KR20160138761A - Security management apparatus and method in a home network system - Google Patents

Abstract

According to an embodiment of the present invention, a security management apparatus for a monitoring device which monitors multiple devices and is connected to a server unit for common use includes; a connection unit electrically connected to the monitoring device; a monitoring unit monitoring a task in the monitoring device; and a control unit permitting or blocking the task based on the monitoring result of the monitoring unit.

Description

TECHNICAL FIELD [0001] The present invention relates to a security management apparatus and security management method in a home network system,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security management apparatus and a security management method in a home network system, and more particularly, to an apparatus and method for monitoring security of a monitoring apparatus connected to a common server unit.

In general, a home network is a system that enables home appliances such as TVs, refrigerators, and air conditioners, household appliances such as door locks, lights, gas, and fire to be controlled through a network. Residential) space and IBS (Intelligent Building System).

FIG. 1 is an exemplary view of such a home network system 40. As shown in FIG. 1, the home network system 40 refers to a network system for at least one household 50, and the monitoring equipment 52 installed in each household 50 is a household appliance (not shown in FIG. 1) Such as a home appliance, and the monitoring device 52 is connected to the outside 10 via the network 20 via the public server unit 30. [ At this time, the monitoring equipment 52 may be, for example, a wall pad provided for each household 50.

However, the home network system 40 has a security problem. That is, although the attack from the outside 10 to the public server unit 30 itself can be blocked by a firewall or other known security technology, a security technique against hacking of the monitoring equipment 52 itself has not yet appeared to be. Therefore, when hacking the monitoring device 52 from the outside, a plurality of devices (for example, a CCTV, a door lock, a photographing means such as a camera, etc.) connected to the monitoring equipment 52, Voice input means such as a microphone or light, etc.) can be arbitrarily operated, and such monitoring equipment 52 can also be exploited for DDos attacks and the like.

Accordingly, there is a need for a technique for providing security against hacking of the monitoring equipment 52. [

Korean Unexamined Patent Publication No. 10-2008-0032788 (published Apr. 16, 2008)

SUMMARY OF THE INVENTION It is an object of the present invention to provide an apparatus and method for providing and managing security for a monitoring device for monitoring a plurality of devices in a home network system.

It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. will be.

According to an embodiment of the present invention, a security management apparatus for a monitoring apparatus connected to a common server unit monitors a plurality of apparatuses includes a connection unit electrically connected to the monitoring equipment, a monitoring unit monitoring a task in the monitoring equipment, And a control unit for allowing or blocking the task based on a result monitored by the monitoring unit.

In addition, the security management apparatus may be included in the monitoring apparatus or may be separately implemented outside the monitoring apparatus.

Also, the first device, which is at least one of the plurality of devices, is connected to the monitoring device through the gateway unit, and the monitoring unit may include a list of the second devices connected to the monitoring device, And a device list monitoring unit for monitoring the device list.

In addition, the monitoring unit may include an initialization process monitoring unit that monitors an initialization process for enabling communication between the monitoring equipment and the gateway unit.

Also, the monitoring unit may include a file monitoring unit for monitoring files included in the monitoring equipment, a process monitoring unit for monitoring a process in the monitoring equipment, a monitoring unit for monitoring connection to the network of the monitoring equipment or data transmitted / A network monitoring unit, a memory access monitoring unit for monitoring access to the memory included in the monitoring equipment, and a device communication monitoring unit for monitoring communication between the monitoring equipment and the device.

Also, the monitoring unit may monitor the task based on a preset white list or a black list.

In addition, the monitoring unit can monitor the task through interlocking with the common server unit.

In addition, the monitoring unit can monitor whether the response from the device to the monitoring equipment is a response when there is no request by the monitoring equipment.

In addition, the monitoring unit may monitor whether the request received from the monitoring equipment is a request from a third equipment for which the request is not permitted.

The control unit may also allow or block access to the file, the process, the connection to the network, the data to and from the network, the access to the memory, or the communication between the monitoring equipment and the device based on the monitored result have.

