KR20090099271A - Broadcasting receiver and method of processing log information - Google Patents

Abstract

A broadcasting receiver and a method of processing log information are provided to monitor the log information of a broadcasting receiver at a remote place. A method for processing the log information of a broadcasting receiver(52) connected to a broadcasting transmitter through a bi-directional communication network is characterized by comprising the steps of: generating the log information of a corresponding broadcasting receiver; and transmitting the generated log information to the broadcasting transmitter through a network management unit(40). The broadcasting receiver is characterized by including: a log information generator that generates the log information; a storage unit that stores the generated log information; and a bi-directional communication unit that transmits the one of those two kinds of log information, which are generated by the log information generator and stored in the storage unit, to the broadcasting transmitter through the network management unit.

Description

Broadcasting receiver and method of processing log information}

The present invention relates to a digital broadcast system, and more particularly, to a broadcast receiver capable of receiving cable broadcasts and a log information processing method of the broadcast receiver.

The cable broadcasting system of the digital broadcasting system is largely composed of a cable broadcasting station which is a transmitting side for transmitting cable broadcasting, and a broadcasting receiver capable of receiving the transmitted cable broadcasting. The cable station may be a headend. The headend refers to a main coordination center having technical facilities for receiving, producing and retransmitting program information.

An object of the present invention is to provide an apparatus and method for monitoring log information of a broadcast receiver in a broadcast transmission terminal of a remote place.

According to an aspect of the present invention, there is provided a method of processing log information of a broadcast receiver, the method comprising: generating log information of a corresponding broadcast receiver connected to a broadcast transmitter through a network capable of bidirectional communication; And transmitting the generated log information to the broadcast transmitter using network management means.

According to an embodiment of the present invention, a broadcast receiver connected to a broadcast transmitter through a network capable of bidirectional communication may include a log information generator configured to generate log information of a corresponding broadcast receiver; A storage unit which stores the generated log information; And a two-way communication unit configured to transmit one log information, among the log information generated by the log information generator and the log information stored in the storage unit, to the broadcast transmitter using network management means.

Other objects, features and advantages of the present invention will become apparent from the following detailed description of embodiments taken in conjunction with the accompanying drawings.

According to the present invention, a broadcast receiver and a method for processing log information of a broadcast receiver may monitor log information of each broadcast receiver connected through a cable network at a broadcast transmitter located at a remote location. Based on the monitored log information, the broadcasting transmitter can obtain information on what hacking attempts have been attempted in the cable network, and can determine the cause thereof. Control can also be performed. By doing so, the present invention can improve the stability and security of the cable network.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention that can specifically realize the above object will be described. At this time, the configuration and operation of the present invention shown in the drawings and described by it will be described as at least one embodiment, by which the technical spirit of the present invention and its core configuration and operation is not limited.

The terms used in the present invention were selected as widely used general terms as possible in consideration of the functions in the present invention, but may vary according to the intention or custom of the person skilled in the art or the emergence of new technologies. In addition, in certain cases, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the corresponding description of the invention. Therefore, it is intended that the terms used in the present invention should be defined based on the meanings of the terms and the general contents of the present invention rather than the names of the simple terms.

The present invention is intended to provide log information of a broadcast receiver to a broadcast transmitting terminal using network management means. That is, the broadcast transmitting end may monitor log information of each broadcast receiver using network management means.

In the present invention, the network management means is a protocol or temporary protocol used to prevent problems caused by various causes, such as overload of network traffic, on the network in advance, or to effectively identify and recover from the causes of failures. Is generically.

Examples of network management means include protocols such as Common Management Information Protocol (CIMP), Remote Network Monitoring (RMON), and Simple Network Management Protocol (SNMP).

The network management means as described above can be used not only for basic network management but also for remotely real time real-time status of various devices connected to the network.

Hereinafter, the present invention will be described as an embodiment of the SNMP network management means, but the spirit of the present invention is not limited thereto.

In order to monitor the log information of the broadcast receiver at the broadcast transmitter, the broadcast receiver should be bidirectional. In the present invention, the broadcast receiver is a device capable of transmitting cable broadcasts to each broadcast receiver and receiving data transmitted from each broadcast receiver, and may be a headend in one embodiment.

