KR20070122313A - Method for data security and home network system by using the same - Google Patents

Abstract

A data security method and a home network system using the same are provided to ensure the reliability of data transmission by performing the security encoding of data transmitted without a separate authentication process when the data are transmitted between a transmitting party and a receiving party. A home network system includes a home gateway(200) and a local device(300). The home gateway generates a serial number according to the number of communication with the local device, encodes the generated serial number and data, and transmits a data packet. The local device decodes the data packet transmitted in the home gateway, calculates back the number of communication with the home gateway through the decoded data and serial number, verifies the data, and transmits the verified information to the home gateway.

Description

Data security method and home network system using the same {Method for data security and home network system by using the same}

1 is a block diagram showing a home network system according to the present invention.

2 is a block diagram showing a main part of a home network system according to the present invention.

3 is a flowchart illustrating a data transmission process in a home network system according to the present invention.

4 is a flowchart illustrating a data receiving process in a home network system according to the present invention.

5 is a structural diagram illustrating a packet conversion process in a home network system according to the present invention.

6 is a table for generating a serial number in a home network system according to the present invention.

** Description of the symbols for the main parts of the drawings **

10: home network system

100: communication network

200: home gateway

230: security module

300: local device

330 local security module

The present invention relates to a data security method and a home network system using the same, and more particularly, to a data security method for protecting data exchanged during a communication process between a home server and a local device in a home network, and a home network system using the same. will be.

In recent years, the rapid development of wired and wireless data communication technology and the expansion and spread of the communication network on which it is based have led to the popularization of high-speed communication services such as the Internet.

In particular, as the high-speed Internet is spreading into homes, existing PC-based network construction technologies are evolving into home network technologies for remote control of digital information appliances in homes.

This home network system is developed from the home automation system of the past, and it can provide basic automation functions such as opening and closing of door, intruder detection, gas alarm, and fire alarm which were provided in the home automation system in an upgraded form.

In addition, entertainment services such as high-quality multimedia services, distance education and video-on-demand services, information services such as personal and family information management, home shopping, e-commerce, home security, and integrated information management and information appliance management, A communication service such as remote energy resource management may be provided.

In general, such a home network system includes a home appliance or home automation device that is linked to a home communication network, a home gateway that connects an external communication network such as the Internet to the home communication network, and a home that controls a plurality of home appliances connected to the home communication network. It consists of a server.

Meanwhile, wired or wireless networking technology is used to construct such a home network system. In addition, such a home network system, like other wired and wireless networks, has the potential for malicious security threats such as hacking and eavesdropping.

In other words, if the security system is not properly established, an unauthorized user may arbitrarily manipulate home appliances of other households through a communication network, and may attack by eavesdropping the operation state of home appliances that are performed in the home. replay attack).

Therefore, a security system for a home network system must be in place. The security method of such a home network system can be broadly classified into a user authentication method and a communication data encryption method.

Here, the user authentication method uses a remote client to access the Internet, and then accesses a home server located in the home network system that is in charge of the communication control of the local devices. Authentication will give you the authority to control local devices.

In the method of encrypting communication data, if a user operates a local device desired by a user who has been able to use the home network, data communication such as a corresponding command is performed between the home server and the local device. Refers to the process of performing encryption to provide confidentiality and integrity to data sent and received. This process makes it possible to secure data inside the home network and to prevent eavesdropping attempts from the outside.

As such, many researches have been made to address security vulnerabilities in home network systems, but most of them are focused on protecting the home network from attackers from outside regarding user authentication.

However, data communication between a home server existing in a home network and a local device connected thereto also has a problem that the contents of the data may be exposed to the outside when security is not achieved.

In particular, local devices such as TVs, refrigerators, boilers, and door openers connected to home network systems often do not have special encryption functions. The interface method through short-range wireless communication uses a fake home server regardless of the authentication process. There is a problem in that eavesdrop or replay attack is possible.

The present invention has been made to solve the above problems, and the data transmitted by performing encryption and decryption through a security algorithm in a state in which a unique function is included in the data transmitted between devices in a local area wireless communication network connecting a home network Its purpose is to provide a data security method and home network system using the same to maintain confidentiality and integrity.

Home network system using a data security method according to the present invention for achieving the above object, in the home network system having a home gateway and a local device, generating and generating a serial number according to the number of times of communication with the local device A home gateway for transmitting a data packet by encrypting the serial number and data; And a local device that decrypts the data packet transmitted from the home gateway, inverts the number of communication with the home gateway through the decrypted data and the serial number, and verifies the data and transmits the verified information to the home gateway.

