KR20180046758A - Different units same security apparatus based on internet of things - Google Patents

Abstract

The present invention relates to a different unit same security (DUSS) device based on internet of things, which includes a sensor data receiver for receiving sensor data by being directly coupled to an internet of things (IoT) sensor, a security level determining unit for determining a security level of the sensor data by checking the type of the sensor data, an encryption unit for encrypting the sensor data according to a predetermined encryption rule with an operation server so as to bypass middleware to pass through in the middle if the security level corresponds to the highest level, and a sensor data transmitter for transmitting the encrypted sensor data to the middleware in accordance with a predetermined protocol. Accordingly, the present invention can enhance security between the IoT sensor and the operation server.

Description

[0001] DIFFERENT UNITS SAME SECURITY APPARATUS BASED ON INTERNET OF THINGS [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a DUSS technology based on the Internet of objects, and more particularly, to a DUSS device based on Internet of Things, which enhances security in communication between an IoT (Internet of Things) sensor and an operation server.

Industrial control systems consist of systems that control major national infrastructures such as electricity, railway, traffic and aerospace. Therefore, most of them are operated as closed networks separated from the public network because of high security. However, even in the closed-type operation of the isolated type, there are problems such as weakness of host security in the control network, unsecured connection of the network related to the control network, and malicious code infection by USB use.

In order to enhance the security of the conventional technology, the host itself protects the system through a software-based firewall and unnecessary port closure. However, this conventional technique has a disadvantage that it is still vulnerable to security in the process of transmitting data to a destination.

Korean Patent Laid-Open Publication No. 10-2012-0120696 (Apr. 25, 2011) discloses a security information providing apparatus for converting and providing security information and a method using the same, and it is an object of the present invention to provide a security information providing apparatus, It is also possible to use the installed equipment by connecting the owner of the security device installed for public purposes in a specific place with the security control system operator by including the device information module, the information sharing module and the security information conversion module. This avoids unnecessary redundant installation of security devices and reduces the cost of designing security control systems.

Korean Patent No. 10-0900882 discloses a gateway device, a network system, and a data conversion method applied to a vehicle using a plurality of mutually different network protocols, 1 and a second communication controller; a third communication controller connected to the third device; and a control unit for converting data between the first device and the second device, wherein data can be exchanged between networks using mutually different network protocols, Can be integrated management.

Korean Patent Laid-Open Publication No. 10-2005-0032477 (September 30, 2004) relates to a server provided with an encrypted data conversion device, wherein the electronic application system includes a local government public server 1, a plurality of resident terminals 3, It is possible to provide a means for relieving the security hole in the e-municipal common server, which is composed of a plurality of municipality terminals 4, and performing data relaying securely between terminals with different encryption protocols.

1. Korean Published Patent Application No. 10-2012-0120696 (Apr. 25, 2011) 2. Korean Patent No. 10-0900882 (Jun. 11, 2007) 3. Korean Patent Publication No. 10-2005-0032477 (September 30, 2004)

An embodiment of the present invention is to provide a different Units Same Security (DUSS) device based on the Internet for enhancing security in communication between an Internet of Things (IoT) sensor and an operation server.

One embodiment of the present invention is to provide a DUSS device based on object-based Internet which can enhance communication security according to importance of sensor data by performing encryption to bypass middleware according to the security level of sensor data.

One embodiment of the present invention can enhance security of communication by transmitting sensor data in a secure mode bus protocol and support the need to perform a separate protocol connection or conversion operation in middleware, thereby reducing the overload rate of middleware And to provide a DUSS device based on the object Internet.

Among the embodiments, a DUSS (Different Units Same Security) device based on a matter-of-interest Internet includes a sensor data receiver for receiving sensor data directly coupled to an IoT (Internet of Things) sensor, An encryption unit for encrypting the sensor data according to a predetermined encryption rule with the operation server so as to bypass middleware passing through the intermediate level when the security level corresponds to the highest level; And a sensor data transmitting unit for transmitting the encrypted sensor data to the middleware in accordance with a predetermined protocol.

