. 5 , the first IoT device 110 queries the Internet server 300 for the IP address of the second IoT device 120 and receives information about it ( S510).

이고, 제1 게이트키퍼(210)로부터 [

, vIP_

, rIP_

]의 매핑 엔트리 정보를 할당받은 제1 사물인터넷 장치(110)가 식별명칭이

인 제2사물인터넷 장치(120)에게 패킷을 송신하고자 할 경우, 제1 사물인터넷 장치(110)는 제2사물인터넷 장치의 도메인 식별명칭(

.utopia.com)을 인터넷서버(300)에 전달하여 공개값 및 IP주소를 요청한다. In other words, the identification name is

and from the first gatekeeper 210 [

, vIP_

, rIP_

The first IoT device 110 to which the mapping entry information of ] is assigned has an identification name

When a packet is to be transmitted to the second IoT device 120, the first IoT device 110 sets the domain identification name (

utopia.com) to the Internet server 300 to request a public value and an IP address.

On the other hand, the DNS-based Internet server 300 is composed of a plurality of affiliated servers (AU). The affiliated server includes a root domain server at the highest level and a plurality of sub-domain servers. Meanwhile, since the IP address of the root domain server is not changed, all of the plurality of domain servers recognize the root domain server.

Hereinafter, a process in which the first IoT device 110 acquires public values and address information of the second IoT device 120 through a query with a plurality of affiliated servers will be described with reference to FIG. 6 .

FIG. 6 is a view for explaining step S510 shown in FIG. 5 .

As shown in FIG. 6 , first, the first IoT device 110 inquires for an IP address of the DNS server located closest to the second IoT device 120 to find out the public value and address of the second IoT device 120 ( S511 ). ).

If the nearest DNS server (hereinafter referred to as a “first affiliated server”) knows the public value and IP address of the second IoT device 120 , it immediately provides the public value and IP address. On the other hand, when the first affiliate server does not know the public I value and IP address of the second IoT device 120, the first affiliate server requests an inquiry from the root domain server (S512).

The root domain server transmits the IP address of the related affiliate server to the first affiliate server using the domain identification name of the second IoT device 120 (S513).

.utopia.com일 경우, 최상위 도메인이 ".com"이 된다. 따라서, 루트 도메인서버는 ".com"이 등록된 소속 서버의 IP주소를 제1 소속서버에 전달한다. For example, the domain identification name of the second IoT device 120 is

If it is .utopia.com, the top-level domain will be ".com". Accordingly, the root domain server transfers the IP address of the affiliated server where ".com" is registered to the first affiliated server.

Then, the first affiliated server inquires the public value and IP address of the second IoT device 120 from the name server managing ".com" (S514).

Then, the ".com" name server searches for the public value and IP address of the second IoT device 120 using its own database. As a result of the search, if the public value and IP address of the second IoT device 120 are unknown, the ".com" name server provides the IP address of the name server of "utopia", which is a subordinate server, to the first affiliated server (S515). .

The first affiliated server inquires the public value and IP address of the second IoT device 120 from the name server of "utopia" using the IP address of the name server of "utopia" received from the name server of ".com". (S516).

Finally, the name server of “utopia” searches for the public value and IP address of the second IoT device 120 inquired by using its own database. Then, when the public value and IP address of the second IoT device 120 are found, the name server of “utopia” extracts the public value and IP address of the second IoT device 120 and provides it to the first affiliated server do (S517).

) 및 IP주소(vIP_

)를 제1 사물인터넷 장치(110)에게 전달한다(S518). Then, the first affiliated server transmits the public value (

) and IP address (vIP_

) to the first IoT device 110 (S518).

Upon completion of step S510 , the first IoT device 110 generates an HTTP request packet in which the payload portion is encrypted using the symmetric key, and transmits the generated HTTP request packet to the second IoT device 120 . (S520).

)과 자신의 비밀값(

)을 수학식 2에 대입하여 대칭키(

)를 산출한다. In other words, the first IoT device 110 receives the public value (

) and its secret value (

) by substituting the symmetric key (

) is calculated.