A security management method using a security management apparatus for a monitoring apparatus connected to a common server unit monitors a plurality of apparatuses according to another embodiment of the present invention includes a step of electrically connecting to the monitoring apparatus, Monitoring and allowing or blocking the task based on the monitored result.

The first device is connected to the monitoring device through a gateway unit, and the monitoring is performed by a second device connected to the monitoring device without passing through the list of the first device or the gateway, Can be monitored.

In addition, the monitoring step may monitor an initialization process for enabling communication between the monitoring equipment and the gateway unit.

In addition, the monitoring may include a file included in the monitoring equipment, a process in the monitoring equipment, access to the network of the monitoring equipment, data to be transmitted to or received from the network, access to the memory included in the monitoring equipment, Monitor the communication between the monitoring device and the device.

In addition, the monitoring step may monitor the task based on a preset white list or a black list.

In addition, the monitoring step may monitor the task through interlocking with the common server unit.

In addition, the monitoring step may monitor whether the response from the device to the monitoring equipment is a response when there is no request by the monitoring equipment.

In addition, the monitoring step may monitor whether the request received from the monitoring equipment is a request from a third equipment that is not permitted.

Also, the step of allowing or blocking may include accessing the file, the process, the connection to the network, the data communicating with the network, the memory contained in the monitoring equipment, or the monitoring equipment, The communication between the devices can be permitted or blocked.

According to another embodiment of the present invention, a computer-readable recording medium having recorded thereon a program including instructions for performing each step according to a security management method may be included.

According to an embodiment of the present invention, only an authorized user or a processor can access the monitoring equipment included in the home network system and the devices connected to the monitoring equipment, and can prevent malicious files from being generated or executed, It can monitor the communication related to the monitoring equipment and can prevent the deception or alteration of the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent invasion of privacy from the outside through the monitoring equipment, and to prevent leakage of various information (internal information or personal information of the company) stored in the monitoring equipment.

1 is a diagram illustrating a home network system to which a security management apparatus according to an embodiment of the present invention is applied.
2A and 2B are views illustrating a configuration of a security management apparatus according to an exemplary embodiment of the present invention.
Figures 3A-3C illustrate connections between a monitoring device and a number of devices.
4A and 4B are views illustrating a configuration in which a security management apparatus according to an exemplary embodiment of the present invention is connected to monitoring equipment.
5A to 5C are conceptual diagrams illustrating a security management apparatus according to an exemplary embodiment of the present invention managing security for communication between a monitoring apparatus and a device.
FIG. 6 is a flowchart illustrating a security management method according to an exemplary embodiment of the present invention. Referring to FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

FIGS. 2A and 2B are views illustrating a configuration of a security management apparatus according to an exemplary embodiment of the present invention. FIGS. 3A to 3C are views illustrating a connection between a monitoring apparatus and a plurality of devices, 4A and 4B are views illustrating a configuration in which a security management apparatus according to an embodiment of the present invention is connected to a monitoring apparatus.

Referring to FIG. 2A, the security management apparatus 100 according to an exemplary embodiment of the present invention includes a connection unit 110 electrically connected to a monitoring device, a monitoring unit 120 monitoring a task in the monitoring equipment, And may include a control unit 130 that allows or blocks the task based on the monitored result, but the configuration shown in FIG. 2A is illustrative and not limited to the one that does not include at least one of the components, And may further include components. In addition, the security management apparatus 100 may be selectively activated or reconfigured by an electronic device or a computer program including a memory for storing instructions executed by the processor and the processor, according to a hybrid implementation of at least some software and hardware Lt; RTI ID = 0.0 > programmable < / RTI >

Here, it is assumed that the security management apparatus 100 according to an embodiment of the present invention is applied to each of the monitoring devices 52 installed in at least one household 50 of the home network system 40 shown in FIG. 1 I will explain. Hereinafter, the home network system will be described in more detail with reference to FIG. 1, but the home network system including at least one " household " The present invention is not limited thereto. That is, according to the embodiment of the present invention, for example, it may be applied to a co-residential (residence) space such as an office tower, an office or an IBS.

