KR102428829B1 - Remote meter reading system with security module applied - Google Patents

Abstract

Disclosed is a remote meter reading system applied with a security module. According to an embodiment of the present disclosure, the remote meter reading system applied with a security module, comprises: a measuring device for measuring a value to be measured; a security module smart metering device for transmitting encrypted measurement data obtained by encrypting a measurement value acquired through the measuring device using an authentication key generated through an interactive authentication process; a security authentication module for outputting decryption measurement data obtained by decrypting the encrypted measurement data using the authentication key generated through the interactive authentication process; and a collection server for collecting, storing, and managing decrypted measurement data. The security authentication module is configured in the collection server or configured in a form of a server separately from the collection server. Therefore, battery consumption can be reduced.

Description

Remote meter reading system with security module applied {REMOTE METER READING SYSTEM WITH SECURITY MODULE APPLIED}

The present invention relates to a remote meter reading system to which a security module is applied, and in particular, a security module smart metering device and a security authentication module in a wireless communication network (LoRa, NB-IoT, WiFi, 3G/4G/5G, etc.) that transmits a measurement target value. By transmitting the encrypted measurement data encrypted using the authentication key generated through this mutual authentication process and the existing measurement value and decrypting it in the security authentication module provided in the collection server or separately configured so that the measurement data is stored and managed, information It is possible to prevent exposure to various risk factors by strengthening security, and has a security function to prevent loss such as personal information exposure and smart metering system paralysis. , it relates to a remote meter reading system with a security module that can save battery consumption by not going through an encryption procedure.

In general, remote meter reading refers to generating data by measuring usage in real time from a meter, and transmitting the collected data to a user through a wireless communication network. In particular, the collected measurement data provides information and services such as real-time water usage to consumers and suppliers through various analysis tools.

In order to obtain effects such as usage reduction, charge collection, supply and demand control, and energy saving using remote meter reading, continuous meter reading values must be continuously transmitted to the operating system to analyze the collected data.

A general smart metering-based remote meter reading system can measure the usage of various meters such as electricity, gas, water, hot water, and heat installed in apartment houses or offices, as well as various measuring instruments such as flow rate, water pressure, and water quality. It is a system that automatically reads the meter at the meter reading center and allows convenient data search and output.

The remote meter reading system introduced in Republic of Korea Patent No. 10-1779202 (hereinafter referred to as "prior art literature") and the like is configured to include a meter, a smart metering device installed corresponding to each of the meters, a gateway, and a remote server.

The information data collected by the smart metering device for each meter is transmitted to the remote server through a wireless communication network. The remote server stores, manages, and analyzes the transmitted information data to provide various services and information.

The wireless communication network includes a plurality of repeaters or gateways. Accordingly, the information data transmitted from the smart metering device for each meter may be transmitted to the remote server through a repeater or a gateway included in the wireless communication network.

By using the smart metering-based remote meter reading system configured in this way, various data information is analyzed, and through this, the metering information data of each meter is analyzed in order to obtain effects such as usage reduction, charge collection, supply and demand control, and energy saving. It should be continuously transmitted to the remote server so that the collected information data can be analyzed.

However, since external network access is possible through wired/wireless connections, it can be accessed with a smart metering device in each home, so it can be exposed to various risk factors such as hacking, malicious code worms and viruses, which exposes consumers' personal information And there is a problem that losses such as industrial system paralysis may occur.

Therefore, there is a need to propose a remote meter reading system to which a security module capable of enhancing security is applied in addition to the data communication protocol applied in the smart metering system.

In addition, due to the characteristics of a smart metering system that performs meter reading at a remote location using a limited battery capacity, it is necessary to propose a remote meter reading system with a security module that can save battery consumption while enhancing security through encryption.

On the other hand, the above-mentioned background art is technical information that the inventor possessed for the derivation of the present invention or acquired in the process of derivation of the present invention, and it cannot be said that it is necessarily a known technique disclosed to the general public before the filing of the present invention. .

Republic of Korea Patent Registration No. 10-1779202 (Announcement Date: September 18, 2017, Title of Invention: LoRa-based remote meter reading system)

The present invention was created to solve the problems of the prior art as described above, and a security module smart metering device that transmits a measurement target value is encrypted using an authentication key generated through a mutual authentication process and an existing measurement value. By transmitting the measurement data and decoding it in the security authentication module provided in the collection server or configured separately to store and manage the measurement data, it is possible to prevent exposure to various risk factors by strengthening information security, thereby exposing personal information and a security function to prevent loss such as paralysis of the smart metering system, and to provide a remote meter reading system with a security module that can save battery consumption while strengthening security through encryption. .

These and other objects and advantages of the present invention will become apparent from the following description of preferred embodiments.

The remote meter reading system to which the security module is applied according to an embodiment of the present disclosure encrypts a measurement value obtained through a measurement device for measuring a measurement target value and an authentication key generated through a mutual authentication process by using the encryption measurement A security module smart metering device for transmitting data, a security authentication module for outputting decryption measurement data obtained by decrypting the encryption measurement data using an authentication key generated through a mutual authentication process, and a collection for collecting, storing and managing the decryption measurement data It is configured to include a server, and the security authentication module is configured in the collection server or is configured in a server form separately from the collection server.

Here, the security module smart metering device further includes a memory, performs a mutual authentication process with the pre-measured value stored in the memory and the security authentication module, and measures encryption using an authentication key generated through the mutual authentication process and a security module for generating data, wherein the pre-measured value may be a most recently acquired value before acquiring the measured value through the measuring device.

