KR20090001223A - System and method for detecting and removing malicious node having multiple identities - Google Patents

Abstract

The multiple identity node, the multiple identity node detection, the elimination system and method are provided to detect the attack and to remove the detected multiple identity node from network from the network. The multiple identity node detection and apparatus for removing(600) detect the multiple identity node among one or more child node connected to the parent node. The multiple identity node detection and apparatus for removing remove the detected multiple identity node. The multiple identity node detection and apparatus for removing comprise the inquiring massage transmit unit(610) and multiple identity detection station(630). The multiple identity node detection and apparatus for removing can include the detection list generating unit(650) in order to remove the detected multiple identity node.

Description

System and method for detecting and removing malicious node having multiple identities}

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a view for explaining the structure of a conventional Zigbee network.

FIG. 2 is a diagram illustrating an example in which an identity of two virtual nodes is registered as a sibling node of a real node in addition to the real node in the Zigbee network.

FIG. 3 is a diagram illustrating an example in which an identity of two virtual nodes is registered as a child node of a real node in addition to the real node in the Zigbee network.

4 is a diagram illustrating a multiple identity node detection and removal system according to an embodiment of the present invention.

5 is a view for explaining the principle of detecting a multi-identity node in the present invention.

FIG. 6 is a diagram illustrating an apparatus for detecting and removing a multi-identity node included in the parent node of FIG. 4.

7 is a flowchart illustrating a multi-identity node detection and removal method according to an embodiment of the present invention.

8 is a flowchart illustrating a detailed operation of detecting a multi-identity node in the multi-identity node detection and removal method according to an embodiment of the present invention.

The present invention relates to the detection and removal of multiple identity nodes, and more particularly, to detect attacks using multiple identity nodes by detecting multiple identity nodes using the time required for query-response between a parent node and a registered child node. An apparatus and method for removing a multi-identity node from a network.

Ubiquitous refers to an information and communication environment in which a user can freely access a network regardless of a location without being aware of a network or a computer. Ubiquitous technology aims to establish a space or environment where anyone, anytime, anywhere, can access the online network and receive services through various terminals and objects, and in accordance with the rapid development of electronic communication technology, such a ubiquitous environment This is actually constructed and used.

In order to construct such a ubiquitous environment, it is necessary to implement a sensor network for collecting information in the ubiquitous space at low cost and efficiently. A typical sensor network using a ubiquitous environment is a tree-structured Zigbee network. Zigbee network is a low-speed, low-power, short-range sensor network that can be useful when constructing a control network for various devices in a small space such as a home or an office.

1 is a view for explaining the structure of a conventional Zigbee network. As shown in FIG. 1, a Zigbee network typically has a tree structure formed by combining a plurality of tree sets TS1, TS21, TS22, TS23,... In such a way that an upper node (parent node, eg, N1) controls at least one lower node (child node, eg, N11, N12, N13, ...), the entire network is called a top node (TC) called a trust center node. Is controlled by

In general, in a Zigbee network, the number of nodes that can be included in one network is limited. Therefore, when a large network needs to be configured, the Zigbee network in which the top node becomes the router node (RN) is implemented, and then the entire network is controlled by the trust center node (TC) controlled by the router node (RN). Is implemented.

On the other hand, in order to easily configure the network, Zigbee network does not perform any authentication when adding a new node. In other words, by registering the identity as a new node to the upper node, the Zigbee device (that is, the sensor) can be operated as one node in the Zigbee network.

However, as with all networks, a user-configured network can be compromised by an intruder or an attacker at any time if the proper security mechanism is not applied in a Zigbee network, and attackers can exploit the simple policy of adding these new nodes. Try to attack against. In this case, the ZigBee network can pose threats such as theft of personal information, invasion of privacy, and unauthorized access to equipment in the home or office.

One of the most dangerous attacks on ZigBee networks is the use of multiple identity nodes. An attack using multiple identity nodes is an attack in which a module is actually included as a node in the network, but the trust center managing the network assumes that multiple nodes exist.

