KR102411265B1 - Smart metering system with security function - Google Patents

Abstract

The present invention relates to a smart metering system, and in particular, a security module smart metering device that transmits a measurement target value transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process, and is provided in a collection server or configured separately By configuring the measurement data to be stored and managed by decryption in the security authentication module, information security can be strengthened to prevent exposure to various risk factors, thereby preventing personal information exposure and loss of smart metering system paralysis. It relates to a smart metering system with a security function that allows
In the smart metering system, the constituent means constituting the smart metering system with a security function according to the present invention is a measuring device that measures a measurement target value, and transmits the measurement target value through a communication network, but authentication generated through a mutual authentication process A security module smart metering device for transmitting encrypted measurement data encrypted using a key, a security authentication module for outputting decryption measurement data obtained by decrypting the encrypted measurement data using an authentication key generated through a mutual authentication process, the decryption measurement It is configured to include a collection server that collects, stores, and manages data, and the security authentication module is configured in the collection server or is configured in a server form separately from the collection server.

Description

Smart metering system with security function

The present invention relates to a smart metering system, and in particular, in a wireless communication network (LoRa, NB-IoT, WiFi, 3G/4G/5G, etc.) that transmits a measurement target value, a security module smart metering device and a security authentication module are mutually authenticated Transmitting encrypted measurement data using an authentication key generated through It relates to a smart metering system having a security function that can prevent it from becoming a security function, thereby preventing personal information exposure and loss such as smart metering system paralysis.

In general, remote meter reading refers to generating data by measuring usage in real time from a meter, and transmitting the collected data to a user through a wireless communication network. In particular, the collected measurement data provides information and services such as real-time water usage to consumers and suppliers through various analysis tools.

In order to obtain effects such as usage reduction, charge collection, supply and demand control, and energy saving using remote meter reading, continuous meter reading values must be continuously transmitted to the operating system to analyze the collected data.

A general smart metering-based remote meter reading system can measure the usage of various meters such as electricity, gas, water, hot water, and heat installed in apartment houses or offices, as well as various measuring instruments such as flow, water pressure, and water quality. It is a system that automatically reads the meter at the meter reading center, and can conveniently search and print data.

The remote meter reading system, which is introduced in Republic of Korea Patent No. 10-1779202 (hereinafter referred to as "prior art literature"), etc., is configured to include a meter, a smart metering device installed corresponding to each of the meters, a gateway, and a remote server.

The information data collected by the smart metering device for each meter is transmitted to the remote server through a wireless communication network. The remote server stores, manages, and analyzes the transmitted information data to provide various services and information.

The wireless communication network includes a plurality of repeaters or gateways. Accordingly, the information data transmitted from the smart metering device for each meter may be transmitted to the remote server through a repeater or a gateway included in the wireless communication network.

By using the smart metering-based remote meter reading system configured in this way, various data information is analyzed, and through this, the metering information data of each meter is analyzed to obtain effects such as usage reduction, charge collection, supply and demand control, and energy saving. It should be continuously transmitted to a remote server so that the collected information data can be analyzed.

However, since external network access is possible through wired/wireless connection and can be accessed with a smart metering device in each home, it can be exposed to various risk factors such as hacking, malicious code worms and viruses, thereby exposing consumers' personal information And there is a problem that losses such as industrial system paralysis may occur.

Therefore, there is a need to propose a smart metering system capable of enhancing security in addition to the data communication protocol applied in the smart metering system.

Republic of Korea Patent Registration No. 10-1779202 (Announcement Date: September 18, 2017, Title of Invention: LoRa-based remote meter reading system)

The present invention was created to solve the problems of the prior art as described above, and a security module smart metering device that transmits a measurement target value transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process, By configuring the measurement data to be stored and managed by decrypting it in the security authentication module provided in the collection server or configured separately, information security can be strengthened to prevent exposure to various risk factors, thereby preventing personal information exposure and smart metering system paralysis An object of the present invention is to provide a smart metering system equipped with a security function that can prevent the loss of etc.

In the smart metering system, the constituent means for forming a smart metering system with a security function, which is the present invention proposed to solve the above problems, is a measuring device that measures a measurement target value, and transmits the measurement target value through a communication network However, a security module smart metering device that transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process, and decrypted measurement data obtained by decrypting the encrypted measurement data using an authentication key generated through a mutual authentication process It is configured to include a security authentication module for outputting , and a collection server for collecting, storing, and managing the decryption measurement data, wherein the security authentication module is configured in the collection server or is configured in a server form separately from the collection server do.

Here, the security module smart metering device is characterized in that it includes a security module that performs a mutual authentication process with the security authentication module and generates encrypted measurement data using an authentication key generated through the mutual authentication process.

Here, in the mutual authentication process, the pre-master key is injected when the security module is manufactured in the form of a chip, and after the security module is mounted on the security module smart metering device, the security module is connected to the security authentication module and the pre-master key. The master key generated through mutual authentication by the master key is injected, stored and managed, and in order to generate the encrypted measurement data, the security module generates a session key generated through mutual authentication by the security authentication module and the master key. It is characterized in that it is a process of receiving and storing and managing the injection.

