KR20190030317A - IoT Security System Based on the BlockChain and Security Method thereof - Google Patents

Abstract

The present invention relates to an internet of things (IoT) security system and a security method using a blockchain for preventing infringement of confidentiality, accessibility and integrity of data that may occur in IoT. The security system comprises one or more nodes, which are entities for executing an operation, for generating an operation verification request signal for requesting permission verification of an operation for execution and performing an operation for requesting permission verification when an operation execution permission signal permitting operation execution is received; and one or more IoT security server for creating a private network using a VPN and transceiving data with the node, receiving an operation verification request signal from the node, verifying whether to permit the operation of the node through the registered block chain and at the same time, transmitting the operation verification request signal received from the node to one or more another IoT security servers, generating an operation execution permission signal if more than half of the IoT security servers permit the execution and transmitting the same to the node.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an Internet security system,

The object of the present invention is to provide an object Internet security system and a security method using a block chain, and more particularly, to a object internet security system using a block chain for preventing infringement of data confidentiality, accessibility, Security method.

As the application of IoT field is expanded, the security problem of communication between objects or objects is becoming an important issue. In the inter-device communication in the IoT field, the mutual authentication for recognizing each other among the devices is mainly comprised of a radio frequency encryption / sink control / control method and a Bluetooth method. The following problems exist in that both use specific radio frequency bands.

In the case where mutual equipment, devices, or users and users are specifically recognized and recognized not only in mutual authentication between the IOT field and devices but also in specific fields such as objects and communication, However, in general, such phenomena as hacking and privilege escape can not be solved fundamentally.

In the case of a method using a specific frequency band, the communication between the devices is temporarily performed or allocated to the device itself, and the control data itself may be used for encryption / decryption according to the characteristics between the devices. As a result, this process can result in a fine time lag (time loss) in the control speed, which may cause a malfunction, and this error can easily occur as the transmission / reception distance becomes longer.

In addition, since the frequency band is used, hacking through the frequency is basically possible. That is, when a malicious user interrupts a specific frequency band through another device, control can not be prevented from being passed to the user. In addition, even if there is no malfunction, the malfunction error due to the frequency interference can not be completely eliminated.

The existing centralized security method does not provide a security method suitable for the distributed IoT environment, so the IoT devices become vulnerable. Therefore, various types of crime such as privacy invasion, abnormal operation, and data tampering can occur, and a security method suitable for a distributed IoT environment is needed.

The conventional security system as described above slows the execution time because a public key / secret key encryption / authentication scheme is used for a relatively low-power object. Also, because the object is moved from the center, when the server is hijacked, the entire network becomes dangerous and the object's operation can not operate normally. Also, since the operation history of the node is not encrypted, it is possible to inquire from outside and there is a possibility of data infringement.

Korean Patent No. 10-1678795 Korean Patent No. 10-1701131

One aspect of the present invention provides a object Internet security system and a security method using a block chain for preventing invasion of confidentiality, accessibility, and integrity of data that may occur in the Internet of things.

The technical problem of the present invention is not limited to the technical problems mentioned above, and other technical problems which are not mentioned can be understood by those skilled in the art from the following description.

The object Internet security system according to an embodiment of the present invention generates an operation verification request signal for requesting permission verification of an operation to be executed as an entity that executes an operation, One or more nodes executing an action for requesting validation; And verifying whether or not the operation of the node is allowed to be performed through the registered block chain by receiving an operation verification request signal from the node, And transmits the operation verification request signal to the one or two or more different object Internet security servers. When the object Internet security server allows more than one object, The above objects include the Internet security server.

In one embodiment, the node may also function as the object Internet security server when the computing power is high.

In one embodiment, the object Internet security server transmits an operation verification request signal to another object Internet security server, and then, after the object Internet security server receives the operation verification request signal, And waits until it sends a judgment about it.

In one embodiment, the object Internet security server comprises: a VPN server that creates a private network with the node and denies network access of an unauthenticated node; A block server for managing a block chain, performing a hash encryption, a data pool management, or a block verification required for a block chain, and managing a security policy stored in a block; Block management system is a web server that provides a controller for users to intuitively check history or update policies; And a DB server for storing and managing blocks on a block-by-block basis.