That is, network attackers register an identity as a new node for one Zigbee device, and register an identity as another new node for the same Zigbee device by spoofing a physical address. This process allows an attacker to join multiple identity nodes to the network by registering multiple identities for a single ZigBee device.

An attacker can use this multi-identity node to send false information that can occur on a device in the home or office multiple times, thereby allowing the trust center to determine that the problem network is intact or that there is no problem at all. Can make you have a problem.

2 and 3 illustrate an example in which multiple identity nodes are registered in a ZigBee network. In FIG. 2, in addition to the real nodes C1 and C2, the identity of two virtual nodes C3 and C4 in the ZigBee network may be defined. 3 illustrates an example in which an identity of two virtual nodes C3 and C4 in addition to real nodes C1 and C2 is registered as a child node of a real node in the Zigbee network. For convenience of description, only some treesets of Zigbee networks are shown in FIGS. 2 and 3.

2 and 3, P is a parent node, C1, C2, C3, and C4 are child nodes of the parent node P, and K1, K2, K3, and K4 are respective child nodes C1, C2. , C3, and C4). 2 and 3, the node C2 is an attacker node that registers the virtual nodes C3 and C4 as child nodes with the parent node P. As shown in FIG. Since the multi-identity nodes (C2, C3, C4) causes a malfunction in the network, the multi-identity nodes (C2, C3, C4) except for the normal nodes (P, C1) in Figures 2 and 3 will be removed.

If the network includes multiple identity nodes, the multiple identity nodes send messages to the central node as if they are sent by multiple nodes, and these messages reduce the reliability of information collected at the central node. As a result, the ZigBee network including the multi-identity node does not provide a normal service, resulting in inconvenience to users, and in some cases, a serious risk may occur.

For example, if the Zigbee Network provides home fire protection services, multiple identity nodes can send false high temperature or smoke information to multiple nodes through multiple identities, in which case the central node determines that a fire has occurred and You'll get the wrong response, such as running it. On the contrary, even in the event of a fire, multiple identity nodes can send normal temperature information and smoke information to the central node through various identities. In this case, the central node does not respond to the fire by judging it to be normal even though there is a fire. This could result in serious damage to life and property.

In sensor networks other than ZigBee networks, countermeasures against such attacks using multiple identity nodes are proposed. One method is to find a multi-identity node existing in a network by allowing one managed node to broadcast a message and having each single node compose and send a response message to the message. .

When this method is used, the response message sent from the multiple identity node is delayed in the multiple identity node because a single node must compose and transmit a response message for two or more identities. Therefore, multiple identity nodes can be detected using the delay in response messages.

However, this method is difficult to apply to the actual network because the difference between the time it takes to write and send a response message and the transmission delay time occurring in the network itself may be large or rather longer. have.

Alternatively, a detection node detecting whether there is a multi-identity node allocates propagation of different channels to each neighbor node, and randomly selects one channel and transmits a message. If this method is used, the multi-identity node cannot respond to its own identity normally because it cannot listen to radio waves through all channels assigned to its own identity, and in this way the multi-identity node detects it. Can be.

However, this method also uses a different channel with each neighbor node, so depending on which channel it communicates with, it can miss message transmission from normal neighbors. Therefore, false positives may occur. There is a problem.

Therefore, there is a need to implement a Zigbee network that can cope with attacks using multiple identity nodes while maintaining the advantages of Zigbee networks that can be implemented at low cost.

An object of the present invention is to detect an attack using a multi-identity node by detecting a multi-identity node by using the time required for query-response between an upper node and a registered lower node, and detects the detected multi-identity node in the network. It is to provide a device for removing from.

Another technical problem to be achieved by the present invention is to detect an attack using a multi-identity node by detecting a multi-identity node by using a time required for a query-response between an upper node and a registered lower node, and detect the detected multi-identity node. It provides a way to remove from the network.