1, the common server unit 30 is a device that manages the monitoring equipment 52 included in at least one household 50 and can be, for example, a desktop or a server, And may be connected to the outside 10.

The common server unit 30 may be connected to the monitoring equipment 52 in at least one or more generations 50 included in the home network system 40. At this time, in connection of the monitoring equipment 52 and the common server unit 30, the monitoring equipment 52 is directly connected to the public server unit 30 as shown in FIG. 1, or alternatively is not shown in FIG. 1 But may be connected to the common server unit 30 via a separate connection configuration (for example, a gateway).

The monitoring equipment 52 included in each household 50 is connected to a plurality of devices not shown in FIG. A plurality of devices may include various electronic products such as a door lock, a lighting or gas, a TV, a refrigerator, an air conditioner, a photographing means such as a camera, a voice input means such as a microphone, The electronic device can support IP based communication or support other wired / wireless based communication. Hereinafter, a connection method between the plurality of devices and the monitoring equipment will be described with reference to FIGS. 3A to 3C.

3A, the first device 53 of the plurality of devices may be connected to the monitoring device 52 through the gateway 70, and the second device 55 of the plurality of devices may be connected to the gateway 70, It can be directly connected to the monitoring equipment 52 without passing through. The gateway unit 70 may be connected to the monitoring equipment 52 (for example, RS-232, RS-485, RF, TCP / IP, Bluetooth or NFC) However, since the configuration and function of the gateway unit 70 are well known, a detailed description thereof will be omitted.

At this time, as shown in FIG. 3A, such a gateway unit 70 may be implemented to be included in the monitoring equipment 52, or alternatively may be separately implemented outside the monitoring equipment 52 as shown in FIG. 3B. 2 (71) may be separately implemented outside the monitoring equipment 52 while being implemented to be included in the monitoring equipment 52 as shown in FIG. 3C (the gateway unit # 1 70) Of course).

Referring to FIG. 2A, a connection unit 110 included in the security management apparatus 100 according to an embodiment of the present invention electrically connects the security management apparatus 100 and the monitoring equipment 52. The security management apparatus 100 can monitor and control the monitoring equipment 52 through this connection unit 110. [

Referring to FIG. 4A, the security management apparatus 100 according to an exemplary embodiment of the present invention may be included in the monitoring equipment 52 to be electrically connected to the monitoring equipment. In this case, the connection unit 110 electrically connects the monitoring equipment 52 and the security management apparatus 100. For example, the connection unit 110 may include a file, a process, a communication memory, etc. Or a part where the monitoring equipment 52 performs communication with the outside or the like.

Accordingly, the security management apparatus 100 can access the file in the monitoring equipment 52, the process in the monitoring equipment 52, the monitoring equipment 52, and the external (for example, a public server or a device ), Or access to the memory contained in the monitoring equipment 52. [0050]

4B, the security management apparatus 100 according to an embodiment of the present invention may be separately implemented outside the monitoring equipment 52. [

The connection unit 110 electrically connects between the monitoring equipment 52 and the security management apparatus 100 separately implemented outside the monitoring equipment 52. For example, the connection unit 110 may include the monitoring equipment 52, A part for controlling a file, a process, a communication or other memory, etc., or a part for which the monitoring equipment 52 performs communication with the outside or the like. 2A, although the security management apparatus 100 is implemented outside the monitoring apparatus 52, the security management apparatus 100 is not limited to the configuration shown in FIG. 2A, As shown in FIG.

The monitoring unit 120 can monitor a task in the monitoring equipment 52. [ To this end, the monitoring unit 120 accesses the monitoring equipment 52 and receives the information about the task. The monitoring unit 120 then determines whether the task related to the task is a predetermined whitelist or black It can be monitored whether or not it is included in the list.

