KR102478699B1 - Blockchain-based IoT security method and apparatus - Google Patents

Abstract

The present invention discloses a blockchain-based IoT security method and device. According to the present invention, a processor; And a memory including the processor, wherein the memory generates a plurality of paths for transmitting a packet including data about the event to a server when an event occurs from a sensor, and is updated at a preset cycle. Encrypting the plurality of paths using an encryption key, encrypting a packet including each of the plurality of encrypted paths, and transmitting the encrypted packet to the server through each of the plurality of paths, by the processor Program instructions to be executed, wherein the plurality of paths include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table, and the encrypted packets are sent to the next client in a number corresponding to the plurality of paths. It is transmitted to the address, and the server is provided with a blockchain-based IoT security device that performs packet verification using packets received through each of the plurality of paths.

Description

Blockchain-based IoT security method and apparatus {Blockchain-based IoT security method and apparatus}

The present invention relates to a blockchain-based IoT security method and device.

Recently, technologies such as artificial intelligence, big data, cloud, Internet of Things (IoT), and networks are being developed in line with the hyper-connected era. As these technologies are advanced, resources are shared by virtualization or cloud environments are being built without depending on a single existing OS or hardware.

As such, although the number of systems using the network is increasing, the security of the network is still insufficient. In particular, the Internet of Things (IoT) is a technology that controls sensors by connecting them to a network, and is used not only in industry and society but also at home. The Internet of Things used at home is called a smart home and refers to a system that can connect and control all devices in the home, such as consumer devices, security devices, and home appliances.

As a fatal disadvantage of these devices, security has become a problem. Devices with weak security can cause secondary damage by identifying life patterns such as personal information leakage and data interception by hackers, such as invasion of privacy of users.

Today, as the number of single-person households increases, the seriousness is on the rise, and the vulnerability of the Internet of Things is increasing every year. On the other hand, as it enters the block chain 3.0 phase, it is being used in various fields such as the medical field, transportation industry, sports and art fields. In addition, security algorithms are being studied with the DAG algorithm, which is a core technology of blockchain.

The DAG (Directed Acyclic Graph) algorithm, which is the core technology of blockchain, has a scaling problem because it processes verification simultaneously. Initially, the client processes a small amount of data, but as the size of the file grows later, the amount of data processed increases, efficiency decreases, and resources are occupied.

US Patent Publication 2019-0349426

In order to solve the problems of the prior art, the present invention proposes a blockchain-based IoT security method and device capable of increasing data processing efficiency.

In order to achieve the above object, according to an embodiment of the present invention, as a blockchain-based IoT security device, a processor; And a memory including the processor, wherein the memory generates a plurality of paths for transmitting a packet including data about the event to a server when an event occurs from a sensor, and is updated at a preset cycle. Encrypting the plurality of paths using an encryption key, encrypting a packet including each of the plurality of encrypted paths, and transmitting the encrypted packet to the server through each of the plurality of paths, by the processor Program instructions to be executed, wherein the plurality of paths include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table, and the encrypted packets are sent to the next client in a number corresponding to the plurality of paths. It is transmitted to the address, and the server is provided with a blockchain-based IoT security device that performs packet verification using packets received through each of the plurality of paths.

The plurality of routes may be three, and each of the three routes may include three client addresses that do not overlap each other.

The encrypted packet may include a number, an event client address, the plurality of client addresses included in each of the plurality of paths, a server address, and sensor data.

The number may be updated according to the address of the client where the event occurred and the address of the client that received the encrypted packet.

In the packet received by the server, the number may include the sum of the address of the client where the event occurred and the addresses of a plurality of clients included in one path.

The server may determine whether the received packet is reliable by comparing the number of the received packet with the address of the last client that transmitted the received packet.

The encryption key may be periodically updated through an AES block encryption algorithm.