Here, the security module includes a first authentication unit that performs the mutual authentication process and stores and manages the master key and the session key, and an encryption unit that encrypts the measurement target value using the session key to generate encrypted measurement data , a counter unit for counting the number of times of use of the session key, wherein when the number of uses counted by the counter unit exceeds a set value, the session key stored and managed by the first authentication unit is discarded and the mutual information is transmitted through the first authentication unit After the authentication process is re-performed to generate a new session key, the first authentication unit is characterized in that it is controlled to be newly stored and managed.

In addition, the security authentication module enables the security module to perform a mutual authentication process, injects the master key and the session key into the security module through a mutual authentication process, and stores the master key and the session key and a decryption unit configured to generate decryption measurement data by using the session key after receiving the encrypted measurement data generated by the second authentication unit and the security module to decrypt the encrypted measurement data.

In addition, further comprising a general smart metering device for transmitting the measurement target value through a communication network, the measurement target value transmitted from the general smart metering device is not input to the security authentication module directly to the collection unit of the collection server It is characterized in that it is input and stored and managed.

According to the smart metering system having a security function of the present invention having the above problems and solutions, the security module smart metering device that transmits the measurement target value encrypts the encryption using the authentication key generated through the mutual authentication process. Since the measurement data is configured to be stored and managed by transmitting the data and decrypting it in the security authentication module provided or separately configured in the collection server, it is possible to prevent exposure to various risk factors by strengthening information security, thereby exposing personal information And the advantage of being able to prevent losses such as paralysis of the smart metering system is generated.

1 is a block diagram of a smart metering system having a security function according to an embodiment of the present invention.
2 is a block diagram of a security module smart metering device constituting a smart metering system having a security function according to an embodiment of the present invention.
3 is a block diagram of a security module provided in a security module smart metering device constituting a smart metering system having a security function according to an embodiment of the present invention.
4 is a block diagram of a collection server and a security authentication module constituting a smart metering system with a security function according to an embodiment of the present invention.
5 is a flowchart for explaining a key issuance and mutual authentication process performed through a smart metering system having a security function according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of the present invention, a smart metering system having a security function, having the above problems, solutions and effects will be described in detail.

Since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. Effects and features of the present invention, and a method for achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various forms.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when described with reference to the drawings, the same or corresponding components are given the same reference numerals, and the overlapping description thereof will be omitted. .

In the following embodiments, terms such as include or have means that the features or components described in the specification are present, and the possibility that one or more other features or components will be added is not excluded in advance.

In the drawings, the size of the components may be exaggerated or reduced for convenience of description. For example, since the size and thickness of each component shown in the drawings are arbitrarily indicated for convenience of description, the present invention is not necessarily limited to the illustrated bar.

In cases where certain embodiments may be implemented differently, a specific order of operations may be performed differently from the described order. For example, two operations described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the described order.

1 is a block diagram of a smart metering system having a security function according to an embodiment of the present invention, and FIG. 2 is a security module smart metering device constituting a smart metering system having a security function according to an embodiment of the present invention. 3 is a block diagram of a security module provided in a security module smart metering device constituting a smart metering system with a security function according to an embodiment of the present invention, and FIG. 4 is an embodiment of the present invention It is a configuration block diagram of a collection server and a security authentication module constituting a smart metering system with a security function according to an example.

As shown in FIG. 1 , the smart metering system 100 having a security function according to an embodiment of the present invention includes a measuring device 10 for measuring a measurement target value, and a communication network 80 for the measurement target value. However, the security module smart metering device 30 for transmitting encrypted measurement data encrypted using an authentication key generated through a mutual authentication process, and decrypts the encryption measurement data using an authentication key generated through a mutual authentication process It is configured to include a security authentication module 50 that outputs one decryption measurement data, and a collection server 70 that collects, stores, and manages the decryption measurement data, and the security authentication module 50 is located in the collection server 70 . It is configured or configured in the form of a server separately from the collection server 70 .

The measuring device 10 may be applied in various ways as long as it can acquire various measurement target values to be collected by the collection server 70 . For example, the measuring device 10 may be variously applied to a meter installed in a pipe network such as a household watt-hour meter, a gas meter, a water meter, and the like to measure flow data, water pressure data, water quality data, and the like.

The measurement target value measured by the measuring device 10 is encrypted in the security module smart metering device 30 and transmitted to the collection server 70 or the security authentication module 50 through the communication network 80 . Specifically, the security module smart metering device 30 transmits the measurement target value through the communication network 80, but transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process.

The security module smart metering device 30 generates, stores and manages an authentication key through a mutual authentication process, and encrypts a measurement target value to be transmitted thereafter using the authentication key, and generates encrypted measurement data for security module smart metering It enables transmission by the first communication unit 36 constituting the device 30 .

