KR20200108742A - Apparatus and method for security control in IoT infrastructure environment - Google Patents

Abstract

The present invention proposes a security control technique including a network access blocking function for preventing the spread of security threats from devices in an Internet of things (IoT) infrastructure environment to an IoT infrastructure and a network access blocking release function for minimizing service delay due to network access blocking. The present invention provides an apparatus and a method for collectively blocking network access to an end device in which a security threat has occurred and/or a group of end devices having the same or similar properties in order to prevent the spread of security threats and to block security threats in early stage when security threats such as DDoS attack and malicious code spread are detected, but canceling network access blocking by checking the security status of devices belonging to the blocked group in a certain order to minimize service delay due to the blocked devices.

Description

Security control device and method in IoT infrastructure environment {Apparatus and method for security control in IoT infrastructure environment}

The present invention relates to security control for preventing the spread of security threats such as DDoS attacks and malicious code spread in IoT infrastructure and for early blocking of security threats, and more specifically, preventing the spread of security threats in the IoT infrastructure environment. The present invention relates to a security control apparatus and method including a network access blocking function and a network access blocking canceling function for minimizing a service delay due to this.

Network segmentation technology is an existing technology to prevent the spread of network infringement. The basic concept of this technology is to control illegal access between network flows through an access control policy between separated network flow areas by dividing the area to be managed into network flow units (eg, service, etc.).

However, this technology can block illegal access that violates the access policy between network flows in separate areas in advance, but does not prevent the spread that occurs in the connection between multiple clients and service servers connected in the workflow area. That is, when a security threat occurs in the network flow area, the spread of the security threat in the network flow area cannot be blocked, and the spread of the security threat to the network flow area set to be accessible by the access control policy cannot be prevented.

Moreover, network segmentation is basically applied to east-west traffic in a server-to-server connection environment rather than targeting north-south traffic in a connection environment between clients and servers in the data center, that is, in the cloud where server groups are operated. , There is a limit to preventing the spread of security threats in the IoT infrastructure of the device-gateway-server structure, which is the subject field of the present invention.

In addition, in the case of IoT, services must be continuously provided, so even if network access is blocked to deal with security threats, a network access blocking release function must also be provided to the limit of minimizing service delay through rapid service resumption.

The present invention provides a network access blocking function that prevents security threats from spreading to the IoT infrastructure in an IoT infrastructure environment of a device-gateway-server structure, and a network access blocking release that minimizes service delay due to network access blocking. We propose a security control technology that includes functions.

The present invention prevents the spread of security threats when a security threat such as DDoS attack and malicious code spread is detected in an IoT infrastructure consisting of a service server, an IoT gateway, and an IoT end device (mixed with'device'). To prevent security threats early, block network access to end devices where security threats occur and/or groups of end devices having the same or similar properties, but block access to minimize service delays caused by blocked devices. Provides an apparatus and method for canceling network access blocking by checking the security status of devices belonging to the group in a certain order.

The present invention prevents a situation in which an attack such as DDoS or malicious code spreads rapidly due to the hyper-connectivity of the IoT connected using various communication means, thereby preventing the damage to the entire IoT service from spreading and minimizing the service delay. It provides a security control device and method in the IoT infrastructure environment for the purpose.

Internet of Things infrastructure by pre-blocking detected security threats even for devices that have not been subjected to security analysis or have not been detected by security threats by collectively blocking network access to devices and/or groups of identical devices Prevents the spread of the security threat as a whole and the spread of damage. In order to block network access of devices by group, products that are physically identical to devices that provide IoT service (eg CCTV, meter reader, door lock, etc.), provide identical services, and identical operating environment (eg: OS and version, etc.).

In addition, in order to minimize service delays that may occur due to network access blocking for devices that do not have security threats during the network access blocking process, a separate network access blocking process for each device and a separate network access blocking function for each device is also provided. Included. As methods for determining the target device for network access cancellation, 1) service provision is given priority and 2) security threat management is given priority, and these methods are selected and applied according to service characteristics at the IoT service operating site. can do.

In order to prevent the spread of the discovered security threats, the present invention blocks network access in units of device groups including devices in which security threats have occurred, and accesses in units of devices through security status checks of devices belonging to the blocked groups. Service delay is minimized by canceling the blocking. This enables security control in an autonomous IoT infrastructure environment where user intervention is minimized.

The configuration and operation of the present invention introduced above will become more apparent through specific embodiments described with reference to the drawings.