According to another aspect of the present invention, a block chain-based IoT security method for a device including a processor and a memory, when an event occurs from a sensor, a plurality of paths for transmitting a packet including data about the event to a server. generating; encrypting the plurality of paths using an encryption key that is updated at a preset cycle; encrypting a packet including each of the plurality of encrypted paths; And transmitting the encrypted packet to the server through each of the plurality of paths, wherein the plurality of paths include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table, wherein the Encrypted packets are transmitted to the next client address in the number corresponding to the plurality of routes, and the server performs packet verification using packets received through each of the plurality of routes. A blockchain-based IoT security method is provided .

According to another aspect of the present invention, a computer readable program for performing the method according to claim 8 is provided.

According to another aspect of the present invention, as a blockchain-based IoT security system, when an event occurs from a sensor, a plurality of paths are generated for transmitting a packet including data about the event to a server, and at a preset cycle. a plurality of clients encrypting the plurality of paths using an updated encryption key and encrypting packets including each of the plurality of encrypted paths; And a server that performs packet verification using packets received through each of the plurality of paths, wherein the plurality of client addresses are randomly determined not to overlap with each other through a pre-stored lookup table, wherein the A blockchain-based IoT security system is provided in which encrypted packets are transmitted to the next client address in a number corresponding to the plurality of routes.

According to the present invention, there is an advantage in promoting system stabilization by reducing resources while improving IoT security.

1 is a diagram illustrating a blockchain-based IoT security architecture according to a preferred embodiment of the present invention.
2 is a diagram illustrating a process of changing an encryption key.
3 is a diagram illustrating a process of changing an encryption key.
4 is a diagram illustrating a method of changing an IV.
5 is a diagram showing the structure of an encrypted packet according to this embodiment.
6 illustrates a process of transmitting a packet from a client where an event occurs to a server according to the present embodiment.
7 is a diagram showing the configuration of a client according to a preferred embodiment of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments are illustrated in the drawings and described in detail.

However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Like reference numerals have been used for like elements throughout the description of each figure.

In the present invention, to enhance security in the Internet of Things environment, security is improved by using a blockchain-based algorithm. We propose an IoT security architecture suitable for

According to this embodiment, when an event occurs in a client to which a sensor is connected, the client where the event occurs individually transmits encrypted packets through a plurality of randomly generated paths, and the server transmits encrypted packets received through different paths. Decrypt and perform packet verification.

Encryption according to this embodiment periodically changes an encryption key using an Advanced Encryption Standard (AES) algorithm. Through this method, a client with a problem can be inferred, and even if the packet is exposed, the encryption key cannot be inferred.

1 is a diagram illustrating a blockchain-based IoT security architecture according to a preferred embodiment of the present invention.

The blockchain-based IoT security architecture according to this embodiment has a structure modified from an existing DAG algorithm.

In general, in a DAG algorithm, an acyclic directed graph is a graph that does not cycle and continues in one direction, and has multi-directionality without a fixed order and continues only in one direction. In the conventional DAG algorithm, one client may receive and transmit packets redundantly. However, there is a problem in that when the number of packet processing processes increases, memory usage increases and power usage increases.

Accordingly, the present invention allows an encrypted packet to be transmitted from a client where an event occurs to a server without a client transmitting and receiving packets redundantly when an event occurs.

Referring to FIG. 1 , the first client 100-1 where an event occurs generates a plurality of paths 104-1 to 104-3 for transmitting event-related packets to the server 102.

According to a preferred embodiment of the present invention, the first client 100-1 generates a plurality of paths including a plurality of client addresses randomly determined not to overlap each other through a lookup table.

As shown in FIG. 1, when a new client joins the network, the new client is registered through the server 102, and the registered client's address is encrypted and transmitted to the clients connected to the server 102 through broadcasting. .

The client receiving this stores the address of the new client in the lookup table.

1 shows a case in which packets are divided into three groups and transmitted.

The first client 100-1 encrypts each of a plurality of routes using an encryption key that is updated at a preset cycle, and encrypts packets including the encrypted routes.

The first client 100-1 transmits the encrypted packet to the first clients 100-2 to 100-4 of each of a plurality of paths.

The server 102 performs packet verification using packets received through each of a plurality of paths.