Here, in the mutual authentication process, a pre-master key is injected when the security module is manufactured in the form of a chip, and after the security module is mounted on the security module smart metering device, the security module and the security authentication module A session in which a master key generated through mutual authentication by the free master key is injected, stored and managed, and the security module is generated through mutual authentication by the security authentication module and the master key in order to generate the encrypted measurement data It may be a process of injecting and managing the key.

Here, the security module performs the mutual authentication process and encrypts and encrypts the measurement target value using a first authentication unit that stores and manages the master key and the session key, the session key and the previous measurement value It further comprises an encryption unit for generating measurement data and a counter unit for counting the number of times of use of the session key, and when the number of uses counted by the counter unit exceeds a set value, the session key stored and managed by the first authentication unit is discarded, , the mutual authentication process is re-performed through the first authentication unit to generate a new session key, and then control to be stored and managed by the first authentication unit.

In addition, the security authentication module enables the security module to perform a mutual authentication process, injects the master key and the session key into the security module through a mutual authentication process, and generates the master key and the session key. After receiving the encrypted measurement data generated by the second authentication unit and the security module for storing, managing, and storing the pre-measured data, decrypt the encrypted measured data using the session key and the pre-measured data to measure the decryption The method may further include a decryption unit for generating data, wherein the pre-measured data may be data decrypted using data most recently received before the encrypted measurement data is input.

And, further comprising a general smart metering device for transmitting the measurement target value through a communication network, the measurement target value transmitted from the general smart metering device is not input to the security authentication module, but to the collection unit of the collection server It can be directly entered and stored and managed.

In addition, when the measurement target value measured by the measuring device is within a preset range, the measurement target value transmitted from the security module smart metering device is not input to the security authentication module, but is directly input to the collection unit of the collection server. can be stored and managed.

According to the remote meter reading system to which the security module of the present invention is applied having the above problems and solutions, the security module smart metering device for transmitting the measurement target value is encrypted using the authentication key and previous measurement data generated through the mutual authentication process Since the encrypted measurement data is transmitted and the measurement data is stored and managed by decrypting it in the security authentication module provided or separately configured in the collection server, it is possible to prevent exposure to various risk factors by strengthening information security. It has the advantage of preventing the loss of personal information exposure and smart metering system paralysis. Also, since the encryption process may not be performed when it is within a preset range, battery consumption can be saved.

1 is a block diagram of a remote meter reading system to which a security module is applied according to an embodiment of the present invention;
2 is a block diagram of a security module smart metering device constituting a remote meter reading system to which a security module is applied according to an embodiment of the present invention;
3 is a block diagram of a security module provided in a security module smart metering device constituting a remote meter reading system to which a security module is applied according to an embodiment of the present invention;
4 is a block diagram of a collection server and a security authentication module constituting a remote meter reading system to which a security module is applied according to an embodiment of the present invention;
5 is a flowchart for explaining a key issuance and mutual authentication process performed through a remote meter reading system to which a security module is applied according to an embodiment of the present invention;
6 is a flowchart for explaining a first issuance procedure of a security module according to an embodiment of the present invention;
7 is a flowchart for explaining a secondary issuance procedure of a security module according to an embodiment of the present invention;
8 is a flowchart illustrating a mutual authentication procedure of a security module according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of a remote meter reading system to which the present invention security module having the above problems, solutions and effects is applied will be described in detail.

Since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. Effects and features of the present invention, and a method of achieving them, will become apparent with reference to the embodiments described below in detail in conjunction with the drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various forms.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when described with reference to the drawings, the same or corresponding components are given the same reference numerals, and the overlapping description thereof will be omitted. .

In the following embodiments, terms such as include or have means that the features or components described in the specification are present, and the possibility that one or more other features or components may be added is not excluded in advance.

In the drawings, the size of the components may be exaggerated or reduced for convenience of description. For example, since the size and thickness of each component shown in the drawings are arbitrarily indicated for convenience of description, the present invention is not necessarily limited to the illustrated bar.

In cases where certain embodiments may be implemented differently, a specific order of operations may be performed differently from the described order. For example, two operations described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the order described.

1 is a configuration block diagram of a remote meter reading system to which a security module is applied according to an embodiment of the present invention, and FIG. 2 is a configuration of a security module smart metering device constituting a remote meter reading system to which a security module according to an embodiment of the present invention is applied 3 is a block diagram of a security module provided in a security module smart metering device constituting a remote meter reading system to which a security module according to an embodiment of the present invention is applied, and FIG. 4 is a configuration block diagram of a security module according to an embodiment of the present invention. It is a configuration block diagram of the collection server and security authentication module constituting the remote meter reading system to which the security module is applied.

As shown in Fig. 1, the remote meter reading system 100 to which the security module according to the embodiment of the present invention is applied performs a mutual authentication process for a measuring device 10 for measuring a measurement target value, and a measurement value obtained through the measuring device. The security module smart metering device 30 for transmitting encrypted measurement data encrypted using an authentication key generated through The security authentication module 50 is configured to include a collection server 70 that collects, stores, and manages decryption measurement data, and the security authentication module 50 is configured in the collection server 70 or separately from the collection server 70 . It is configured in the form of a server.

The measuring device 10 may be applied in various ways as long as it can acquire various measurement target values to be collected by the collection server 70 . For example, the measuring device 10 may be variously applied to a meter installed in a pipe network such as a household watt-hour meter, a gas meter, a water meter, and the like to measure flow data, water pressure data, water quality data, and the like.

The measurement target value measured by the measuring instrument 10 is encrypted in the security module smart metering device 30 and transmitted to the collection server 70 or the security authentication module 50 through the communication network 80 . Specifically, the security module smart metering device 30 transmits the measurement target value through the communication network 80, but transmits encrypted measurement data encrypted using an authentication key generated through a mutual authentication process.