The home gateway may include an external interface connected to an external communication network; An internal interface connected to the home network; A security module for performing a data security function with the local device; And a database storing information necessary for data security.

The security module includes a function generator for generating a serial number based on the number of times of communication with the local device; And an encryption unit for encrypting and decrypting the data to which the serial number is attached by an encryption key algorithm.

The database may include an ID corresponding to the local device; Cumulative number of times of communication according to communication with the local device; And a serial number generation function for generating a serial number according to the communication frequency.

The local device may include a communication interface connected to the home network; A local security module for performing a data security function with the home gateway; And a local database in which information necessary for data security is stored.

The local security module includes a function generator for generating a serial number based on the number of times of communication with the home gateway; And an encryption unit for encrypting and decrypting the data to which the serial number is attached by an encryption key algorithm.

The local database may include an ID corresponding to the home gateway; Cumulative number of times of communication in accordance with communication with the home gateway; And a serial number generation function for generating a serial number according to the communication frequency.

In addition, a home network system using a data security method according to the present invention for achieving the above object, in a home network system having a home gateway and a local device, generating a serial number according to the number of times of communication with the local device; A home gateway which encrypts the generated serial number and data to transmit a data packet, decrypts the received data packet, and verifies the data by inverting the number of communication with the local device through the decrypted data and serial number; Decrypts the data packet transmitted from the home gateway and verifies the data by inverting the number of communication with the home gateway through the decrypted data and the serial number, and generates and generates a serial number according to the number of communication with the home gateway. And a local device for transmitting the data packet by encrypting the serial number and data.

A data security method according to the present invention for achieving the above object is a security method for encrypting data transmitted in a home network system having a home gateway and a local device, the number of times of communication with the local device to the data to be transmitted; Generating a serial number based on the number; Generating a data packet by encrypting the data and the serial number by an encryption key algorithm; Transmitting the data packet to the data packet receiving side; And accumulating the number of times of communication as the data packet is normally received at the side of receiving the data packet.

 Repeatedly transmitting the data packet when the data packet is not normally received at the receiving side of the data packet; And transmitting an error message if the data packet is not normally received even after repeatedly transmitting the data packet.

A security method for decrypting a data packet transmitted by a security method for encrypting data transmitted in a home network system having a home gateway and a local device, the method comprising: receiving the transmitted data packet; Decoding the received data packet into the serial number and the data; Inverting the number of times of communication generating the serial number from the serial number; Comparing the inverted communication times with the actual communication times with the home gateway; And transmitting the data packet to the home gateway when the communication times are equal, and accumulating the communication times with the home gateway.

Determining that there is a problem in the reliability of the received data packet when the communication times are different in comparing the inverted communication times with the actual communication times with the home gateway, and outputting an error message. do.

Hereinafter, a data security method and a home network system using the same according to the present invention will be described in detail with reference to the accompanying drawings.

In the description of the present invention, the names of the elements defined are defined in consideration of functions in the present invention, and should not be understood as meanings that limit the technical elements of the present invention. May be referred to by other names in the art.

 In addition, the code added to each component is described for convenience of description, and the contents shown in the drawings in which these codes are described do not limit each component to the range in the drawing. In addition, as long as the functional similarity and identity thereof, even if the modified embodiment is adopted, it can be seen as an equivalent configuration, and even if the embodiment in which the modified part of the configuration is employed, it can be seen as an equivalent configuration.

First, the home network system using the data security method according to the present invention will be briefly described.

1 is a block diagram showing a home network system according to the present invention, Figure 2 is a block diagram showing the main part of the home network system according to the present invention.

As shown, the home network system 10 using the data security method according to the present invention includes a local device 300 formed of various home appliances connected on the home network 400 and a local device connected on the home network ( It includes a home gateway 200 connecting the 300 and the external communication network (for example, the Internet network) 100.

The communication network 100 is a wide area network composed of the Internet, a public line network, a wireless communication network, a CATV (CAble TeleVision) network, or the like, and is provided so that terminals located at remote locations are interconnected according to a predetermined communication protocol. Since this is a known technique, a detailed description thereof will be omitted, and in the following description, the communication network will be referred to collectively.

The home network 400 is a home gateway 200 and a plurality of devices (300a, 300b, 300c, 300d) constituting the local device 300 is connected to each other, the wired or wireless network, and wired and wireless It may be implemented in a mixed form.

Examples of wired networks include power line communication (PLC) networks using power lines installed in homes, home phone network (HomePNA) networks using telephone lines installed in homes, and real-time high-speed data of AV devices. The Institute of Electrical and Electronics Engineers (IEEE) 1394 network, a serial bus method used for transmission, and an RS-485 network using a multipoint communication line can be used.