As described above, the encryption key for packet encryption is periodically updated, and the AES block encryption operation mode is used in this embodiment.

The AES algorithm is an encryption algorithm established by the National Institute of Standards and Technology (NIST) and approved by the National Security Agency for use in top secret applications. The AES algorithm is a symmetric key algorithm that uses the same key in encryption and decryption processes and has an SPN structure.

Although the SPN (substitution permutation network) structure has the disadvantage of requiring an inverse function in the encryption/decryption process, it can be designed more efficiently than the Feistel structure because encryption/decryption can be performed at once without moving bits in the middle. By utilizing the text box (S-box) and the permutation box (P-box) used for encryption, a cipher text block is generated through several rounds.

There are five block encryption operating modes: ECB (Electronic Code Block) Mode, CBC (Cipher Block Chaining) Mode, CFB (Cipher FeedBack) Mode, OFB (Output FeedBack) Mode, and CTR (CounTeR) Mode. Among them, the CBC technique is applied to the AES encryption algorithm.

CBC encryption is the most widely used encryption method with the highest security among block encryption operation modes. It is computed. The encryption key value used here is changed at regular intervals through rotation, time synchronization, and modular operation.

According to this embodiment, for encryption in the client 100 and the server 102, the encryption key is renewed at regular intervals.

Referring to FIG. 1 , when an event occurs, a first client 100-1 transmits an encrypted packet to randomly determined other three clients 100-2 to 100-4.

The client receiving the encrypted packet decrypts it, encrypts it again, and transmits it to the next client. Afterwards, the server decrypts the three packets and performs packet verification.

2 is a diagram illustrating a process of changing an encryption key.

,

는 192bit(24byte)

는 192bit(24byte)로 구성된다. 암호화 기호는 다음과 같이 사용된다(

: 암호 키 1,

: 암호 키 2,

: 임시 암호 키, P: 입력, C: 출력)IV (Initialization Vector) in the encryption key is 128 bits (16 bytes),

,

is 192bit(24byte)

is composed of 192 bits (24 bytes). Encryption symbols are used as follows (

: Passkey 1,

: passkey 2,

: temporary encryption key, P: input, C: output)

The encryption key is periodically changed, and if it is the same as the current time, the encryption key is used without change, and if the period is exceeded, the encryption key is changed.

은 시간 함수로 연산 되어 다시 출력된다. 출력된

은 왼쪽 시프트 연산을 하여

에 한 자리씩 이동시켜 대입한다. 이때, 최상위비트에 해당하는

의 자리는

자리로 이동한다. 즉, 수학식 1과 같이 정의된다. If the defined time differs from the current time, the encryption key

is calculated as a time function and output again. output

is left shift operation

Move one place to , and substitute. At this time, the highest bit corresponding to

the seat of

move to seat That is, it is defined as in Equation 1.

은

으로 다시 복사하여 암호 키로 사용한다. 암호화가 변경되면

는 IV와 조합하여 사용되고 있는 암호 키 전체를 변경한다.

silver

Copy it back to , and use it as an encryption key. When encryption is changed

changes the entire encryption key being used in combination with the IV.

3 is a diagram illustrating a process of changing an encryption key.

Referring to Figure 3, the encryption key is changed using the current time of the system.

의 24 byte의 1 byte 씩 순서대로 XOR 연산하여

로 다시 출력한다. More specifically, it adds the months of the current date and the minutes of the hour,

By performing XOR operation of 24 bytes of 1 byte in order

output again with

Equation 2 shows the above calculation process.

는

에 복사되어 저장된다. used here

Is

copied and stored in

는 임시 암호 키로 사용된다. 이는 네트워크의 타임아웃 또는 정상적인 복호화가 이루어지지 않을 경우 사용되는 암호 키이다.

is used as a temporary encryption key. This is an encryption key used when the network times out or normal decryption does not occur.

The temporary cryptographic key is discarded when the next cryptographic key is changed.

4 is a diagram illustrating a method of changing an IV.

