KR102452489B1 - System for processing a dual security in apartment complexes - Google Patents

Abstract

The present invention relates to security processing in a multi-unit housing complex. To achieve the purpose, provided is a dual security processing system in a multi-unit housing complex, which includes: a first network switching device performing a switching operation based on Layer 3 to connect an external communication network with an internal communication network within the multi-unit housing complex comprising at least two management servers necessary for the management of the complex, and processing security on an IP layer between the network of the complex and the external communication network; and a second network switching device performing a switching operation based on Layer 2 to connect a device in each household in the complex with the internal communication network of the complex, and processing security on a data link layer. Therefore, the present invention is capable of preventing hacking as well as reducing the risk of hacking to the internal network.

Description

System for processing a dual security in apartment complexes

The present invention relates to a security processing system in an apartment complex.

In general, an apartment is a type of apartment building, in which a building with more than a certain floor is divided into several houses on each floor so that each independent household can live.

Recently, apartments with home network systems are being built. As a result, the components inside the household are systematized, so that a single controller can control various facilities wirelessly.

Meanwhile, with the recent development of information technology, not only PCs but also various home network devices such as mobile phones, digital TVs, PDAs, and game machines are being connected to a single network. have.

The aforementioned home network technology refers to an environment in which home network devices in the home are connected through a single topology so that they can share digital data and use broadband communication with each other. means wired and wireless network equipment itself, and in a broad sense, home network includes not only the equipment but also middleware and services for integration/control/operation between home network devices.

Meanwhile, attention is focused on smart apartments in which home network technology is applied to apartments.

A smart apartment is a residential integrated mobile service that provides everything in apartment life, and it can mean providing apartment notices, convenience services, communication between residents, inquiry and reservation of community facilities, and IoT services.

As interest in these smart apartments is rising, related companies are developing various types of platforms with high usability while maximizing the convenience of residents.

According to the development of these various platforms, a network environment is essentially implemented in a multi-unit housing complex such as an apartment, and there is a risk of hacking to the outside according to the implementation of the network environment.

For this reason, recently, it is essential to construct a security system in a multi-unit housing complex such as an apartment.

Korean Patent Publication No. 10-2005-0100811 (published on October 20, 2005)

According to the present invention, by applying a security protocol to a network switching device that connects an external communication network and an internal communication network, and a second network switching device connected to a device in each household, it is possible to reduce the risk of hacking into the internal network as well as to reduce the risk of hacking. It provides a double security processing system in an apartment complex that can block hacking through households.

Objects of the present invention are not limited to the objects mentioned above, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

As a technical means for achieving the above technical problem, the double security processing system in the apartment complex according to the embodiment of the present invention performs a switching operation based on layer 3 to perform the switching operation required for the management of the apartment complex with the external communication network. A first network switching device that connects an internal communication network of the complex within the apartment complex composed of at least two management servers, and performs security processing at the IP layer between the complex internal communication network and the external communication network, and a switching operation based on layer 2 It may include a second network switching device for connecting devices in each household in the apartment complex to an internal communication network and processing security in the data link layer by performing the operation.

According to an embodiment of the present invention, the first network switching device includes a first security module for performing security processing using either one of IPSec and GRE, which are tunneling methods in the IP layer, or a combination method of IPSec and GRE can do.

According to an embodiment of the present invention, the first security module performs a primary security process of checking the validity of the access request packet using pre-stored manager contact information as the access request packet of the administrator authority is received, The access request packet may be processed by performing secondary security processing on the access request packet whose validity is checked through the secondary security process in a tunneling method.

According to an embodiment of the present invention, the first security module is a security chip mounted on the first network switching device and having a security processing function or having a security processing function stored in an executable form in a memory in the first network switching device It may be a security program.

According to an embodiment of the present invention, the dual security processing system is included in the internal communication network and based on the reception of a SIP-based packet from the SIP-based application through communication with the external communication network, the second network A SIP-based service is provided through interworking with devices of each generation through a switching device, or a SIP-based service is provided through interworking with a management server connected to the first network switching device, user authentication method, TLS (Transport Layer) Security) Security through at least one or a combination of protocol-based security processing, S/MIME (Secure/Multipurpose Internet Mail Extension) method, NAI (Network Asserted Identity), SIP Identity, and SIP Privacy method, or a combination thereof It may include a SIP server that performs processing to process SIP-based packets.

According to an embodiment of the present invention, the second network switching device may include a second security module for performing security processing using any one of PPTP, L2TP, and MPLS, which are tunneling methods using the data link layer.