)를 이용하여 페이로드 부분이 암호화된 HTTP요청 패킷을 생성한다. 이때, HTTP요청 패킷의 헤더의 관련 필드는 [S.IP= rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]로 구성된다. 생성된 HTTP요청 패킷은 제2 사물인터넷 장치(120)를 향하여 전송된다. 전송된 HTTP요청 패킷은 제2 사물인터넷 장치(120)에 전달되기 전에 제1 게이트키퍼(210)에 도달하며, 제1 게이트키퍼(210)는 HTTP요청 패킷의 헤더를 [S.IP= vIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]로 변경한다. 그 다음, 제1 게이트키퍼(210)는 제2 사물인터넷 장치(120)가 속한 제2 게이트키퍼(220)방향으로 HTTP요청 패킷을 브로드캐스팅한다. In addition, the first IoT device 110 uses the calculated symmetric key (

) to create an HTTP request packet with the payload part encrypted. At this time, the relevant field of the header of the HTTP request packet is [S.IP= rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] is composed of The generated HTTP request packet is transmitted toward the second IoT device 120 . The transmitted HTTP request packet arrives at the first gatekeeper 210 before being delivered to the second IoT device 120, and the first gatekeeper 210 sets the header of the HTTP request packet to [S.IP=vIP_

, D.IP= vIP_

, Op.1=

, Op.2=

change to ]. Next, the first gatekeeper 210 broadcasts the HTTP request packet in the direction of the second gatekeeper 220 to which the second IoT device 120 belongs.

, D.IP= rIP_

, Op.1=

, Op.2=

]로 변경한 다음, 변경된 HTTP요청 패킷을 실질적으로 rIP_

를 사용하는 제2 사물인터넷 장치(120)에 전달한다. The HTTP request packet arrives at the second gatekeeper 220 via the Internet in a conventional manner. Then, the second gatekeeper 220 verifies the packet, and sets the header of the verified packet to [S.IP=vIP_

, D.IP= rIP_

, Op.1=

, Op.2=

], then the changed HTTP request packet is effectively rIP_

is transmitted to the second IoT device 120 using

Then, the second IoT device 120 decodes the payload portion of the received packet (S530).

) 을 추출한다. 그리고, 제2 사물인터넷 장치(110)는 패킷에 포함된 페이로드의 시작 부분에서 제1 사물인터넷 장치의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. In other words, the second IoT device 120 receives the public value ( (

) is extracted. In addition, the second IoT device 110 sets the public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)과 자신의 비밀값(

)을 상기의 수학식 3에 대입하여 대칭키(

)를 산출한다. 그리고 제2 사물인터넷 장치(120)는 산출된 대칭키를 이용하여 패킷의 페이로드부분을 복호화한다. If the two values are the same as a result of the comparison, the second IoT device 120 sets the extracted public value (

) and its secret value (

) by substituting Equation 3 above, the symmetric key (

) is calculated. Then, the second IoT device 120 decrypts the payload portion of the packet using the calculated symmetric key.

)를 이용하여 페이로드 부분이 암호화된 HTTP 응답 패킷을 생성하고, 생성된 HTTP 응답 패킷을 제1 사물인터넷 장치(110)로 향하여 송신한다(S540).Then, if the second IoT device 120 can provide the file information specified by the HTTP request of the first IoT device 110 , the second IoT device 120 uses the symmetric key (

) to generate an HTTP response packet in which the payload portion is encrypted, and transmit the generated HTTP response packet to the first IoT device 110 (S540).

)를 이용하여 페이로드 부분이 암호화된 HTTP 응답 패킷을 생성한다. 이때, HTTP 응답 패킷의 헤더에는 [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]의 주소 정보를 포함한다. That is, the second IoT device 120 uses the symmetric key (

) to generate an HTTP response packet in which the payload part is encrypted. At this time, in the header of the HTTP response packet, [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] contains address information.

, D.IP= vIP_

, Op.1=

, Op.2=

]로 변경하여 제1 사물인터넷 장치(110)에 소속되어 있는 제1 게이트키퍼(210)에 브로드캐스팅한다. The generated HTTP response packet is transmitted to the first IoT device 110 . The transmitted HTTP response packet arrives at the second gatekeeper 220 first, and the second gatekeeper 220 sets the packet header to [S.IP=vIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] to broadcast to the first gatekeeper 210 belonging to the first IoT device 110 .