Here, the task refers to a task performed by the monitoring equipment 52, for example, an operation related to system hardening, an operation related to a code signing solution, The operation of encrypting data on the communication, the operation of applying a one-time password to access to monitoring equipment 52, the operation of security control service, the prevention of leakage of data But are not limited to, working with application protection techniques, working on ensuring service continuity, working on data recovery in case of need, or monitoring abnormal use of the device.

More specifically, the task of system hardening is performed by the application (software) that can be installed in the monitoring equipment 52 and resources such as a file, a directory, and a registry that can access the monitoring equipment 52 (Eg, based on a whitelist or blacklist) and then monitoring the installation or execution of an unprejudged app, or accessing resources.

In addition, the work related to the code signing solution can be normally executed only for the application that has been code-signed, so that the application distributed by the hacker or the like can not be executed. In this case, This can mean signing the code based on the certificate in the previous executable file.

In addition, the authentication of a user or a device based on a certificate may refer to permitting access only to a user or a device having the certificate installed, for example, a certificate of a device for low-power short-range communication, The international standard interface certificate of the modem, the European protocol certificate of the DOCSIS, or the certificate of the separate broadcasting mode of the security module.

In addition, the task of data encryption on communication refers to data encryption through SSL certificate. For example, if a moderated site does not have a normal SSL certificate, it blocks access to such site, Prevention

In addition, the work related to the security control service can refer to monitoring the malicious code for the end point at the gateway level by utilizing the function of monitoring URL, IPS / FILE and the like.

In addition, the work related to data leakage prevention refers to the detection and blocking and reporting of data including confidential information and personal information among the data transmitted to the outside, for example, from a device supporting the IoT (Object Internet) function It is possible to prevent confidential information and personal information from being leaked.

In addition, work on the application protection technology refers to blocking external leakage of such data by applying encryption to data stored in the monitoring equipment 52 and separating secret data. For example, data separation, , Encryption, authentication, and the like.

2B, the monitoring unit 120 may include a file monitoring unit 121, a process monitoring unit 122, a network monitoring unit 123, a memory access monitoring unit 124, And may further include other configurations that do not include at least one or more of the following, but may not be shown here.

The file monitoring unit 122 monitors a file in the monitoring equipment 52. [ For example, the file monitoring unit 122 can monitor creation, copying, deletion, movement, access, reading, writing, file name change or execution of a file based on a white list or a black list. The file to be targeted may include an executable file, a configuration file, an important data file, a registry or a system file. More specific examples include a file for storing contents of conversation between generations using the monitoring equipment 52, And the like, and the like, but the present invention is not limited thereto.

The process monitoring unit 122 monitors the process in the monitor equipment 52. [ For example, the process monitoring unit 122 may monitor the intrusion or execution of a process for disabling the operation of the security management apparatus 100 based on a whitelist or a blacklist.

The network monitoring unit 123 monitors the connection of the monitoring equipment 52 to the network or the data transmitted and received through the network on the basis of a white list or a black list. At this time, the monitored network includes, for example, a public server unit 30, a network connection to the other external network 10, packets, data, and commands transmitted and received via the network.

The memory access monitoring unit 125 monitors accesses to the memory included in the monitoring equipment 52 and externally monitors the memory included in the monitoring equipment 52 such as the contents of conversations between households, , Personal information about household members, visitor information, etc.) can be monitored based on a whitelist or a blacklist.

The initialization process monitoring unit 126 may monitor the initialization process of the monitoring equipment 52 and the gateway unit 70. [ That is, the initialization process monitoring unit 126 may monitor various initialization processes that enable communication between the monitoring equipment 52 and the gateway unit 70. The initialization process may be performed by, for example, And transmitting the IP of the equipment 52.

The device list monitoring unit 127 may also monitor a list of a plurality of devices (e.g., a first device or a second device) connected to the monitoring equipment 52. [ More specifically, the device list monitoring unit 127 can monitor the modulation or the change of the device list, and can also monitor the connection to the monitoring device 52 of the unauthorized device that is not included in the device list . The device list monitoring unit 126 may monitor the device list transmission process between the gateway unit 70 and the monitoring equipment 52. [ Here, in the process of transmitting the device list, the monitoring device 52 receives information on the device (e.g., the first device) connected to the gateway 70 from the gateway 70, And the like.

