KR20150146147A - Home network security service - Google Patents

Abstract

According to the present invention, a house complex type home network security method comprises the following steps of: extracting a packet transmitted to a residential gateway connected to a home network (S101); analyzing the extracted packet (S102); extracting the MAC address of a transmitting side from the analyzed packet (S103); comparing the extracted MAC address of the transmitting side with permitted MAC address data (S104); performing a MAC address analysis routine and controlling a corresponding device when the extracted MAC address of the transmitting side is permitted (S105); checking whether the packet is hacked when the extracted MAC address of the transmitting side is not permitted (S106); and executing a hacking blocking mode if it is determined that the packet is hacked (S107).

Description

{Home network security service}

Home network security

The present invention relates to a method and system for security of a home complex type home network. More particularly, the present invention relates to a home network security method and system for analyzing a MAC (Media Access Control) address of a packet broadcast in a home network, When an unauthorized MAC address is detected from an external network or a home network by comparing it with an authorized MAC address of a server and a residential gateway, it is determined that the MAC address is an external intrusion or an intrusion, By minimizing the burden on traffic and providing security functions optimized for the home network, it is possible to effectively block and detect illegal external intrusion, thereby maximizing security efficiency to the home network.

Generally, a security method of an enterprise network includes a firewall for primarily blocking an illegal external intrusion and an IDS (Intrusion Detection System) for detecting an intrusion through the firewall .

That is, an illegal external access is blocked by a firewall according to a security level of the enterprise, and an ID is detected as an intrusion due to the firewall being not blocked by the firewall, and the IDs are classified into a network type and a host type.

In recent years, in order to prevent security incidents from the inside along with the interworking of the firewall and the IDS, the security method of the enterprise type network environment monitors network traffic from the outside as well as internal intranet traffic .

[0003] On the other hand, in recent years, home electric appliances that have become popular in the home are becoming digital, so that digital devices installed in the home are connected to one network, and a home network capable of being controlled by wired / The environment is being built.

Accordingly, a security environment for preventing unauthorized external access such as the security of the enterprise network is required in a home network environment.

However, since the security method of the corporate network environment as described above monitors not only network traffic but also intranet traffic in the internal network, many traffic is targeted for monitoring, and most of the devices connected to the network are personal computers Server, etc., many types of intrusion into them cause unreasonable load for intrusion blocking or intrusion detection.

Therefore, in the home network environment which is very different from the enterprise network environment, it is difficult to provide the enterprise network environment and the resource of the home gateway / home server is also limited. Therefore, .

In addition, since most of the devices connected to the network are digital home appliances, the necessity of monitoring the internal network is much lower than that of the enterprise network.

In addition, since there is no special security device for the home network of the home network, hacking from inside can not be detected and intercepted.

Accordingly, an object of the present invention is to provide a security method that matches the characteristics of a home network as described above, and it is an object of the present invention to provide a security method that analyzes a MAC address of a packet broadcast in a home network, A home network type home network security method and system in which an intruder can be prevented from being judged as an external intrusion or an internal intrusion when an unauthorized MAC address is detected from an external network or a home network compared with an authorized MAC address of the home network .

Another object of the present invention is to provide a method and system for security of a residential complex type home network in which convenience in use is improved to further improve commerciality.

Reduces the burden on the traffic of the network to the minimum, and provides the security function optimized for the home network to effectively block and detect illegal external intrusion.

As described above, according to the present invention, a MAC address of a packet transmitted to a home network is analyzed, and a MAC

Address of the unauthorized MAC address is detected, it is determined that the unauthorized MAC address is an external intrusion,

It is possible to effectively block and detect illegal external intrusions by providing a security function optimized for a home network while reducing the burden on the traffic of the network to a minimum.

Therefore, not only the efficiency of security for the home network can be maximized, but also the convenience of use is improved and the merchantability is improved.

Brief Description of the Drawings Fig. 1 is a flowchart of a method for security of a home-type home network according to the present invention.
2 is a conceptual diagram of a home network type home network security system according to the present invention;
3 is a detailed block diagram of a security device of a home complex type home network security system according to the present invention;

According to another aspect of the present invention, there is provided a method for securing a home network type home network, comprising the steps of: extracting a packet transmitted to a residential gateway connected to a home network by analyzing a receiving MAC address of a packet transmitted to a server; Analyzing the extracted packet; extracting a MAC address of the transmitting side from the analyzed packet; comparing the extracted MAC address of the transmitting side with the permitted MAC address data; The method comprising the steps of: performing a MAC address analysis routine and controlling a corresponding device when the MAC address of the transmitting side is permitted; and if the MAC address of the transmitting side is not permitted, Detecting an ICMP and confirming whether or not the IC card is hacked; and performing a hacking blocking mode when it is determined that the IC card is hacked, The.