The security module smart metering device 30 generates, stores and manages an authentication key through a mutual authentication process, and encrypts the measurement target value to be transmitted thereafter using the authentication key, and generates encrypted measurement data to create the security module smart metering device ( 30) to be transmitted by the first communication unit 36 constituting it.

More specifically, in the prior art, the measurement target value was processed according to a specific communication and encryption standard, for example, ASE128 in the first communication unit 36, and then transmitted to the collection module 70 through the communication network 80. , in the present invention, after the measurement target value is encrypted using an authentication key generated through a mutual authentication process, the first communication unit 36 re-encrypts it according to a specific communication and encryption standard, and then the communication network 80 ) is transmitted through As a result, since the measurement target value is transmitted with double encryption, a very strong security state can be maintained.

In addition, the security module smart metering device 30 may further include a memory 33 to use the pre-measured value stored in the memory 33 in the encryption process.

Specifically, the memory 33 of the security module smart metering device 30 may temporarily store the values measured from the measuring device 10 , and when encrypting the currently acquired measured values through the measuring device 10 , the measuring device 10 ), a previously measured value, which is the most recently acquired value before acquiring the measured value, can be used in the encryption process.

Here, since the security authentication module 50 can store the decrypted measurement data decrypted for the pre-measured value, when the mutual authentication process operates normally, the security module smart metering device 30 and the security authentication module for the pre-measured value (50) can secure the same information as each other. Therefore, in addition to the authentication key generated through the mutual authentication process, security can be further strengthened by using the corresponding information in the encryption process.

A detailed configuration of the security module smart metering device 30 and a method of generating an authentication key through the mutual authentication process and the mutual authentication process will be described later.

Data communication between the security module smart metering device 30 and the collection server 70 or the security authentication module 50 is made through the communication network 80 . The communication network 80 encrypts the measurement target value from the security module smart metering device 30 (and general smart metering device 20) to the collection server 70 or the security authentication module 50 Any one of various wired or wireless communication networks can be applied if measurement data or unencrypted measurement target values can be easily transmitted. For example, when the communication network 80 is configured as a wireless communication network, at least one of various communication networks such as LoRa, IoT, LTE, 5G, and WiFi may be selected and applied.

The encryption measurement data transmitted through the communication network 80 is transmitted to the collection server 70 or the security authentication module 50 . The security authentication module 50 may be configured as one component in the collection server 70 , that is, in the collection server 70 , or may be configured separately in the form of a server separately from the collection server 70 . However, in any case, the encryption measurement data must go through a process of being decrypted in the security authentication module 50 .

The security authentication module 50 outputs decryption measurement data obtained by decrypting the encryption measurement data using an authentication key generated through a mutual authentication process. Then, the decryption measurement data may be stored and managed in the collection unit 73 of the collection server 70 and further monitored, and may be utilized as data for generating various analysis data by various analysis methods.

The security authentication module 50 generates, stores and manages an authentication key through a mutual authentication process, and then decrypts the received encryption measurement data using the authentication key, generates decryption measurement data, and the collection unit 73 ) to be stored and managed.

The encryption measurement data transmitted through the communication network 80 is decrypted using an authentication key generated through a mutual authentication process in the security authentication module 50, but in more detail, the second communication unit 71 It is input and is transmitted to the security authentication module 50 after being decrypted according to the specific communication and encryption standard (eg, ASE128). That is, the data transmitted to the security authentication module 50 corresponds to the encrypted measurement data encrypted in the security module 40 of the security module smart metering device 30, and the security authentication module 50 is also the same The encryption measurement data is decrypted using the authentication key generated through the mutual authentication process to output the decryption measurement data.

More specifically, in the prior art, after the measurement target value transmitted through the communication network 80 is processed according to a specific communication and encryption standard, for example, ASE128, in the second communication unit 71, the collection module 70 ), but in the present invention, the data transmitted through the communication network 80 is decrypted according to a specific communication and encryption standard in the second communication unit 71, and is generated by the decryption processing After the encryption measurement data is decrypted using an authentication key generated through a mutual authentication process in the security authentication module 50 , it is stored and managed in the collection unit 73 . As a result, the measurement target value can be transmitted and received while maintaining a very strong security state because it is transmitted after being encrypted twice, and stored and managed after being decrypted twice.

Here, the security authentication module 50 may decrypt the reef measurement data using pre-measured data in addition to the authentication key generated through the mutual authentication process. The pre-measured data may refer to data decrypted using the most recently received data before the encrypted measurement data is input.

That is, since the pre-measured data stored in the security authentication module 50 corresponds to the same information as the pre-measured value stored in the security module smart metering device 30, the security module smart metering device 30 is generated through the mutual authentication process. When the encryption measurement data is generated using a pre-measured value in addition to the authentication key, the security authentication module 50 may decrypt the encrypted measurement data using the pre-measured data in addition to the authentication key generated through the mutual authentication process. .

Through this, the encryption and decryption process can be further improved by performing the encryption and decryption process using the most recently measured data in addition to the authentication key compared to the case where the encryption and decryption process is performed only with the authentication key generated through the mutual authentication process. can

As will be described later, when the security authentication module 50 is configured as a separate server, the second communication unit 71 needs to be provided in the security authentication module 50 as well, and the security authentication module 50 is When provided in the collection server 70, it is provided in the configuration of the collection server 70.

The decryption measurement data that is decrypted and output by the security authentication module 50 is transmitted to the collection server 70 , specifically, the collection unit 73 , and stored and managed. That is, the collection server 70 collects, stores and manages the decryption measurement data in the collection unit 73 , and enables additional monitoring and various analysis.

