KR102548430B1 - Apparatus and method establishing a policy of end-to-end communication - Google Patents

Abstract

Disclosed is an apparatus and method for automatically setting an identifier (ID)-based policy to be used when a terminal communication device such as an IoT terminal and an IoT service server is connected. A method for setting a connection policy between a first end communication device and a second end communication device in a policy management device according to an aspect includes an identifier of the first end communication device and a first security module connected to the first end communication device. Storing first connection relationship information matching the identifier of; storing second connection relationship information obtained by matching an identifier of the second end-end communication device with an identifier of a second security module connected to the second end-end communication device; checking a correspondence between the first end communication device and the second end communication device based on service group information and unique information of the first and second end communication devices; and storing identifier-based bi-directional connection information based on the first security module and bi-directional connection information based on the identifier based on the second security module in a policy storage unit by using the first and second connection relationship information, respectively. including;

Description

Apparatus and method for setting end-to-end communication policy {APPARATUS AND METHOD ESTABLISHING A POLICY OF END-TO-END COMMUNICATION}

The present invention relates to Internet of Things (IoT) technology, and more particularly, to an apparatus and method for setting a policy to be used when connecting an IoT terminal and an end-end communication device such as an IoT service server.

The Internet is evolving from a human-centered network in which humans create and consume information to an Internet of Things (IoT) network in which information is exchanged and processed between distributed components such as objects. The Internet of Things (IoT) refers to a concept capable of performing mutual communication by connecting all communicable things to a network. Things, which are all objects that can be recognized systematically, are equipped with short-distance and long-distance communication functions and can produce data through sensors. In order to implement IoT, technical elements such as sensing technology, wired and wireless communication and network infrastructure, service interface technology and security technology are required. Recently, technologies such as a sensor network for connection between objects, machine to machine (M2M), and machine type communication (MTC) have been studied. These IoT services are provided in a public network environment. In other words, anyone can access the IoT network at any time. As such, since the IoT service is provided in a public network environment, the IoT device (IoT terminal or IoT service server) may be exposed to the public network and security may be weak.

The present invention has been proposed to solve the above problems, to provide a device and method for automatically setting an identifier (ID: Identifier) based policy to be used when connecting an end-to-end communication device such as an IoT terminal and an IoT service server. There is a purpose.

A method for setting a connection policy between a first end communication device and a second end communication device in a policy management device according to an aspect includes an identifier of the first end communication device and a first security module connected to the first end communication device. Storing first connection relationship information matching the identifier of; storing second connection relationship information obtained by matching an identifier of the second end-end communication device with an identifier of a second security module connected to the second end-end communication device; checking a correspondence between the first end communication device and the second end communication device based on service group information and unique information of the first and second end communication devices; and storing identifier-based bi-directional connection information based on the first security module and bi-directional connection information based on the identifier based on the second security module in a policy storage unit by using the first and second connection relationship information, respectively. including;

The storing of the first connection relationship information may include receiving, from a first security module, an identifier of the first security module and unique information of the first end communication device; It may include assigning an identifier to the first terminal communication device and matching the assigned identifier with a first identifier of the first security module.

The receiving of the unique information may be performed in response to an operation in which the first security module is communicatively connected to the first end communication device.

The storing of the second connection relationship information may include receiving, from a second security module, an identifier of the second security module and unique information of the second end communication device; and assigning an identifier to the second terminal communication device and matching the assigned identifier with the identifier of the second security module.

The receiving of the unique information may be performed in response to an operation in which the second security module is communicatively connected to the second end communication device.

The checking of the corresponding relationship may include: checking whether service group information identified as the unique information of the first-end communication device and service group information identified as the unique information of the second-end communication device match; and acquiring third connection relationship information obtained by matching the identifier of the first-end communication device with the identifier of the second-end communication device.

The checking of service group information may include matching and storing an identifier of the first end-point communication device with service group information checked using the unique information of the first end-point communication device; and identifying an identifier of the first-end communication device matched to service group information identified using the unique information of the second-end communication device.

The storing of the policy in the storage unit may include: searching for the first and second connection relationship information using the third connection relationship information; combining all paths between the first and second end communication devices based on identifiers using the inquired first and second connection relationship information; and storing bi-directional connection information based on the first security module and bi-directional connection information based on the second security module in a policy storage unit in the entire path.

The policy storage unit may be a blockchain.

The unique information may be an IP address or a MAC address.

The bidirectional connection information based on the identifier based on the first security module may be composed of an identifier of the first terminal communication device, an identifier of the first security module, and an identifier of the second security module.