More specifically, in the prior art, the measurement target value was processed according to a specific communication and encryption standard, for example, AES128 in the first communication unit 36, and then transmitted to the collection module 70 through the communication network 80. , in the present invention, after the measurement target value is encrypted using an authentication key generated through a mutual authentication process, the first communication unit 36 re-encrypts it according to a specific communication and encryption standard, and then the communication network 80 ) is transmitted through As a result, since the measurement target value is transmitted with double encryption, a very strong security state can be maintained.

A detailed configuration of the security module smart metering device 30 and a method of generating an authentication key through the mutual authentication process and the mutual authentication process will be described later.

Data communication between the security module smart metering device 30 and the collection server 70 or the security authentication module 50 is made through the communication network 80 . The communication network 80 encrypts the measurement target value from the security module smart metering device 30 (and general smart metering device 20) to the collection server 70 or the security authentication module 50 Any one of various wired or wireless communication networks can be applied if measurement data or unencrypted measurement target values can be easily transmitted. For example, when the communication network 80 is configured as a wireless communication network, at least one of various communication networks such as LoRa, IoT, LTE, 5G, and WiFi may be selected and applied.

The encryption measurement data transmitted through the communication network 80 is transmitted to the collection server 70 or the security authentication module 50 . The security authentication module 50 may be configured as one component in the collection server 70 , that is, in the collection server 70 , or may be configured in the form of a server separately from the collection server 70 . However, in any case, the encryption measurement data must go through a process of being decrypted in the security authentication module 50 .

The security authentication module 50 outputs decryption measurement data obtained by decrypting the encryption measurement data using an authentication key generated through a mutual authentication process. Then, the decryption measurement data may be stored and managed in the collection unit 73 of the collection server 70, further monitored, and utilized as data for generating various analysis data by various analysis methods.

The security authentication module 50 generates, stores and manages an authentication key through a mutual authentication process, and then decrypts the received encryption measurement data using the authentication key, generates decryption measurement data, and the collection unit 73 ) to be stored and managed.

The encryption measurement data transmitted through the communication network 80 is decrypted using an authentication key generated through a mutual authentication process in the security authentication module 50, but, in more detail, to the second communication unit 71 It is input and is transmitted to the security authentication module 50 after being decrypted according to the specific communication and encryption standard (eg, AES128). That is, the data transmitted to the security authentication module 50 corresponds to the encrypted measurement data encrypted in the security module 40 of the security module smart metering device 30, and the security authentication module 50 is also the same The encryption measurement data is decrypted using the authentication key generated through the mutual authentication process to output the decryption measurement data.

More specifically, in the prior art, after the measurement target value transmitted through the communication network 80 is processed according to a specific communication and encryption standard, for example, AES128 in the second communication unit 71, the collection module 70 ), but in the present invention, the data transmitted through the communication network 80 is decrypted according to a specific communication and encryption standard in the second communication unit 71, and the data generated by the decryption processing After the encryption measurement data is decrypted using an authentication key generated through a mutual authentication process in the security authentication module 50 , it is stored and managed in the collection unit 73 . As a result, the measurement target value can be transmitted and received while maintaining a very strong security state because it is transmitted after being encrypted twice, and stored and managed after being decrypted twice.

As will be described later, when the security authentication module 50 is configured as a separate server, the second communication unit 71 needs to be provided in the security authentication module 50 as well, and the security authentication module 50 is the When provided in the collection server 70, it is provided in the configuration of the collection server 70.

The decryption measurement data that is decrypted and output by the security authentication module 50 is transmitted to the collection server 70, specifically, the collection unit 73, and stored and managed. That is, the collection server 70 collects, stores and manages the decryption measurement data in the collection unit 73 , and enables additional monitoring and various analysis.

As described above, the security module smart metering device 30 generates decryption measurement data using an authentication key generated through a mutual authentication process. For this purpose, as shown in FIG. 2 , the security module 40 It consists of more Specifically, the security module smart metering device 30 performs a mutual authentication process with the security authentication module 50 and a security module 40 for generating encrypted measurement data using an authentication key generated through the mutual authentication process. includes

Hereinafter, a detailed configuration of the security module smart metering device 30 including the security module 40 will be described with reference to FIG. 2 .

As shown in FIG. 2, the security module smart metering device 30 applied to the present invention is an interface connected to the control unit 31 for controlling the overall operation and communication of the security module smart metering device, and the corresponding measuring device 10 (32), a storage 38 for storing information data (data including a measurement target value) about the measuring device 10 collected under the control of the control unit 31; The first communication unit 36, the security module smart, which transmits the measurement target value related to the collected measuring instrument 10 to the collection server 70 or the security authentication module 50 after being encrypted through the security module 40 Performing a mutual authentication process with the power supply unit 37 and the security authentication module 50 for supplying power necessary for the overall operation and communication of the metering device 30, and using the authentication key generated through the mutual authentication process to measure the and a security module 40 for generating encrypted measurement data by encrypting the target value.