As described above, the security module smart metering device 30 generates decryption measurement data using an authentication key generated through a mutual authentication process. For this purpose, as shown in FIG. 2 , the security module 40 It includes more. Specifically, the security module smart metering device 30 performs a mutual authentication process with the security authentication module 50 and a security module 40 for generating encrypted measurement data using an authentication key generated through the mutual authentication process. includes

Hereinafter, a detailed configuration of the security module smart metering device 30 including the security module 40 will be described with reference to FIG. 2 .

As shown in FIG. 2, the security module smart metering device 30 applied to the present invention is an interface connected to the control unit 31 for controlling the overall operation and communication of the security module smart metering device, and the corresponding measuring device 10 (32), a storage 38 for storing information data (data including a measurement target value) about the measuring device 10 collected under the control of the control unit 31; The first communication unit 36, the security module smart, which transmits the measurement target value related to the collected measuring instrument 10 to the collection server 70 or the security authentication module 50 after being encrypted through the security module 40 Performing a mutual authentication process with the power supply unit 37 and the security authentication module 50 for supplying power necessary for the overall operation and communication of the metering device 30, and using the authentication key generated through the mutual authentication process to measure the and a security module 40 for generating encrypted measurement data by encrypting the target value.

The interface 32 is connected to the measuring device 10 so that measurement target values (power amount, flow rate, hydraulic pressure, water consumption, etc.) related to the measuring device 10 are measured and collected under the control of the control unit 31 . . The interface 32 is connected to the corresponding measuring device 10 through RS232 or RS485 so that the measurement target value related to the measuring device 10 is read.

Here, the measurement target value for the measuring device 10 includes measurement data (water quality-related data, flow rate data, water pressure data, etc.) of the measuring device 10, as well as measuring device unique information that can identify the measuring device 10. In addition, it is preferable to further include data of the state information (failure, power state, etc.) of the measuring device 10 .

The control unit 31 performs an operation of controlling the measurement target value of the measuring device 10 to be collected through the interface 32 . That is, the control unit 31 collects measurement target values related to the corresponding measuring device 10 by reading the measurement data of the measuring device 10 through the interface 32 in real time or every set collection period.

The control unit 32 controls the collected measurement target value for the measuring device 10 to be stored in the storage 38 . That is, the storage 38 performs an operation of storing the measurement target value for the measuring device 50 under the control of the controller 31 . The storage 38 may be composed of an SD card, and the storage 38 composed of the SD card stores various information such as unique information, measurement data, power information and status of the security module smart metering device 30 . do.

The measurement target value for the measuring device 10 stored in the storage 38 is encrypted by the security module 40 under the control of the control unit 31 and then through the first communication unit 76 . It may be transmitted to the collection server 70 or the security authentication module 50 . That is, the first communication unit 36 transmits the encrypted measurement data in which the measurement target value is encrypted by the security module 40 to the collection server 70 or the security authentication module 50 .

That is, the security module 40 encrypts the measurement target value using an authentication key under the control of the control unit 31 to encrypt the measurement data through the first communication unit 36 to the collection server 70 or An operation of transmitting to the security authentication module 50 is performed. A detailed description thereof will be given later.

The first communication unit 36 collects the measurement target value for the measuring device 10 stored in the storage 78 under the control of the control unit 31 after being encrypted by the security module 40 . It may be transmitted to the server 70 or the security authentication module 50, and in some cases, the measurement target value for the measuring device 10 collected through the interface 32 under the control of the control unit 31 is the Without being stored in the storage 38, it can be directly encrypted by the security module 40 and then transmitted to the collection server 70 or the security authentication module 50. However, even in the latter case, it is preferable that the data is eventually stored in the storage 38 . The reason is to perform retransmission of the measurement target value with respect to the measuring device 10 when a transmission failure of the measurement target value with respect to the measuring device 10 occurs.

As a result, the control unit 31 determines that, according to a setting method, the measurement target value for the measuring device 10 collected in advance through the interface 32 and stored in the storage 38 is transferred from the security module 40 . After being encrypted, it can be controlled so that it can be transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36 , and to the measuring instrument 10 collected through the interface 32 . The measurement target value is not stored in the storage 38 but is encrypted in the security module 40 and immediately transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36. You can also control it so that Of course, as described above, even in the latter case, if the transmission of the measurement target value with respect to the measuring device 10 fails, in order to perform retransmission of the measurement target value with respect to the measuring device 10, eventually the storage 38 It is preferable to store it in

The first communication unit 36 may be configured to be applicable to various wired or wireless communication methods. For example, when using a wireless communication method, the first communication unit 36 may apply at least one of 3G, LTE, LTE-Cat.M1, 5G, LoRa, NB-IoT, and other various wireless communication methods. can be configured. Therefore, the control unit 31 uses at least one of communication methods such as LoRa, NB-IoT, WiFi, 3G/4G/5G, etc. through the first communication unit 36 to measure the measurement target value for the measuring device 10 . It may be transmitted to the collection server 70 or the security authentication module 50 . However, it is preferable that at least one of communication methods such as LoRa, NB-IoT, WiFi, and 3G/4G/5G is preferentially applied.

Power needs to be supplied for the operation of the interface 32 including the control unit 31 , the storage 38 , and the first communication unit 36 , which is accomplished by the power supply unit 37 . That is, the power supply unit 37 performs an operation of supplying power for individual operations, linkage operations, and communication operations of the control unit 31 , the interface 32 , the storage 38 , and the first communication unit 36 .