In one embodiment, the VPN server may create a private network using a shared key scheme.

In one embodiment, the block server may share a block chain with a block server included in another object Internet security server.

In one embodiment, the DB server may be stored in a local environment or used in conjunction with a cloud.

In one embodiment, the block is an element constituting the block server. The block is connected to another block through a block hash, and the validity of the block chain can be checked through the hash value.

In one embodiment, the block includes: a block header containing header values for managing a block; An inner policy in which an operation regarding a network policy is recorded; An outer policy in which a policy for the operation of the node is recorded; And a transaction in which the operation history of the node is stored.

In one embodiment, the things Internet security server can verify that the node performs the allowed action with reference to the outer policy area.

The object Internet security method according to an embodiment of the present invention includes: requesting permission verification of an operation to be performed by a node; The object Internet security server receiving the operation verification request signal from the node and performing verification of whether or not to permit the operation of the node through the registered block chain; Transmitting the operation verification request signal received from the node to the one or more other object Internet security servers; Generating and transmitting an operation execution permission signal to the object Internet security server when the object Internet security server permits more than one object Internet security server to execute; And executing an operation for requesting permission verification when an operation execution permission signal that the node permits operation execution from the object Internet security server is received.

In one embodiment, after the step of transmitting the operation verification request signal to one or more other object Internet security servers, the other object Internet security server determines whether or not to allow the operation of the node to execute the operation verification request signal And may further include a step of waiting until the verification is completed and the determination is transmitted.

In one embodiment, prior to the step of requesting an acceptance verification, the step of establishing the node and the object Internet security server may be further included.

According to an aspect of the present invention, a low-power IoT system can be performed, a system can be prevented from being taken over when a high-level server is stolen, and infringement of information that may occur in an existing method can be prevented.

FIG. 1 is a control block diagram illustrating a schematic configuration of an object Internet security system according to an embodiment of the present invention. Referring to FIG.
2 is a control block diagram illustrating the block server shown in Fig.
Figure 3 is a control block diagram illustrating the block in Figure 2;
FIG. 4 is a flowchart illustrating a method for securing an object Internet using a block chain according to an embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

FIG. 1 is a control block diagram illustrating a schematic configuration of an object Internet security system according to an embodiment of the present invention. Referring to FIG.

Specifically, the object Internet security system according to an embodiment of the present invention includes one or more nodes 100 and one or more object Internet security servers 200.

The node 100 is an entity that executes an operation in the Internet of Things (IoT), an intelligent technology and service that connects all objects based on the Internet and communicates information between people, objects, objects and objects, Generates an operation verification request signal for requesting permission verification of an operation to be performed, transmits the generated operation verification request signal to the object Internet security server 200, and executes an operation execution permission from the object Internet security server 200 When an acceptance signal is received, an operation for requesting permission verification is executed corresponding to the received operation execution permission signal. At this time, the node 100 transmits and receives data to and from the object Internet security server 200 through the private network created using the VPN.

That is, the node 100 is determined by the object Internet security server 200 when it executes its own operation.

In one embodiment, when the computing power is high, the node 100 may perform the action assigned to itself and also function as the object Internet security server 200 together. That is, when the node 100 performs a function as the object Internet security server 200, the node 100 may perform a function for verifying the execution of the other nodes 100 as described later.

As used herein, computing power refers to the ability to undertake or to perform calculations, often as a function of computing resources, in particular the number of instructions that can be executed at a given time or the amount of random access memory The ability of the computer to speak.

The object Internet security server 200 creates a private network using a VPN to transmit and receive data to and from the node 100, receives an operation verification request signal from the node 100, And transmits the operation verification request signal received from the node 100 to one or more other objects Internet security servers 200. In addition, When the object Internet security server 200 permits execution of more than half of the objects, it generates an operation execution permission signal, and transmits the generated operation execution permission signal to the node 100 through the private network.

Here, blockchain security technology is a technique for preventing hacking in online financial transactions. In the block chain, existing financial companies keep transaction records in a centralized server. However, in the block chain, Servers in the online network participants' computers. When additional transactions occur, they have to be approved by each participant. Because the book itself is open on the Internet and verification is done from time to time, hacking is basically impossible.