The security level determination unit may receive a cryptographic scheme including a security level and a cryptographic rule according to the type of the sensor data from the operation server.

The security level determination unit may set a value of a cryptographic rule in the cryptographic scheme so that the cryptographic rule coded in advance is used when the security level corresponds to the highest level.

When the security level does not correspond to the highest level, the encryption unit determines whether to process the sensor data in the middleware via the middleware in accordance with a common cryptographic rule predetermined with both the operating server and the middleware, Data can be encrypted.

The encryption unit may encrypt the sensor data according to the encryption rule to bypass the middleware even when the security level does not correspond to the highest level when a request is received from the operation server.

The previously promised protocol may correspond to a secure Modbus protocol.

The encryption unit may set a value related to a security level or a cryptosystem in at least a part of the secure mode bus protocol in the process of encrypting the sensor data.

The encryption unit may include at least a part of the secure mode bus protocol information of an initiation character associated with a cryptographic scheme, an address, a function code, an encryption algorithm, ), The data maximum length, and the end character information.

The sensor data transmission unit may transmit the encrypted sensor data through the protocol in a UART (Universal Asynchronous Receiver / Transmitter) communication environment.

Among the embodiments, the DUSS method based on the object Internet includes a sensor data receiving step of receiving sensor data by directly coupling with the IoT sensor, a security level determining step of determining the security level of the sensor data by checking the type of the sensor data, Encrypting the sensor data according to a predetermined encryption rule with an operation server so as to bypass intermediate middleware when the security level corresponds to the highest level, and transmitting the encrypted sensor data to the middleware in advance And a sensor data transmitting step of transmitting the received data to the sensor.

The security level determination step may include receiving a cryptographic scheme including a security level and a cryptographic rule according to the kind of the sensor data from the operation server.

The step of determining the security level may include setting a value of a cryptographic rule in the cryptographic scheme such that the cryptographic rule coded in advance is used when the security level corresponds to the highest level.

The encryption step may include encrypting the sensor data according to the encryption rule so as to bypass the middleware even when the security level does not correspond to the highest level when a request is received from the operation server.

The disclosed technique may have the following effects. It is to be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, as it is not meant to imply that a particular embodiment should include all of the following effects or only the following effects.

The Different Units Same Security (DUSS) device based on the Internet according to an embodiment of the present invention can enhance security in the communication between the Internet of Things (IoT) sensor and the operation server.

The DUSS device based on the object Internet according to an embodiment of the present invention performs encryption to bypass the middleware according to the security level of the sensor data, thereby enhancing the communication security according to the importance of the sensor data.

The DUSS device based on the object Internet according to an embodiment of the present invention can enhance the security of communication by transmitting the sensor data by the secure Modbus protocol and at the same time, it does not have to perform any protocol connection or conversion operation in the middleware, Can be reduced.

FIG. 1 is a diagram for explaining a different Units Same Security (DUSS) system based on the Internet according to an embodiment of the present invention.
Fig. 2 is a view for explaining a DUSS device in Fig. 1. Fig.
3 is a flowchart illustrating an embodiment of a process of transmitting sensor data in the DUSS device in FIG.
4 is a flowchart illustrating another embodiment of a process of transmitting sensor data in the DUSS device in FIG.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

It is to be understood that the singular " include " or "have" are to be construed as including the stated feature, number, step, operation, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

FIG. 1 is a diagram for explaining a different Units Same Security (DUSS) system based on the Internet according to an embodiment of the present invention.

1, the DUSS system 100 based on the object Internet includes an operation server 110, a middleware 120, a DUSS device based on a DUT (hereinafter referred to as a DUSS device) 130, and an Internet of Things (IOT) (140).