The interface 32 is connected to the measuring device 10 so that measurement target values (power amount, flow rate, hydraulic pressure, water consumption, etc.) related to the measuring device 10 are measured and collected under the control of the control unit 31 . . The interface 32 is connected to the corresponding measuring device 10 through RS232 or RS485 so that the measurement target value related to the measuring device 10 is read.

Here, the measurement target value for the measuring device 10 includes measurement data (water quality-related data, flow rate data, water pressure data, etc.) of the measuring device 10, as well as measuring device unique information that can identify the measuring device 10. In addition, it is preferable to further include data of the state information (failure, power state, etc.) of the measuring device 10 .

The control unit 31 performs an operation of controlling the measurement target value of the measuring device 10 to be collected through the interface 32 . That is, the control unit 31 collects measurement target values related to the corresponding measuring device 10 by reading the measurement data of the measuring device 10 through the interface 32 in real time or every set collection period.

The control unit 32 controls the collected measurement target values for the measuring device 10 to be stored in the storage 38 . That is, the storage 38 performs an operation of storing the measurement target value with respect to the measuring device 50 under the control of the controller 31 . The storage 38 may be composed of an SD card, and the storage 38 composed of the SD card stores various information such as unique information, measurement data, power information and status of the security module smart metering device 30 . do.

The measurement target value for the measuring device 10 stored in the storage 38 is encrypted by the security module 40 under the control of the control unit 31 and then through the first communication unit 76 . It may be transmitted to the collection server 70 or the security authentication module 50 . That is, the first communication unit 36 transmits the encrypted measurement data in which the measurement target value is encrypted by the security module 40 to the collection server 70 or the security authentication module 50 .

That is, the security module 40 encrypts the measurement target value using an authentication key under the control of the control unit 31 and encrypts the encrypted measurement data through the first communication unit 36 to the collection server 70 or An operation of transmitting to the security authentication module 50 is performed. A detailed description thereof will be given later.

The first communication unit 36 collects the measurement target value related to the measuring device 10 stored in the storage 78 under the control of the control unit 31 after being encrypted by the security module 40 . It may be transmitted to the server 70 or the security authentication module 50, and in some cases, the measurement target value for the measuring device 10 collected through the interface 32 under the control of the controller 31 is the Without being stored in the storage 38, it can be directly encrypted by the security module 40 and then transmitted to the collection server 70 or the security authentication module 50. However, even in the latter case, it is preferable that the data is eventually stored in the storage 38 . The reason is to perform retransmission of the measurement target value with respect to the measuring device 10 when a transmission failure of the measurement target value with respect to the measuring device 10 occurs.

As a result, the control unit 31 determines that, according to a setting method, the measurement target value for the measuring device 10 collected in advance through the interface 32 and stored in the storage 38 is transferred from the security module 40 . After being encrypted, it can be controlled so that it can be transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36, and to the measuring instrument 10 collected through the interface 32 The measurement target value is not stored in the storage 38 but is encrypted in the security module 40 and immediately transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36. You can also control it so that Of course, as described above, even in the latter case, when the transmission of the measurement target value with respect to the measuring device 10 fails, in order to perform retransmission of the measurement target value with respect to the measuring device 10, eventually the storage 38 It is preferable to store it in

The first communication unit 36 may be configured to be applicable to various wired or wireless communication methods. For example, when using a wireless communication method, the first communication unit 36 is configured such that at least one of 3G, LTE, LTE-Cat.M1, 5G, LoRa, NB-IoT, and other various wireless communication methods is applicable. can be configured. Therefore, the control unit 31 uses at least one of communication methods such as LoRa, NB-IoT, WiFi, 3G/4G/5G, etc. through the first communication unit 36 to measure the measurement target value for the measuring device 10 . It can be transmitted to the collection server 70 or the security authentication module (50). However, it is preferable that at least one of communication methods such as LoRa, NB-IoT, WiFi, and 3G/4G/5G is preferentially applied.

Power needs to be supplied for the operation of the interface 32 including the control unit 31 , the storage 38 , and the first communication unit 36 , which is accomplished by the power supply unit 37 . That is, the power supply unit 37 performs an operation of supplying power for individual operations, linkage operations, and communication operations of the control unit 31 , the interface 32 , the storage 38 , and the first communication unit 36 .

The power supply unit 37 can adopt and apply DC 12V to 24V power, and the state information of the power supply unit, specifically, whether the power supply is faulty or whether the power is normally supplied, is detected in real time or periodically by the control unit 31 . That is, the control unit 31 transmits the state information of the power supply unit 37 to the collection server 70 or the security authentication module 50 through the first communication unit 36 . The control unit 31 transmits the state information of the power supply unit when transmitting the measurement target value regarding the measuring device 10 to the collection server 70 or the security authentication module 50 through the first communication unit 36 . It is desirable to minimize power consumption. Here, the state information of the power supply unit is also encrypted by the security module 40 together with the measurement target value and then transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36. can

On the other hand, the security module smart metering device 30 according to the present invention is configured to further include a display unit 35 and a memory 33 as shown in FIG. 2 . The display unit 35 performs an operation of displaying the measurement target value related to the collected measuring device 10 under the control of the control unit 31, and the memory 33 is an internal memory of the control unit 31, The security module performs an operation of storing the firmware required for the operation of the smart metering device (30).