The block chain was initially used as a security technology for trading bits coins. Bitcoin was once popular as a future currency, but its popularity has waned in 2014 when Mt. Songs, a large brokerage firm, filed for bankruptcy protection on the grounds that it was unreasonable. However, the block-chain technology is open-source, such as bit coin, which is not patented. The use of block chains reduces the cost of maintaining and maintaining customer databases (DBs), which is why global financial companies are eyeing this technology.

The object Internet security server 200 transmits an operation verification request signal to another object Internet security server 200 and then transmits the operation verification request signal to the other object Internet security server 200, 100, and waits until the judgment is transmitted from the other object Internet security server 200. When the determination is made from the other object Internet security server 200, the object Internet security server 200 And judges whether or not the object Internet security server 200 has permitted the execution of the corresponding node 100 as a result of the collected judgment.

In one embodiment, the object Internet security server 200 may include nodes 100 having high computing power among the nodes 100 described above.

The object Internet security system having the above-described configuration is a technology for preventing invasion of confidentiality, accessibility, and integrity of data that may occur in the Internet (IoT). In order to achieve the above object, .

Referring to FIG. 1, the object Internet security server 200 includes a VPN server 210, a block server 220, a web server 230, and a DB server 240.

The VPN server 210 creates a private network with the node 100, transmits and receives data to and from the node 100 through the created private network, and refuses access to the network of the unauthenticated node 100.

In one embodiment, since the VPN server 210 creates a private network using a shared key scheme using a VPN to form a network with the nodes 100, the public key / private key scheme used in the conventional scheme By reducing the overhead, it is possible to effectively perform the function even in the node 100 having low power.

Here, the shared key scheme is a process in which a computer can access a wireless network using a WEP (Wired Equivalent Privacy) protocol, which is one of Shared Key Authentication (SKA). When a SKA is used, With this computer, you can fully access all WEP networks and exchange encrypted or unencrypted data.

A virtual private network (VPN) or virtual private network (VPN) is a method used to add security and personal information to private and public networks such as WiFi hotspots and the Internet. It is used by enterprises to protect sensitive data. do. However, personal VPNs are becoming more and more popular as more and more interactions are made with the Internet. Since the user's initial IP address is changed to the IP address of the VPN provider, the VPN increases the personal information. Using this method, subscribers can obtain an IP address in the gateway city provided by the VPN service. For example, if you live in San Francisco, but use a VPN, it may look like you live in Amsterdam, New York, or gateway cities.

The block server 220 manages the block chain and performs hash encryption, data pool management, or block verification necessary for the block chain, Manage policies.

Here, a cryptographic hash function is a special class of hash function with properties suitable for use in decryption, the input data is often called a message, and the output (hash value or hash) is often referred to as a message digest or simply a digest.

Here, the data pool is a gateway for accessing the GDSN network. All the information necessary for conducting business transactions between the trading partners is exchanged in a standardized manner, and communication between the trading partners has a common point and provides a function of synchronizing data.

In one embodiment, the block server 220 may share a block chain with the block server 220 included in the other object Internet security server 200-2.

The web server 230 maintains the web server 230 independently of each object Internet security server 200 when the object Internet security server 200 is executed. Provides a controller for checking or updating the policy.

The DB server 240 stores and manages the block 250 on a block basis.

In one embodiment, the DB server 240 may be stored in a local environment or used in conjunction with a cloud.

In one embodiment, block 250 is an element that constitutes block server 220, which is coupled to another block 250 via a block hash, and may be validated through the corresponding hash value .

In one embodiment, block 250 includes a block header that contains header values for managing block 250, an inner policy in which an action is recorded regarding network policy, An outer policy in which a policy for the operation of the node 100 is recorded and a transaction in which an operation history of the node 100 is stored.

The object Internet security server 200 having the above-described configuration can verify whether the node 100 executes the allowed operation with reference to the outer policy area.

The object Internet security system having the above-described configuration is a bottom-up method for performing an operation and verifies it in a distributed system. Therefore, it is possible to prevent a system from being compromised when a host server is hijacked .