, D.IP= rIP_

, Op.1=

, Op.2=

]로 변경한다. 그리고, 변경된 패킷을 실질적으로 rIP_

를 사용하는 제1 사물인터넷 장치(110)에 전달한다.The broadcast HTTP response packet arrives at the first gatekeeper 210 via a conventional method of the Internet. Then, the first gatekeeper 210 verifies the security of the arrived packet, and sets the header of the packet to [S.IP=vIP_

, D.IP= rIP_

, Op.1=

, Op.2=

change to ]. And, the changed packet is effectively rIP_

is transmitted to the first IoT device 110 using

Then, the first IoT device 110 decodes the payload portion of the received packet (S550).

) 을 추출한다. 그리고, 제1 사물인터넷 장치(110)는 패킷에 포함된 페이로드의 시작 부분에서 제2 사물인터넷 장치의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. The first IoT device 110 receives the public value (

) is extracted. Then, the first IoT device 110 sets the public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)를 이용하여 패킷의 페이로드 부분을 복화화한다. If the two values are the same as a result of the comparison, the first IoT device 110 uses the symmetric key (

) to decrypt the payload part of the packet.

In this way, the first IoT device 110 may receive desired file information included in the HTTP response packet sent from the second IoT device 120 .

Hereinafter, a method of performing communication between IoT devices connected to the same network using FIG. 7 will be described.

7 is a flowchart illustrating a method of performing authentication and communication between IoT devices connected to the same network according to another embodiment of the present invention.

In FIG. 7, for convenience of description, the first IoT devices 110-1, 110-2, and 110-3 included in the first subnetwork will be described as an example.

)(110-1), 자율주행차량(

)(110-2) 및 카메라 장치(

)(110-3)을 포함할 수 있다. At this time, the plurality of IoT devices connected to the first sub-network are autonomous vehicles (

) (110-1), autonomous vehicle (

) (110-2) and the camera device (

) (110-3).

)(110-1)이 동일 서브네트워크에 소속된 자율주행차량(

)(110-2) 및 카메라 장치(

)(110-3)에 각각 데이터 패킷을 보내는 경우에 대하여 설명한다. 7, the autonomous vehicle (

) (110-1) is an autonomous vehicle belonging to the same subnetwork (

) (110-2) and the camera device (

), a case in which data packets are transmitted to 110-3 will be described.

)(110-1), 자율주행차량(

)(110-2) 및 카메라 장치(

)(110-3)는 각각 비밀값 및 공개값을 생성한다. 그리고, 자율주행차량(

)(110-1), 자율주행차량(

)(110-2) 및 카메라 장치(

)(110-3)는 생성된 공개값을 게이트 키퍼(210)에 전달하여 실재 IP 주소 및 가상 IP주소를 할당받는다. First, autonomous vehicles (

) (110-1), autonomous vehicle (

) (110-2) and the camera device (

) (110-3) generates a secret value and a public value, respectively. and autonomous vehicles (

) (110-1), autonomous vehicle (

) (110-2) and the camera device (

) 110-3 transmits the generated public value to the gatekeeper 210 to be assigned a real IP address and a virtual IP address.

)(110-1), 제2 자율주행차량(

)(110-2) 및 카메라 장치(

)(110-3)는 SDN 또는 DNS 기반의 인터넷 서버(300)에 각각의 식별명칭, 공개값 및 가상 IP주소가 등록된 상태이다. And, the first autonomous vehicle (

) (110-1), the second autonomous vehicle (

) (110-2) and the camera device (

) 110-3 is a state in which each identification name, public value, and virtual IP address are registered in the SDN or DNS-based Internet server 300 .

)(110-1)은 제2 자율주행차량(

)(110-2)과의 양방향 통신을 수행하기 위하여 패킷을 전송한다(S710). Then, as shown in FIG. 7, the first autonomous vehicle (

) (110-1) is the second autonomous vehicle (

) transmits a packet to perform bidirectional communication with 110-2 (S710).

)(110-1)는 인터넷 서버(300)로부터 제2 자율주행차량(

)(110-2)에 대한 공개값 및 가상 IP 주소를 수신받는다. 그 다음, 제1 자율주행차량(

)(110-1)는 수신된 제2 자율주행차량(

)(110-2)의 공개값과 자신의 비밀값을 이용하여 대칭키(

)를 생성한다. 제1 자율주행차량(

)(110-1)는 생성된 대칭키를 이용하여 생성된 패킷의 페이로드 부분을 암호화한다. 이때, 생성된 패킷의 헤더는 [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]의 주소 정보를 포함한다. The first autonomous vehicle (

) 110-1 is the second autonomous vehicle (

) receives the public value and virtual IP address for (110-2). Then, the first autonomous vehicle (

) 110-1 is the received second autonomous vehicle (

) using the public value of (110-2) and its own private value, the symmetric key (

) is created. The first autonomous vehicle (

) 110-1 encrypts the payload portion of the generated packet using the generated symmetric key. At this time, the header of the generated packet is [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] contains address information.