The network access blocking function of the security control device and method of the present invention not only blocks network access to devices in which security threats occur, but also blocks devices with high probability of occurrence of the same security threat in advance. Since the spread of security threats from devices can be prevented in advance, the spread of damage to IoT infrastructure and services that can be caused by DDoS attacks and malicious code infection with strong spreading power can be prevented in advance. At the same time, the network access blocking release function of the security control apparatus and method of the present invention can minimize service delay caused by blocking network access to the device. As network access blocking is applied in units of device groups with similar properties, network access to normal devices without security threats can be blocked, so the network access blocking release function is performed by continuously checking the security status of devices blocked from network access. .

As such, service delay can be minimized while preventing the spread of security threats to the IoT infrastructure early without the intervention of the administrator.

IT market research firm Gartner predicts that the number of IoT-related connected devices will reach 25 billion by 2020 from 5 billion in 2015, and the number of various electronic devices and objects affected by the IoT also increased in 2014. It is expected that from 10 billion objects to 30 billion objects will be connected to the Internet and used by 2020. UK's Makina Research predicts that the global IoT market will grow at an annual average of 218% by 2022, reaching $1.2 trillion. As the scale of the IoT increases, the damage caused by security incidents is expected to increase.The scale of damage to the IoT security caused by hacking is expected to increase from 134 trillion won in 2015 to 267 trillion won in 2030 (KIET , 2014), the related market is expected to expand as the demand for security technology increases.

IoT-based large-scale services are spreading to specific specific services such as smart remote meter reading services such as power/gas/water and smart health care services, and these services are particularly public and are damaged by security threats because of their sensitivity to personal information. As the economic and social impact is expected to increase, the demand for security technology to solve this problem will increase, and the related market will expand rapidly.

Figure 1 Configuration diagram for a method of blocking and unblocking access to IoT infrastructure
Figure 2 Flowchart of network access blocking procedure in IoT infrastructure
3 Explanatory diagram of the priority of determining a cancellation device according to a network access blocking cancellation policy
Fig. 4 Flow chart of network access blocking cancellation procedure in IoT infrastructure

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms different from each other, only this embodiment makes the disclosure of the present invention complete, and those skilled in the art to which the present invention pertains. It is provided to fully inform the scope of the invention to the person, and the invention is defined by the description of the claims.

On the other hand, terms used in the present specification are for explaining examples and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase. As used herein, "comprises" or "comprising" refers to the presence of one or more other components, steps, actions and/or elements other than the recited elements, steps, actions and/or elements, or Does not rule out addition.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In adding reference numerals to elements of each drawing, even though they are indicated on different drawings, the same elements are assigned the same reference numerals as much as possible, and in describing the present invention, a detailed description of related known configurations or functions If the gist of the present invention may be obscured, a detailed description thereof will be omitted.

1 is a configuration diagram of an embodiment of a security control device of the present invention.

Referring to FIG. 1, the present invention provides a security control server 10 for generating a command to block and release network access of an end device 30, which is a target of blocking and unblocking network access, and the security control server 10 It includes a gateway 20 for blocking and releasing network access of the control target end device(s) 30 by receiving a network connection blocking and blocking cancellation command.

The security control server 10 may be located on a management server that manages various policies for IoT services. The gateway 20 is a device that manages network access to an end device 30 installed and operated in an actual field for IoT service, and is configured in various sizes according to the IoT service. The end device 30 is mainly composed of sensors and actuators that collect information and control services for IoT services.

The main functional modules of the security control server 10, the gateway 20, and the end device 30 according to the present invention will be described as follows.

As shown in FIG. 1, the security control server 10 is composed of a connection blocking module 11 and a connection blocking release module 12. When a security threat is detected in the IoT infrastructure, the access blocking module 11 will block only the devices with the security threat according to the level of the detected security threat, or the same or similar group (identical) including the devices with the security threat. It is determined whether to block the device group collectively, and requests the gateway 20 to which the device 30 is connected to a network access blocking command for the determined device or device group. Here, the grouping of devices to be blocked is physically identical devices (eg, CCTV, meter reader, door lock, etc.), devices that provide the same service, and/or devices having the same operating environment (eg, OS and version, etc.) It can be categorized as, but the present invention is not limited to the method. In addition, when the detected security threat is determined to be a DDoS (denial of service attack) with high propagation power or a malicious code that spreads rapidly, a group to block network access is determined according to the spread or propagation method. For example, when a malicious code mainly propagating to CCTV is detected, the CCTV product or CCTV product group in which the security threat has occurred is determined as a device group to block network access. By doing this, even if a security threat has not been detected, it is highly likely that the detected security threat has spread to the product, so it is possible to block it in advance.