The power supply unit 37 can adopt and apply DC 12V to 24V power, and the state information of the power supply unit, specifically, whether power is faulty or whether power is normally supplied, is detected in real time or periodically by the control unit 31 . That is, the control unit 31 transmits the state information of the power supply unit 37 to the collection server 70 or the security authentication module 50 through the first communication unit 36 . The control unit 31 transmits the state information of the power supply unit when transmitting the measurement target value regarding the measuring device 10 to the collection server 70 or the security authentication module 50 through the first communication unit 36 . It is desirable to minimize power consumption. Here, the state information of the power supply unit is also encrypted by the security module 40 together with the measurement target value and then transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36. can

On the other hand, the security module smart metering device 30 according to the present invention is configured to further include a display unit 35 and a memory 33 as shown in FIG. 2 . The display unit 35 performs an operation of displaying the measurement target value for the collected measuring device 10 under the control of the control unit 31, and the memory 33 is an internal memory of the control unit 31, The security module performs an operation of storing the firmware required for the operation of the smart metering device (30).

The display unit 35 is composed of an LCD to display the measurement target value for the measuring instrument 10 under the control of the control unit 31, specifically measurement data of the measuring instrument 10, the measuring instrument 10 status information, etc. , furthermore, according to the control of the control unit 31, the state of the security module smart metering device 30 (unique information of the security module smart metering device 30, the temperature of the security module smart metering device 30, the state of the power supply, firmware version, etc.).

The memory 33 is composed of SDRAM, and stores firmware required for the operation of the security module smart metering device 30 . The firmware stored in the memory 33 is updated as necessary. The firmware stored in the memory 33 may be updated by wire or wirelessly. The firmware stored in the memory 33 may be updated by wire through a TTL232 port provided in the security module smart metering device, etc., and by adding a BLE communication function to the first communication unit 36, FOTA (Firmware Over- It can also be updated over-the-air via The-Air) function.

On the other hand, the security module smart metering device 30 according to the present invention is preferably configured to further include various environmental sensors such as a temperature sensor and a humidity sensor, and the control unit 31 transmits the detection data of the environmental sensors to the measuring device ( After the measurement target value for 10) is encrypted together by the security module 40 , it may be transmitted together when transmitted to the collection server 70 or the security authentication module 50 .

The control unit 31 applied to the present invention encrypts the measurement target value with respect to the measuring device 10 through the security module 40 in order to minimize power consumption, and then the collection server 70 or the security authentication module 50 ), it is preferable to transmit information data that needs to be transmitted separately (detection data of environmental sensors, state information data of the power supply unit, state information data of the security module smart metering device 30, etc.) together.

The control unit 31 according to the present invention continuously stores the measurement target value for the measuring device 10 so that the collection server 70 stores, manages, and analyzes the measurement target value for each measuring device 10 . After being collected and encrypted by the security module 40, it is controlled so that it can be continuously transmitted.

As described above, the measurement target value and various information data are encrypted through the security module 40 under the control of the control unit 31 to be encrypted measurement data through the first communication unit 36 through the collection server ( 70) or the security authentication module 50 .

To this end, the security module 40 performs a mutual authentication process with the security authentication module 50 and encrypts the measurement target value and various information data using an authentication key generated through the mutual authentication process to encrypt measurement data operation to create The encrypted measurement data encrypted and output by the security module 40 is transmitted to the collection server 70 or the security authentication module 50 through the first communication unit 36 .

As such, the security module 40 encrypts the measurement target value using an authentication key, and the authentication key is generated by performing a mutual authentication process with the security authentication module 50 . The security module 40 performs a mutual authentication process with the security authentication module 50 to generate the authentication key.

The mutual authentication process receives a pre-master key when the security module 40 is manufactured in a chip form, and after the security module 40 is mounted on the security module smart metering device 30, the security module ( 40) receives, stores and manages the master key generated through mutual authentication by the security authentication module 50 and the free master key, and the security module 40 performs the security authentication to generate the encrypted measurement data It is a process of receiving, storing and managing a session key generated through mutual authentication by the module 50 and the master key.

Specifically, the security module 40 is manufactured in the form of a chip before being mounted on the security module smart metering device 30 , and a pre-master key is injected into the security module 40 at this time. The pre-master key is issued in advance, injected into the security module 40, and stored and managed in the security authentication module 50 at the same time. This process is called the primary issuance and certification process.

5 is a view showing the security module issuance and mutual authentication procedure as a whole. Referring to FIG. 6 which shows the primary issuance and authentication process in detail, first, the operating institution pre-issues the key (pre-issue key). issuing key) and deliver it to the issuing authority and the authentication server. Here, the issuing agency corresponds to a company (that is, a security module manufacturer) that manufactures the chip-type security module 40, and the authentication server is a security authentication module 50 or a collection server having a security authentication module 50 ( 70) is applicable. Also, here, the operating institution may be a local government that operates a smart metering system, or may be a company or institution entrusted with operation.

The personalization agent that has received the pre-issuing key derives the pre-issuing key using the injected pre-issuing key. Then, after performing mutual authentication for issuance with the default key in the security module 40 , the free master key is transferred to the security module 40 to be injected. That is, the pre-master key is injected into the chip-type security module 40 through the first issuance process using the pre-issuing key as described above.

On the other hand, the pre-issuing key delivered to the authentication server, specifically the security authentication module 50 or the collection server 70 having the security authentication module 50, is used for issuing and injecting the master key later. Generates a free master key to be used. That is, the authentication server uses the pre-issuing key to derive a pre-master key and then uses it for mutual authentication later.

When the primary issuance and authentication process is completed, an additional issuance and authentication process, that is, a secondary issuance and authentication process, is performed thereafter.