The multi-identity node detection and removal system according to an embodiment of the present invention for achieving the technical problem includes at least one tree set comprising an upper parent node and at least one child node connected to the parent node. Treesets are connected to form a tree structure network in such a manner that a child node of an upper treeset becomes a parent node of a lower treeset. At this time, the parent node generates a discovery message and transmits a query message generated by encrypting the discovery message through a security key of each child node to the corresponding child node, and each child node decodes the query message. After recovering the discovery message and generating a corresponding message using the restored discovery message, the response message generated by encrypting the corresponding message using the own security key is transmitted to the parent node, and the parent node has each child. After decoding the response message transmitted from the node, the response message is restored, the generated discovery message is compared with the restored response message, and the response time and the threshold response time of the response message are compared to detect the multiple identity node. .

The parent node may determine a child node having a response time longer than the threshold response time among each child node as a multi-identity node.

Meanwhile, the parent node repeatedly transmits the query message as many times as the number of detections repeated, and increases the risk by a predetermined size when the response time is longer than the threshold response time. The risk may be calculated for the response message corresponding to the query message, and the child node having the risk greater than the critical risk may be determined as the multi-identity node.

Meanwhile, the highest parent node of the tree structure network includes a node list in which a list of nodes constituting the tree structure network is stored, and the parent node includes a detection list in which a list of child nodes detected as the multi-identity node is stored. Further transmit to the top parent node of the rescue network, the top parent node may update the node list in response to the detection list.

At this time, it is preferable that the highest parent node removes the node detected as the multi-identity node from the node list in response to the detection list.

Meanwhile, the search message is a random number, and the corresponding message is a number obtained by adding 1 to the restored search message.

In addition, the tree structure network is preferably a Zigbee (Zigbee) network.

The multi-identity node detection and removal apparatus according to another embodiment of the present invention for achieving the technical problem is to detect and remove the multi-identity node of the at least one child node connected to the parent of the upper layer, the query message transmission And multiple identity detection. The query message transmitter generates a search message, and transmits a query message generated by encrypting the search message through a security key of each child node to the child node. The multi-identity detection unit receives a response message created in response to the query message from the child node to restore a corresponding message, compares the generated search message with the restored corresponding message, and responds to the response message and the threshold response time. Compare and detect multiple identity nodes.

Meanwhile, the apparatus for detecting and removing a multi-identity node according to another embodiment of the present invention may further include a detection list generation unit for generating a detection list in which a list of child nodes detected as the multi-identity node is stored, wherein the parent node In response to the detection list, the detection list may be transmitted to a top node including the node list so that the node list in which the list of child nodes is stored is updated.

The multi-identity node detection and removal method according to an embodiment of the present invention for achieving the another technical problem, at least a tree set comprising an upper parent node and at least one child node connected to the parent node. A method for detecting and removing multiple identity nodes in a tree structure network including one, wherein the tree structure network is formed by connecting tree sets in such a manner that a child node of an upper tree set becomes a parent node of a lower tree set. Generating, at the parent node, a discovery message, and transmitting the query message generated by encrypting the discovery message through a security key of each child node to the corresponding child node; decoding the query message at each child node Restore the search message, generate a corresponding message using the restored search message, and then Transmitting the response message generated by encrypting the corresponding message through ankey to the parent node, and decoding the response message transmitted from each child node in the parent node, and restoring the corresponding message. And detecting the multi-identity node by comparing the discovery message with the restored corresponding message and comparing the response time and the threshold response time of the response message.

The detecting of the multiple identity node may include determining a child node having a response time longer than the threshold response time among the child nodes as the multiple identity node.

Meanwhile, the transmitting to the corresponding child node may include transmitting the query message repeatedly as many times as the number of detection repetitions, wherein the detecting of the multi-identity node includes: the response time is greater than the threshold response time. Calculating a risk for a response message corresponding to the repeatedly transmitted query message for each child node in a manner of increasing the delayed instruction value by a predetermined size in a longer time, and a child having a risk greater than a threshold risk. And determining the node as a multi-identity node.

Meanwhile, the top parent node of the tree structure network may include a node list in which a list of nodes constituting the tree structure network is stored. In this case, the multi-identity node detection and removal method according to an embodiment of the present invention may include the parent. At the node, transmitting a detection list in which the list of child nodes detected as the multi-identity node is stored to a top parent node of the tree structure network, and at the top parent node, in response to the detection list, the tree structure network The method may further include updating a node list in which the list of nodes constituting the node is stored.