The display unit 35 is composed of an LCD to display a measurement target value related to the measuring device 10, specifically measurement data of the measuring device 10, status information of the measuring device 10, etc. according to the control of the control unit 31, and , furthermore, according to the control of the control unit 31, the state of the security module smart metering device 30 (unique information of the security module smart metering device 30, the temperature of the security module smart metering device 30, the state of the power supply, firmware version, etc.).

The memory 33 is composed of SDRAM, and stores firmware required for the operation of the security module smart metering device 30 . The firmware stored in the memory 33 is updated as necessary. The firmware stored in the memory 33 may be updated by wire or wirelessly. The firmware stored in the memory 33 may be updated by wire through a TTL232 port provided in the security module smart metering device, etc., and by adding a BLE communication function to the first communication unit 36, FOTA (Firmware Over- It can also be updated over-the-air through The-Air) function.

On the other hand, it is preferable that the security module smart metering device 30 according to the present invention is further provided with various environmental sensors such as a temperature sensor and a humidity sensor, and the control unit 31 transmits the detection data of the environmental sensors to the measuring device ( After the measurement target value for 10) is encrypted together by the security module 40 , it can be transmitted together when transmitted to the collection server 70 or the security authentication module 50 .

The control unit 31 applied to the present invention encrypts the measurement target value with respect to the measuring device 10 through the security module 40 in order to minimize power consumption, and then the collection server 70 or the security authentication module 50 ), it is preferable to transmit information data that needs to be transmitted separately (detection data of environmental sensors, state information data of the power supply unit, state information data of the security module smart metering device 30, etc.) together.

The control unit 31 according to the present invention continuously stores the measurement target value for the measuring device 10 so that the collection server 70 stores, manages, and analyzes the measurement target value for each measuring device 10 . After being collected and encrypted by the security module 40, it is controlled so that it can be continuously transmitted.

As described above, the measurement target value and various information data are encrypted through the security module 40 under the control of the control unit 31 to be encrypted measurement data through the first communication unit 36 through the collection server ( 70) or the security authentication module 50 .

To this end, the security module 40 performs a mutual authentication process with the security authentication module 50 and encrypts the measurement target value and various information data using an authentication key generated through the mutual authentication process to encrypt measurement data operation to create The encrypted measurement data encrypted and output by the security module 40 is transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36 .

In this way, the security module 40 encrypts the measurement target value using an authentication key, and the authentication key is generated by performing a mutual authentication process with the security authentication module 50 . The security module 40 performs a mutual authentication process with the security authentication module 50 to generate the authentication key.

The mutual authentication process receives a pre-master key when the security module 40 is manufactured in a chip form, and after the security module 40 is mounted on the security module smart metering device 30, the security module ( 40) receives, stores and manages the master key generated through mutual authentication by the security authentication module 50 and the free master key, and the security module 40 performs the security authentication to generate the encrypted measurement data It is a process of receiving, storing and managing a session key generated through mutual authentication by the module 50 and the master key.

Specifically, the security module 40 is manufactured in the form of a chip before being mounted on the security module smart metering device 30 , and at this time, the pre-master key is injected into the security module 40 . The pre-master key is issued in advance, injected into the security module 40, and stored and managed in the security authentication module 50 at the same time. This process is called the primary issuance and certification process.

The first issuance and authentication process will be described in more detail with reference to FIG. 5 . First, the operating institution issues a pre-issuing key and transmits the pre-issuing key to the issuing institution and the authentication server. Here, the issuing agency corresponds to a company that manufactures the chip-type security module 40 , and the authentication server corresponds to the security authentication module 50 or the collection server 70 having the security authentication module 50 . Also, here, the operating institution may be a local government that operates a smart metering system, or may be a company or institution entrusted with operation.

The personalization agent that has received the pre-issuing key stores the pre-issuing key in the issuer and derives the pre-issuing key through this. Then, after performing mutual authentication with the default key in the security module 40, the pre-master key is transferred to the security module 40 to be injected. The pre-master key is injected into the chip-type security module 40 through this primary issuance process.

On the other hand, the pre-issuing key delivered to the authentication server, specifically the security authentication module 50 or the collection server 70 having the security authentication module 50, is used for issuing and injecting the master key later. Generates a free master key to be used. That is, the authentication server uses the pre-issuing key to derive a pre-master key, and then uses it for mutual authentication later.

When the primary issuance and authentication process is completed, an additional issuance and authentication process, that is, the secondary issuance and authentication process, is performed thereafter.

Specifically, the chip-type security module 40 is mounted on the security module smart metering device 30 . At this time, it is necessary to check whether the security module 40 mounted on the security module smart metering device 30 corresponds to a permitted or authorized chip. That is, the security module 40 needs to verify whether it corresponds to a trusted chip authorized or permitted or requested by the manufacturer or management organization of the security module smart metering device 40, and injects the master key through the verification Needs to be.