의 192bit(24byte)는 24byte 중 뒤의 8byte의 자리를 버리고, 앞자리 16byte만 사용하여

와 IV를 XOR 연산한다. Referring to Figure 4, the encryption key

For 192bit (24byte) of 24bytes, the last 8bytes are discarded and only the first 16bytes are used.

and IV are XORed.

The computed IV is used again to generate an encryption key.

,

,

및 IV를 조합하여 연산한다. In this way, the key used as the encryption key in the entire algorithm is

,

,

and IV are combined and calculated.

Referring back to FIG. 1 , the first client 100-1 where an event occurs encrypts one or more routes and packets including the same using an encryption key that is updated at a preset cycle, and the first client 100 of each of the plurality of routes -2 to 100-4).

5 is a diagram showing the structure of an encrypted packet according to this embodiment.

As shown in FIG. 5, the packet according to this embodiment includes a number, an event client address, a plurality of randomly generated client addresses (Random Address 1 to 3), and a server address. ) and sensor data.

FIG. 5 is a diagram illustrating a packet structure when each of a plurality of paths is transmitted from a client where an event occurs to a server through three clients.

Here, a plurality of randomly generated client addresses (Random Addresses 1 to 3) may be individually generated for each of a plurality of routes, and when packets are transmitted in three groups as shown in FIG. 1, each of the three groups is individually generated. do.

In addition, the packet can consist of a total of 20 bytes, and the octet 4 address of the current client is substituted for the number.

According to this embodiment, the number is updated according to the address of the client where the event occurred and the address of the client that received the encrypted packet.

In 4 bytes, the address of the client where the event occurred is entered.

From 8 bytes to 12 bytes, the client address corresponding to multiple paths randomly generated by the event generating client is input.

The address of the server is entered in 15 bytes, and the data generated by the event client is input from 18 bytes.

According to this embodiment, a plurality of randomly generated client addresses are encrypted using an encryption key so that the order of the next client's address cannot be known.

Encryption of the client address corresponding to each path is as shown in Equation 3 below.

As in Equation 3, 2 bits of the current address are shifted and an arbitrarily defined number "2" and XOR are operated and encrypted.

The server 102 receives packets received through each of a plurality of paths and performs verification.

According to this embodiment, packet verification is performed based on the packet number and the last client address that transmitted the packet to the server 102.

The server 102 checks the sum of the client address where the event occurred and the randomly generated client address for each group through the number, and compares the last address of the client transmitting the packet to determine whether the packet is reliable. do.

6 illustrates a process of transmitting a packet from a client where an event occurs to a server according to the present embodiment.

In FIG. 6, packets are divided into three groups and transmitted, the first route is when the client addresses are 192.168.0.7, 192.168.0.2, and 192.168.0.1 (A(7, 2, 1)), and the second route is the client address. If the addresses are 192.168.0.9, 192.168.0.4, 192.168.0.8 (A(9, 4, 8)), and the third path is the client address 192.168.0.10, 192.168.0.6, 192.168.0.3 (A(10, 6, 3)).

If the description is centered on the first route, the event generating client transmits a packet encrypted with “5, E5, A (7, 2, 1), S15, D1” to the client whose client address is 192.168.0.7, and receives it. The first client of the first path inputs 12, which is the sum of 5 and 7, in the number position and transmits it to the next client.

Thereafter, the packets are summed up in the same way and 15 is entered in the number position, and the packets are transmitted to the server 102.

The server 102 verifies whether the packet is properly received through one of a plurality of paths generated by the event generating client by using the number input in place of the number and the address of the last client of the first path.

Address summation and packet verification are similarly performed for the remaining second and third paths.

If the packet verification fails, the server 102 discards the packet and stores the suspected client in a lookup table.

7 is a diagram showing the configuration of a client according to a preferred embodiment of the present invention.

As shown in FIG. 7 , a client according to this embodiment may include a processor 700 and a memory 702 .

The processor 700 may include a central processing unit (CPU) capable of executing a computer program or other virtual machines.

Memory 702 may include a non-volatile storage device such as a non-removable hard drive or a removable storage device. The removable storage device may include a compact flash unit, a USB memory stick, and the like. Memory 702 may also include volatile memory, such as various random access memories.