The operating server 110 may be connected to at least one middleware 120 via a network. The operating server 110 may correspond to a computing device capable of integrally managing data received through at least one middleware 120. For example, the operating server 110 may correspond to a communication service provider (for example, KT, SKT, or the like) and manages a plurality of middleware 120 in an integrated manner.

The middleware 120 may be connected to at least one IoT sensor 140, a DUSS device 130 combined with the IoT sensor 140, and an operation server 110 via a network. The middleware 120 corresponds to a middleware (software engine) that connects different types of hardware, protocols, and communication environments in a distributed computing environment to enable smooth communication between an application program and an environment in which the programs are operated. For example, the middleware 120 receives data from a plurality of IoT sensors 140, each of which can use a different communication protocol, converts the data into a predetermined protocol with the operation server 110, As shown in Fig. In addition, the middleware 120 can process or manage the sensor data itself according to a situation such as an overload of the operation server 110 or the like.

The DUSS device 130 may be directly coupled to at least one IoT sensor 140 to be electrically connected to the middleware 120. The DUSS device 130 may be connected to the middleware 120 via a network and may bypass the middleware 120 under certain conditions And may be indirectly connected to the operation server 110 through a network. In one embodiment, the DUSS device 130 may combine the IoT sensors 140 of different models and transmit the sensor data received from the associated IoT sensor 140 to the middleware 120 in a pre- 120). In one embodiment, when the sensor data received from the IoT sensor 140 meets a specific condition, the DUSS device 130 encrypts the corresponding sensor data according to a predetermined encryption rule with the operation server 110, The middleware 120 may be bypassed.

The IoT sensor 140 may correspond to a sensor based on the object which transmits information detected during a specific time period from the measured object to the middleware 120 or the operation server 110 as a signal. In one embodiment, the IoT sensor 140 is an integrated sensor capable of performing at least one sensor function from a temperature sensor, a pressure sensor, a humidity sensor, a flow sensor, a magnetic sensor, an optical sensor, an acoustic sensor, . The IoT sensor 140 can directly transmit the sensing data to the middleware 120 and is directly coupled to the DUSS device 130 and electrically coupled to the DUSS device 130 to transmit the subsequent communication process to the DUSS device 130. [ And may be performed by the device 130.

Fig. 2 is a view for explaining a DUSS device in Fig. 1. Fig.

2, the DUSS device 130 may include a sensor data receiving unit 210, a security level determining unit 220, a controller 230, an encrypting unit 240, and a sensor data transmitting unit 250, They can be electrically connected.

The sensor data receiving unit 210 can directly receive the sensor data by coupling with the IoT sensor 140. [ In one embodiment, the sensor data receiver 210 may include a connector (not shown) that is electrically interconnectable with the IoT sensor 140 and may be coupled directly to the IoT sensor 140 via a connector, 140, < / RTI >

The security level determination unit 220 can determine the security level of the sensor data by checking the type of the sensor data. In one embodiment, the type of sensor data may correspond to at least one of temperature, pressure, humidity, flow rate, magnetism, light, sound, taste and smell. In one embodiment, the sensor data received from the IoT sensor 140 may include the type of the object to be measured and sensing information. For example, the sensor data may be implemented as a binary image including a header and a body, and the header may record the type and position of the sensing information of the measured object in the body. In one embodiment, the security level determination unit 220 can check the type of the sensor data based on the header of the sensor data, inquire the security level table according to the type of sensor data stored in advance, The value of the level can be set to the value of the security level of the corresponding sensor data.

The security level determination unit 220 may receive a cryptographic scheme including a security level and a cryptographic rule according to the type of sensor data from the operation server 110. [ In one embodiment, the cryptographic scheme comprises at least one cryptographic rule that is required to be applied according to the security level, and the cryptographic rules are associated with the operating server 110 in association with the applicable cryptographic algorithm, it means. In one embodiment, the security level determination unit 220 determines which security level value has a value according to the type of sensor data (for example, temperature, pressure, humidity, flow rate, magnetism, light, sound, taste and smell) (For example, 1: security level minimum, 2: security level intermediate, 3: security level best), and a cryptographic scheme containing information about which cryptographic scheme . For example, the security level determination unit 220 may receive, from the operation server 110, a cryptographic scheme including a security level and a cryptographic rule according to the type of sensor data, as shown in Table 1 below.