1 is a conceptual diagram of a cable broadcast network including a bidirectional broadcast receiver according to the present invention.

That is, the head end 10 receives a broadcast signal from the television broadcasting station 20 through various communication networks and transmits the signal to each broadcast receiver 31 through 34 through a cable network including at least one node. . Each of the broadcast receivers 31 to 34 and the headend 10 may exchange data through a cable network infrastructure capable of transmitting data in both directions.

In addition, the broadcast receivers 31 to 34 may transmit their log information to the headend 10 using SNMP.

Each of the broadcast receivers 31 to 34 is largely divided into a host and a cable card. The cable card can be attached to or detached from the host.

The host may be a digital television, a digital versatile disk (DVD) player, a digicam, a set-top box, or the like, or may be a device connected to various types of interfaces with the devices. An example will be given.

For example, the headend 10 may include an SNMP management server, and each broadcast receiver 31 to 34 collects log information by using an SNMP agent and collects log information. Can be sent over the cable network to the SNMP management server. The SNMP management server may issue a specific command to each broadcast receiver to operate each broadcast receiver.

2 is a conceptual diagram illustrating a concept of SNMP for processing log information of a broadcast receiver according to the present invention.

SNMP can be used in any kind of network environment using TCP / IP (transmission control protocol / internet protocol).

In the present invention, the SNMP management server 40 is included in the headend 10 or the headend 10 serves as an SNMP management server. The SNMP management server 40 may be connected to a plurality of SNMP agents 51, 52, ... through a cable network. According to an embodiment of the present invention, the broadcast receiver includes an SNMP agent or performs an SNMP agent role for collecting and transmitting log information. If a cable modem is built in the broadcast receiver for bidirectional data transmission, the SNMP agent may be included in the cable modem.

2 illustrates two SNMP agents 51 and 52 as an example, and the present invention will be described as an embodiment of the SNMP agent 51.

The SNMP management server 40 may request status information from the SNMP agent 51 of a broadcast receiver connected to a cable network using an SNMP manager, and obtain the requested status information from the SNMP agent 51. . In addition, the SNMP agent 51 may collect log information of the corresponding broadcast receiver and transmit the log information to the SNMP management server 40. The log information may be transmitted from the SNMP agent 51 to the SNMP management server 40 in real time or periodically, or may be transmitted to the SNMP management server 40 only at the request of the SNMP management server 40. have.

At this time, the request of the log information or the response of the requested log information is modified by TCP / IP such as UDP (user datagram protocol) or IP (internet protocol) and transmitted through a network dependent protocol.

The SNMP agent 51 collects log information of the broadcast receiver according to a predetermined format and transmits the log information to the SNMP management server 40. At this time, the SNMP agent 51 which transmits log information to the SNMP management server 40 may convert log information into a data structure called a management information base (MIB) and transmit the converted log information. The SNMP agent 51 may transmit not only log information but also various state information represented by a MIB data structure to a remote SNMP management server 40. The SNMP agent 51 collectively refers to a device or an application that can interface the MIB data with a network related standard such as UDP / IP.

3 is a view showing an example of various state information that can be transmitted from the SNMP agent in the broadcast receiver to the SNMP management server according to the present invention.

All of the state information of FIG. 3 can be transmitted to the MIB data structure. 3 lists some of the information that can be defined as MIB data.

In the example of FIG. 3, the ocstbHostHWIdentifiers object represents information about a unique number of a broadcast receiver, and the ocstbHostAVInterfaceTable object represents interface information of a broadcast receiver. In addition, the ocstbHostIEEE1394Table object represents connection status information when the broadcast receiver is connected according to the IEEE 1394 standard.

4 is a diagram illustrating an example of log information transmitted from an SNMP agent in a broadcast receiver to an SNMP management server according to an embodiment of the present invention. The log information may be transmitted in a MIB data structure.