The connection blocking release module 12 of the security control server 10 may block access to a normal device accordingly if the network access of the device is blocked in groups. Therefore, in order to minimize service delay, the normal device This is to quickly release the connection block. At this time, since a security threat has not been detected previously, but a security threat may be detected during the device inspection process, at this time, a function of removing the security threat through recovery may be provided for the device in which the security threat has been detected. In addition, it manages the history (number of times, etc.) of security threat occurrences in the device where the security threat is detected so that it can be used as a reference for the decision of the device to be unblocked when the security status check is performed during the network access block release process (in the future. See the description of the end device (30))

The security control execution module 21 of the gateway 20 blocks or releases the network access of the device according to the network access blocking or disconnection command received from the security control server 10. No separate explanation is required for the specific method of blocking and unblocking the device's network access (for example, in the case of Linux, it may be performed using the Iptables firewall function).

The end device 30 performs a device security status check function through the security status check and recovery module 31. The device security status check may be performed by measuring an integrity value for an in-device boot image, an execution object, and a configuration file. In the case of measuring the integrity value, abnormal behavior such as installation of abnormal binaries (malware, etc.) and change of settings can be checked in the environment in which it is first installed and operated. If it is determined that there is an abnormality in the device during the integrity measurement process, that is, if the integrity value for the first installed and operated environment and the integrity value measured at the time of inspection are different, it is determined that there is an abnormality and a method such as updating the SW image for the device. To restore the device to its normal state.

FIG. 2 is a flowchart illustrating an operation procedure for the device of FIG. 1 to block network access of an end device.

101: The security control server 10 detects a security threat. Security threat detection is performed using various security threat detection methods, and the detection method is not limited in the present invention.

103: Adds the history that a security threat has occurred for a device in which a security threat has been detected. For example, it accumulates the number of security threats. The security threat occurrence history information is used in the order of determining the release device when the network access block for the device is released.

105: Check whether or not the detected security threats have been duplicated by exceeding the reference number set by the administrator. Here, the reference number refers to a reference value to block end devices in groups. The number of duplicate occurrences targets a number of devices within a managed service area. If the number of occurrences exceeds the reference number, it means that the security threat has spread to a number of devices, and it is necessary to pre-block not only the device that has been generated, but also devices that are the same or similar to the transmitted device. The method of defining a device group can be defined in several ways, such as using the same model, the same operating system and version, and providing the same service, and the method is not limited.

107: If the threshold value to be blocked by the group is not exceeded, a policy for blocking the device (a device in which a security threat has occurred) is distributed to the security control execution module 21 of the gateway 20 to which the device is connected.

201: The security control execution module 21 of the gateway 20 applies a blocking policy distributed from the access blocking module 11 of the security control server 10 to block network access of the corresponding device.

109: As a result of checking in step 105, when the threshold value to be blocked by the group is exceeded, a device group having the same properties as the device in which the security threat has occurred is determined.

111: Also, according to the detected security threat, check the device group corresponding to the blocking policy separately defined by the administrator.

113: According to the determined group, the network access blocking policy of the corresponding device is distributed to the security control execution module 21 of the gateway 20 to which the device belonging to the group is connected.

203: The security control execution module 21 of the gateway 20 applies a blocking policy distributed from the access blocking module 11 of the security control server 10 to collectively block network access to the corresponding device.

3A and 3B illustrate a sequence of determining a device to release network access blocking for rapid service restart after network access blocking is applied to the IoT infrastructure.

The order of deciding the device to be cleared of network access blocking may vary depending on whether to prioritize service provision or security threat management, and this depends on the policy of the site that provides the IoT service.

3A shows a case in which a device to be released from network access blocking is determined by applying a service provision priority policy. In the case of a normal device without a security threat, it has the same properties as the device where the security threat occurred in order to prevent the spread of the security threat, so it is blocked because there is a possibility that there is a potential security threat. Check the network access blocking and restart the service quickly. In addition, a device that does not have a security threat is more likely to be a device that does not have a security threat, and a device that does not have a security threat history is more likely to be a normal device.