[Table 1]

When the security level of the sensor data corresponds to the highest level, the security level determination unit 220 may set the value of the encryption rule in the encryption scheme so that the hardware-coded encryption rule is used in advance. In one embodiment, when the security level according to the type of the sensor data corresponds to the highest level (for example, 3: the security level is the best), the security level determination unit 220 determines the security level The value of the cryptographic rule in the cryptographic scheme can be set so that the pre-hardware coded cryptographic rule is used. For example, if it is determined that the type of the sensor data corresponds to 'temperature' and the security level is '3' and the security level is the best, the security level determination unit 220 determines that the security level The encryption scheme for the symmetric encryption scheme is selected from among the symmetric encryption schemes among the encryption schemes previously coded by the hardware, and the encryption rules included in the symmetric encryption scheme, that is, the block cipher, the public key cipher, the hash function, , A corresponding value of a cryptographic scheme mapped to a security level '3' in the cryptographic scheme so that an encryption algorithm such as a digital signature is used.

The control unit 230 can control the entire operation of the DUSS device 130 and can control the data flow between the sensor data receiving unit 210, the security level determining unit 220, the encrypting unit 240, and the sensor data transmitting unit 250 Can be controlled.

If the security level of the sensor data corresponds to the highest level, the encryption unit 240 may encrypt the sensor data according to a predetermined encryption rule with the operation server 110 so as to bypass the intermediate middleware 120 have. For example, when the security level of the sensor data is '3', the encryption unit 240 applies 'symmetric encryption method-AES encryption algorithm' included in the password rule previously agreed with the operation server 110 The middleware 120 can decrypt the encrypted sensor data received from the DUSS device 130 and bypass it to be transmitted to the operation server 110 in a subsequent step have.

In one embodiment, when the middleware 120 confirms that the sensor data received from the DUSS device 130 has been encrypted using an unexpected encryption rule, the middleware 120 accesses, analyzes, or processes the encrypted sensor data through a separate software engine And bypasses the signal through the process of transmitting the signal to the operation server 110 as it is. In one embodiment, the middleware 120 may include a repeater for reproducing decrypted encrypted sensor data signals in accordance with the transmission distance during the communication process, and may transmit the encrypted sensor data, reproduced via the repeater, (110) and bypassed.

If the security level of the sensor data does not correspond to the highest level, the encryption unit 240 transmits the control data to the operation server 110 and the middleware 120 to determine whether to process sensor data in the middleware 120 via the middleware 120. [ The sensor data can be encrypted according to the common cryptographic rules promised with all of them. For example, if the security level of the sensor data does not correspond to the highest level as '2', the encryption unit 240 encrypts DES (Data Encryption) included in the common password rule preliminarily promised to the operating server 110 and the middleware 120, Standard encryption algorithm to encrypt the sensor data so that the middleware 120 decrypts and analyzes the encrypted sensor data received from the DUSS device 130 at a later stage, It is possible to determine whether or not the processing is performed on its own.

The encryption unit 240 can encrypt the sensor data according to a cryptographic rule to bypass the middleware 120 even when the security level of the sensor data does not correspond to the highest level when a request is received from the operation server 110 . In one embodiment, when the encryption unit 240 receives an encryption request for all the sensor data from the operation server 110, even if the security level of the sensor data does not correspond to the highest level, The middleware 120 can not decrypt the encrypted sensor data received from the DUSS device 130 in the subsequent step and bypasses the decrypted sensor data to be transmitted to the operation server 110 . In another embodiment, the encryption unit 240 encrypts and decrypts the security data based on the encryption scheme including the security level and the encryption rule according to the type of the sensor data received from the operation server 110 by the security level determination unit 220 The security level according to the type of sensor data included in the encryption scheme received from the operation server 110 and the security level according to the security level An example of a cryptographic rule is shown.