In FIG. 3 and FIG. 4, M denotes a mandatory matter, which is mandatory in the standard relating to MIB data of cable broadcasting. In addition, the RO indicates that the headend has only read-only permission to read corresponding state information or log information of the broadcast receiver. N-Acc indicates that the headend is not accessible to the state or log information.

As such, the broadcast receiver may define the MIB data structure and transmit the above-listed information as the MIB data to the headend in the SNMP method.

Therefore, in view of describing the MIB data structure, the headend may play the role of an SNMP management server, and the broadcast receiver may play the role of an SNMP agent.

The MIB data structure of log information according to the present invention can be defined as shown in FIG.

That is, FIG. 4 is an example of a MIB data structure for log information of a corresponding broadcast receiver defined by an SNMP agent of a broadcast receiver.

The log information ocStbHostSyslog MIB transmitted from each broadcast receiver to the headend using SNMP is composed of an ocStbHostSyslogEvent object indicating whether log information is transmitted and an ocStbHostSyslogTable object indicating log detail information for each log information.

The ocStbHostSyslogEvent object includes an ocStbHostSyslogControl object. The ocStbHostSyslogTable object may include at least one of an ocStbHostSyslogIndex object, an ocStbHostSyslogTime object, and an ocStbHostSyslogText object.

If the ocStbHostSyslogControl object is set to 0 (Reset Log), the log information stored in the memory of the broadcast receiver is deleted. After deletion, it goes to the DefaultReporting state. If the ocStbHostSyslogControl object is set to 1 (DefaultReporting), it indicates that the log information stored in the storage of the broadcast receiver is read and reported to the headend.

The ocStbHostSyslogIndex object represents an index indicating the number of log information.

The ocStbHostSyslogTime object represents a time when a packet first enters a broadcast receiver at a corresponding index.

 The ocStbHostSyslogText object represents the content of the log information. For example, the IP address of the source transmitting the packet to the broadcast receiver may be represented in text form.

The objects included in the log information and their meanings are merely embodiments to help the understanding of the present invention, and addition, deletion, change, etc. of the objects may be easily modified by those skilled in the art, and thus the present invention will not be limited to the examples described above.

That is, when a broadcast modem capable of receiving cable broadcasts has a built-in cable modem, and the broadcast receiver operates based on IP, the broadcast receiver may be subject to hacking. Hacking here means not only stealing the system's information, but also generating excessive traffic to the broadcast receiver, making all the digital devices (e.g. personal computers) connected to the cable network uncontrollable. Includes acts.

Therefore, the present invention generates log information in a broadcast receiver that can be used as a target of hacking or another hacking path, converts the generated log information into a MIB data structure as shown in FIG. (Or network operator). In this case, the log information may be converted into a MIB data structure and provided to the headend in real time or periodically, or may be provided to the headend only when a request is made from the headend. The headend analyzes log information provided from each broadcast receiver located at a remote location to investigate the degree of network traffic occurrence or trace of infiltration, and if there is a possibility of hacking, performs appropriate processing on the corresponding broadcast receiver. That is, the headend can obtain information about what hacking attempts have been attempted in the cable network based on the log information of the broadcast receiver provided using SNMP, and can determine the cause thereof, and can perform appropriate control according to the identified cause. . For example, the packet causing the traffic may be prevented from propagating to the corresponding broadcast receiver or another digital device. By doing so, the present invention can improve the stability and security of the cable network.

There may be various methods for generating log information in the broadcast receiver, and the present invention may generate log information for a network interface by activating a netfilter function provided at a kernel level. In one embodiment it is.

The log information is a history when data is input or output to a corresponding broadcast receiver through a cable network. The log information may include only a history when data is input through the cable network, a history when data is output, or may include all history when data is input or output. This may be changed by an option of a command set by the user to generate log information of the corresponding broadcast receiver.

According to an embodiment of the present invention, a broadcast receiver is equipped with a cable modem to enable bidirectional communication, and transmits and receives data based on IP through the cable modem. In this case, the transmission unit of data is an IP packet according to an embodiment.

According to an embodiment of the present invention, log information on an IP packet input to a cable modem of a broadcast receiver through a cable network is generated.