According to an embodiment of the present invention, the second security module is a security chip mounted on the second network switching device and having a security processing function or a security processing function stored in an executable form in a memory in the second network switching device. It may be a security program with

According to the above-described embodiment of the present invention, by applying a security protocol to the network switching device connecting the external communication network and the internal communication network, and the second network switching device connected to the device in each household, hacking of the internal network Not only can it reduce the risk, but it also has the effect of blocking hacking through generations.

1 is a diagram illustrating an overall network configuration of a dual security processing system in an apartment complex according to an embodiment of the present invention.
2 is a flowchart illustrating an operation process of a dual security processing system in an apartment complex according to an embodiment of the present invention.
3 is a flowchart illustrating an operation process of a dual security processing system in an apartment complex according to another embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and/or systems described herein. However, this is merely an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification. The terminology used in the detailed description is for the purpose of describing embodiments of the present invention only, and should in no way be limiting. Unless explicitly used otherwise, expressions in the singular include the meaning of the plural. In this description, expressions such as “comprising” or “comprising” are intended to indicate certain features, numbers, steps, acts, elements, some or a combination thereof, one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, acts, elements, or any part or combination thereof.

Hereinafter, a double security processing system in an apartment complex according to an embodiment of the present invention will be described with reference to the accompanying drawings.

Prior to the description of the embodiment of the present invention, a multi-family housing complex is a residential form in which several households and several households reside together in one building, and examples thereof include an apartment, a row house, a multi-family house, an officetel, and the like. However, the present invention is not limited thereto.

1 is a diagram illustrating an overall network configuration of a dual security processing system in an apartment complex according to an embodiment of the present invention.

As shown in FIG. 1, the dual security processing system connects the external communication network 10 and only the internal communication network 20, and as packets are received, the first network switching device 100 and each It may be configured as a second network switching device 120 that is connected to the device 30 in the household and processes the packet through a switching operation as packets are received.

The complex internal communication network 20 includes at least one management server 22 for managing various facilities within the apartment complex, for example, an elevator, a lobby door, a parking lot, an internal community facility, and the like, and a SIP server 24 for providing a SIP service. ), a network switching device 23 to which the plurality of second network switching devices 120 are connected, and an in-household device 30 connected to the second network switching device 120 . Here, the management server 22 may be connected to each of the ports (not shown) provided in the first network switching device 100 to be connected to the external communication network 10 .

The external communication network 10 includes a wired communication network such as the Internet, and a wireless communication network such as 4G and 5G, and a service server (not shown) to provide various services only through connection with various devices in the internal communication network 20 . ), various devices (not shown), etc. may be connected.

The first network switching device 100 according to an embodiment of the present invention uses a protocol address to provide a management server 22, a network switching device 23 and a SIP server within the external communication network 10 and the internal communication network 20 only. 24) as an L3 switching device that supports communication by connecting it, only when connecting between the internal communication network 20 and the external communication network 10, security processing can be performed at the IP layer.

The first network switching device 100 is an L3 switch and performs switching by reading an IP or IPX address of a packet for packet switching between ports, and may set a communication path only once. In particular, the first network switching device 100 may switch a packet using a corresponding security protocol, and may be a layer 3 switch because an IP or an IPX address corresponds to layer 3 among OSI 7 layers.

The first network switching device 100 checks the state of the device connected to each port during booting, loads the address of each management server 22 in the memory of the table, and performs switching based on this information when the packet is transmitted can do.

In particular, the first network switching device 100 according to the embodiment of the present invention can perform security processing at the IP layer when performing a switching operation, that is, IPsec ( Internet Protocol Security) and Generic Routing Encapsulation (GRE), or a combination thereof, may perform security processing.

To this end, the first network switching device 100 according to an embodiment of the present invention includes a first security module (not shown) consisting of a security chip in which a security program to which a tunneling protocol is applied is embedded, or a memory (not shown) in which a security program is stored. 110) may be included. Specifically, the first network switching device 100 uses different protocols according to the devices connected for each port, that is, the management server 22, the network switching device 23, and the SIP server 24, which are devices connected to each port at boot time. It may include a first security module 110 corresponding to a security chip in which an applicable security program is embedded. To this end, security level information for devices connected to each port is set in the first security module 110 of the first network switching device 100, and a security protocol suitable for the security level information of devices connected to each port is applied. As much as possible, it can be set at the time of initial booting. In addition, the first security module 110 monitors the state of the device connected to each port at a preset cycle, and as the type of the device connected to the arbitrary port is changed, using security level information according to the changed device type You can change the applied security protocol of

In addition, as the first security module 110 receives an access request packet with admin authority from a specific device, for example, the manager-side device 40 , it may be processed as double security. Specifically, the first security module 110 performs the first security processing using preset manager information, for example, smart phone contact information, as the access request packet of the administrator's authority is received through the external communication network 10, and then 1 As the secondary security processing is completed, secondary security processing of processing a packet is performed using a protocol applied to the security program, and the security-processed packet may be transmitted to the management server 22 through the secondary security processing. Here, the primary security processing may be performed by transmitting a predetermined message to preset smart phone contact information or through a phone connection using smart phone contact information.