To this end, after the security module 40 to which the pre-master key is injected is mounted on the security module smart metering device 30, the security module 40 is injected with the security authentication module 50 in advance Mutual authentication is performed using the pre-master key, and the master key generated through this mutual authentication is injected and stored and managed. The master key is issued in advance and stored and managed in the security authentication module 50, and when the security module 40 is authenticated as a reliable chip through a mutual authentication process using the pre-master key, the master key is the It is delivered to the security module 40 and injected.

The secondary issuance and authentication process will be described in more detail with reference to FIG. 5 as follows.

The security module 40 mounted on the security module smart metering device 30 is injected with a free master key for mutual authentication, stored and managed, and the authentication server, that is, the security authentication module 50 or having the same The collection server 70 also derives and stores and manages the free master key.

The operating organization issues an issuing key in advance and transmits it to the authentication server, that is, the security authentication module 50 or the collection server 70 having the same. Then, the authentication server derives a master key through the issuing key. The authentication server, that is, the security authentication module 50 or the collection server 70 having the same performs mutual authentication using the security module smart metering device 30 and the free master key having the security module 40. carry out When the mutual authentication is completed, the authentication server, that is, the security authentication module 50 or the collection server 70 having the same, transmits the derived master key to the security module smart metering device having the security module 40 ( 30), so that the master key is injected into the security module 40.

In this way, through the additional issuance and authentication process, that is, the secondary issuance and authentication process, the security authentication module 50 and the security module 40 store and manage the same master key, that is, a symmetric key. In this way, since the security module 40 stores and manages the same master key as the security authentication module 50, after performing mutual authentication with the security authentication module 50 using the master key, the security The session key used for the enhanced data transmission/reception, ie, encryption of the measurement target value, may be injected. Such a process is referred to as an authentication and session key generation process.

The security module 40 encrypts the measurement target value under the control of the controller 31 to generate encrypted measurement data. To this end, the security module 40 must be issued a session key, which can be automatically generated and injected through a mutual authentication process with the security authentication module 50 using the master key. That is, in order to generate the encrypted measurement data, the security module 40 may receive and store and manage a session key generated through mutual authentication by the security authentication module 50 and the master key.

When the security module 40 receives the session key through mutual authentication with the security authentication module 50, the security module 40 encrypts the measurement target value using the session key to obtain encrypted measurement data. can create The encrypted measurement data may be transmitted to the collection server 70 or the authentication server 50 through the first communication unit 36 under the control of the control unit 31 . As described above, the encrypted measurement data may be transmitted after being encrypted again according to a specific communication and encryption standard through the first communication unit 36 .

When the authentication and session key generation process is described in more detail with reference to the attached FIG. 5 , the security module smart metering device 30 including the security authentication module 50 and the security module 40 is derived and Mutual authentication is performed using the stored and managed master key, and the session key is automatically generated through the mutual authentication process, and the automatically generated session key is the security authentication module 50 and the security module 40. is injected and stored and managed. Thereafter, the security module smart metering device 30 including the security authentication module 50 and the security module 40 may perform encrypted communication using the session key.

In this way, the security module 40 performs mutual authentication with the security authentication module 50 and encrypts the measurement target value using the session key issued through the mutual authentication. A detailed configuration of the security module 40 for performing such an operation is as shown in FIG. 3 .

As shown in FIG. 3 , the security module 40 includes a first authentication unit 41 , an encryption unit 43 , and a counter unit 45 .

The first authentication unit 41 performs the mutual authentication process and stores and manages the master key and the session key. That is, the first authentication unit 41 performs a mutual authentication process with the security authentication module 50 , specifically, the second authentication unit 51 as shown in FIG. 4 .

Specifically, the first authentication unit 41 stores and manages the pre-master key injected while the security module 40 is manufactured in the form of a chip. Thereafter, a mutual authentication process is performed through the second authentication unit 51 and the communication network 80 to receive and store and manage the master key. That is, a mutual authentication process is performed using the stored and managed free master key, and the master key is received from the second authentication unit 51 through authentication and stored and managed. When the first authentication unit 41 receives the master key from the second authentication unit 51 through mutual authentication, the first authentication unit 41 discards the free master key and stores and manages only the master key.

The first authentication unit 41 also automatically receives a session key used when the encryption unit 43 encrypts the measurement target value through mutual authentication with the second authentication unit 51 . That is, the first authentication unit 41 performs a mutual authentication process with the second authentication unit 51 using the stored and managed master key, and receives the session key from the second authentication unit 51 through authentication. is delivered and stored and managed.

When the session key is generated and stored and managed, the encryption unit 43 may encrypt the measurement target value using the session key. The encryption unit 43 may perform an operation of generating encrypted measurement data by encrypting the measurement target value using the session key. That is, when the encryption unit 43 encrypts the measurement target value under the control of the control unit 31, it encrypts the encrypted measurement data by using the session key stored and managed in the first authentication unit 41. generated and output to the first communication unit 36 . Then, the first communication unit 36 may re-encrypt the encryption measurement data according to a specific communication and encryption standard as described above and transmit it through the communication network 80 .