In addition, updating the node list may include removing a node detected as the multi-identity node from the node list in response to the detection list.

DETAILED DESCRIPTION In order to fully understand the present invention, the operational advantages of the present invention, and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents described in the drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

In the present invention, it is possible to determine whether a registered node is normally registered as one identity after a new node is registered in order to cope with multiple identity attacks that may be fatal to the Zigbee network while still using the advantages of the Zigbee network that can be implemented inexpensively. A Zigbee network is proposed.

Since a single Zigbee module is registered with multiple identities when using multiple identity nodes, commands from a higher module to lower modules must be processed by a single Zigbee module registered with multiple identities. The present invention is implemented using this feature. That is, the present invention proposes a method for detecting a multi-identity node and removing the detected multi-identity node from the network through a query-response using encryption and decryption, which requires some load on the multi-identity node.

To this end, in the present invention, an encrypted query message is broadcasted, and multiple identity nodes are detected by using a delay of a response message transmitted for the query message. In addition, the present invention proposes a method for removing a detected multiple identity node from a network, whereby detection and response to multiple identity attacks can be simultaneously performed.

In fact, in the present invention, each parent node detects an attack from child nodes in consideration of a tree-type network, which is a general structure of a Zigbee network. To do this, the parent node queries the child node to prove its identity (i.e. broadcasts an encrypted query message) and the child node answers it. At this time, the attack can be detected by checking whether the response is returned within the threshold time.

Hereinafter, a multi-identity node detection and removal system and method according to an embodiment of the present invention will be described.

4 is a diagram illustrating a multiple identity node detection and removal system according to an embodiment of the present invention. Multi-identity node detection and removal system 400 includes at least one, preferably a plurality of treesets (circles indicated by dots), which are not shown in the figure, trust center node (TC) and trust center node (not shown). Subnodes connected to the TC) also constitute a treeset. At this time, the tree set is composed of an upper parent node (N1, or N2, ...) and at least one (preferably plural) lower child nodes N11, N12, N13, N14, ... N21, N22, ..., ...).

In the multi-identity node detection and removal system 400 shown in FIG. 4, the child nodes (for example, N1, N2, ...) of the upper tree set are the parent nodes of the lower tree sets TS1, TS2, ... Treesets may be connected in a manner to form a tree structure network. For convenience of explanation, hereinafter, the network formed by the multi-identity node detection and removal system 400 will be described as a Zigbee network, but the present invention is not limited thereto.

FIG. 5 is a diagram for explaining the principle of detecting multiple identity nodes in the present invention. Hereinafter, the principle of the present invention based on a query-response will be described. In the network, a normal single identity node computes once for a query that a parent node sends to a child node that is a single identity node, determines whether it should respond, and generates an answer for that query. However, the multi-identity node computes the identity of which node the node should respond to by calculating a number of devices by one device that constitutes the multi-identity node, and generates an answer to the query.

Since the parent node transmits a query by encrypting a specific object, the child node needs to calculate a decryption of the transmitted query to know who the subject of the query is. At this time, it is not possible to know which cipher is used by which key among the multiple identities. Therefore, in order to determine this, the multiple identity node has to decrypt all the identities. Therefore, a multi-identity node must generate a response to multiple identities in response to a query received from a parent node by one device constituting the multi-identity node. As a result, the time taken for a multi-identity node to generate a response is a single identity. It takes longer than a node takes to generate a response. Therefore, this principle can be used to detect multiple identity nodes.

Hereinafter, a process of detecting a multi-identity node will be briefly described with reference to FIG. 5. First, the parent node p generates a query message Mq for identification and transmits it to each child node c _i . In an embodiment of the present invention, the query message preferably includes a random number r randomly generated at the parent node, and the random number r is encrypted with a security key (ki) shared with each child node.

On the other hand, each child node (c _i ) decodes the query message received from the parent node (p) to restore a random number (r), for example, a value obtained by adding 1 to the random number (r) as a security key (k _i ) After encrypting again to generate a response message Ma, the response message Ma is transmitted to the parent node p.