The following is an embodiment of a command to generate log information.

iptable -A INPUT -i eth1 -j LOG --log-prefix "IPTABLES PROTOCOL-X-IN:"

In the command, the '-A' argument indicates all, the 'INPUT' argument indicates when data is input from the outside to the broadcast receiver, and the 'eth1' argument indicates a communication interface. Also, the 'LOG --log-prefix' argument instructs the generation of log information, and the "IPTABLES PROTOCOL-X-IN:" argument indicates an example of displaying the contents included in the log information. Here, the user can modify, change, or add each argument when generating the command.

If the command is put in a shell script used for system initialization, log information can be generated even after the reboot. The log information generated according to the log information generation command may be stored as a syslog or a message file.

The log information may be used to analyze a history of packets received through a cable network (ie, a network interface) of a corresponding broadcast receiver.

The log information is changed to the MIB data structure as shown in FIG. 4 in real time or periodically or at the request of the headend, and then transmitted to the headend through SNMP.

In this case, the log information is an index (ie, ocStbHostSyslogIndex object) indicating the number of log information, as shown in FIG. , ocStbHostSyslogText object). The contents of the log information may be in text form and may include a source IP address, a media access control (MAC) address, a target IP address, a target MAC address, a protocol, a port used, a data amount, a size, a cumulative amount of generation, and the like. The present invention shows an example of including the IP address of the source (origin) that transmitted the IP packet. The index may be generated whenever the source IP address of the packet input to the broadcast receiver is changed.

The headend can then remotely monitor the history of packet data entering the broadcast receiver over the cable network. The headend can obtain information on what hacking attempts have been attempted in the cable network from the monitored log information.

That is, when the headend analyzes log information and finds a packet causing excessive traffic to the broadcast receiver, the headend is not only the broadcast receiver but also another digital device connected to a cable network (e.g., a personal computer). Can be blocked).

5 is a block diagram illustrating an embodiment of a broadcast receiver according to the present invention, and is a broadcast receiver capable of receiving cable broadcast.

The broadcast receiver of FIG. 5 may be divided into a host 100 and a cable card 200. The cable card 200 may be mounted on or detached from the host 100. The host 100 may include a cable modem.

The host 100 may receive only a cable broadcast signal or may receive any one or more broadcast signals of cable broadcast, terrestrial broadcast, and satellite broadcast. The host 100 of FIG. 5 considers an example in which one or more broadcast signals among cable broadcast, terrestrial broadcast, and satellite broadcast may be received.

Meanwhile, FIG. 5 illustrates a broadcast receiver capable of an out-of-band (OOB) method and a DOGSIS settop gateway (DSG) method as a bidirectional communication method between a broadcast receiver and a headend (broadcast transmitter). In this manner, the host may receive a broadcast or transmit log information to the headend.

The OOB (Out Of Band) method is a kind of standard that defines a transmission standard between a headend and a broadcast receiver (or set-top box). On the other hand, the DSG (DOCSIS Settop Gateway) method is a transmission method between a cable modem control system in a headend and a cable modem in a broadcast receiver, and may transmit data using a cable modem.

The broadcast receiver of FIG. 5 is an example of applying the OOB and DSG mixing schemes. The host 100 in the broadcast receiver of FIG. 5 includes a tuner 101, a first demodulator 102, a multiplexer 103, a demultiplexer 104, a decoder 105, and a second demodulator (DOCSIS). 106, a bidirectional communication unit 107, a control unit 108, a log information generation unit 109, and a storage unit 110.

In one embodiment, the bidirectional communication unit 107 is provided with a cable modem for bidirectional data transmission based on IP. In addition, an SNMP agent may be included in the cable modem to transmit log information according to the present invention to the headend using SNMP, or the cable modem may serve as an SNMP agent.

The tuner 101 tunes a specific channel frequency among terrestrial A / V (Audio / Video) broadcasts transmitted through an antenna or cable A / V broadcasts transmitted in-band through a cable. The demodulator 102 may output the demodulator 102.