)(110-1)가 생성된 패킷을 제2 자율주행차량(

)(110-2)에게 전송한다. 전송된 패킷은 제2 자율주행차량(

)(110-2)에 도달하기 전에 해당 게이트키퍼(200)를 경유하게 된다. The first autonomous vehicle (

) 110-1 sends the generated packet to the second autonomous vehicle (

) to (110-2). The transmitted packet is the second autonomous vehicle (

) before reaching 110-2, it passes through the corresponding gatekeeper 200.

)(110-2)에게 전달한다(S720).The gatekeeper 200 verifies the received packet and changes the header of the packet. Then, the gatekeeper 200 transmits the changed packet to the second autonomous vehicle (

) to (110-2) (S720).

)(110-1)의 실재 IP주소 및 공개값(

)을 추출하고, 기 저장된 주소 매핑 테이블을 이용하여 제1 자율주행차량(

)(110-1)의 가상 IP 주소를 획득한다. 그리고 게이트키퍼(200)는 패킷의 헤더에 포함된 제1 자율주행차량(

)(110-1)의 실재 IP 주소를 획득한 가상 IP로 변경한다. In other words, the gatekeeper 200 is the first autonomous vehicle (

) (110-1) real IP address and public value (

) and using a pre-stored address mapping table to extract the first autonomous vehicle (

) obtains a virtual IP address of 110-1. And the gatekeeper 200 is the first autonomous vehicle (

) (110-1) changes the real IP address to the acquired virtual IP.

)(110-2)의 가상 IP주소 및 공개값(

)을 추출하고, 기 저장된 주소 매핑 테이블을 이용하여 제2 자율주행차량(

)(110-2)의 실재 IP 주소를 획득한다. 그리고 게이트키퍼(200)는 패킷의 헤더에 포함된 제2 자율주행차량(

)(110-2)의 가상 IP 주소를 획득한 실재 IP로 변경한다.In addition, the gatekeeper 200 includes the second autonomous vehicle (

) (110-2) virtual IP address and public value (

) and using a pre-stored address mapping table to extract the second autonomous vehicle (

) to obtain the real IP address of 110-2. And the gatekeeper 200 is the second autonomous vehicle (

), the virtual IP address of 110-2 is changed to the obtained real IP.

)(110-2)에 전달한다. 제2 자율주행차량(

)(110-2)은 대칭키를 생성하고, 생성된 대칭키를 이용하여 수신된 패킷의 페이로드 부분을 복호화한다(S730).Then, the gatekeeper 200 transmits the changed packet to the second autonomous vehicle (

) to (110-2). The second autonomous vehicle (

) 110-2 generates a symmetric key and decrypts the payload portion of the received packet using the generated symmetric key (S730).

)(110-2)은 수신된 패킷의 헤더에 포함된 옵션 1 필드로부터 제1 자율주행차량(

)(110-1)의 공개값(

)을 추출한다. 그리고, 제2 자율주행차량(

)(110-2)은 패킷에 포함된 페이로드의 시작 부분에서 제1 자율주행차량(

)(110-1)의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. In detail, the second autonomous vehicle (

) 110-2 is the first autonomous vehicle (

) (110-1) public value (

) is extracted. And, the second autonomous vehicle (

) 110-2 is the first autonomous vehicle (

) (110-1) public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)(110-2)는 추출된 제1 자율주행차량(

)(110-1)의 공개값(

)과 자신의 비밀값(

)을 이용하여 대칭키(

)를 생성한다. 그리고 제2 자율주행차량(

)(110-2)는 생성된 대칭키를 이용하여 패킷의 페이로드 부분을 복호화한다. As a result of the comparison, if the two values are the same, the second autonomous vehicle (

) (110-2) is the extracted first autonomous vehicle (

) (110-1) public value (

) and its secret value (

) using the symmetric key (

) is created. and a second autonomous vehicle (

) 110-2 decrypts the payload portion of the packet using the generated symmetric key.