After that, the parent node p decodes the response message Ma received from the child node c _i , extracts a random number r + 1, and compares it with the random number r + 1 generated to check whether it is a suitable response message. The response time Ma is calculated by comparing the response time t (that is, the difference between the time of sending the query message Mq and the time of receiving the response message Ma) and comparing it with the threshold response time T. It is determined whether one child node c _i is a multi-identity node.

For example, if the response time t is greater than the threshold response time T, a method of determining as a multiple identity node may be used, and various other determination methods may be used. A specific method for determining whether the node is a multiple identity node will be described later. Hereinafter, a configuration and operation of a multi-identity node detection and removal system according to an embodiment of the present invention will be described with reference to FIG. 4 and FIG. 7, which shows a flowchart of a method for detecting and removing a multi-node node according to an embodiment of the present invention. . For convenience of explanation, hereinafter, the description will be given based on an operation in which the parent node N1 detects multiple identity nodes among the child nodes N11, N12, N13, N14, ... in the tree set TS1. The description applies equally to other treesets.

First, the parent node N1 generates the discovery message r and then the discovery message r through the security keys K1, K2, K3, K4,… of each child node N11, N12, N13, N14,…. ) Is encrypted to generate a query message (Mq), and the query message (Mq) is transmitted to the corresponding child node (S701). On the other hand, each child node (N11, N12, N13, N14, ...) decodes the received query message (Mq) to restore the search message (r) and the corresponding message (r + 1) using the restored search message (r) ) After that, each child node (N11, N12, N13, N14,…) encrypts the corresponding message (r + 1) through its own security key (K1, K2, K3, K4,…) and generates a response message (Mr). It generates and transmits the generated response message (Mr) to the parent node (N1) (S703).

Thereafter, the parent node N1 decodes the response message Mr transmitted from each of the child nodes N11, N12, N13, N14, ..., restores the corresponding message r + 1, and then generates the generated discovery message ( r) and the restored corresponding message r + 1 are compared to determine whether the transmitted response message Mr is valid. Thereafter, the parent node N1 compares the response time t of the response message Mr and the threshold response time T to detect which child node has multiple identity nodes (S705).

At this time, the parent node (N1) may determine a child node having a response time (t) longer than the threshold response time (T) as a multi-identity node, in the present invention, the query-response for more accurate determination It is preferable to use a repeating method.

That is, the parent node N1 repeatedly transmits a query message as many times as the number of detection repetitions, and when the response time t is longer than the threshold response time T, the risk D is increased by a predetermined size (preferably 1). ) In a way that increases the risk (D1, D2, D3, D4,…) for each child node (N11, N12, N13, N14,…), and then the risk (D) is greater than the critical risk (DTH) A node may be determined as a multi-identity node.

In the above description, the operation of determining the multi-identity node among the child nodes N11, N12, N13, N14, ... by the parent node N1 has been described, but the present invention may also be applied to a method of removing the detected multi-identity node. have. Hereinafter, an operation of removing the detected multi-identity node will be described.

In an embodiment of the present invention, the trust center node TC, which is the top parent node of the tree structure network, includes a node list in which a list of nodes constituting the tree structure network is stored. In the present invention, the detected multiple identity nodes can be removed by updating the node list.

That is, the parent node N1 creates a detection list in which a list of child nodes detected as multi-identity nodes is stored, and then transmits a detection list created as the highest parent node of the tree structure network. The Trust Center node (TC) then updates the node list in response to the detection list so that the detected multiple identity nodes are reflected in the node list. In an embodiment of the present invention, the trust center node may remove a node detected as a multi-identity node from the node list in response to the detection list, thereby allowing the tree structure network to be reconstructed into a list from which the multi-identity node has been removed.

Hereinafter, an operation of detecting and removing a multi-identity node will be described in detail with reference to FIGS. 6 and 8. 6 is a view for explaining a multi-identity node detection and removal device included in the parent node of Figure 4, Figure 8 is a multi-identity node detection and removal method according to an embodiment of the present invention, detecting the multi-identity node It is a flowchart for demonstrating an operation | movement concretely.