Therefore, as shown in FIG. 3A, first (1) among devices that do not have a security threat, the network access block is canceled through a security status check from the device that does not have a history of security threats. After that, the security status is checked in the order of (2) devices with a small history of security threats, and (3) devices with a large history of security threats among devices that do not have a security threat. (4) In the case of a device in which a security threat has occurred, it is always necessary to restore the device security state, so perform the network access blocking release procedure regardless of the order.

Next, FIG. 3B shows a case in which a device to be released from network access blocking is determined by applying a security threat management priority policy. In other words, it is a case in which security threat processing is prioritized over service provision, and can be applied where a high-level security policy is adopted by a site operating an IoT service. In this case, (1) the security threat processing in the device where the security threat occurred is the most urgent, so the recovery and release procedures for the device should be performed first. After the security threat has occurred, the device that does not have a security threat is processed. In this case, (2) the device with a large history of security threats is likely to contain security threats, so the history of security threats is Check the security status in the order of many devices, (3) devices with less history, and (4) devices with no security threats, and then release the network access block.

4 is a flowchart illustrating a detailed operation procedure for each component for releasing a network access block in order to quickly resume a service after a network access block is applied in an IoT infrastructure.

151: The access blocking release module 12 of the security control server 10 determines the device 30 to perform the security status check according to the device release policy (see FIG. 3) from which network access is blocked adopted by the service.

153: Requests the determined device to check the security status of the device.

351: The device receiving the security status check request generates its own security status check result value through a method such as integrity measurement.

353: The device transmits the device security status check result to the access block release module 12.

155: The access blocking release module 12 checks the security status check result transmitted from the device 30 and determines whether there is a normal or abnormality.

157: If normal, a policy for releasing the blocking of network access to the corresponding device is transmitted to the gateway 20 connected to the corresponding device.

251: The security control enforcement module 21 of the gateway 20 applies the received policy to release the blocking of network access to the corresponding device and restarts the service.

159: If it is determined that there is an abnormality after checking the device security status in step 155, a request for restoration of the device is requested.

353: The device performs restoration to a normal state according to a restoration request. The recovery process may be performed through a method such as SW update.

355: The device transmits the recovery result to the connection blocking release module 12 of the security control server 10.

161: The access blocking release module 12 transmits a network blocking release policy to the gateway 20 to which the corresponding device is connected to resume service for the restored device.

253: The security control execution module 21 of the gateway 20 applies the received policy to release the blocking of network access to the corresponding device and restarts the service.

163: The access blocking release module 12 of the security control server 10 repeats the above procedure for the next device to be released according to the policy described in FIG. 3.

Depending on the implementation, the process of determining the device to release the network access blocking and the release procedure for the determined device may be sequentially performed, or each process may be performed in parallel to increase performance.

The security threat detection, security status check, and device recovery process in the present invention can be performed using various existing security threat detection methods, device integrity remote verification methods, SW firmware update methods, and the like. Excluded from the scope of the invention.

The present invention can be implemented in terms of a device or a method. In particular, a function or process of each component of the present invention includes a digital signal processor (DSP), a processor, a controller, an application-specific IC (ASIC), It can be implemented as a hardware element including at least one of programmable logic devices (FPGA, etc.), other electronic devices, and combinations thereof. It can also be implemented as software in combination with hardware elements or independently, and this software can be stored on a recording medium.

Above, the configuration of the present invention has been described in detail through a preferred embodiment of the present invention, but those of ordinary skill in the art to which the present invention pertains, the present invention is disclosed in the present specification without changing the technical spirit or essential features. It will be appreciated that it may be implemented in a specific form different from that of. It should be understood that the embodiments described above are illustrative in all respects and not limiting. The scope of protection of the present invention is determined by the claims described later rather than the detailed description, and all changes or modifications derived from the scope of the claims and their equivalent concepts should be interpreted as being included in the technical scope of the present invention. .

Claims (16)