The memory 702 stores program instructions executable by the processor 700 .

Program commands according to this embodiment generate a plurality of paths for transmitting a packet including data about the event to a server when an event occurs from a sensor, and uses an encryption key that is updated at a predetermined cycle to retrieve the information. A plurality of paths are encrypted, a packet including each of the plurality of encrypted paths is encrypted, and the encrypted packet is transmitted to the server through each of the plurality of paths.

Here, the plurality of routes include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table, and the encrypted packets are transmitted to the next client address in a number corresponding to the plurality of routes, The server performs packet verification using packets received through each of the plurality of paths.

The embodiments of the present invention described above have been disclosed for illustrative purposes, and those skilled in the art having ordinary knowledge of the present invention will be able to make various modifications, changes, and additions within the spirit and scope of the present invention, and such modifications, changes, and additions will be considered to fall within the scope of the following claims.

Claims (10)

As a blockchain-based IoT security device,
processor; and
Including a memory containing the processor,
the memory,
When an event occurs from the sensor, a plurality of paths are generated to transmit a packet including data related to the event to the server;
Each of the plurality of paths includes a plurality of client addresses that do not overlap each other,
Encrypting the plurality of client addresses included in each of the plurality of paths using an encryption key that is renewed at a predetermined cycle,
Encrypting a packet including each of the encrypted plurality of client addresses;
So that the encrypted packet is transmitted to the server through each of the plurality of paths,
Including program instructions executed by the processor,
The plurality of paths include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table,
The encrypted packets are transmitted to the next client address in a number corresponding to the plurality of routes, and the server performs packet verification using packets received through each of the plurality of routes. Blockchain-based IoT security device. According to claim 1,
The plurality of paths are three,
A blockchain-based IoT security device where each of the three paths contains three non-overlapping client addresses. According to claim 1,
The encrypted packet is a blockchain-based IoT security device including a number, an event client address, the plurality of client addresses, server addresses, and sensor data included in each of the plurality of routes. According to claim 3,
The number is a blockchain-based IoT security device that is updated according to the address of the client where the event occurred and the address of the client that received the encrypted packet. According to claim 4,
In the packet received by the server, the number includes the sum of the address of the client where the event occurred and the addresses of a plurality of clients included in one path. Blockchain-based IoT security device. According to claim 5,
The server compares the number of the received packet with the address of the last client that transmitted the received packet to determine whether it is a reliable packet. According to claim 1,
The encryption key is a blockchain-based IoT security device that is periodically updated through the AES block encryption algorithm. A block chain-based IoT security method for a device including a processor and memory,
generating a plurality of paths for transmitting a packet including data about the event to a server when an event occurs from a sensor, wherein each of the plurality of paths includes a plurality of client addresses that do not overlap with each other;
encrypting the plurality of client addresses included in each of the plurality of routes using an encryption key renewed at a preset cycle;
encrypting a packet including each of the encrypted plurality of client addresses; and
Transmitting the encrypted packet to the server through each of the plurality of paths,
The plurality of paths include a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table,
The encrypted packets are transmitted to the next client address in a number corresponding to the plurality of routes, and the server performs packet verification using packets received through each of the plurality of routes. Blockchain-based IoT security method. A computer program stored in a computer readable recording medium for performing the method according to claim 8. As a blockchain-based IoT security system,
When an event occurs from the sensor, a plurality of routes are generated to transmit a packet including data about the event to a server, each of the plurality of routes includes a plurality of client addresses that do not overlap with each other, and a preset a plurality of clients encrypting the plurality of client addresses included in each of the plurality of routes using an encryption key that is periodically updated, and encrypting packets including each of the plurality of encrypted client addresses; and
Including a server that performs packet verification using packets received through each of the plurality of paths,
The plurality of n includes a plurality of client addresses randomly determined not to overlap with each other through a pre-stored lookup table, and the encrypted packets are transmitted to the next client address in a number corresponding to the plurality of routes Blockchain-based IoT security system.

Images