The second issuance process will be described in detail with reference to FIG. 7 , the chip-type security module 40 is mounted on the security module smart metering device 30 . At this time, it is necessary to check whether the security module 40 mounted on the security module smart metering device 30 corresponds to a permitted or authorized chip. That is, the security module 40 needs to verify whether it corresponds to a trusted chip authorized or permitted or requested by the manufacturer or management organization of the security module smart metering device 40, and injects the master key through the verification. Needs to be.

For this initial device registration process, the issuing organization issues an issuing key and injects it into the HSM device. Here, the HSM device may mean a security device for key storage, which may be used in the secondary issuance server. After that, when the pre-issuing key is transmitted to the authentication server, specifically, the security authentication module 50 or the collection server 70 having the security authentication module 50, the security authentication module 50 or the security The collection server 70 having the authentication module 50 requests device registration initialization and device registration start. After the security module 40 to which the pre-master key has been injected is mounted on the security module smart metering device 30, the security module 40 includes the security authentication module 50 and the pre-injected pre-master Mutual authentication by key is performed, and the master key generated through this mutual authentication is injected and stored and managed. The master key is issued in advance and stored and managed in the security authentication module 50, and when the security module 40 is authenticated as a reliable chip through a mutual authentication process using the free master key, the security authentication module 50 ) or the collection server 70 having the security authentication module 50 makes a device registration completion request, and the master key is delivered to the security module 40 and injected.

A mutual authentication process for generating a session key after the secondary issuance will be described in detail with reference to FIG. 8 as follows.

The security module 40 mounted on the security module smart metering device 30 is injected with a free master key for mutual authentication, stored and managed, and the authentication server, that is, the security authentication module 50 or having the same The collection server 70 also derives and stores and manages the free master key.

The operating organization issues an issuing key in advance and transmits it to the authentication server, that is, the security authentication module 50 or the collection server 70 having the same. Then, the authentication server derives a master key through the issuing key. The authentication server, ie, the security authentication module 50 or the collection server 70 having the same, performs mutual authentication with the security module smart metering device 30 having the security module 40 and the free master key. carry out When the mutual authentication is completed, the authentication server, that is, the security authentication module 50 or the collection server 70 having the same, transmits the derived master key to the security module smart metering device having the security module 40 ( 30), so that the master key is injected into the security module (40).

In this way, through the additional issuance and authentication process, that is, the secondary issuance and authentication process, the security authentication module 50 and the security module 40 store and manage the same master key, that is, a symmetric key. In this way, since the security module 40 stores and manages the same master key as the security authentication module 50, after performing mutual authentication with the security authentication module 50 using the master key, the security The session key used for the enhanced data transmission/reception, ie, encryption of the measurement target value, may be injected. Such a process is referred to as an authentication and session key generation process.

The security module 40 encrypts the measurement target value under the control of the controller 31 to generate encrypted measurement data. To this end, the security module 40 must be issued a session key, and the session key can be automatically generated and injected through a mutual authentication process with the security authentication module 50 using the master key. That is, in order to generate the encrypted measurement data, the security module 40 may receive and store and manage the session key generated through mutual authentication by the security authentication module 50 and the master key.

When the security module 40 receives the session key through mutual authentication with the security authentication module 50, the security module 40 encrypts the measurement target value using the session key to obtain encrypted measurement data. can create The encrypted measurement data may be transmitted to the collection server 70 or the authentication server 50 through the first communication unit 36 under the control of the control unit 31 . As described above, the encrypted measurement data may be transmitted after being encrypted again according to a specific communication and encryption standard through the first communication unit 36 .

When the authentication and session key generation process is described in more detail with reference to the attached FIG. 8 , the security module smart metering device 30 including the security authentication module 50 and the security module 40 is derived and Mutual authentication is performed using the stored and managed master key, and the session key is automatically generated through the mutual authentication process, and the automatically generated session key is the security authentication module 50 and the security module 40. is injected and stored and managed. Thereafter, the security module smart metering device 30 including the security authentication module 50 and the security module 40 may perform encrypted communication using the session key.

In this way, the security module 40 performs mutual authentication with the security authentication module 50 and encrypts the measurement target value using the session key issued through the mutual authentication. A detailed configuration of the security module 40 for performing such an operation is as shown in FIG. 3 .

As shown in FIG. 3 , the security module 40 includes a first authentication unit 41 , an encryption unit 43 , and a counter unit 45 .

The first authentication unit 41 performs the mutual authentication process and stores and manages the master key and the session key. That is, the first authentication unit 41 performs a mutual authentication process with the security authentication module 50 , specifically, the second authentication unit 51 as shown in FIG. 4 .

Specifically, the first authentication unit 41 stores and manages the pre-master key injected while the security module 40 is manufactured in the form of a chip. Thereafter, a mutual authentication process is performed through the second authentication unit 51 and the communication network 80 to receive and store and manage the master key. That is, a mutual authentication process is performed using the stored and managed free master key, and the master key is received from the second authentication unit 51 through authentication and stored and managed. When the first authentication unit 41 receives the master key from the second authentication unit 51 through mutual authentication, the first authentication unit 41 discards the free master key and stores and manages only the master key.