The bidirectional connection information based on the identifier based on the second security module may be composed of an identifier of the second terminal communication device, an identifier of the second security module, and an identifier of the second security module.

A policy management device for setting a connection policy between a first-end communication device and a second-end communication device according to another aspect includes an identifier of the first-end communication device and an identifier of a first security module connected to the first-end communication device. , the first connection relationship information matched, the identifier of the second end-end communication device, and the second connection relationship information matched with the identifier of the second security module connected to the second end-end communication device, the connection relationship information is stored. an identifier management unit stored in the unit; an end device management unit that checks a correspondence between the first end communication device and the second end communication device based on service group information and unique information of the first and second end communication devices; and storing identifier-based bi-directional connection information based on the first security module and identifier-based bi-directional connection information based on the second security module using the first and second connection relationship information, respectively, in a policy storage unit. It includes; a policy management unit that does.

The policy management device further includes a receiver configured to receive, from a first security module, an identifier of the first security module and unique information of the first end-point communication device, and the identifier management unit includes the first end-point communication device. An identifier may be assigned to and the assigned identifier may be matched with the first identifier of the first security module.

The receiving unit receives an identifier of the first security module and unique information of the first end communication device from the first security module in response to an operation in which the first security module is communicatively connected to the first end communication device. can receive

The policy management device further includes a receiver configured to receive, from a second security module, an identifier of the second security module and unique information of the second end communication device, and the identifier management unit includes the second end communication device. An identifier may be assigned to and the assigned identifier may be matched with an identifier of the second security module.

The reception unit receives an identifier of the second security module and unique information of the second end communication device from the second security module in response to an operation in which the second security module is communicably connected to the second end communication device. can do.

The end device management unit checks service group information identified as the unique information of the first end communication device and service group information identified as the unique information of the second end communication device, and identifies the identifier of the first end communication device and Third connection relationship information matching the identifier of the second end communication device may be obtained.

The end device management unit matches and stores the identifier of the first end communication device with the service group information identified using the unique information of the first end communication device, and stores the identified service using the unique information of the second end communication device. Matching of service group information of the first and second end communication devices may be confirmed by checking the identifier of the first end communication device matched with the group information.

The policy manager searches the first and second connection relationship information using the third connection relationship information, and uses the retrieved first and second connection relationship information to perform the first and second end communication based on identifiers. Full paths between devices may be combined, and bidirectional connection information based on the first security module and bidirectional connection information based on the second security module may be stored in a policy storage unit in the entire path.

The policy storage unit may be a block chain, and the unique information may be an IP address or a MAC address.

The bidirectional connection information based on the identifier based on the first security module may be composed of an identifier of the first terminal communication device, an identifier of the first security module, and an identifier of the second security module.

The bidirectional connection information based on the identifier based on the second security module may be composed of an identifier of the second terminal communication device, an identifier of the second security module, and an identifier of the second security module.

In one embodiment, security of IoT services through a public network is increased by using an identifier (ID)-based policy by breaking away from an IP address-based policy having high variability according to a network structure.

In one embodiment, security is provided to all IoT services without changing the legacy system by assigning an identifier (ID: Identifier) to the end communication device and automatically setting an identifier-based policy when the security module is communicably connected to the end communication device. can do.

In one embodiment, by recording bi-directional connection information based on an identifier based on a security module as a policy, in end-to-end communication through a public network, the security module of each end communicates with the lower end communication device. Only the security module on the other end needs to be identified. Therefore, security is strengthened by minimizing the exposure of the terminal communication device through the public network.

1 is a diagram illustrating an end-to-end communication system according to an embodiment of the present invention.
2 is a block diagram of the policy management apparatus of FIG. 1;
FIG. 3 is a flowchart illustrating the operation of the policy management device 150 in the end-to-end communication system of FIG. 1 .
4 is a diagram illustrating communication between an IoT terminal and an IoT service server as an embodiment of the end-to-end communication system of FIG. 1 .
5 is a flowchart illustrating a method of generating ID connection relationship information between an IoT service server and a second security module in the system of FIG. 4 .
6 is a flowchart illustrating a method of setting a connection policy between an IoT terminal and an IoT service server in the system of FIG. 4 .

The above-described objects, features and advantages will become more apparent through the following detailed description in conjunction with the accompanying drawings, and accordingly, those skilled in the art to which the present invention belongs can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an end-to-end communication system according to an embodiment of the present invention. Referring to FIG. 1 , the end-to-end communication system according to the present embodiment includes end-to-end communication devices 110 and 130, security modules 120 and 140, a policy management device 150, and a policy storage device 160. Including and they are connected to the communication network (170).