The session key stored and managed in the first authentication unit 41 needs to be updated to enhance security. To this end, the security module 40 according to the present invention is configured to include a counter 45 for counting the number of times the session key is used. Each time the session key is used by the encryption unit 43, the counter 45 counts to increase the number of uses, and if it exceeds a set reference set value thereafter, the existing session key whose number of uses has exceeded is returned. It is discarded and updated with a new session key.

That is, the security module 40 according to the present invention includes a counter 45 for counting the number of times the session key is used. The session key stored and managed in the authentication unit 41 is discarded and the mutual authentication process is re-performed through the first authentication unit 41 to generate a new session key and then newly stored in the first authentication unit 41 control to be managed.

More specifically, when the number of times the session key is used exceeds a preset value, the security module 40 controls the existing session key stored and managed in the first authentication unit 41 to be discarded. In addition, the security module 40 is configured such that the first authentication unit 41 re-performs mutual authentication with the second authentication unit 51 to receive a new session key and to store and manage the renewed new session key. do. Since the first authentication unit 41 still stores and manages the master key, a new session key may be automatically generated by performing mutual authentication with the second authentication unit 51 using the master key.

The security module 40 performs mutual authentication with the security authentication module 40 provided in the collection server 70 or configured in the form of a separate server, and transmits and receives data.

4 illustrates that the security authentication module 50 is provided in the collection server 70, in some cases, the security authentication module 50 is configured in the form of a separate server, and the collection server 70 It can be connected to and transmit the decrypted data, that is, the decryption measurement data, to the collection server 70 to be stored and managed.

In FIG. 4, the second communication unit 71 is exemplified as being provided in the collection server 70, but when the security authentication module 50 is configured in a separate server form, the security authentication module 50 is the second It is preferable to include a communication unit 71 .

The security authentication module 50 basically includes a second authentication unit 51 and a decryption unit 53 .

The second authentication unit 51 enables the security module 40 to perform a mutual authentication process, injects the master key and the session key into the security module 40 through the mutual authentication process, and An operation of storing and managing the master key and the session key is performed.

Specifically, the second authentication unit 51 performs a mutual authentication process when the first authentication unit 41 receives a request for mutual authentication using the free master key, and converts the master key, which is a symmetric key, to the first authentication unit ( 41) for injection. Accordingly, the second authentication unit 51 also stores and manages the pre-master key until the master key is injected into the first authentication unit 41, and mutual authentication is performed using the pre-master key, and the first authentication unit When the master key is injected in (41), the free master key is discarded.

The second authentication unit 51 also performs mutual authentication using the master key when the first authentication unit 41 makes a request for mutual authentication using the master key. to allow it to be created. The second authentication unit 51 also stores and manages the master key and the session key in order to perform mutual authentication and encryption/decryption data communication.

When the session key is generated and stored and managed in the second authentication unit 51 , the decryption unit 53 may decrypt the encrypted measurement data transmitted through the second communication unit 71 . That is, after receiving the encryption measurement data generated by the security module 40, the decryption unit 53 decrypts the encryption measurement data using the session key to generate decryption measurement data. .

That is, the decryption unit 53 transmits the encrypted measurement data transmitted by the first communication unit 36 after being encrypted by the security module 40, specifically, the encryption unit 43 to the second communication unit ( 71), the encrypted measurement data is decrypted using the session key stored and managed in the second authentication unit 51, and decrypted measurement data is generated and output. Then, the decryption measurement data is transferred to the collection unit 73 of the collection server 70 and stored and managed.

As described above, the second communication unit 71 re-encrypts the encryption specific data according to a specific communication and encryption standard by the first communication unit 36 and is double-encrypted and then transmitted, the specific communication and encryption Decrypts the received data according to the standard. Then, the encrypted encrypted measurement data is output to the encryption unit 43 , which is transmitted to the decryption unit 53 to be decrypted. Then, decryption measurement data is generated, which is transmitted to the collection unit 73 and stored and managed. The decoded measurement data corresponds to the measurement target value.

In this way, the security authentication module 50 decrypts the encrypted measurement data encrypted and transmitted by the security module 40, so that the decrypted measurement data, that is, the measurement target value, can be stored and managed in the collection unit 73 . do. That is, the security module smart metering device 30 includes a security module 40 to encrypt and transmit the measurement target value, and decrypts it in the security authentication module 50 to collect the collection unit 73 of the collection server 70 . ) to be stored and managed.

However, in some cases, unencrypted data, that is, a measurement target value, may be transmitted from a device on which the security module 40 is not mounted, that is, the general smart metering device 20 , and transmitted to the collection server 70 . In this case, it is preferable that the measurement target value is directly transferred to the collection unit 73 of the collection server 70 and stored and managed without the need to be transmitted to the security authentication module 50 .