The first security module 110 performs security processing on the IP packet coming from the external communication network 10 by using the security protocol applied to the first security module 110, and then transfers it to the internal communication network 20 only. Switching for transmitting to the external communication network 10 by using the security protocol applied to the first security module 110 to secure the IP packet transmitted to the management server 22 or just flowing in from the device in the internal communication network 20 to the external communication network 10 action can be performed.

Also, the first security module 110 may process a packet received at each port by applying a different security processing method to each port. Specifically, the first security module 110 checks the status of the management server 22 connected to each port during booting, and provides information about the address of each management server 22 and the security protocol that is a security processing method to be applied to each port. As the information is loaded into the memory and a packet is received at an arbitrary port, information on the security protocol applied to the arbitrary port is retrieved from the memory, and then, based on this, the packet received to the arbitrary port can be securely processed and transmitted.

The second network switching device 120 performs switching by reading the MAC address of the packet, and since the MAC corresponds to layer 2 of the OSI layer, it can be referred to as a layer 2 (L2) switch, and manages the devices 30 in each household. It may be connected to the server 22 or connected to the external communication network 10 through the network switching device 23 and the first network switching device 100 .

The second network switching device 120 can transmit data received through an arbitrary port only through a specific port. Check the state of the node connected to each, for example, the device 30 in the household, recognize the MAC address of each device 30 and load it in the memory, and then when a packet is received from the device 30 of each household A switching operation may be performed based on the information.

In particular, the second network switching device 120 according to the embodiment of the present invention is a tunneling scheme in the data link layer, PPTP (Point-to-Point Tunneling Protocol), L2TP (Layer Two Tunneling Protocol), MPLS (Multi-Protocol) The packet may be processed through at least one or more of (label switching) or a combination thereof.

To this end, the second network switching device 120 according to the embodiment of the present invention is composed of a security chip having a security processing function applied to the tunneling protocol in the data link layer, or a program to which the tunneling protocol in the data link layer is applied is executed. The second security module 130 may include a memory (not shown) stored in a possible form.

In addition, the second security module 130 may process a packet received at each port by applying a different security processing method to each port of the second network switching device 120 . Specifically, the second security module 110 recognizes the MAC address of each device 30 connected to each port during booting, loads information on different security protocols to be applied to each port in the memory, and sends the packet to an arbitrary port. As it is received, information on the security protocol applied to the arbitrary port is retrieved from the memory, and the packet received to the arbitrary port can be securely processed and transmitted based on this.

On the other hand, the dual security processing system according to the embodiment of the present invention is only included in the internal communication network 20 and SIP-based packets are received from the SIP-based application 50 through communication with the external communication network 10. Accordingly, a SIP-based service is provided through interworking with the devices 30 of each generation through the second network switching device 120 or SIP-based service is provided through interworking with the management server 22 connected to the first network switching device 100 . User authentication method, TLS (Transport Layer Security) protocol-based security processing, S/MIME (Secure/Multipurpose Internet Mail Extension) method, NAI (Network Asserted Identity), SIP identity and SIP privacy The SIP server 24 may further include a SIP server 24 for processing SIP-based packets by performing security processing through at least one of (Privacy) methods or a combination thereof. Here, the S/MIME method means that the body of the message, which is a SIP-based packet, is generated and encrypted with MIME, the NAI is a method of identifying the sender within the same domain, and the SIP identity is a method that authenticates the sender between domains. SIP privacy is a method of protecting a specific part of a message received through an external domain, and user authentication is a method of confirming whether the identifier of the sender, that is, the application 50 is an authenticated user.

An operation process of the double security processing system in the multi-unit housing complex having the configuration as described above will be described with reference to FIGS. 2 and 3 .

2 is a flowchart illustrating an operation process of a dual security processing system in an apartment complex according to an embodiment of the present invention.

As shown in FIG. 2 , the first network switching device 100 secures the packet as a security protocol through the first security module 110 as the packet is introduced through an arbitrary port ( S200 ), and then transmits the packet. It is transmitted to the destination address of (S210). Here, the packet flowing into an arbitrary port is simply a request for access of the management server 22 in the internal communication network 20 , and the device 30 in each household through the internal communication network 20 and the second network switching device 120 . ), but may include, but is not limited to, an access request from the internal communication network 20 to the external communication network 10, and the like.