The end communication devices 110 and 130 are communication devices that exist at the ends of the communication path, and provide IoT services by communicating with IoT terminals such as gas sensors, fire detection sensors, cameras, artificial intelligence speakers, etc., for example. It includes an IoT service server that provides. The IoT terminal includes a memory, a processor, and a communication circuit to communicate with an IoT service server or to perform P2P communication with other IoT terminals. The IoT service server may be connected to the IoT terminal, periodically receive status information from the IoT terminal, update firmware of the IoT terminal, and provide services such as content streaming to the IoT terminal.

The security modules 120 and 140 are communicatively connected to the end communication devices 110 and 130 to protect the end communication devices 110 and 130 from external attacks through the communication network 170 . The security modules 120 and 140 are located at a higher layer of the end communication devices 110 and 130 on the communication layer. The security modules 120 and 140 may be manufactured in the form of physical adapters and physically connected to the terminal communication devices 110 and 130 . In this case, the security modules 120 and 140 may include a memory, a processor, and a communication circuit. Alternatively, the security modules 120 and 140 may be manufactured as software and stored in the memory of the terminal communication devices 110 and 130 to be executed. The security modules 120 and 140 are stored in their own storage with an arbitrary identifier (ID: Identifier, hereinafter referred to as ID) that can be distinguished from other security modules.

The security modules 120 and 140, when transmitting the packet received from the end communication devices 110 and 130 to the outside, query the policy storage device 160 for a policy, and according to the policy inquiry result, the outside of the packet decide whether to send At this time, the policy is an identifier (ID)-based policy, and is bi-directional connection information based on the security module (120, 140). In addition, the security modules 120 and 140 query the policy storage device 160 for a policy when a packet directed to the terminal communication devices 110 and 130 is received from the outside, and the packet is stored according to the policy inquiry result. Determines whether or not to transmit internally. To this end, when the security modules 120 and 140 are communicatively connected to the terminal communication devices 110 and 130 for the first time, their ID and unique information of the terminal communication devices 110 and 130, for example, IP The address or MAC address is transmitted to the policy management device 150 so that a connection policy between the terminal communication devices 110 and 130 is set.

When the security module 120 or 140 transmits the packet received from the terminal communication device 110 or 130 to the outside, the security module 120 or 140 requests a token seed from the policy storage device 160 and returns the token seed received from the policy storage device 160 The token generated by using is inserted into the packet and transmitted. In addition, the security modules 120 and 140, when a packet from the outside to the terminal communication devices 110 and 130 is received, requests the token seed used by the side transmitting the packet to the policy storage device 160 and , The token included in the packet is verified using the token seed received from the policy storage device 160. The security modules 120 and 140, upon successful token verification, remove the token from the packet received from the outside and deliver it to the internal terminal communication device 110 and 130.

The policy management device 150 sets an ID-based terminal communication connection policy and stores it in the policy storage device 160 . Here, the ID-based terminal communication connection policy includes ID-based two-way connection information based on the security modules 120 and 140 . For example, the ID-based bi-directional connection information based on the first security module 120 includes the ID of the first end communication device 110, the ID of the first security module 120, and the second security module ( 140) connection information. And the ID-based bidirectional connection information based on the second security module 140 includes the ID of the second end communication device 130, the ID of the second security module 140, and the ID of the first security module 120. It is connection information consisting of

The policy management device 150, when the security modules 120 and 140 are communicatively connected to the terminal communication devices 110 and 130 and operate, their ID and security module 120 from the security modules 120 and 140. , 140) receives unique information of the terminal communication device 110 or 130, for example, an IP address or a MAC address. The policy management device 150 creates ID connection relationship information between the end communication devices 110 and 130 and the security modules 120 and 140 after assigning IDs to end communication devices 110 and 130 that do not have IDs. The policy management device 150 checks the end communication devices 110 and 130 belonging to the same service group, and combines ID connection information with the security modules 120 and 140 to determine the end communication devices. Combine the entire path based on ID between (110, 130). In addition, the policy management device 150 generates bidirectional connection information based on the security modules 120 and 140 in the entire path and stores it in the policy storage device 160 .