According to another aspect of the present invention, there is provided a home network type home network security system comprising: a main server connected to a wired / wireless communication network outside a housing complex for performing data communication with outside and inside of the housing complex; A hub for distributing a communication network in a housing complex provided at a terminal end of the home network to each household, and a data communication unit connected to the hub for data communication with one or more digital devices installed in the room, A packet analyzer for analyzing the packet extracted by the packet extractor, a packet analyzer for analyzing the packet extracted by the packet extractor, A MAC address extracting unit for extracting a MAC address from the packet analyzed by the packet analyzing unit; And a control unit for comparing the MAC address extracted by the MAC address extracting unit and the MAC address stored in the storage unit to determine whether the extracted MAC address is permitted, A processing unit for outputting,

A control unit for controlling the digital device according to a control signal output from the processing unit, and a hacking determination unit for determining whether a MAC address for which permission is determined by the processing unit is not allowed and for executing a hacking blocking mode upon hacking Thus,

And a security device installed to enable data communication with the paper server and the residential gateway.

Therefore, while minimizing the burden on the traffic of the home network, the security function optimized for the home network can be provided to block and detect illegal external intrusion.

In addition, the convenience of use is improved and the merchantability is further improved.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a flowchart of a method of securing a home-type home network according to the present invention. When data is transmitted to a home network from outside or inside, data broadcast to the home network is received by a server installed in a housing complex, Only works with server

The security device analyzes the MAC address of the transmitted packet and extracts a packet transmitted to a residential gateway connected to the home network in step S101.

Here, the residential gateway is in data communication with one or more digital devices (for example, a personal computer, a boiler, a refrigerator, a lighting device, etc.) installed in a room, Digital machine

For example.

The MAC address refers to a physical address and is an address for recognizing the hardware itself unlike a general network address (TCP / IP, etc.). The data includes only the server's MAC address and the address of the residential gateway connected to the home network.

Mac address is included.

Accordingly, when data transmitted from the outside or the inside to the home network is broadcasted,

And analyzes the load cast data to extract and receive data of the residential gateway connected to the home network.

However, the security device is not limited to a specific location as long as it can monitor a packet broadcasted to the home network.

The MAC address of the transmitting side is extracted (S103) by analyzing the extracted data (hereinafter, mixed with the packet) (S102), and the extracted MAC address of the transmitting side is compared with the permitted MAC address data (S104).

At this time, the authorized MAC address is a MAC address of a server and all the residential gateway connected to the home network.

Therefore, if the MAC address of the transmitting side is extracted and compared with the stored MAC address, if the same MAC address as the extracted MAC address is present in the stored MAC address, that is, if the extracted MAC address of the transmitting side is permitted, Performs the analysis routine and controls the corresponding device (S105).

If the extracted MAC address of the transmitting side is not permitted, that is, if the same MAC address as the extracted MAC address is not stored, it is determined that the device is not normally connected.

In this case, the UDP (User Datagram Protocol) portion of the transmitted packet is analyzed, and the Internet Control Message Protocol (ICMP) is detected to check whether the packet is hacked (S106) If it is determined to be a hacking result, the hacking blocking mode is executed (S107). The method of determining whether or not the hacking is performed can be variously applied to the needs of those skilled in the art.

In addition, the hacking blocking mode is for blocking transmission of a packet having a MAC address determined as a hacking, tracing back the MAC address determined by the hacking, and transmitting a message informing the administrator of the occurrence of a hacking. The manager may be a home network manager that manages the entire home network, or a manager of a house where a residential gateway is installed.

FIG. 2 is a conceptual diagram of a home complex type home network security system according to the present invention. The complex server 10 of the housing complex is configured to be capable of data communication with the hub 30 by the home network 20, 20 is transmitted to the corresponding digital device 50 via a residential gateway (RG) 40 installed in the corresponding house via the hub 30.

FIG. 3 is a detailed block diagram of a security system of a home network type security system according to the present invention. The security device 60 connected to the home network 20 extracts a packet, And the security device 60 can be configured to be interlocked with the server 10 only.