)(110-1)가 동일 서브 네트워크에 머무르는 카메라 장치(

)(110-3)와의 통신을 수행할 경우, 제1 자율주행차량(

)(110-1)은 패킷을 생성하여 송신한다(S740). In addition, the first autonomous vehicle (

) (110-1) is a camera device (

) (110-3), the first autonomous vehicle (

) 110-1 generates and transmits a packet (S740).

)(110-1)는 인터넷 서버(300)로부터 카메라 장치(

)(110-3)에 대한 공개값 및 가상 IP 주소를 수신받는다. 그 다음, 제1 자율주행차량(

)(110-1)는 수신된 카메라 장치(

)(110-3)의 공개값과 자신의 비밀값을 이용하여 대칭키(

)를 생성한다. 제1 자율주행차량(

)(110-1)는 생성된 대칭키를 이용하여 생성된 패킷의 페이로드 부분을 암호화한다. 이때, 생성된 패킷의 헤더는 [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

]의 주소 정보를 포함한다. The first autonomous vehicle (

) 110-1 is a camera device (

) receives the public value and virtual IP address for (110-3). Then, the first autonomous vehicle (

) 110-1 is the received camera device (

) using the public value of (110-3) and its own private value, the symmetric key (

) is created. The first autonomous vehicle (

) 110-1 encrypts the payload portion of the generated packet using the generated symmetric key. At this time, the header of the generated packet is [S.IP=rIP_

, D.IP= vIP_

, Op.1=

, Op.2=

] contains address information.

)(110-1)가 생성된 패킷을 카메라 장치(

)(110-3)에게 전송하면, 전송된 패킷은 카메라 장치(

)(110-3)에 도달하기 전에 해당 게이트키퍼(200)를 경유하게 된다. The first autonomous vehicle (

) (110-1) sends the generated packet to the camera device (

) (110-3), the transmitted packet is transmitted to the camera device (

) before reaching 110-3, it passes through the corresponding gatekeeper 200.

)(110-3)에게 전달한다(S750).The gatekeeper 200 verifies the received packet and changes the header of the packet. Then, the gatekeeper 200 transmits the changed packet to the camera device (

) to (110-3) (S750).

)(110-1)의 실재 IP주소 및 공개값(

)을 추출하고, 기 저장된 주소 매핑 테이블을 이용하여 제1 자율주행차량(

)(110-1)의 가상 IP 주소를 획득한다. 그리고 게이트키퍼(200)는 패킷의 헤더에 포함된 제1 자율주행차량(

)(110-1)의 실재 IP 주소를 획득한 가상 IP로 변경한다. In other words, the gatekeeper 200 is the first autonomous vehicle (

) (110-1) real IP address and public value (

) and using a pre-stored address mapping table to extract the first autonomous vehicle (

) obtains a virtual IP address of 110-1. And the gatekeeper 200 is the first autonomous vehicle (

) (110-1) changes the real IP address to the acquired virtual IP.

)(110-3)의 가상 IP주소 및 공개값(

)을 추출하고, 기 저장된 주소 매핑 테이블을 이용하여 카메라 장치(

)(110-3)의 실재 IP 주소를 획득한다. 그리고 게이트키퍼(200)는 패킷의 헤더에 포함된 카메라 장치(

)(110-3)의 가상 IP 주소를 획득한 실재 IP로 변경한다.In addition, the gatekeeper 200 includes a camera device (

) (110-3) virtual IP address and public value (

), and the camera device (

) to obtain the real IP address of (110-3). And the gatekeeper 200 is a camera device included in the header of the packet (

) (110-3) change the virtual IP address of the acquired real IP.

)(110-3)에 전달한다. 카메라 장치(

)(110-3)은 대칭키를 생성하고, 생성된 대칭키를 이용하여 수신된 패킷의 페이로드 부분을 복호화한다(S760).Then, the gatekeeper 200 transmits the changed packet to the camera device (

) to (110-3). camera device (

) 110-3 generates a symmetric key and decrypts the payload portion of the received packet using the generated symmetric key (S760).