In FIG. 6, for convenience of description, only an arbitrary treeset of the treeset of FIG. 4 is illustrated. In addition, although the multi-identity node detection and removal apparatus 600 is illustrated in FIG. 6 to be independently implemented and included in the parent node (P), those skilled in the art to which the present invention pertains to multi-identity node detection and It will be appreciated that the removal device 600 may be implemented in various forms. For example, the multi-identity node detection and removal device can be implemented independently and coupled to all nodes acting as parent nodes, and each component constituting the multi-identity node detection and removal device is distributed to the parent node. It could be.

Referring back to FIG. 6, the multi-identity node detection and removal apparatus 600 detects and removes a multi-identity node among at least one child node c1, c2, ... that is connected to the parent node P. FIG. The multi-identity node detection and removal apparatus 600 includes a query message transmitter 610 and a multi-identity detector 630, and further includes a detection list generator 650 for removing the detected multi-identity node. can do.

First, the query message transmitter 610 generates a search message r (S801). The search message r generated at this time is preferably a random number. Thereafter, the query message transmitter 610 selects the child node ci to transmit the query message, and selects the security key Ki of the selected child node ci (S803). Thereafter, the query message transmission unit 610 encrypts the identity IDp, the identity of the corresponding child node IDc _i , the generated discovery message r, and the like through the selected security key Ki. Create a message Mq. In the embodiment of the present invention, the query message Mq may be expressed as follows.

As can be seen from the above equation, in the present invention, encryption is performed n times to increase the complexity of the problem, where n is two or more. Thereafter, the query message transmitter 610 transmits the generated query message Mq to the child nodes c1, c2,... (S805). At this time, the query message transmission time is stored to calculate the response time, and the identity IDc _i and the search message r of the child node are stored for message verification.

Meanwhile, in the embodiment of the present invention, the query message transmitter 610 may use the method of transmitting all the query messages in another method. In this case, an inquiry message Mq is generated and transmitted for all child nodes c1, c2, ... that are not selected nodes.

After receiving the query message Mq, the child node c _i extracts the security key Ki to decrypt the query message Mq (S807). In the embodiment of the present invention, it is preferable to extract the key k _i shared by the child node ci with the trust center node, but other key extraction methods may be used. For example, a child node (ci) may store and use its own security key.

After extracting the security key Ki, the child node ci decodes the query message Mq through the security key Ki, restores the search message r (S809), and is included in the query message Mq. It extracts the identity of the parent node (IDp) and the identity of the child node (IDc _i ), and determines whether the extracted child node is the same as its identity.

If the extracted child node has the same identity as its own identity, the child node ci generates a corresponding message r + 1 by adding a predetermined value (preferably 1) to the extracted search message r (S811). ). Subsequently, the child node ci encrypts the identity IDp of the parent node, its identity IDc _i , and the like with a security key k _i shared by the parent node and the parent node, and generates a response message Ma. In an embodiment of the present invention, the response message Ma may be expressed as follows.

As can be seen from the above equation, in the present invention, in order to minimize the delay time in the child node, it is preferable that the child node (ci) performs the encryption only once. Subsequently, the child node ci transmits the generated response message Ma to the parent node p (S813).

After the response message Ma is transmitted from the child node ci, the multi-identity detection unit 630 receives the response message and restores the corresponding message r + 1 through the security key Ki. Thereafter, the multi-identity detection unit 630 compares the generated search message r with the restored corresponding message r + 1 and checks whether the received response message Ma is a valid message. In an embodiment of the present invention, the multi-identity detection unit 630 determines that a valid message is normally received when the difference between the generated discovery message r and the restored corresponding message r + 1 is 1.

When it is determined that the response message Ma is normally received, the multi-identity detection unit 630 detects the multi-identity node by comparing the response time t and the threshold response time T of the response message (S815). That is, the multi-identity detection unit 630 determines that the response message Ma arrives within the predetermined threshold response time T as a normal node, whereas the multi-identity detection unit 630 determines that the response message Ma arrives beyond the predetermined threshold response time T as a multi-identity node. Hereinafter, an operation of determining whether the node is a multiple identity node will be described in detail.