In addition, the wireless network includes a wireless LAN network using the 2.4 GHz or 5 GHz band as an IEEE 802.11 series, a Bluetooth network that is an industry standard for wireless access in the 2.4 GHz band to support communication between short-range devices, Ultra Wide Band (UWB) network, a short-range broadband communication technology, and ZigBee network, an industry standard for home automation and data networks with low transmission rates, may be used.

The local device 300 is an object of the control and monitoring of the home gateway 200, home appliances (for example, refrigerator, boiler, 300a), information equipment (computer, television, etc. 300b), home automation equipment (For example, a light lamp 300c), a security device (for example, door lock, 300d, etc.), and the configuration for implementing the unique function of each device is a known technology, so the detailed description thereof will be omitted, In the description, the local device 300 will be referred to collectively.

The home gateway 200 relays the communication network 100 and the home network 400 and controls each local device 300 connected to the home network 400 according to an external or internal command.

The local device 300 and the home gateway 200 transmit and receive mutual control signals or response signals through the home network 400.

Hereinafter, the configuration of the local device 300 and the home gateway 200 will be described in detail with reference to FIG. 2.

The home gateway 200 includes an external interface 210 connected to the communication network 100, an internal interface 220 connected to the home network 400, a security module 230 for performing a data security function, and The database 240 stores information necessary for data security, and the controller 250 interlocked with each component to control each component.

Here, the external interface 210 provides an interface function so that the home gateway 200 can operate in connection with an external communication network 100. In this case, the external interface 210 may be connected to a wired or wireless Internet, a mobile communication network, or the like. The external interface 210 is provided to satisfy the communication protocol (for example, TCP / IP) of the communication network 100.

The internal interface 220 provides an interface function so that the home gateway 200 can interoperate with the local device 300 in the home. At this time, the internal interface 220 is a communication protocol (for example, wireless LAN, Bluetooth, and UWB (Ultra Wide Band)) of a wireless network and a home network 400 that is implemented in a mixed form of wireless and wireless. , ZigBee, etc.). These communication protocols can be variously modified and detailed description thereof will be omitted.

The database 240 stores information for the security module 230 to perform a security function. The database 240 includes a table corresponding to an ID corresponding to each local device 300, a serial number generation function corresponding to each local device 300, and a number of communication times between the home gateway 200 and a specific local device 300. (See FIG. 6).

Meanwhile, the security module 230 performs a security function of the data packet transmitted and received at the home gateway 200. The security module 230 includes a function generator 232 for generating a specific serial number and attaching the serial number to data to be transmitted, and an encryption unit for encrypting and decrypting the data with the serial number attached by a specific encryption algorithm. 234.

Here, the serial number generation of the function generator 232 is generated based on a serial number generation function provided in the database 240 to correspond to each local device 300. The serial number generation function generates a serial number by using the number of times of communication between the home gateway 200 and the specific local device 300 as an index. In addition, the number of times of communication is cumulatively increased when communication between the home gateway 200 and the specific local device 300 is successful, and is initialized when it is increased more than a predetermined number of times.

Data encryption of the encryption unit 234 is performed by an algorithm using a predetermined encryption key to the data attached to the serial number, the home gateway 200 and the local device 300 is provided to use the same encryption algorithm.

Meanwhile, the function generation unit 232 and the encryption unit 234 forming the security module 230 may be implemented in hardware or in software according to the characteristics of the home network 400.

The local device 300 has a different configuration according to each function (for example, home appliances, information equipment, security equipment, home automation equipment, etc.). However, it has a common configuration for connecting to the home network 400. The communication interface 320 connected to the home network 400, the local security module 330 for performing a data security function, a local database 340 for storing information necessary for data security, and each component Local control unit 350 is provided to interlock and control each component.

Here, the communication interface 320 provides an interface function so that the local device 300 can be linked to the home gateway 200 through the home network 400. At this time, the communication interface 320 is provided to satisfy the communication protocol of the home gateway 200.

The local database 340 stores information for the local security module 330 to perform a security function. In the local database 340, the ID corresponding to each local device 300, the serial number generation function corresponding to each local device 300, and the number of times of communication between the home gateway 200 and the specific local device 300 are listed. In the form (see Figure 6).

As such, the ID, serial number generation function, and communication count stored in the table form correspond to the ID, serial number generation function, and communication count stored in the database 240 of the home gateway 200. It is updated when communication is successfully performed between the 200 and the local device 300.

Meanwhile, the local security module 330 performs a security function of the data packet transmitted and received from the local device 300. The local security module 330 performs the same function as the security module 230 of the home gateway 200, and generates a specific serial number and a function generator 332 attaching the serial number to data to be transmitted. And an encryption unit 334 for encrypting and decrypting the data to which the serial number is attached by a specific encryption algorithm.