The policy storage device 160 receives and stores the ID-based terminal communication connection policy generated by the policy management device 150 . The ID-based terminal communication connection policy includes ID-based two-way connection information based on the security module (120, 140). The policy storage device 160 includes nodes constituting a blockchain network. Nodes constituting a blockchain network periodically create blocks to record and store transactions. In an embodiment of the present invention, the transaction includes the ID-based end-to-end communication connection policy. Blocks created from the nodes constituting the blockchain network are made in a connected state like a chain, and since each node shares the same block, a significant number of nodes must be hacked to forge transactions stored in the block. In addition, if more than a certain number of transactions are recorded in the block, the nodes go through a mutual agreement process so that the transactions are accumulated equally.

2 is a block diagram of the policy management apparatus of FIG. 1; The policy management device 150 may include a memory, a memory controller, one or more processors (CPUs), a peripheral interface, an input/output (I/O) subsystem, a display device, an input device, and communication circuitry. These components communicate through one or more communication buses or signal lines. These various components may be implemented in hardware, software, or a combination of both hardware and software, including one or more signal processing and/or application specific integrated circuits.

The memory may include high-speed random access memory, and may also include one or more magnetic disk storage devices, non-volatile memory such as flash memory devices, or other non-volatile semiconductor memory devices. In some embodiments, memory is a storage device located remotely from one or more processors, such as RF circuitry, the Internet, an intranet, a local area network (LAN), a wide LAN (WLAN), a storage area network (SAN), and the like, or a network attached storage device accessed through a communication network (not shown), such as a suitable combination thereof. Access to memory by other components of the device, such as the processor and peripheral interface, may be controlled by the memory controller.

The peripheral interface connects the input/output peripherals of the device with the processor and memory. One or more processors execute various software programs and/or sets of instructions stored in memory to perform various functions and process data for the system. In some embodiments, the peripheral interface, processor and memory controller may be implemented on a single chip such as a chip. In some other embodiments, they may be implemented as separate chips.

The I/O subsystem provides an interface between peripheral interfaces and input/output peripherals of devices such as display devices and input devices. The display device may use a liquid crystal display (LCD) technology or a light emitting polymer display (LPD) technology, and the display device may be a capacitive, resistive, or infrared touch display.

A processor is a processor configured to perform operations associated with a system and to execute instructions, such as to control the receipt and manipulation of input and output data between components of the system using instructions retrieved from memory. In some embodiments, software components may be loaded (installed) with an operating system, a graphics module (instruction set), and a program for performing operations for the present invention. The operating system may be, for example, a built-in operating system such as Darwin, RTXC, LINUX, UNIX, OSX, WINDOWS or VxWorks, Android, iOS, etc., and performs general system tasks (eg, memory management, storage device control, power management, etc.) and facilitates communication between the various hardware and software components.

Communication circuitry may include Ethernet communication circuitry and RF circuitry. The Ethernet communication circuit performs wired communication, and the RF circuit transmits and receives electromagnetic waves. RF circuitry converts electrical signals into electromagnetic waves and vice versa, and communicates with communication networks, other mobile gateways, and communication devices through these electromagnetic waves. The RF circuitry may include known circuitry for performing these functions, including but not limited to, for example, an antenna system, an RF transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a CODEC chipset, a memory, and the like. can The RF circuitry may communicate with other devices by means of cellular telephone networks, wireless networks such as wireless LANs and/or metropolitan area networks (MANs), and short-range wireless communications.

As shown in FIG. 2, a receiving unit 210, an identifier management unit 220, a connection relationship information DB 230, a service group identification unit 240, a service group information DB 250, an end device management unit 260, A policy management unit 270 is included. The receiving unit 210, the identifier management unit 220, the service group identification unit 240, the terminal device management unit 260, and the policy management unit 270 may be implemented as programs and stored in a memory and then executed by a processor, or may be executed by a processor or hardware and It may be implemented as a combination of software.

When the security modules 120 and 140 are communicatively connected to the terminal communication devices 110 and 130 and operate, the receiver 210 receives its own ID and security modules 120 and 140 from the security modules 120 and 140. ) Receives unique information of the terminal communication devices 110 and 130 connected to, for example, an IP address or a MAC address. For example, it receives its ID and the MAC address of the first end communication device 110 from the first security module 120 . The second security module 140 receives its ID and the IP address of the second end communication device 130 .

The identifier management unit 220 assigns IDs to end communication devices 110 and 130 that do not have IDs, and then generates ID connection relationship information between the end communication devices 110 and 130 and the security modules 120 and 140 to obtain connection relationship information. Stored in DB (230). For example, when the reception unit 210 receives its ID and the MAC address of the first end communication device 110 from the first security module 120, the identifier management unit 220, the first end communication device ( 110), the ID of the first security module 120 and the ID of the first terminal communication device 110 are matched, and the connection relation information is stored in the connection relation information DB 230. In addition, when the reception unit 210 receives its ID and the IP address of the second end communication device 130 from the second security module 140, the identifier management unit 220, the second end communication device 130 A temporary ID is given to the second security module 140 and the ID of the second terminal communication device 130 is matched, and connection relation information is stored in the connection relation information DB 230.