The device communication monitoring unit 127 can monitor communication between the monitoring equipment 52 and a plurality of devices. For example, it is possible to monitor an abnormal access from the outside to a photographing means such as a camera connected to the monitoring equipment 52 or a voice input / output means such as a microphone or the like.

The device communication monitoring unit 127 can monitor a communication (for example, a control command or an event, hereinafter referred to as device-related communication) transmitted to the device 53 or transmitted from the device 53 5A to 5C, it is assumed that the communication method between the monitoring device 52 and the plurality of devices is a half-duplex polling method. At this time, in half duplex and polling communication mode, a slave can perform a response when a master makes a request, a request of a master is transmitted to all slaves, and a response of one slave is transmitted to another slave and a master Let's take a look at the premise.

5A is a diagram conceptually showing a case where the communication method between the monitoring equipment 52 and a plurality of devices in the home network system is a half duplex method. Referring to FIG. 5A, in the case of a half-duplex polling scheme, the monitoring equipment 52 is a master requesting communication 60 and the device 53 is a slave for responding to the request 60 ). That is, in the half duplex and polled home network system, the plurality of devices 53 can respond 61 only when there is a request 60 of the monitoring equipment 52. In addition, when the master monitoring device 52 makes a request 60, the slave device 53 can perform a response. At this time, the request of the monitoring device 52 is transmitted to all the devices 53 , The response of any one of the devices 53 is transmitted to the other device and the monitoring device 52.

5B is a diagram showing a case where there is a response 61 from the device 53 even when there is no request 60 of the monitoring equipment 52 in the home network system. In this case, the device communication monitoring unit 127 can analyze that there is a response 61 even though there is no request. This situation can be detected, for example, even when the device 53 is infected with a malicious code, If the third equipment 56, not the monitoring equipment 52, transmits a request 62 to attack the equipment 53 as shown in FIG. 5C, Lt; / RTI >

On the other hand, in FIG. 5C, when the monitoring device 52 receives a request 62 to attack the device 53 from a third device 56 other than the device 53, The device communication monitoring unit 127 may analyze whether the third equipment 56 has delivered the request 62 to attack.

Meanwhile, the monitoring of the monitoring unit 120 may be performed in cooperation with the common server unit 30, with the help of the common server unit 30. [ For example, when the monitoring unit 120 can not perform monitoring, the common server unit 30 may perform monitoring instead of the monitoring unit 120. Alternatively, the monitoring unit 120 transmits the monitoring result to the public server unit 30 and receives the analysis result from the common server unit 30, and then uses the analysis result to determine whether to allow or block the corresponding task .

Referring back to FIG. 2A, the controller 130 may allow or block the following tasks based on the white list or the black list, based on the monitoring result of the monitoring unit 120.

For example, the control unit 130 can lock down (lock down) the installation or execution of an application or access to a resource that is not defined in the work related to the system hardening. In the work related to the code signing solution, (Lock down) an application that has not been authenticated, and can only block access to a user or device without a certificate in the process of authenticating a user or a device based on a certificate. In addition, it is possible to prevent a communication from being connected to a site that has been modulated by a job related to data encryption, and to prevent data leakage to a normal site. In addition, it is possible to block (lock down) the creation, copying, deletion, movement, access, reading, writing, file name change or execution of a file, It is possible to block the network connection to the public server unit 30 or the network connection to the external network 10 and to prevent the process or the user from accessing the memory included in the monitoring equipment 52 from outside . In addition, the control unit 130 may block abnormal access to the audio input / output means such as a photographing means such as a camera or a built-in camera connected to the monitoring equipment 52, a microphone, or the like, Personal information, company internal information, etc. can be blocked.

In the case where there is modulation or deodorization of data or the like in the initialization process, or when the list of the devices connected to the monitoring device 52 is altered or deodorized during the device list transmission process, Can be blocked.