)(110-3)는 수신된 패킷의 헤더에 포함된 옵션 1 필드로부터 제1 자율주행차량(

)(110-1)의 공개값(

)을 추출한다. 그리고, 카메라 장치(

)(110-3)는 패킷에 포함된 페이로드의 시작 부분에서 제1 자율주행차량(

)(110-1)의 공개값(

)을 추출한다. 그리고, 헤더에서 추출된 공개값(

)과 페이로드에서 추출된 공개값(

)을 상호 비교하여 두 값이 동일한지 여부를 판단한다. Specifically, the camera device (

) 110-3 represents the first autonomous vehicle (

) (110-1) public value (

) is extracted. And, the camera device (

) 110-3 is the first autonomous vehicle (

) (110-1) public value (

) is extracted. And, the public value extracted from the header (

) and the public value extracted from the payload (

) to determine whether the two values are the same.

)(110-3)는 추출된 제1 자율주행차량(

)(110-1)의 공개값(

)과 자신의 비밀값(

)을 이용하여 대칭키(

)를 생성한다. 그리고 카메라 장치(

)(110-3)는 생성된 대칭키를 이용하여 패킷의 페이로드 부분을 복호화한다. If the two values are the same as a result of comparison, the camera device (

) (110-3) is the extracted first autonomous vehicle (

) (110-1) public value (

) and its secret value (

) using the symmetric key (

) is created. and the camera device (

) 110-3 decrypts the payload portion of the packet using the generated symmetric key.

As such, the IoT communication method according to an embodiment of the present invention may implement a mobile edge computing technology. In other words, the gatekeeper 200 performs communication between the IoT devices 110-1, 110-2, and 110-3 connected to the same subnetwork by applying the MEC technology. In particular, the IoT communication method can achieve the effect of maximizing communication security and shortening data transmission by applying MEC technology in an autonomous vehicle environment.

In addition, according to an embodiment of the present invention, authentication and communication of the IoT device can be provided without using a certificate that requires a secondary certification authority or a public key algorithm that requires too much computation in the operation of the IoT device. Therefore, there is no need for security technologies such as IPSec or SSL that involve human involvement and solve authentication and security issues.

Also, according to an embodiment of the present invention, the public value of the IoT device is stored in the SDN control server or DNS AU server, and the public value of the IoT device can be secured through a query/response through the SDN control server or DNS AU server. It is safe from man-in-the-middle attack (MITM) because it can solve the mutual authentication problem in the Diffie-Hellman symmetric key exchange technology, and it can prevent the public value from being manipulated by a third party.

In addition, according to an embodiment of the present invention, all data packets are transmitted through a gatekeeper to which the sending or receiving IoT device is connected, and the gatekeeper converts the real IP address of the sending IoT device included in the packet into a virtual IP. Since it is transmitted by changing the address, it is possible to prevent the actual IP address from being exposed to the outside. In addition, when a specific IoT device is attacked from the outside, information about the purpose of the specific IoT device can be obtained through a traffic analysis attack, but the actual IP address and the externally exposed virtual IP address are different from each other, which can make traffic analysis attacks difficult.

Although the present invention has been described with reference to the embodiment shown in the drawings, which is merely exemplary, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. will be. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the following claims.

110, 120, 130, 140: IoT device
210, 220, 230, 240: Gatekeeper
300: Internet Server

Claims (19)

In the IoT security system according to the network hierarchical structure,
A plurality of IoT devices that transmit and receive packets generated while being connected to a subnetwork and generate a secret value that is not disclosed to the outside and a public value used in place of the secret value;
Generating entry information using the public values received from the plurality of IoT devices as an index, allocating the generated entry information to the plurality of IoT devices, respectively, and verifying packets received from the plurality of IoT devices a gatekeeper that changes the IP address of the IoT device included in the header of the verified packet from the real IP address to a virtual IP address and transmits it to the IoT device; and
The identification name, public value, and virtual IP address received from the plurality of IoT devices are registered, and the registered public value and virtual IP address are provided to an IoT device to communicate between the IoT device and other IoT devices. includes an Internet server that connects the communication of
The public value is
It is calculated through the following formula,

(here,

is the public value of the IoT device,

is the secret value of the IoT device. )
When the first IoT device connected to the first subnetwork transmits a packet to the second IoT device connected to the second subnetwork,
The internet server is
The public value and virtual IP address of the second IoT device are extracted by comparing the identification name of the second IoT device received from the first IoT device with previously registered information, and the extracted second IoT device is disclosed. passing the value and the virtual IP address to the first IoT device;
The first IoT device,
In the state that the public value and virtual IP address of the second IoT device are received, its own secret value (