To this end, in the present invention, the parent node p includes a list of child nodes. In the present invention, the child node list is preferably implemented as shown in the following table, but the present invention is not limited thereto.

Referring to FIG. 8, when the response message Ma arrives after a predetermined threshold response time T, the multi-identity detection unit 630 sets the risk D of the child node list by a predetermined size (preferably). 1) to increase (S817). As described above, in the embodiment of the present invention, since the query message Mq is repeatedly transmitted to the child node, the response message Ma will also be transmitted several times. The risk (D) is changed by repeating the above-described process for the response message (Ma) which is transmitted several times, and the risk (Di) and the critical risk (DTH) for the corresponding child node (ci) are subsequently continued in the child node list. In comparison (S819), if the risk Di exceeds the critical risk DTH, the multi-identity node is detected by determining the child node ci as a multi-identity node (S821).

In order to remove the multi-identity node from the network after the multi-identity node is detected, the detection list generator 650 generates a detection list in which a list of child nodes detected as the multi-identity node is stored. After the detection list is created, the parent node (p) transmits the detection list to the trust center node (TC), which is the highest node, so that the node list of the trust center node (TC) is updated so that the multi-identity node is removed from the network. do.

On the other hand, the operation of removing the multi-identity node from the ZigBee network in another way, the parent node (p) is for the child node (c _i ), the risk Di in the child node list exceeds the critical risk (DTH), Forward network removal message to Trust Center node (TC). Since the network configured in the present invention is preferably a Zigbee network, the network removal message used in this case is preferably a Device Update Service message specified in the Zigbee standard.

Receiving the network removal message, the Trusted Center node (TC) uses the Remove Device Service to remove the device by using the address of the node as a parent node (in some cases, the parent node and each router node). To pass.

On the other hand, the parent node and / or router node received the device removal message removes all information shared with the node and suspends all current connections. Also, in order to prevent re-registration of the same node later, the address information of the corresponding node is stored.

In the above description, a method for detecting and removing multiple identity nodes in a ZigBee network has been described for a secure group communication method for devices on an IEEE 802.15.4-based ZigBee network. It will be appreciated that the pendulum can be applied to a tree structure network having the same structure as the Zigbee network in addition to the Zigbee network.

Meanwhile, the above-described embodiments of the present invention can be written as a program that can be executed in a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. In addition, the structure of the data used in the above-described embodiment of the present invention can be recorded on the computer-readable recording medium through various means.

The computer-readable recording medium may be a magnetic storage medium (for example, a ROM, a floppy disk, a hard disk, etc.), an optical reading medium (for example, a CD-ROM, DVD, etc.) and a carrier wave (for example, the Internet). Storage medium).

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the present invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the multi-identity node detection and removal system according to the embodiment of the present invention uses the response time of the response message to the encrypted query message, thereby minimizing the process of detecting and responding to the multi-node node attack. It has the advantage of detecting and responding to attacks using nodes in a simple way.

In addition, the multi-identity node detection and removal system according to an embodiment of the present invention detects and responds to multiple-identity node attacks within a range that complies with the ZigBee standard, and thus can be easily applied to existing products using the ZigBee standard.

Claims (17)