The service group identification unit 240 checks service groups of end communication devices 110 and 130 connected to the security modules 120 and 140 by referring to information stored in the service group information DB 250 . The service group identification unit 240 receives the unique information of the terminal communication devices 110 and 130, for example, an IP address or a MAC address from the receiving unit 210, and uses the received unique information to provide service group information. In the DB 250, corresponding service group information is checked. The service group information DB 250 stores a corresponding service group name for each service group, and a list of MAC addresses or IP addresses of the terminal communication devices 110 and 130 belonging to the corresponding service group. For example, if Samsung Electronics provides an IoT service, the IP address of the platform server providing the IoT service and the MAC addresses of IoT terminals manufactured and sold by Samsung Electronics providing the IoT service are stored in the service group information DB 250. is stored in

The end device management unit 260 checks the correspondence of the end communication devices 110 and 130 using the service group information of the end communication devices 110 and 130 checked by the service group identification unit 240. The terminal device management unit 260 receives the IDs of the terminal communication devices 110 and 130 whose corresponding relationship is confirmed from the identifier management unit 220 and generates connection relationship information matching the received IDs. The terminal device management unit 260 may store ID connection relation information of the end communication devices 110 and 130 in the connection relation information DB 230 .

Depending on the embodiment, when service group information of any one end communication device (eg, 110) among the end communication devices 110 and 130 is received from the service group identification unit 240, the end device management unit 260 is an identifier management unit. The ID of the terminal communication device 110 received from 220 is matched with the corresponding service group of the service group information DB 250 and stored. Further, when the service group information of the other terminal communication device 130 is received from the service group identification unit 240, the terminal device management unit 260 stores the service group information DB 250 using the received service group information. After querying and receiving the ID of the communication device 110, the received ID of the terminal communication device 110 is matched with the ID of the terminal communication device 130 received from the identifier management unit 220, and the terminal communication device 110, 130) can obtain ID connection relationship information.

The policy management unit 270 checks the ID connection relationship information between the terminal communication devices 110 and 130 and the security modules 120 and 140 stored in the connection relationship information DB 230 and the terminal device management unit 260. ID-based two-way based on the security module 120, 140 using the corresponding relationship between the end-end communication devices 110 and 130, specifically, the ID connection relationship information between the end-end communication devices 110 and 130 Connection information is created and transmitted to the policy storage device 160 to be stored. Specifically, the policy management unit 270 uses the ID connection relationship information between the end communication devices 110 and 130 to connect the end communication devices 110 and 130 and security modules in the connection relationship information DB 230 ( 120, 140), and by using the ID connection relationship information between the searched end-end communication devices 110 and 130 and the security modules 120 and 140, the ID-based end-end communication device 110, 130) combine the entire pathway of the liver. In addition, the policy management unit 270 stores, for example, bidirectional connection information based on the first security module 120 and bidirectional connection information based on the second security module 140 in the entire path, respectively, in the policy storage device ( 160) to be transmitted and stored. For example, the ID-based bi-directional connection information based on the first security module 120 includes the ID of the first end communication device 110, the ID of the first security module 120, and the second security module ( 140) connection information. And the ID-based bidirectional connection information based on the second security module 140 includes the ID of the second end communication device 130, the ID of the second security module 140, and the ID of the first security module 120. It is connection information consisting of

FIG. 3 is a flowchart illustrating the operation of the policy management device 150 in the end-to-end communication system of FIG. 1 .

In step 301, the policy management device 150 generates connection relationship information matching the ID of the first terminal communication device 110 and the ID of the first security module 120. When the policy management device 150 receives its ID and the IP address or MAC address of the first end communication device 110 from the first security module 120, the temporary ID is assigned to the first end communication device 110. , and the ID of the first security module 120 and the ID of the first terminal communication device 110 are matched, and the connection relation information is stored in the connection relation information DB 230 .

In step 302, the policy management device 150 generates connection relationship information matching the ID of the second terminal communication device 130 and the ID of the second security module 140. When the policy management device 150 receives its ID and the IP address or MAC address of the second end communication device 130 from the second security module 140, the temporary ID is assigned to the second end communication device 130. , and the ID of the second security module 140 and the ID of the second terminal communication device 130 are matched, and connection relation information is stored in the connection relation information DB 230 .