The first authentication unit 41 automatically receives a session key used when the encryption unit 43 encrypts the measurement target value through mutual authentication with the second authentication unit 51 . That is, the first authentication unit 41 performs a mutual authentication process with the second authentication unit 51 using the stored and managed master key, and receives the session key from the second authentication unit 51 through authentication. Receive and store and manage

When the session key is generated and stored and managed, the encryption unit 43 may encrypt the measurement target value using the session key. The encryption unit 43 may perform an operation of generating encrypted measurement data by encrypting the measurement target value using the session key. That is, when the encryption unit 43 encrypts the measurement target value under the control of the control unit 31, it encrypts the encrypted measurement data by using the session key stored and managed in the first authentication unit 41. generated and output to the first communication unit 36 . Then, the first communication unit 36 may re-encrypt the encrypted measurement data according to a specific communication and encryption standard as described above and transmit it through the communication network 80 .

The session key stored and managed in the first authentication unit 41 needs to be updated to enhance security. To this end, the security module 40 according to the present invention is configured to include a counter 45 for counting the number of times the session key is used. Each time the session key is used by the encryption unit 43, the counter 45 counts to increase the number of uses, and if it exceeds a set reference set value, the existing session key whose number of uses has exceeded is returned. It is discarded and updated with a new session key.

That is, the security module 40 according to the present invention includes a counter 45 for counting the number of times the session key is used. The session key stored and managed in the authentication unit 41 is discarded and the mutual authentication process is re-performed through the first authentication unit 41 to generate a new session key and then newly stored in the first authentication unit 41 control to be managed.

More specifically, when the number of times the session key is used exceeds a preset value, the security module 40 controls the existing session key stored and managed in the first authentication unit 41 to be discarded. In addition, the security module 40 is configured such that the first authentication unit 41 re-performs mutual authentication with the second authentication unit 51 to receive a new session key and to store and manage the renewed new session key. do. Since the first authentication unit 41 still stores and manages the master key, a new session key may be automatically generated by performing mutual authentication with the second authentication unit 51 using the master key.

The security module 40 performs mutual authentication with the security authentication module 40 provided in the collection server 70 or configured in the form of a separate server, and transmits and receives data.

4 illustrates that the security authentication module 50 is provided in the collection server 70, in some cases, the security authentication module 50 is configured in the form of a separate server, and the collection server 70 It can be connected to and transmit the decrypted data, that is, the decryption measurement data, to the collection server 70 to be stored and managed.

In FIG. 4 , the second communication unit 71 is exemplified as provided in the collection server 70 , but when the security authentication module 50 is configured in a separate server form, the security authentication module 50 is the second It is preferable to include a communication unit 71 .

The security authentication module 50 basically includes a second authentication unit 51 and a decryption unit 53 .

The second authentication unit 51 enables the security module 40 to perform a mutual authentication process, injects the master key and the session key into the security module 40 through the mutual authentication process, and An operation of storing and managing the master key and the session key is performed.

Specifically, the second authentication unit 51 performs a mutual authentication process when the first authentication unit 41 receives a mutual authentication request using the free master key, and converts the master key, which is a symmetric key, to the first authentication unit ( 41) for injection. Accordingly, the second authentication unit 51 also stores and manages the pre-master key until the master key is injected into the first authentication unit 41, and mutual authentication is performed using the pre-master key, and the first authentication unit When the master key is injected in (41), the free master key is discarded.

The second authentication unit 51 also performs mutual authentication using the master key when the first authentication unit 41 requests mutual authentication using the master key. to allow it to be created. The second authentication unit 51 also stores and manages the master key and the session key in order to perform mutual authentication and encryption/decryption data communication.

When the session key is generated and stored and managed in the second authentication unit 51 , the decryption unit 53 may decrypt the encrypted measurement data transmitted through the second communication unit 71 . That is, after receiving the encryption measurement data generated by the security module 40, the decryption unit 53 decrypts the encryption measurement data using the session key to generate decryption measurement data. .

That is, the decryption unit 53 transmits the encrypted measurement data transmitted by the first communication unit 36 after being encrypted by the security module 40, specifically, the encryption unit 43 to the second communication unit ( 71), the encrypted measurement data is decrypted using the session key stored and managed in the second authentication unit 51, and decrypted measurement data is generated and output. Then, the decryption measurement data is transferred to the collection unit 73 of the collection server 70 and stored and managed.

As described above, the second communication unit 71 re-encrypts the encryption-specific data according to a specific communication and encryption standard by the first communication unit 36 and transmits it after double encryption, the specific communication and encryption Decrypts the received data according to the standard. Then, the encrypted measurement data is output to the encryption unit 43, which is transmitted to the decryption unit 53 to be decrypted. Then, decryption measurement data is generated, which is transmitted to the collecting unit 73 and stored and managed. The decoded measurement data corresponds to the measurement target value.

In this way, the security authentication module 50 decrypts the encrypted measurement data encrypted and transmitted by the security module 40, so that the decrypted measurement data, that is, the measurement target value, can be stored and managed in the collection unit 73 . do. That is, the security module smart metering device 30 includes a security module 40 to encrypt and transmit the measurement target value, and decrypts it in the security authentication module 50 to collect the collection unit 73 of the collection server 70 . ) to be stored and managed.

In addition, as described above, the security module smart metering device 30 and the security authentication module 50 additionally use pre-measured values and pre-measured data in addition to the session key to perform encryption and decryption processes, thereby further enhancing security. can be strengthened

However, in some cases, the unencrypted data, that is, the measurement target value, may be transmitted from the device on which the security module 40 is not mounted, that is, the general smart metering device 20 , and transmitted to the collection server 70 . In this case, it is preferable that the measurement target value is directly transferred to the collection unit 73 of the collection server 70 and stored and managed without being transmitted to the security authentication module 50 .

That is, the remote meter reading system 100 to which the security module according to the present invention is applied further includes a general smart metering device 20 that directly transmits the measurement target value through a communication network, as shown in FIG. 1 , The measurement target value transmitted from the general smart metering device 20 is not input to the security authentication module 50 but is directly input to the collection unit 73 of the collection server 70 and stored and managed.