Here, the serial number generation of the function generator 332 is generated based on a serial number generation function provided in the local database 340 to correspond to each local device 300, and the serial number generation function is the home gateway 200. Create a serial number with the number of communication with. The number of times of communication is cumulatively increased when communication between the home gateway 200 and a specific local device 300 succeeds and is initialized when the number of times is increased.

Data encryption of the encryption unit 334 is performed by an algorithm using a predetermined encryption key to the data attached to the serial number, the home gateway 200 and the local device 300 is provided to use the same encryption algorithm.

Hereinafter will be described the operation of the home network system using the data security method according to the present invention as described above. Each element mentioned below should be understood with reference to the above description and drawings.

Here, in describing the operation of the home network system using the data security method according to the present invention, in most cases, the home gateway becomes the transmitting side and the local device becomes the receiving side, so that the home gateway is transmitted and the local device is received. I will explain mainly. But the opposite can also be done by the same process.

3 is a flowchart illustrating a data transmission process in a home network system according to the present invention, FIG. 4 is a flowchart illustrating a data reception process in a home network system according to the present invention, and FIG. It is a structural diagram showing the process of packet conversion.

First, a case in which the home gateway 200 transmits a control command to a specific local device 300 will be described.

First, as the data including the control command is generated in the controller 250 of the home gateway 200, the home gateway 200 and the local device are generated by the function generator 232 of the security module 230. A serial number is generated using the number of communication set between 300 as an exponent (step S110).

Thereafter, the encryption unit 234 of the security module 230 attaches the generated serial number to the data and combines the data and serial combined by an encryption algorithm using an encryption key set between the home gateway 200 and the local device 300. The number is encrypted (step S120). Hereinafter, data encrypted with a serial number attached is referred to as a 'data packet' (see FIG. 5).

As the data packet is encrypted, the controller 250 transmits the data packet to the home network 400 through the internal interface 220 of the home gateway 200, and the local device 300 transmits the data to the home network 400. The received data packet is received through the communication interface 320 (step 130).

Here, when the data packet is normally received, the local device 300 receiving the data packet transmits a response signal indicating that the data packet is normally received to the home gateway 200. This process will be described in detail later when describing a process of receiving a data packet from the local device 300.

On the other hand, the controller 250 detects the response signal transmitted from the local device 300 (step S140). If a signal indicating that the data packet is normally received by the local device 300 is received, it is determined that communication between the home gateway 200 and the local device 300 is normally performed. At the same time, the number of times of communication between the local device 300 stored in the database 240 is accumulated (step S150).

At this time, if a signal indicating that the data packet is not normally received by the local device 300 is received, or if no signal is received, the above-described data packet transmission process is repeated (step S160).

In addition, even in the above-described repetition process, if a signal indicating that the local device 300 does not normally receive the data packet is received or no signal is received, an error message is output and the operation is terminated ( Step S170).

Hereinafter, a case in which a control command of the home gateway 200 is received from the local device 300 will be described with reference to FIG. 4.

First, the local device 300 receives a data packet transmitted from the home gateway 200 through the home network (step S210).

As the data packet is received by the local device 300, the encryption unit of the local security module 330 decrypts the received data packet to release the encryption. At this time, the algorithm used for decryption is decrypted by the same encryption key as the home gateway 200, that is, a predetermined encryption key (step S220).

Thereafter, the function generator 332 of the local security module 330 inverts the serial number from the decrypted data packet to obtain the number of times of communication with the home gateway 200. In the inversion process of the serial number, the communication number of the home gateway 200 can be obtained by inverting the serial number of the decrypted data packet using the serial number generation function stored in the local database 340 corresponding to the home gateway 200. It may be (step S230).

Thereafter, the local controller 350 of the local device 300 compares the number of times of communication with the home gateway 200 and the number of times of communication stored in the local database 340 (that is, the number of times of communication with the home gateway 200). The reliability of the transmitted data packet is verified (step S240).

Here, if the number of times of communication obtained by inverting the serial number and the number of times of communication stored in the local database 340 are equal, the local controller 350 determines that the reliability of the received data packet is confirmed.

At this time, the control command included in the data packet is executed and the number of times of communication with the home gateway 200 stored in the local database 340 are accumulated (step S250), and the data packet is normally received by the home gateway 200 as the transmitting side. The response signal indicated is transmitted (step S260).

Such a response signal may be transmitted by the data security method according to the present invention as described above, but may be transmitted only by a normal encryption process.