On the other hand, as the packet is introduced into the second network switching device 120 ( S220 ), the second network switching device 120 secures the packet with a security protocol through the second security module 130 , and then sends it to the corresponding destination address. to (S230).

3 is a flowchart illustrating an operation process of a dual security processing system in an apartment complex according to another embodiment of the present invention.

As shown in FIG. 3 , the first network switching device 100 recognizes the state and address of the management server 22 connected to each port as it boots ( S300 ) and uses the first security module 110 . Thus, information of a security protocol to be applied to each port to which each management server 22 is connected is set in memory (S310). To this end, information of a security protocol to be applied to each management server 22 according to a type is stored in the first security module 110 .

In addition, the second network switching device 120 recognizes the state and MAC address of the device 30 connected to each port as it boots ( S320 ), and uses the second security module 130 to each device 30 . ) sets the information of the security protocol to be applied to each connected port in the memory (S330). To this end, information of a security protocol to be applied according to the type of each device 30 is stored in the second security module 130 .

Thereafter, as the packet is introduced to a random port of the first network switching device 100 ( S340 ), the first network switching device 100 provides information on the security protocol applied to the arbitrary port through the first security module 110 . is retrieved from the memory (S342), and the packet flowing into an arbitrary port is processed using the security process and transmitted to the destination address of the packet through a switching operation (S344).

On the other hand, as the packet is introduced through the arbitrary port of the second network switching device 120 ( S350 ), the second network switching device 120 performs the security protocol applied to the arbitrary port through the second security module 110 . After information is retrieved from the memory (S352), a packet flowing into an arbitrary port is secured using this information and transmitted to the destination address of the packet through a switching operation (S354).

Meanwhile, combinations of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, such that the instructions executed by the processor of the computer or other programmable data processing equipment are described in each block of the block diagram. It creates a means to perform functions.

These computer program instructions may also be stored in a computer-usable or computer-readable recording medium (or memory), etc., which may direct a computer or other programmable data processing equipment to implement a function in a specific manner, so that the computer is available. Alternatively, the instructions stored in the computer-readable recording medium (or memory) may produce an article of manufacture including instruction means for performing the functions described in each block of the block diagram.

And, since the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other program It is also possible that instructions for performing the possible data processing equipment provide steps for performing the functions described in each block of the block diagram.

In addition, each block may represent a module, segment, or part of code including at least one or more executable instructions for executing specified logical function(s). It should also be noted that, in some alternative embodiments, it is also possible for the functions mentioned in the blocks to occur out of order. For example, it is possible that two blocks shown in succession are actually performed substantially simultaneously, or that the blocks are sometimes performed in the reverse order according to the corresponding function.

10: external communication network
20: only internal communication network
30: device
40: admin side device
50: application
100, 120: first and second network switching devices
110, 130: first and second security modules

Claims (7)

In a double security processing system in a multi-unit housing complex,
A switching operation is performed based on layer 3 to connect an external communication network and an internal communication network within the apartment complex composed of at least two management servers required for the management of the apartment complex, and at the IP layer between the network and the external network a first network switching device for performing security processing;
A second network switching device for performing a switching operation based on layer 2 to connect devices in each household in the apartment complex to an internal communication network, and to process security in a data link layer;
The first network switching device,
A first security module for performing security processing using either one of IPSec and GRE, which is a tunneling method in the IP layer, or a combination method of IPSec and GRE,
The first security module,
As the access request packet with administrator authority is received, a primary security process of checking the validity of the access request packet is performed using pre-stored manager contact information, and the access request packet whose validity is checked through the primary security process is tunneled Process the access request packet by performing secondary security processing in this way,
As a SIP-based packet is received from an application that is included in the complex internal communication network and operates based on SIP through communication with the external communication network, SIP-based through interworking with devices of each generation through the second network switching device SIP-based service is provided by providing a service of A SIP server that processes SIP-based packets by performing security processing through at least one or a combination of Multipurpose Internet Mail Extension) method, NAI (Network Asserted Identity), SIP Identity, and SIP Privacy method. A double security processing system in an apartment complex comprising:
delete delete According to claim 1,
The first security module,
Double security in an apartment complex, characterized in that it is a security chip mounted on the first network switching device and has a security processing function or a security program having a security processing function stored in an executable form in a memory in the first network switching device processing system.
delete According to claim 1,
The second network switching device,
and a second security module for performing security processing using any one of PPTP, L2TP, and MPLS, which are tunneling methods using the data link layer.
7. The method of claim 6,
The second security module,
Dual in an apartment complex, characterized in that it is a security chip mounted on the second network switching device and has a security processing function or a security program having a security processing function stored in an executable form in a memory in the second network switching device secure processing system.

Images