Terrestrial broadcasting and cable broadcasting may have different transmission schemes, and the first demodulator 102 may perform different demodulation processes for signals of different demodulation schemes. In FIG. 5, when the terrestrial A / V broadcast is modulated and transmitted in a VSB (Vestigial Sideband Modulation) scheme, and the cable A / V broadcast is modulated and transmitted in a quadrature amplitude modulation (QAM) scheme, the first demodulator 102 ) Demodulates the signal in the VSB method or demodulates the signal in the QAM method according to the signal selected by the tuner 101.

The signal demodulated by the first demodulator 102 is output through the multiplexer 103 in a stream form. At this time, if there are a plurality of in-band tuners capable of receiving cable A / V broadcasting, and different channels are tuned simultaneously in each in-band tuner and demodulated in each demodulator, the multiplexer 103 multiplexes the multiplexers. And output.

If the signal demodulated by the first demodulator 102 is a stream of terrestrial broadcast, the demodulated stream is output to the demultiplexer 104 through the multiplexer 103, and the multiplexer 103 if the stream is cable broadcast. It is output to the demultiplexer 104 through the cable card 200 mounted in the slot. The cable card 200 may include a conditional access (CA) system for copy protection and limited access to high value-added broadcast content.

That is, the cable card 200 descrambles the single stream or the multi-stream of the cable broadcast output from the multiplexer 103 to descramble and output the descrambler 104. If the cable card 200 is not mounted, the single stream or the multi-stream of the cable broadcast demodulated by the first demodulator 102 is directly output to the demultiplexer 104. In this case, since the scrambled cable broadcast cannot descramble, the user cannot normally watch.

The demultiplexer 104 separates the audio, video, and data streams from the multiplexed broadcast stream and outputs them to the decoders 105. The decoder 105 may include an audio decoder, a video decoder, and a data decoder.

That is, the demultiplexer 104 decodes the audio stream from the audio decoder, the video stream from the video decoder, and the data stream from the data decoder.

Meanwhile, the bidirectional communication unit 107 receives the downlink data broadcast of the DSG method transmitted from the headend, or transmits uplink information of the broadcast receiver (for example, application for a paid program, diagnosis information of the host, etc.) to the headend in the DSG method. Can be. The second demodulator 106 demodulates the DSG data broadcast provided from the bidirectional communication unit 107 and outputs the demodulated data broadcast to the controller 108.

In addition, the bidirectional communication unit 107 receives an OOB data broadcast transmitted from the headend, or transmits upstream information (for example, a paid program request, diagnostic information of a host, etc.) of the broadcast receiver to the headend in the OOB method. Can be. The data broadcast received by the OOB method is output to the cable card 200.

The uplink information of the broadcast receiver is input to the bidirectional communication unit 107 through the cable card 200 in the case of the OOB method, and is modulated by a quadrature phase shift keying (QPSK) in the bidirectional communication unit 107 to the headend. Can be sent. In the case of the DSG method, the second demodulator 106 is converted according to the network protocol through the control unit 108, and in the bidirectional communication unit 107, for example, QAM (Quadrature Amplitute Modulation) -16 is modulated and then the cable modem is changed. Can be sent to the headend.

In addition, the log information provided by the log information generation unit 109 is changed from the SNMP agent in the cable modem of the bidirectional communication unit 107 to a MIB data structure as shown in FIG. 4 and transmitted to the SNMP management server of the headend. The SNMP agent may be included in the controller 108 or the log information generator 109. The present invention describes what is included in the cable modem in one embodiment.

In this case, the log information changed into the MIB data structure is packetized by TCP / IP such as UDP (user datagram protocol) or IP (internet protocol) and transmitted to the headend through a network dependent protocol.

That is, the SNMP agent collects log information generated by the log information generator 109 in real time or periodically or when a request is received from the headend, and then defines the MIB data structure as shown in FIG. Send to management server. The log information generated by the log information generating unit 109 may be output to the bidirectional communication unit 107 in real time, and stored in the storage unit 110 and then output to the bidirectional communication unit 107 only periodically or upon request. May be

In this case, the log information generation unit 109 may be provided in the control unit 108, or may be provided outside the control unit 108 as shown in FIG. In addition, the controller 108 may play a role of generating log information. In this case, the log information generator 109 may be omitted. The present invention describes generating the log information in the log information generating unit 109 in one embodiment. At this time, the log information generation unit 109 activates the netfilter function provided at the kernel level to generate log information for the network interface.