On the other hand, the local controller 350 determines that there is a problem in the reliability of the received data packet when the number of communication obtained by inverting the serial number and the number of communication stored in the local database 340 are different, and outputs an error message. And the operation ends (step S270).

Through this process, it is possible to secure reliability against external hacking, tapping, re-attack, and the like for data communication generated between the home gateway 200 as the transmitting side and the local device 300 as the receiving side.

Although described in detail with respect to preferred embodiments of the present invention as described above, those of ordinary skill in the art, without departing from the spirit and scope of the invention as defined in the appended claims Various modifications may be made to the invention. Therefore, changes in the future embodiments of the present invention will not be able to escape the technology of the present invention.

In this way, the components of the present invention may be implemented by adding components having other additional functions, or replacing the components with other components. However, all other modified embodiments include the essential elements of the present invention should be considered to be included in the technical scope of the present invention.

As described above, according to the data security method and the home network system using the same, it is possible to securely encrypt data transmitted without a separate authentication procedure when transmitting data between a transmitting side and a receiving side, thereby making reliable data transmission. There is an effect that can be secured.

In addition, according to the data security method and the home network system using the same, there is an effect that can ensure the data reliability of the transmitting side and the receiving side by providing the communication frequency index accumulated independently on the transmitting side and the receiving side, respectively. .

In addition, according to the data security method and the home network system using the same, it is possible to encrypt data using a common encryption key for the transmitting side and the receiving side, respectively, thereby securing the data reliability of the transmitting side and the receiving side. .

Claims (12)

In a home network system having a home gateway and a local device, A home gateway generating a serial number according to the number of times of communication with the local device and encrypting the generated serial number and data to transmit a data packet; And a local device that decrypts the data packet transmitted from the home gateway, inverts the number of communication with the home gateway through the decrypted data and the serial number, and verifies the data and transmits the verified information to the home gateway. Characterized by a home network system. The method of claim 1, wherein the home gateway, An external interface connected to an external communication network; An internal interface connected to the home network; A security module for performing a data security function with the local device; And a database storing information necessary for data security. The method of claim 2, wherein the security module A function generator for generating a serial number based on the number of times of communication with the local device; And an encryption unit for encrypting and decrypting the data to which the serial number is attached by an encryption key algorithm. The method of claim 2, wherein the database, An ID corresponding to the local device; Cumulative number of times of communication according to communication with the local device; And a serial number generation function for generating a serial number according to the communication frequency. The method of claim 1, wherein the local device, A communication interface connected to the home network; A local security module for performing a data security function with the home gateway; And a local database in which information necessary for data security is stored. The method of claim 5, wherein the local security module A function generator which generates a serial number based on the number of times of communication with the home gateway; And an encryption unit for encrypting and decrypting the data to which the serial number is attached by an encryption key algorithm. The method of claim 5, wherein the local database, An ID corresponding to the home gateway; Cumulative number of times of communication in accordance with communication with the home gateway; And a serial number generation function for generating a serial number according to the communication frequency. In a home network system having a home gateway and a local device, Generates a serial number according to the number of times of communication with the local device, encrypts the generated serial number and data, transmits a data packet, decrypts the received data packet, and decrypts the received data packet with the local device through the decrypted data and serial number. A home gateway that inverts the number of communication to verify data; Decrypts the data packet transmitted from the home gateway, verifies the data by inverting the number of communication with the home gateway through the decrypted data and the serial number, and generates and generates a serial number according to the number of communication with the home gateway. And a local device which transmits a data packet by encrypting the serial number and data. A security method for encrypting data transmitted in a home network system having a home gateway and a local device, Generating a serial number based on the number of times of communication with the local device in the data to be transmitted; Generating a data packet by encrypting the data and the serial number by an encryption key algorithm; Transmitting the data packet to the data packet receiving side; Accumulating the number of communication times as the data packet is normally received at the receiving side of the data packet. The method of claim 9, wherein when the data packet is not normally received at the side of receiving the data packet, Repeatedly transmitting the data packet; And transmitting an error message if the data packet is not normally received even after repeatedly transmitting the data packet. A security method for decrypting a data packet transmitted by the method of claim 10, Receiving the data packet being transmitted; Decoding the received data packet into the serial number and the data; Inverting the number of times of communication generating the serial number from the serial number; Comparing the inverted communication times with the actual communication times with the home gateway; And transmitting the data packet to the home gateway when the number of communication times compared are the same, and accumulating the number of times of communication with the home gateway. The method of claim 11, Determining that there is a problem in the reliability of the received data packet when the communication times are different in comparing the inverted communication times with the actual communication times with the home gateway, and outputting an error message. Data security method characterized in that.

Images