In step S303, the policy management device 150 determines the service group information of the end communication devices including the first and second end communication devices 110 and 130 and the first and second end communication devices 110 and 130. A correspondence relationship between the first end communication device 110 and the second end communication device 130 is checked based on unique information, for example, an IP address or a MAC address. The policy management device 150 uses the unique information of the terminal communication device 110 or 130 received from the security modules 120 or 140, for example, an IP address or a MAC address to generate a service group information DB 250. Check the corresponding service group information in , and confirm that it is the same. The policy management device 150 generates ID connection relationship information between the terminal communication devices 110 and 130 whose corresponding relationship is confirmed. According to an embodiment, the policy management device 150 checks the service group information using the IP address or MAC address of the first end communication device 110, and then adds the service group information to the first end communication device 110. Match and save the ID. Then, the policy management device 150 searches for the ID of the first end communication device 110 matched to the service group information using the IP address or MAC address of the second end communication device 130, and then the end communication devices ID connection relationship information between (110, 130) is generated.

In step S304, the policy management device 150, the ID connection relationship information between the terminal communication devices (110, 130) and the security module (120, 140) stored in steps S301 and step S302, and the terminal identified in step S303 By using the correspondence between the communication devices 110 and 130, ID-based bi-directional connection information based on each security module 120 and 140 is generated and stored in the policy storage device 160, for example, a block chain. do. The policy management device 150 combines the entire path between the terminal communication devices 110 and 130, and then combines bidirectional connection information based on the first security module 120 and the second security module 140 in the entire path. The bidirectional connection information based on each is transmitted to and stored in the policy storage device 160 . For example, the ID-based bi-directional connection information based on the first security module 120 includes the ID of the first end communication device 110, the ID of the first security module 120, and the second security module ( 140) connection information. And the ID-based bidirectional connection information based on the second security module 140 includes the ID of the second end communication device 130, the ID of the second security module 140, and the ID of the first security module 120. It is connection information consisting of

4 is a diagram illustrating communication between an IoT terminal and an IoT service server as an embodiment of the end-to-end communication system of FIG. 1 . For example, an IoT terminal is a so-called artificial intelligence speaker that has a microphone and a speaker, receives a voice request from a user, transmits it to an IoT service server, and receives and outputs a response received from the IoT service server. The IoT service server is a device that provides an artificial intelligence voice assistant (Voice Assistant) service, recognizes and analyzes voice, and provides a corresponding service. In the embodiment with reference to FIG. 4, the IoT terminal 410 may be the first terminal communication device 110 in the embodiment with reference to FIG. 1, and the IoT service server 430 in the embodiment with reference to FIG. 1 It may be a two-end communication device (130). The first security module 120 may be connected to the IoT terminal 410 in the form of a physical adapter, or may be implemented as software and installed in the IoT terminal 410 to operate. In FIG. 4 , the gateway 420 may be, for example, a router. When a plurality of IoT terminals 410 are connected to the first security module 120, the gateway 420 is assigned a public IP address and allocates a private IP address to the plurality of IoT terminals 410. The IoT terminal 410 communicates with the IoT service server 430 through the gateway 420 and the Internet 440 .

In the embodiment with reference to FIG. 4 , when the second security module 140 is connected to the IoT service server 430, the policy management device 150 assigns a temporary ID to the IoT service server 430 so that the second security module Establish a connection relationship with the ID of (140). Then, when the first security module 120 is connected to the IoT terminal 410, the policy management device 150 grants a temporary ID to the IoT terminal 410 to establish a connection relationship with the ID of the first security module 120. Set up. The policy management device 150 uses the MAC address of the IoT terminal 140 and the IP address of the IoT service server 430 to confirm that they belong to the same service group, and then the IoT service server 430 and the second security module ( 140) using the ID connection relationship information between the IoT terminal 410 and the first security module 120 to create bi-directional connection information based on the security modules 120 and 140 and store the policy Save to device 160.

5 is a flowchart illustrating a method of generating ID connection relationship information between an IoT service server and a second security module in the system of FIG. 4 .

Referring to Figure 5, in step S501, the second security module 140 is communicatively connected to the IoT service server 430. Here, the communicable connection includes a physical connection or a software connection. In step S502, the second security module 140 collects the public IP address of the IoT service server 430 and transmits the collected public IP address and its own ID ₁ to the policy management device 150.