That is, the smart metering system 100 having a security function according to the present invention further includes a general smart metering device 20 that directly transmits the measurement target value through a communication network, as shown in FIG. 1 , The measurement target value transmitted from the general smart metering device 20 is not input to the security authentication module 50 but is directly input to the collection unit 73 of the collection server 70 and stored and managed.

The general smart metering device 20 has the same configuration except for the security module 40 among the configurations of the security module smart metering device 30 described above. That is, the general smart metering device 20 does not encrypt the measurement target value, but only performs encryption according to a specific communication and encryption standard by the first communication unit 36 and then through the communication network 80 the collection server (70). Then, the second communication unit 71 decrypts the measurement target value according to a specific communication and encryption standard, and does not transmit it to the security authentication module 50, but is directly transmitted to the collection unit 73 to be stored and managed. .

That is, the smart metering system 100 having a security function according to the present invention collects the measurement target value transmitted without encryption from the existing general smart metering device that is not equipped with the security module 40, that is, the general smart metering device. It is received from the server 70 so that it can be stored and managed.

Although the embodiments according to the present invention have been described above, these are merely exemplary, and those of ordinary skill in the art will understand that various modifications and equivalent ranges of embodiments are possible therefrom. Accordingly, the true technical protection scope of the present invention should be defined by the following claims.

10: measuring instrument
20: general smart metering device
30: security module smart metering device
31: display
32: interface 33: memory
35: display unit 36: first communication unit
37: power unit 38: storage
40: security module 41: first authentication unit
43: encryption unit 45: counter unit
50: security authentication module 51: second authentication unit
53: decryption unit 70: collection server
71: second communication unit 73: collection unit
80: communication network
100: smart metering system with security function

Claims (6)

In the smart metering system,
a measuring instrument for measuring the measurement target value; a security module smart metering device that transmits the measurement target value through a communication network, but transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process; a security authentication module for outputting decrypted measurement data obtained by decrypting the encrypted measurement data using an authentication key generated through a mutual authentication process; It is configured to include a collection server that collects, stores and manages the decryption measurement data,
The security authentication module is configured in the collection server,
The security module smart metering device includes a security module that performs a mutual authentication process with the security authentication module and generates encrypted measurement data using an authentication key generated through the mutual authentication process,
In the mutual authentication process, when the security module is manufactured in the form of a chip, a pre-master key is injected, and after the security module is mounted on the security module smart metering device, the security module connects the security authentication module and the pre-master A master key generated through mutual authentication by a key is injected, stored and managed, and the security module injects a session key generated through mutual authentication by the security authentication module and the master key in order to generate the encryption measurement data It is a process of receiving, storing and managing
The security module includes: a first authentication unit that performs the mutual authentication process and stores and manages the master key and the session key; an encryption unit that encrypts the measurement target value using the session key to generate encrypted measurement data; A counter unit for counting the number of times the session key is used, wherein when the number of uses counted by the counter unit exceeds a set value, the session key stored and managed in the first authentication unit is discarded and the mutual authentication process is performed through the first authentication unit After this is performed again to generate a new session key, control so that the first authentication unit is newly stored and managed,
The security authentication module enables the security module to perform a mutual authentication process, injects the master key and the session key into the security module through a mutual authentication process, and stores and manages the master key and the session key A second authentication unit, after receiving the encrypted measurement data generated by the security module, includes a decryption unit that decrypts the encrypted measurement data using the session key to generate decryption measurement data,
Further comprising a general smart metering device for transmitting the measurement target value through a communication network, the measurement target value transmitted from the general smart metering device is directly input to the collection unit of the collection server without being input to the security authentication module stored and managed,
The security module smart metering device includes a control unit that controls the overall operation and communication of the security module smart metering device, an interface connected to a corresponding measuring device, a storage for storing measurement target values related to the measuring device collected under the control of the control unit, and the A first communication unit that transmits to the security authentication module after the measurement target value for the collected measuring device is encrypted through the security module under the control of the control unit, the security module supplies power necessary for the overall operation and communication of the smart metering device and a security module that performs a mutual authentication process with the power supply unit and the security authentication module and encrypts the measurement target value using an authentication key generated through the mutual authentication process to generate encrypted measurement data,
Here, the control unit detects the state information of the power supply unit, and controls the state information of the power supply unit to be encrypted by the security module together with the measurement target value,
The security module smart metering device is configured to further include environmental sensors including a temperature sensor and a humidity sensor, and the control unit controls the detection data of the environmental sensors to be encrypted by the security module together with the measurement target value,
The control unit controls so that the encrypted measurement data encrypted by the security module is encrypted again according to AES128 by the first communication unit and transmitted to the second communication unit of the collection server,
The second communication unit of the collection server decrypts the data received from the first communication unit according to AES128 to output encrypted measurement data, and the decryption unit of the security authentication module decrypts the encrypted measurement data again to collect the collection server A smart metering system with a security function, characterized in that it is delivered to the department and stored and managed.
delete delete delete delete delete

Images