In an IoT infrastructure environment including at least one end device for performing an IoT service,
When a security threat to an end device is detected within the IoT infrastructure, a security control server that blocks access to the IoT network of the end device and generates a command to cancel the access block is included, the security control server
Depending on the level of the detected security threat, it is determined whether to block only the end device with the security threat or the end device group containing the end device with the security threat, and access the network to the determined end device or end device group to be blocked. A connection blocking module configured to generate a blocking command and
When an end device group is determined as the connection blocking target, a connection blocking release module configured to determine an end device to be disconnected from the end device group and to generate a network connection blocking release command for the connection blocking release target end device. Security control device in the IoT infrastructure environment including. In claim 1, wherein the connection blocking target end device group determined by the connection blocking module is
A security control device in an IoT infrastructure environment including at least one of end devices that are physically identical to the end device where the security threat has occurred, end devices that provide the same service, and end devices that have the same operating environment . The apparatus of claim 1, wherein when the access blocking module determines an end device or an end device group to be blocked, the security control device in an IoT infrastructure environment refers to a history of occurrence of a security threat in an end device in which a security threat is detected. In claim 1, when the connection blocking release module determines the target end device for connection blocking release, (1) end devices that have no history of security threats among end devices that do not have security threats, and (2) no security threats occur. End devices with a small history of security threats among end devices that do not have a security threat, (3) end devices with a high history of security threats among end devices that do not have a security threat, and (4) end devices with a security threat in order to cancel access blocking Security control device in IoT infrastructure environment that determines end devices. In claim 1, when the connection blocking release module determines the target end device for connection blocking release, (1) an end device in which a security threat has occurred, and (2) an end device with a large history of occurrence of a security threat among end devices in which no security threat has occurred. Devices, (3) end devices that do not have a history of security threats among end devices that do not have a security threat, and (4) end devices that do not have a history of security threats among end devices that do not have a security threat. Security control device in IoT infrastructure environment that determines end devices. In claim 1, the end device
A security control device in an IoT infrastructure environment including a security state check and recovery module configured to perform a security state check of an end device and restore the end device to a normal state when it is determined that there is an abnormality in the security state. In claim 4, the security status check and recovery module of the end device
A security control device in an IoT infrastructure environment that checks the security status by measuring integrity values for boot images, execution objects, and configuration files in end devices. The security control apparatus in an IoT infrastructure environment of claim 1, further comprising a gateway that receives the network access blocking and disconnection command from the security control server to block and release the network access of the end device. In an IoT infrastructure environment including at least one end device for performing an IoT service,
When a security threat to a certain end device is detected, it is determined by determining whether to block only the end device with the security threat or block the end device group containing the end device with the security threat according to the level of the detected security threat. Blocking network access to an end device or group of end devices to be disconnected,
IoT infrastructure environment comprising the step of determining an end device to be disconnected from among the end device groups, and performing network access disconnection for the end device to be disconnected from the end device when an end device group is determined as the target for connection blocking Security control method In claim 9, the connection blocking target end device group
Security control method in an IoT infrastructure environment including at least one of end devices that are physically identical to the end device where the security threat has occurred, end devices that provide the same service, and end devices that have the same operating environment . The method of claim 9, wherein when determining the target end device or end device group to block access, a security threat occurrence history in an end device in which a security threat is detected is referred to. In claim 9, when determining the end device to be released from the access block, (1) an end device without a history of security threats among end devices without a security threat, and (2) a security among end devices without a security threat. End devices with a small history of threat occurrence, (3) end devices with a large history of security threats among end devices that do not have a security threat, and (4) end devices that have a security threat in order to determine the target end devices to be cleared of access blocking. Security control method in IoT infrastructure environment. In claim 9, when determining the end device to be released from the access block, (1) an end device in which a security threat has occurred, (2) an end device that has a history of occurrence of a security threat among end devices that do not have a security threat, and (3) End devices that have no history of security threats among end devices that do not have security threats are selected in the order of end devices that do not have a history of security threats. Security control method in IoT infrastructure environment. The IoT infrastructure environment of claim 9, further comprising a security state check and recovery step configured to perform a security state check of the end device and restore the end device to a normal state if it is determined that there is an abnormality in the security state. Security control method. As a method of controlling security of end devices in an IoT infrastructure environment including at least one end device for performing IoT service,
1) detecting a security threat to the end device;
2) accumulating the number of times a security threat has occurred to an end device in which a security threat has been detected;
3) checking whether the detected security threat has occurred in excess of the set reference number;
4) blocking access to a network of an end device in which a security threat has occurred when the reference number of times has not been exceeded;
5) In the case of exceeding the reference number in step 3), in the IoT infrastructure environment, including the step of determining an end device group identical to the end device in which the security threat has occurred, and blocking network access of the determined end device group. Security control method. In claim 15, after step 5)
6) performing a security status check on the end devices included in the end device group, and determining whether the corresponding end device is normal or abnormal;
7) if it is determined that the corresponding end device is normal, releasing blocking of network access to the corresponding device;
8) When it is determined that there is a problem with the corresponding end device, a security control method in an IoT infrastructure environment that further includes the step of restoring the end device to a normal state and releasing the blocking of network access to the device.

Images