) by substituting the symmetric key (

), and the symmetric key (

) to encrypt the application layer payload portion of the packet to be transmitted, and then transmit the encrypted packet to the second IoT device:

here,

represents the public value of the second IoT device,

denotes a secret value of the first IoT device. According to claim 1,
The IoT device is
An IoT security system including at least one of equipment, electronic devices, automatons, drones, and robots. delete According to claim 1,
the gatekeeper
An IoT security system that uses the public value received from the IoT device as an index, and stores entry information including the public value, real IP address, and virtual IP address in the form of an address mapping table. delete delete delete According to claim 1,
A first gatekeeper included in the first subnetwork,
The real IP address of the first IoT device included in the header of the packet is changed to a virtual IP address using the stored address mapping table, and the packet including the changed header is converted to a second gate to which the second IoT device is connected. Internet of Things security system that transmits to the keeper. 9. The method of claim 8,
the second gatekeeper,
Extracting the virtual IP address of the second IoT device included in the header of the received packet, changing the extracted virtual IP address of the second IoT device to the real IP address using the stored address mapping table, An IoT security system for delivering a packet including a header to the second IoT device. 10. The method of claim 9,
The second IoT device,
The public value of the first IoT device is extracted from the received packet, and the symmetric key (

) to decrypt the encrypted payload,
The symmetric key (

) is an IoT security system represented by the following equation;

here,

represents the public value of the first IoT device,

denotes a secret value of the second IoT device. 11. The method of claim 10,
The second IoT device,
extracting the public value of the first IoT device from the option field of the IP header of the received packet;
The IoT security system for extracting the public value of the first IoT device included in the beginning of the application layer payload of the received packet. According to claim 1,
The internet server is
Internet of Things security system based on Software-Defined Networking (SDN) or Domain Name System (DNS). 13. The method of claim 12,
When the software defined networking (SDN) is applied to the Internet server, P2P-based communication is performed between the first IoT device and the second IoT device,
The gatekeeper is
The session establishment is established by verifying the session establishment request packet generated from the IoT device,
When the session establishment is completed, the packet generated by the first IoT device is transmitted to the second IoT device via the second gatekeeper to which the second IoT device belongs;
An IoT security system in which the packet generated by the second IoT device is transmitted to the first IoT device via the first gatekeeper to which the first IoT device belongs. 14. The method of claim 13,
The session establishment request packet is
An IoT security system in which a payload portion of an application layer is encrypted by a symmetric key generated using the secret value of the first IoT device and the public value of the second IoT device. 13. The method of claim 12,
When the Internet server is based on the Domain Name System (DNS),
The Internet server includes a plurality of affiliated servers, and registers the domain type identification name, public value, and virtual IP address received from the IoT device in any one affiliated server among the plurality of affiliated servers, and registers the registered public domain server. An IoT security system that connects communication between an IoT device and another IoT device by providing a value and a virtual IP address to the IoT device with which it wants to communicate. 16. The method of claim 15,
When the first IoT device queries the Internet server about the public value and IP address of the second IoT device,
The internet server is
Sends a query about the public value and IP address of the second IoT device to an upper-level name server among a plurality of affiliated servers. An IoT security system that continuously performs queries and responses by transmitting it to the first IoT device. 17. The method of claim 16,
The affiliated server is
A thing that extracts the public value and virtual IP address of the second IoT device using mapping entry information registered in its database, and delivers the extracted public value and virtual IP address to the first IoT device in the form of a DNS response Internet security system. 13. The method of claim 12,
When communication is performed between a plurality of IoT devices connected to the same subnetwork, packets transmitted or received from the IoT devices pass through the same gatekeeper,
The gatekeeper is
The real IP address of the sending IoT device included in the header of the packet received from the sending IoT device is changed to a virtual IP address, the virtual IP address of the receiving IoT device is changed to the real IP address, and the changed packet is changed. An IoT security system that delivers 19. The method of claim 18,
The transmitting-side IoT device,
Generates a symmetric key by using its own secret value and the public value of the receiving-side IoT device, and encrypts the application layer payload part of the packet using the generated symmetric key,
The receiving-side IoT device,
An IoT security system that generates a symmetric key using its own secret value and the public value of the transmitting-side IoT device, and decrypts the application layer payload portion of the packet using the generated symmetric key.

Images