[Table 2]

The encryption unit 240 may set a value associated with a security level or a cryptosystem in at least a part of a secure Modbus protocol in the process of encrypting the sensor data. In one embodiment, the protocol promised prior to middleware 120 may correspond to a secure Modbus protocol, where the secure Modbus protocol is a type of serial protocol and is used by many industries for communication protocols Which is based on the Modbus protocol.

The encryption unit 240 encrypts the sensor data by using at least a part of the secure mode bus protocol information of the start character related to the encryption system, an address, a function code, an encryption algorithm, , Data length before encryption, length of data, maximum length of data, and end character information. Table 3 below shows a frame for the secure Modbus protocol corresponding to the protocol promised in advance with the middleware 120 in one embodiment of the present invention. In one embodiment, the function may correspond to a user defined function code that defines an operation required to perform the authentication procedure between the devices.

[Table 3]

The sensor data transmitting unit 250 can transmit the sensor data to the middleware 120 in accordance with a predetermined protocol. More specifically, the sensor data transmission unit 250 transmits the sensor data that has not been encrypted since the security level corresponds to the highest level and the encrypted sensor data or the security level does not correspond to the highest level, and transmits the unencrypted sensor data to the middleware 120 in a predetermined protocol can do. In one embodiment, the sensor data sender 250 may transmit the encrypted sensor data in a UART (Universal Asynchronous Receiver / Transmitter) communication environment with the middleware 120 in a predetermined protocol. In one embodiment, the sensor data sender 250 may send sensor data to the middleware 120 in a secure Modbus protocol.

3 is a flowchart illustrating an embodiment of a process of transmitting sensor data in the DUSS device in FIG.

The sensor data receiving unit 210 can directly receive the sensor data by combining with the IoT sensor 140 (step S310).

The security level determination unit 220 can determine the security level of the sensor data by checking the type of the sensor data (step S320).

If the security level of the sensor data corresponds to the highest level, the encryption unit 240 may encrypt the sensor data according to a predetermined encryption rule with the operation server 110 so as to bypass the intermediate middleware 120 (Step S330).

The sensor data transmission unit 250 can transmit the encrypted sensor data to the middleware 120 in a predetermined protocol (step S340). In one embodiment, the sensor data sender 250 may send sensor data to the middleware 120 in a secure Modbus protocol.

In the subsequent steps, the middleware 120 can bypass the encrypted sensor data when it is confirmed that the sensor data received from the DUSS device 130 has been encrypted through the unexpected encryption rule.

In one embodiment, the DUSS device 130 may perform encryption to bypass the middleware 120 according to the security level of the sensor data, thereby enhancing communication security according to the importance of the sensor data, It is possible to increase the communication security by transmitting the sensor data to the middleware 120, and to prevent the middleware 120 from performing a separate protocol connection or conversion operation, thereby reducing the overload rate of the middleware 120.

4 is a flowchart illustrating another embodiment of a process of transmitting sensor data in the DUSS device in FIG.

The security level determination unit 220 may receive the encryption scheme including the security level and the encryption rule according to the type of the sensor data from the operation server 110 (step S410).

The sensor data receiving unit 210 can directly receive the sensor data by combining with the IoT sensor 140 and determine the security level of the sensor data by checking the type of the sensor data based on the received cipher system ).

If the security level of the sensor data corresponds to the highest level (step S430), the security level determination unit 220 can set the value of the encryption rule in the encryption scheme so that the hardware-coded encryption rule is used S440). Following step S440, the encryption unit 240 may encrypt the sensor data according to a cryptosystem configured to bypass the intermediate middleware 120 via the intermediary (step S450).