The object Internet security system having the above-described configuration can prevent the infringement of information that may occur in the existing system because the operation history of the nodes 100 is encrypted with the key of the owner of the private network in the block 250 .

The existing object management system mainly focuses on the method of verifying the operation to objects through the block chain address authentication method. The scheme uses a public / private key encryption / authentication scheme to verify the behavior of objects. To describe a series of operations, the controller sends the command to the controller using the RPC protocol in the center, and the controller transmits the public key and the command received to the target object. The target object verifies the command received through its secret key and operates. Then, one of the operation histories is made into a block hash, which is verified in the network and generates a valid block.

Therefore, since the conventional method uses a public / private key encryption / authentication scheme for a relatively low-power object, it is expected that considerable overhead will occur in the process of encrypting / decrypting communication. Also, because the action on the object is taken from the center, when the server is hijacked, the action of the object may cause unwanted behavior. In addition, since the operation history is not encrypted and can be inquired from outside, there is a possibility of data infringement.

However, the object Internet security system having the above-described configuration reduces the overhead used in the public / private key encryption / authentication scheme by creating a private network through the VPN. Since the VPN uses the shared key method, it uses less power than the conventional method. Moreover, since the VPN can access only if it is connected to the Internet and can directly manage the devices registered in the private network, It is possible to shut down the connection of the device.

In addition, in the method for verifying the operation of the node 100 in the object Internet security system having the above-described configuration, the operation of the node 100 can be simplified by referring to the plurality of block servers 220, Since these histories are encrypted with the key of the owner of the private network, the other person can not confirm the operation details even if they inquire the block 250. [

Further, the system of the present invention can guarantee the integrity of the above contents through data integrity, which is a basic strength of a block chain. Here, data integrity is used in the meaning of precision, accuracy, completeness, and validity, and means a problem of ensuring the accuracy of the database. For example, data integrity refers to the protection of data and always maintains normal data, and various studies are conducted to protect the data. In addition, research to acknowledge a certain file update only to a specific person, or copying in advance to a separate medium in case of destruction of the case.

In the object Internet security system having the above-described configuration, a private network is created through a VPN, and communication between them is performed using a shared key method. The shared key method has the effect of reducing the execution time even in low power objects compared to the public key / secret key method. Also, since it is free of distance and firewall, it can be guaranteed that the operation is performed in any time and space. Moreover, suspicious devices can not connect to the network at all. In addition, unlike the existing technology, since the operation of the node 100 is owned by each user, the node 100 can act independently as long as the entire system is not controlled. Even if a part of the object Internet security server 200 is hijacked, in order to substantially control the operation, it is impossible to control the whole system unless the computing power of the whole system is higher than the POW theory of the block chain. Finally, since the contents of the block 250 are encrypted by the key of the network master, the operation history of the actual node can not be confirmed even if the other party inquires part or all of the contents of the block 250.

FIG. 4 is a flowchart illustrating a method for securing an object Internet using a block chain according to an embodiment of the present invention.

Referring to FIG. 4, in the object Internet security method using a block chain, the node 100 requests permission verification of an operation to be performed by the node 100 (410).

When the object Internet security server 200 receives the operation verification request signal from the node 100 and determines whether the operation of the node 100 is permitted or not through the registered block chain (420).

The object Internet security server 200 transmits the operation verification request signal received from the node 100 to one or two or more different object Internet To the security server 200 (430).

The object Internet security server 200-1 transmits the operation verification request signal to one or more object Internet security servers 200 in step 430 and then transmits the operation verification request signal to the object Internet security server 200-1 When the verification of whether or not the operation of the node 100 is allowed to be performed for the received operation verification request signal is terminated and the determination is not transmitted ("No" in step 430), the other object Internet security server 200-2 (440) awaiting and determining whether to allow execution of the node (100) until the operation of the node (100) is verified as to whether or not the operation of the node (100) .

In operation 430, after transmitting the operation verification request signal to one or more other object Internet security servers 200, the object Internet security server 200-2 transmits the operation verification request signal to the node 100, (Yes in step 430), the object Internet security server 200 collects judgments received from the object Internet security server 200 (step 430) 200 generates the operation execution permission signal, and transmits the generated operation execution permission signal to the node 100 (460).