In step S503, the policy management device 150 assigns a temporary ID ₂ to the IoT service server 430. In step S504, the policy management device 150 stores the ID connection relationship between the second security module 140 and the IoT service server 430, that is, (ID ₁ and ID ₂ ). In step S505, the policy management device 150 checks the service group using the public IP address of the IoT service server 430. For example, it is confirmed that it is Samsung Electronics' IoT service. In step S506, the policy management device 150 matches and stores ID ₂ of the IoT service server 430 with the service group.

6 is a flowchart illustrating a method of setting a connection policy between an IoT terminal and an IoT service server in the system of FIG. 4, which is operated after the procedure described with reference to FIG. 5.

Referring to FIG. 6 , in step S601 , the first security module 120 is communicatively connected to the IoT terminal 410 . Here, the communicable connection includes a physical connection or a software connection. In step S602, the first security module 120 collects the MAC address of the IoT terminal 410 and transmits the collected MAC address and its own ID ₃ to the policy management device 150.

In step S603, the policy management device 150 assigns a temporary ID ₄ to the IoT terminal 410. In step S604, the policy management device 150 stores the ID connection relationship between the first security module 120 and the IoT terminal 410, that is, (ID ₃ and ID ₄ ). In step S605, the policy management device 150 checks the service group using the MAC address of the IoT terminal 410. For example, it is confirmed that it is an IoT terminal of Samsung Electronics.

Since ID ₂ of the IoT service server 430 matches the service group in the embodiment with reference to FIG. 5 , in step S606, the policy management device 150 determines the ID between the IoT terminal 410 and the IoT service server 430. Create connection relationship information (ID2: ID ₄ ). In step S607, the policy management device 150, by using the ID connection relationship information (ID2: ID ₄ ) between the IoT terminal 410 and the IoT service server 430, the IoT service server 430 and the second security module Check the ID connection relationship information between the (140) and the ID connection relationship information between the IoT terminal 410 and the first security module 120, and use this to determine the ID base between the IoT terminal 410 and the IoT service server 430 Combine all paths. The full path based on ID is (ID ₂ : ID ₁ : ID ₃ : ID ₄ ).

In step S608, the policy management device 150 generates bi-directional connection information based on the security modules 120 and 140 based on the ID-based full path and stores it in the policy storage device 160. ID-based two-way connection information based on the first security module 120 is (ID ₄ , ID ₃ , ID ₁ ). ID-based two-way connection information based on the second security module 140 is (ID ₃ , ID ₁ , ID ₂ ).

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in separate embodiments in this specification may be implemented in combination in a single embodiment. Conversely, various features that are described in this specification in a single embodiment may be implemented in various embodiments individually or in combination as appropriate.

Although actions are described in a particular order in the drawings, it should not be understood that such actions are performed in the specific order as shown, or that the actions are performed in a series of sequential order, or that all described actions are performed to achieve a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily performed by a person skilled in the art to which the present invention belongs, it will not be described in detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention to those skilled in the art to which the present invention belongs, and thus the above-described embodiments and It is not limited by drawings.

110: first end communication device
120: first security module
130: second end communication device
140: second security module
150: policy management device
160: policy storage device
170: communication network
210: receiver
220: identifier management unit
230: connection relationship information DB
240: service group identification unit
250: service group information DB
260: terminal device management unit
270: policy management department

Claims (24)