The control unit 130 also makes a response 61 when the device 53 does not receive the request 60 from the monitoring device 52 or requests the device 53 to attack the device 53 (62), it may block such a response (61) or request (62).

Additionally, although not shown in FIG. 2A, the storage unit may store a result monitored by the monitoring unit 120, and the storage unit may be in the form of a memory for storing data. Accordingly, the manager or the common server unit 30 of the home network system 40 can recognize, manage, and process the security problem for the home network system 40 based on the data stored in the storage unit at any time.

In addition, although not shown in FIG. 2A, the alarm unit may transmit the task details permitted or blocked by the control unit 130 to the user or the administrator. For example, alarms can be used to set up or run blocked applications or to access resources, to block the execution of applications that are not code-signed, to connect to moderated sites, An abnormal access to a voice input / output means such as a camera or a built-in camera such as a camera connected to the equipment 52 or a voice input / output means such as a microphone, an attempted outflow of personal information (such as business information) But it is not limited thereto. The notification message may be various forms of SMS, MMS, LMS, smart phone application, and the like.

In addition, the alarm unit may be configured to respond 61 even if the device 53 does not have a request 60 from the monitoring equipment 52, or to request 62 the third device 56 to attack the device 53, The user or administrator can be informed of such details.

As described above, according to the security management apparatus according to an embodiment of the present invention, only authorized users or processors can access the monitoring equipment included in the home network system and the devices connected to the monitoring equipment, Can be prevented from being generated or executed, monitoring communication related to the monitoring equipment, and preventing deception or alteration of the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent invasion of privacy from the outside through the monitoring equipment, and to prevent leakage of various information (internal information or personal information of the company) stored in the monitoring equipment.

Hereinafter, a method for managing security in a home network system using a security management apparatus according to an embodiment of the present invention will be described.

FIG. 6 is a flowchart illustrating a security management method according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 6, a security management method according to an exemplary embodiment of the present invention includes a step (S100) of electrically connecting to the monitoring equipment, a step (S200) of monitoring a task in the monitoring equipment (S300) of permitting or blocking the task as a basis, but the spirit of the present invention is not limited to that shown in FIG.

The step S100 to be electrically connected is performed, for example, by the connection unit 110 of the security management apparatus 100 through which the security management apparatus 100 can be connected to the monitoring equipment 52. [ At this time, when the security management apparatus 100 is included in the monitoring equipment 52 and when the security management apparatus 100 is separately implemented outside the monitoring equipment 52, the connection unit 110 is connected to the monitoring equipment 52 And the security management apparatus 100 can be electrically connected to each other as described above.

The monitoring step S200 is performed, for example, by the monitoring unit 120 of the security management apparatus 100, through which a file or a process in the security monitoring equipment 52, access to a network connection or a memory, The process, device list transmission process, and communication between the monitoring device 52 and the device may be monitored, as described above.

The step of allowing or blocking S300 may block or allow the task based on the whitelist or blacklist based on the monitoring result in step S200 of monitoring. For example, you can work on system hardening, working with code signing solutions, creating, copying, deleting, moving, accessing, reading, writing, changing file names, It is possible to allow or block based on a list or blacklist as described above.

As described above, according to the embodiment of the present invention, only the authorized user or the processor can access the monitoring equipment included in the home network system and the devices connected to the monitoring equipment, Can monitor the communication related to the monitoring equipment, and can prevent the deception or alteration of the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent invasion of privacy from the outside through the monitoring equipment, and to prevent leakage of various information (internal information or personal information of the company) stored in the monitoring equipment.