A multiple identity node detection and removal system comprising at least one treeset comprising an upper parent node and at least one child node connected to the parent node, wherein the child node of the upper tree set is the lower tree set. In the multi-identity node detection and removal system, the tree sets are connected to form a tree structure network in such a manner as to be a parent node of The parent node generates a discovery message and transmits a query message generated by encrypting the discovery message through a security key of each child node to the corresponding child node. Each child node decodes the query message, restores a search message, generates a corresponding message using the restored search message, and encrypts the corresponding message using its own security key. To the node, The parent node decodes the response message transmitted from each child node, restores the corresponding message, compares the generated search message with the restored corresponding message, and compares the response time and the threshold response time of the response message. Multiple identity node detection and removal system, characterized in that for detecting multiple identity nodes. The method of claim 1, The parent node, multiple identity node detection and removal system, characterized in that the child node having a response time longer than the threshold response time of each child node as a multi-identity node. The method of claim 1, The parent node repeatedly transmits the query message as many times as the number of detection repetitions, and increases the risk by a predetermined size when the response time is longer than the threshold response time. The multi-identity node detection and removal system, characterized in that the risk is calculated for the response message corresponding to the inquiry message, and the child node with the risk is greater than the critical risk as a multi-identity node. The method of claim 1, The top parent node of the tree structure network includes a node list in which a list of nodes constituting the tree structure network is stored. The parent node further transmits a detection list in which the list of child nodes detected as the multi-identity node is stored to the top parent node of the tree structure network, and the top parent node updates the node list in response to the detection list. Multiple identity node detection and removal system, characterized in that. The method of claim 4, wherein And the highest parent node removes the node detected as the multi-identity node from the node list in response to the detection list. The method of claim 1, And wherein said discovery message is a random number and said corresponding message is a number added to 1 to said restored discovery message. The method of claim 1, The tree structure network is a multiple identity node detection and removal system, characterized in that the Zigbee (Zigbee) network. An apparatus for detecting and removing a multi-identity node among at least one child node connected to an upper parent node, A query message transmitter for generating a discovery message and transmitting a query message generated by encrypting the discovery message through a security key of each child node to a corresponding child node; Respond message is received by receiving the response message written in response to the query message from the child node, and the generated search message is compared with the restored corresponding message, and the response time and the threshold response time of the response message are multiplied. Multiple identity node detection and removal device comprising a multiple identity detection unit for detecting the identity node. The method of claim 8, And a detection list generation unit for generating a detection list in which a list of child nodes detected as the multi-identity node is stored. And the parent node transmits the detection list to a top node including the node list so that the node list in which the list of child nodes is stored is updated in response to the detection list. . The method of claim 8, The tree structure network is a multiple identity node detection and removal device, characterized in that the Zigbee (Zigbee) network. A method for detecting and removing a multi-identity node in a tree structure network including at least one tree set including an upper parent node and at least one child node connected to the parent node, wherein the tree structure network is a higher level node. In the multiple identity node detection and removal method, wherein the tree sets are formed in such a manner that the child nodes of the tree set of are parent nodes of the lower tree set. Generating, at the parent node, a discovery message and transmitting a query message generated by encrypting the discovery message through a security key of each child node to the corresponding child node; In each of the child nodes, the query message is decoded to restore the search message, generate a corresponding message using the restored search message, and encrypt the corresponding message using the own security key. Transmitting to a parent node; And In the parent node, decode the response message transmitted from each child node to restore the corresponding message, compare the generated search message with the restored corresponding message, and compare the response time and the threshold response time of the response message. And detecting the multi-identity node by using the multi-identity node detection and removal method. The method of claim 11, The detecting of the multi-identity node includes determining a child node having a response time longer than the threshold response time among each child node as a multi-identity node. The method of claim 11, The transmitting to the corresponding child node may include transmitting the query message repeatedly as many times as the number of detection repetitions. Detecting the multi-identity node, Calculating a risk level for the response message corresponding to the repeatedly sent query message for each child node in such a manner that the delay indication value is increased by a predetermined size when the response time is longer than the threshold response time. ; And And determining a child node having a risk greater than a critical risk as a multi-identity node. The method of claim 11, The top parent node of the tree structure network includes a node list in which a list of nodes constituting the tree structure network is stored. Transmitting, at the parent node, a detection list in which a list of child nodes detected as the multi-identity node is stored to a top parent node of the tree structure network; And And updating the node list in which the list of nodes constituting the tree structure network is stored, in response to the detection list, at the top parent node. The method of claim 14, The updating of the node list includes removing a node detected as the multi-identity node from the node list in response to the detection list. The method of claim 11, And the discovery message is a random number, and the corresponding message is the number of the restored discovery message plus one. The method of claim 11, The tree structure network is a multiple identity node detection and removal method, characterized in that the Zigbee (Zigbee) network.

Images