A method of setting a connection policy between a first end communication device and a second end communication device in a policy management device, the method comprising:
storing first connection relationship information obtained by matching an identifier of the first end-end communication device with an identifier of a first security module connected to the first end-end communication device;
storing second connection relationship information obtained by matching an identifier of the second end-end communication device with an identifier of a second security module connected to the second end-end communication device;
checking a correspondence between the first end communication device and the second end communication device based on service group information and unique information of the first and second end communication devices; and
policy storage of identifier-based bi-directional connection information based on the first security module and identifier-based bi-directional connection information based on the second security module by using the first and second connection relationship information and the corresponding relationship; storing in a means; According to claim 1,
The step of storing the first connection relationship information,
Receiving, from a first security module, an identifier of the first security module and unique information of the first end communication device;
and assigning an identifier to the first end communication device and matching the assigned identifier with a first identifier of the first security module. According to claim 2,
Receiving the unique information,
characterized in that it is performed in response to an operation in which the first security module is communicatively connected to the first end communication device. According to claim 1,
The step of storing the second connection relationship information,
Receiving, from a second security module, an identifier of the second security module and unique information of the second end communication device;
and assigning an identifier to the second end communication device and matching the assigned identifier with the identifier of the second security module. According to claim 4,
Receiving the unique information,
characterized in that it is performed in response to an operation in which the second security module is communicatively connected to the second end communication device. According to claim 1,
The step of confirming the corresponding relationship is,
checking whether the service group information identified as the unique information of the first-end communication device matches the service group information identified as the unique information of the second-end communication device; and
and obtaining third connection relationship information obtained by matching the identifier of the first-end communication device with the identifier of the second-end communication device. According to claim 6,
The step of confirming the matching of the service group information,
matching and storing an identifier of the first end communication device with service group information identified using the unique information of the first end communication device; and
and verifying an identifier of the first-end communication device matched to the identified service group information using the unique information of the second-end communication device. According to claim 6,
The step of storing the policy in the storage means,
querying the first and second connection relationship information using the third connection relationship information;
combining all paths between the first and second end communication devices based on identifiers using the inquired first and second connection relationship information; and
and storing bi-directional connection information based on the first security module and bi-directional connection information based on the second security module in a policy storage unit in the entire path. According to claim 1,
The method of claim 1, wherein the policy storage means is a block chain. According to claim 1,
The unique information is characterized in that the IP address or MAC address. According to claim 1,
The bi-directional connection information based on the identifier based on the first security module,
characterized in that it consists of an identifier of the first end communication device, an identifier of the first security module, and an identifier of the second security module. According to claim 11,
The identifier-based bi-directional connection information based on the second security module,
characterized in that it consists of an identifier of the second end communication device, an identifier of the second security module, and an identifier of the second security module. A policy management device for setting a connection policy between a first end communication device and a second end communication device, comprising:
The first connection relationship information obtained by matching the identifier of the first end communication device with the identifier of the first security module connected to the first end communication device, the identifier of the second end communication device, and the second end communication an identifier management unit that stores second connection relationship information, which is matched with an identifier of a second security module connected to the device, in the connection relationship information storage unit;
an end device management unit that checks a correspondence between the first end communication device and the second end communication device based on service group information and unique information of the first and second end communication devices; and
policy storage of identifier-based bi-directional connection information based on the first security module and identifier-based bi-directional connection information based on the second security module by using the first and second connection relationship information and the corresponding relationship; A policy management unit comprising a; policy management unit to store in the unit. According to claim 13,
A receiver configured to receive, from a first security module, an identifier of the first security module and unique information of the first end communication device;
The identifier management unit,
The policy management device, characterized in that assigning an identifier to the first terminal communication device and matching the assigned identifier with a first identifier of the first security module. 15. The method of claim 14,
the receiver,
and receiving an identifier of the first security module and unique information of the first end communication device from the first security module in response to an operation in which the first security module is communicatively connected to the first end communication device. policy management device. According to claim 13,
A receiver configured to receive, from a second security module, an identifier of the second security module and unique information of the second end communication device;
The identifier management unit,
The policy management device, characterized in that assigning an identifier to the second terminal communication device and matching the assigned identifier with the identifier of the second security module. 17. The method of claim 16,
the receiver,
Receiving an identifier of the second security module and unique information of the second end communication device from the second security module in response to an operation in which the second security module is communicatively connected to the second end communication device. policy management device. According to claim 13,
The terminal device management unit,
The service group information identified as the unique information of the first-end communication device and the service group information identified as the unique information of the second-end communication device are matched, and the identifier of the first-end communication device and the second-end communication device A policy management device characterized in that for obtaining third connection relationship information matching the identifier of. According to claim 18,
The terminal device management unit,
The service group information identified using the unique information of the first-end communication device is matched with the identifier of the first-end communication device and stored, and the service group information matched with the service group information identified using the unique information of the second-end communication device is stored. A policy management device characterized by confirming the matching of service group information of the first and second end communication devices by checking the identifier of the first end communication device. According to claim 18,
The policy management department,
The first and second connection relationship information is inquired using the third connection relationship information, and the entire path between the first and second end-end communication devices based on identifiers is determined using the retrieved first and second connection relationship information. and storing bi-directional connection information based on the first security module and bi-directional connection information based on the second security module in the policy storage unit in the entire path. According to claim 13,
The policy storage unit is a policy management device, characterized in that the block chain. According to claim 13,
The unique information is an IP address or a MAC address, characterized in that the policy management device. According to claim 13,
The bi-directional connection information based on the identifier based on the first security module,
The policy management device characterized in that it consists of an identifier of the first terminal communication device, an identifier of the first security module, and an identifier of the second security module. 24. The method of claim 23,
The identifier-based bi-directional connection information based on the second security module,
The policy management device characterized in that it consists of an identifier of the second terminal communication device, an identifier of the second security module, and an identifier of the second security module.

Images