The operation of the controller 108 and the log information generator 109 may be performed by any one of hardware, firmware, middleware, and software, or may be performed by a combination of at least two of them.

Meanwhile, the broadcast receiver of FIG. 5 may further include a downloadable conditional access system (DCAS) 111, and the DCAS 111 may receive and operate the encryption algorithm when the headend transmits the encryption algorithm. Therefore, when the DCAS 111 is provided in the host 100, the cable broadcasting can be descrambled without the cable card 200.

Log information generation and transmission method according to the present invention can be equally applied to next-generation cable networks, such as IPv6, DOCSIS3.0, DCAS.

It is easy for a person skilled in the art to change or modify the present invention from the present specification. Therefore, although an embodiment of the present invention has been described above clearly, various modifications thereof should be made without departing from the spirit and the scope of the present invention.

1 is a conceptual diagram of a cable network for data transmission and reception between a broadcast receiver and a headend according to an embodiment of the present invention;

2 is a conceptual diagram for exchanging information between an SNMP management server and an SNMP agent according to an embodiment of the present invention;

3 is a view showing an example of various state information that can be transmitted to the headend using SNMP in the broadcast receiver according to the present invention

4 is a diagram illustrating an example of log information that can be transmitted to a headend using SNMP in a broadcast receiver according to the present invention.

5 is a block diagram showing an embodiment of a broadcast receiver according to the present invention;

* Explanation of symbols in main part of drawing *

10: head end 20: broadcasting station

31, 32, 33, 34: broadcast receiver

40: SNMP management server 51,52: SNMP agent

101: tuner 102: first demodulator

103: multiplexer 104: demultiplexer

105: decoding unit 106: second demodulation unit

107: bidirectional communication unit 108: control unit

109: log information generation unit 110: storage unit

111: DCAS

Claims (12)

In the log information processing method of the broadcast receiver connected to the broadcast transmission end in a network capable of bidirectional communication, Generating log information of the corresponding broadcast receiver; And And transmitting the generated log information to the broadcast transmitter using network management means. The method of claim 1, Wherein the network management means is any one of the Common Management Information Protocol (CIMP), Remote Network Monitoring (RMON) and Simple Network Management Protocol (SNMP) log information processing method of a broadcast receiver. The method of claim 1, And the log information includes at least one of index information indicating the number of log information to be transmitted, time information of an input / output packet in a corresponding index, and corresponding log contents. The method of claim 3, wherein And the log content comprises at least one of an address of a source side transmitting a packet to the broadcast receiver and an address of a target side transmitting a packet from the broadcast receiver. The method of claim 1, And the log information is defined as MIB (management information base) data. A broadcast receiver connected to a broadcast transmission end through a network capable of bidirectional communication, A log information generator for generating log information of the broadcast receiver; A storage unit which stores the generated log information; And And a bidirectional communication unit configured to transmit one log information of the log information generated by the log information generator and the log information stored in the storage unit to the broadcast transmitter using network management means. The method of claim 6, The network management means is a broadcast receiver, characterized in that any one of CIMP (Common Management Information Protocol), RMON (Remote Network Monitoring) and SNMP (Simple Network Management Protocol). The method of claim 6, And the log information includes at least one of an index information object representing the number of log information transmitted, a time information object of an input / output packet in a corresponding index, and a corresponding log content object. The method of claim 8, And the log content comprises at least one of an address of a source side transmitting a packet to the broadcast receiver and an address of a target side transmitting a packet from the broadcast receiver. The method of claim 6, And the log information is defined as management information base (MIB) data. The method of claim 6, The two-way communication unit broadcast receiver, characterized in that it comprises a modem. The method of claim 11, wherein the modem And an SNMP agent for defining the log information as a MIB data structure and transmitting the log information to a broadcast transmitter including an SNMP management server.

Images