Combinations of each step of the flowchart and each block of the block diagrams appended to the present invention may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may be stored in a computer-usable or computer-readable memory, a recording medium, capable of directing a computer or other programmable data processing apparatus to implement a function in a particular manner, It is also possible for the instructions stored in the readable memory to produce an article of manufacture containing instruction means for performing the function described in each block or flowchart of each block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

100: security management device
110: connection unit 120:
130:

Claims (20)

1. A security management apparatus for a monitoring apparatus connected to a common server unit for monitoring a plurality of apparatuses,
A connection unit electrically connected to the monitoring equipment;
A monitoring unit for monitoring a task in the monitoring equipment; And
And a control unit for allowing or blocking the task based on a result monitored by the monitoring unit
Security management device.
The method according to claim 1,
The security management apparatus includes:
Characterized in that it is embodied in the monitoring equipment or separately implemented outside the monitoring equipment
Security management device.
The method according to claim 1,
Wherein at least one of the plurality of devices is connected to the monitoring equipment through a gateway unit,
Wherein,
And a device list monitoring unit for monitoring a list of the first devices or a list of second devices connected to the monitoring device without going through the gateway unit
Security management device.
The method of claim 3,
Wherein,
And an initialization process monitoring unit for monitoring an initialization process for enabling communication between the monitoring equipment and the gateway unit
Security management device.
The method according to claim 1,
Wherein,
A file monitoring unit monitoring a file included in the monitoring equipment;
A process monitoring unit for monitoring processes in the monitoring equipment;
A network monitoring unit monitoring a connection of the monitoring equipment to the network or data transmitted to and receiving from the network;
A memory access monitoring unit for monitoring access to a memory included in the monitoring equipment; And
And a device communication monitoring unit for monitoring communication between the monitoring equipment and the device
Security management device.
The method according to claim 1,
Wherein,
And monitors the task based on a predetermined whitelist or blacklist
Security management device.
The method according to claim 1,
Wherein,
And monitors the task through interlocking with the common server unit
Security management device.
The method according to claim 1,
Wherein,
Whether the response from the device to the monitoring device is a response when there is no request by the monitoring device
Security management device.
The method according to claim 1,
Wherein,
Monitors whether the request received by the monitoring equipment is a request from a third party that is not authorized
Security management device.
6. The method of claim 5,
Wherein,
Accepting or blocking the file, the process, the connection to the network, the data communicating with the network, the access to the memory, or the communication between the monitoring equipment and the device based on the monitored result
Security management device.

A security management method using a security management apparatus for a monitoring apparatus connected to a common server unit and monitoring a plurality of devices,
Electrically connecting the monitoring equipment;
Monitoring a task in the monitoring equipment; And
And allowing or blocking the task based on the monitored result
How to manage security.
12. The method of claim 11,
Wherein at least one of the plurality of devices is connected to the monitoring equipment through a gateway unit,
Wherein the monitoring comprises:
Monitors a list of the first devices or a list of second devices connected to the monitoring device without going through the gateway
How to manage security.
13. The method of claim 12,
Wherein the monitoring comprises:
Monitoring an initialization process enabling communication between the monitoring equipment and the gateway unit
How to manage security.
12. The method of claim 11,
Wherein the monitoring comprises:
A file included in the monitoring equipment, a process in the monitoring equipment, a connection to the network of the monitoring equipment or data communicated with the network, access to memory contained in the monitoring equipment, or communication between the monitoring equipment and the equipment To monitor
How to manage security.
12. The method of claim 11,
Wherein the monitoring comprises:
And monitors the task based on a predetermined whitelist or blacklist
How to manage security.
12. The method of claim 11,
Wherein the monitoring comprises:
And monitors the task through interlocking with the common server unit
How to manage security.
15. The method of claim 14,
Wherein the monitoring comprises:
Whether the response from the device to the monitoring device is a response when there is no request by the monitoring device
How to manage security.
12. The method of claim 11,
Wherein the monitoring comprises:
Monitors whether the request received by the monitoring equipment is a request from a third party that is not authorized
How to manage security.
15. The method of claim 14,
The step of allowing or blocking comprises:
Accessing a network of the monitoring equipment, or data communicating with the network, accessing memory contained in the monitoring equipment, or allowing communication between the monitoring equipment and the device based on the monitored results; Or block
How to manage security.
A computer-readable recording medium having recorded thereon a program for executing each step according to the security management method of any one of claims 11 to 19.

Images