The general smart metering device 20 has the same configuration except for the security module 40 among the configurations of the security module smart metering device 30 described above. That is, the general smart metering device 20 does not encrypt the measurement target value, but only performs encryption according to a specific communication and encryption standard by the first communication unit 36 and then through the communication network 80 the collection server (70). Then, the second communication unit 71 decrypts the measurement target value according to a specific communication and encryption standard, and then directly transmits it to the collection unit 73 without transmitting it to the security authentication module 50 so that it is stored and managed. .

That is, the remote meter reading system 100 to which the security module according to the present invention is applied is an existing general smart metering device that is not equipped with the security module 40, that is, the measurement target value transmitted without encryption from the general smart metering device is also a collection server It is received from (70) so that it can be stored and managed.

In addition, when the measurement target value measured through the measuring device 10 is within a preset range, the measurement target value transmitted from the security module smart metering device 30 is not input to the security authentication module 50, but the collection server It can be directly input to the unit 73 and stored and managed.

That is, as described above, the general smart metering device 20 in which the security module 40 is excluded so as not to undergo separate encryption for the measurement target value that does not require security enhancement may be provided, but in a different way, the measuring device 10 ), when the measured measurement target value is within a preset range, the security module smart metering device 30 may be directly transferred to the collection unit 73 of the collection server without going through a separate encryption process to be stored and managed.

For example, when the measured value of water consumption is significantly lower than that of a general household, an vacant house can be predicted and used for crime. It is necessary to further strengthen the security of personal information corresponding to 10).

On the other hand, according to the remote meter reading system, in a general case where the measured value is within a preset range and falls within a normal distribution, there is also a case where there is no possibility of being abused for a crime. In this case, the mutual authentication process with the security authentication module 50 It can be directly input to the collection unit 73 of the collection server without having to go through the storage management.

In the case of mutual authentication with the security authentication module 50, since additional batteries are consumed, in the case of a remote meter reading system that needs to maximize battery consumption at a remote location, as described above, measurement values within a preset range are separately measured. By performing a mutual authentication process with the security authentication module 50 only in the case of a measured value that does not fall within a preset range without performing encryption, it is possible to enhance security and save battery consumption.

Although the embodiments according to the present invention have been described above, these are merely exemplary, and those of ordinary skill in the art will understand that various modifications and equivalent ranges of embodiments are possible therefrom. Accordingly, the true technical protection scope of the present invention should be defined by the following claims.

10: measuring instrument
20: general smart metering device
30: security module smart metering device
31: display unit
32: interface 33: memory
35: display unit 36: first communication unit
37: power unit 38: storage
40: security module 41: first authentication unit
43: encryption unit 45: counter unit
50: security authentication module 51: second authentication unit
53: decryption unit 70: collection server
71: second communication unit 73: collection unit
80: communication network
100: remote meter reading system with security module applied

Claims (5)

In the remote meter reading system to which the security module is applied,
a measuring instrument for measuring the measurement target value;
a security module smart metering device for transmitting encrypted measurement data obtained by encrypting the measurement value obtained through the measuring device using an authentication key generated through a mutual authentication process;
a security authentication module for outputting decryption measurement data obtained by decrypting the encryption measurement data using an authentication key generated through a mutual authentication process;
and a collection server that collects, stores and manages the decryption measurement data,
The security authentication module is configured in the collection server or is configured in the form of a server separately from the collection server,
The security module smart metering device,
memory; further comprising
A security module for performing a mutual authentication process with the pre-measured value stored in the memory and the security authentication module, and generating encrypted measurement data using an authentication key generated through the mutual authentication process,
The measured value is,
It is the most recently acquired value before acquiring the measured value through the measuring device,
The mutual authentication process is
When the security module is manufactured in the form of a chip, a pre-master key is injected, and after the security module is mounted on the security module smart metering device, the security module performs mutual authentication with the security authentication module and the pre-master key. The process of receiving, storing and managing the master key generated through the injection, and storing and managing the session key generated through mutual authentication by the security authentication module and the master key by the security module in order to generate the encrypted measurement data A remote meter reading system to which a security module is applied, characterized in that. delete According to claim 1,
The security module,
a first authentication unit performing the mutual authentication process and storing and managing the master key and the session key;
an encryption unit for generating encrypted measurement data by encrypting the measurement target value using the session key and the pre-measured value; and
It further includes; a counter for counting the number of times the session key is used,
When the number of times of use counted by the counter exceeds a set value, the session key stored and managed by the first authentication unit is discarded, and the mutual authentication process is re-performed through the first authentication unit to generate a new session key. A remote meter reading system to which a security module is applied, characterized in that it is controlled to be stored and managed by the first authentication unit. According to claim 1,
The security authentication module,
To enable the security module to perform a mutual authentication process, to inject the master key and the session key to the security module through a mutual authentication process, to store and manage the master key and the session key, and to store pre-measured data a second authentication unit to store; and
After receiving the encryption measurement data generated by the security module, a decryption unit for generating decryption measurement data by decrypting the encryption measurement data using the session key and the pre-measured data;
The previously measured data is a remote meter reading system to which a security module is applied, characterized in that it is data decrypted using the most recently received data before the encrypted measurement data is input. According to claim 1,
A general smart metering device for transmitting the measurement target value through a communication network; further comprising,
A remote meter reading system to which a security module is applied, characterized in that the measurement target value transmitted from the general smart metering device is not input to the security authentication module but is directly input to the collection unit of the collection server and stored and managed.

Images