If the security level of the sensor data does not correspond to the highest level (step S460), the encryption unit 240 determines whether to process the sensor data in the middleware 120 via the middleware 120, The sensor data can be encrypted according to the common cryptographic rules predetermined with all of the middleware 120 (step S470).

The sensor data transmission unit 250 can transmit the encrypted sensor data in the secure mode bus protocol (step S480).

In the subsequent steps, the middleware 120 bypasses the encrypted sensor data received from the DUSS device 130 according to the security level of the sensor data, or decides whether to process the corresponding sensor data through decryption and analysis by itself You can decide.

In one embodiment, the DUSS device 130 may apply encryption differently according to the security level to enhance communication security according to the importance of the sensor data.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: Internet based DUSS system
110: operating server 120: middleware
130: Internet based DUSS device
140: IoT sensor
210: sensor data receiving unit 220: security level determining unit
230: control unit 240:
250: Sensor data transmitter

Claims (13)

A sensor data receiving unit for receiving sensor data directly coupled to an IoT (Internet of Things) sensor;
A security level determination unit for determining a security level of the sensor data by checking the type of the sensor data;
An encryption unit for encrypting the sensor data according to a predetermined encryption rule with an operation server so as to bypass intermediate middleware when the security level corresponds to the highest level; And
And a sensor data transmitter for transmitting the encrypted sensor data to the middleware in accordance with a predetermined protocol.
The apparatus of claim 1, wherein the security level determination unit
And receives a cryptographic scheme including a security level and a cryptographic rule according to the kind of the sensor data from the operation server.
3. The apparatus of claim 2, wherein the security level determining unit
Wherein the value of the encryption rule in the encryption scheme is set so that the encryption rule coded in advance is used when the security level corresponds to the highest level.
The apparatus of claim 1, wherein the encryption unit
If the security level does not correspond to the uppermost level, encrypts the sensor data in accordance with a common encryption rule predetermined with both the operating server and the middleware to determine whether to process the sensor data in the middleware via the middleware Based DUSS device.
The apparatus of claim 1, wherein the encryption unit
And when the request is received from the operation server, encrypts the sensor data according to the encryption rule so as to bypass the middleware even if the security level does not correspond to the highest level.
2. The method of claim 1, wherein the predetermined protocol is
Wherein the DUSS device corresponds to a secure Modbus protocol.
7. The apparatus of claim 6, wherein the encryption unit
Wherein a value related to a security level or a cryptosystem is set in at least a part of the secure mode bus protocol in an encryption process of the sensor data.
8. The apparatus of claim 7, wherein the encryption unit
An address, a function code, an encryption algorithm, a length of data before encryption, a length of data before encryption, The maximum length, and the end character information of the DUSS.
The apparatus of claim 1, wherein the sensor data transmitter
And transmits the encrypted sensor data through the protocol in a Universal Asynchronous Receiver / Transmitter (UART) communication environment.
A sensor data receiving step of receiving sensor data directly coupled to an IoT (Internet of Things) sensor;
Determining a security level of the sensor data by checking the type of the sensor data;
An encryption step of encrypting the sensor data according to a predetermined encryption rule with an operation server so as to bypass intermediate middleware when the security level corresponds to the highest level; And
And a sensor data transmitting step of transmitting the encrypted sensor data in a protocol predetermined with the middleware.
11. The method of claim 10, wherein the determining the security level comprises:
And receiving a cryptographic scheme including a security level and a cryptographic rule according to the kind of the sensor data from the operation server.
11. The method of claim 10, wherein the determining the security level comprises:
And setting a value of a cryptographic rule in the cryptographic scheme so that a cryptographic rule coded in advance is used when the security level corresponds to the highest level.
11. The method of claim 10, wherein the encrypting step
And encrypting the sensor data according to the encryption rule to bypass the middleware even if the security level does not correspond to the highest level when a request is received from the operation server. Way.

Images