In the case where the operation execution permission signal is generated and transmitted to the node 100 in the step 460, when the operation permission signal is received that the node 100 permits the operation from the object Internet security server 200, And executes the requested operation (470).

The operation verification request signal is transmitted to one or more other object Internet security servers 200 in the above-described step 430, and then the operation object verification request signal (Yes in step 430), the object Internet security server 200 collects judgments received from the object Internet security server 200. As a result, If the object Internet security server 200 is not allowed to execute the operation ("No" in step 450), it generates an operation prohibition signal and transmits the generated operation execution permission signal to the node 100 (step 480) .

In the case where the node 100 generates an operation prohibition signal in step 480 and transmits an operation inhibition signal to the node 100, when the operation inhibition signal indicating that the node 100 does not permit the operation from the object Internet security server 200 is received, And does not execute the requested operation (490).

The object Internet security method using the block chain having the above-described steps may further include setting the node 100 and the object Internet security server 200 before requesting the permission verification in the above-described step 410. [ At this time, the node 100 defines various behaviors of the node 100 and updates the operation policies of the nodes 100 in the object Internet security server 200 in the future.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. It will be possible.

100: node
200: Things Internet security server
210: VPN server
220: Block server
230: Web server
240: DB server
250: Block

Claims (13)

An operation execution request signal for requesting permission verification of an operation to be executed, the operation execution request signal for requesting permission verification of an operation to be executed, ; And
A private network is established using a VPN to transmit / receive data to / from the node, and an operation verification request signal is received from the node to verify whether the operation of the node is permitted or not through the registered block chain, And transmits the received operation verification request signal to one or two or more different object internet security servers, and when one or more object internet security servers permit execution, Object Internet Security System Using Block Chain Including Internet Security Server.
2. The method of claim 1,
And when the computing power is high, the function of the object Internet security server is also performed.
The Internet security server of claim 1,
After transmitting the operation verification request signal to the other object Internet security server, it waits until another object Internet security server that has received the operation verification request signal ends the verification of whether or not the operation of the node is allowed to execute and transmits a judgment Internet Security System for Objects using Block Chain.
The Internet security server of claim 1,
A VPN server that creates a private network with the node and denies the network access of the unauthorized node;
A block server for managing a block chain, performing a hash encryption, a data pool management, or a block verification required for a block chain, and managing a security policy stored in a block;
Block management system is a web server that provides a controller for users to intuitively check history or update policies; And
And a DB server for storing and managing blocks in block units.
5. The method according to claim 4,
Wherein the private network is created using a shared key method.
5. The method according to claim 4,
And a block chain is shared with a block server included in another object Internet security server.
5. The system according to claim 4,
Wherein the object is stored in a local environment or used in conjunction with a cloud.
5. The method of claim 4,
Wherein the block server is connected to another block through a block hash, and the validity of the block chain is checked through the hash value.
9. The method of claim 8,
A block header containing header values for managing blocks;
An inner policy in which an operation regarding a network policy is recorded;
An outer policy in which a policy for the operation of the node is recorded; And
And a transaction in which an operation history of the node is stored.
10. The Internet security server of claim 9,
And verifies whether or not the node executes an allowed operation with reference to the outer policy area.
The node requesting permission verification of an operation to be performed by the node;
The object Internet security server receiving the operation verification request signal from the node and performing verification of whether or not to permit the operation of the node through the registered block chain;
Transmitting the operation verification request signal received from the node to the one or more other object Internet security servers;
Generating and transmitting an operation execution permission signal to the object Internet security server when the object Internet security server permits more than one object Internet security server to execute; And
And executing an operation for requesting permission verification when an operation execution permission signal that the node permits an operation execution from the object Internet security server is executed.
12. The method of claim 11,
After the step of transmitting the operation verification request signal to one or more other object Internet security servers, the other object Internet security server terminates the verification of whether or not the operation of the node is allowed to execute on the received operation verification request signal, Further comprising the step of: waiting for transmission of the judgment result.
12. The method of claim 11,
Further comprising the step of setting the node and the object Internet security server prior to the step of requesting permission verification.

Images