1 and 2, the home network type home network security method and system according to the present invention includes a server 10, a home network 20, a hub 30, a residential gateway 40, a digital device 50, and a security device 60.

The server 10 is connected to a wired / wireless communication network outside the housing complex and is used for data communication with the outside and the inside of the housing complex. The construction and operation method of the server 10 can be variously modified. The home network 20 is connected to the server 10 and constitutes a communication network within the housing complex. The home network 20 is composed of a wired network that supports a full speed of 10 Mbps (Mega byte per second). If necessary, Can be used.

The hub 30 is provided at the end of the home network 20 to distribute communication networks within the housing complex to each household. The hub 30 is connected to one communication line from the server 10, To each of the one or more residential gateways (40).

The resident gateway 40 is connected to the hub 30 and performs data communication with one or more digital devices 50 installed in the room. The resident gateway 40 analyzes MAC addresses of packets transmitted from the hub 30, Extracts the packet transmitted to the gateway 40, analyzes the transmitted packet, and controls the corresponding digital device 50.

The digital device 50 performs an operation according to data transmitted from the residential gateway 40. The digital device 50 may be a personal computer operated using digital data, a heating device such as a boiler, , An indoor lighting device, and the like.

In the home network system configured as described above, the security gateway 60 includes the security gateway 60. The security gateway 60 includes an interface 61, a packet extractor 62, A packet analysis unit 63, a MAC address extraction unit 64, a storage unit 65, a processing unit 66, a control unit 67, and a hacking determination unit 68.

The interface 61 is for data communication with the home network 20. Data input to the interface 61 is extracted by the packet extracting unit 62 and analyzed by the packet analyzing unit 63 .

The MAC address extracted by the packet analyzing unit 63 is extracted from the MAC address extracting unit 64 as described above.

The processing unit 66 compares the transmitted MAC address extracted by the MAC address extractor 64 with the stored MAC address and stores the received MAC address in the storage unit 65 If the stored MAC address data is included in the stored MAC address data, the extracted MAC address is permitted and a control signal is output.

The control signal output from the processing unit 66 is transmitted to the control unit 67 and the control unit 67 controls the digital device 50 according to the control signal.

If the transmission side MAC address for which permission is determined in the processing unit 66 is not stored in the storage unit 56, the hacking determination unit 68 determines that the transmission side MAC address has been transmitted by an illegal device from the outside, And the shutdown mode is executed.

The present invention can be variously modified without departing from the basic concept according to the needs of those skilled in the art.

10: Only server
20: Home network
30: Hub
40: Residential Gateway
50: Digital devices
60: security device
61: Interface
62:
63: Packet analysis section
64: Mac address extracting unit
65:
66:
67:
68: Hacking judgment unit

Claims (2)

(S101) of extracting a packet transmitted to a residential gateway connected to a home network by analyzing a receiving MAC address of a packet transmitted to the server, analyzing the extracted packet (S102), analyzing A step (S103) of extracting a MAC address of a transmitting side from the packet, a step (S104) of comparing the extracted MAC address of the transmitting side with the permitted MAC address data, and a step (S105) of performing a MAC address analysis routine and controlling the corresponding device (S105); and if the extracted MAC address of the transmitting side is not permitted, analyzing the UDP part of the TPC / IP, (S106), and if the hacking is determined as a result of the analysis, a hacking blocking mode is executed (S107). A server 10 connected to a wired / wireless communication network outside the housing complex and performing data communication with the outside and inside of the housing complex, a home network 20 connected to the server 10 to form a communication network within the housing complex, A hub 30 installed at the end of the home network 20 for distributing the communication network in the housing complex to each household and a data communication unit 30 connected to the hub 30 for data communication with one or more digital devices 50 installed in the room. (61) for performing data communication with the home network (20), a packet extracting unit (62) for extracting a packet of data input to the interface (61)
A packet analyzing unit 63 for analyzing the packet extracted by the packet extracting unit 62,
A MAC address extracting unit 64 for extracting a MAC address from the packet analyzed by the packet analyzing unit 63, a storing unit 65 for storing permitted MAC address data, A processor 66 for comparing the MAC address stored in the storage 65 with the MAC address stored in the storage 65, determining whether the extracted MAC address is permitted, and outputting a control signal,
A control unit 67 for controlling the digital device 50 according to a control signal output from the processing unit 66 and a control unit 67 for determining whether or not the MAC address, And a hacking determination unit 68 that executes a hacking blocking mode when the server 10 and the security gateway 60 are connected to each other. Home network type security system.

Images