KR20220058182A - Secure access method to meter and access terminal performing the same - Google Patents

Abstract

According to the present invention, a security access method between an access terminal and meters incorporating short-range wireless modems and security devices comprises the following steps of: obtaining access information on the meters in an inspection area in the access terminal; broadcasting an inspection access request from the access terminal to one or more meters; sending a response to the inspection access request from the meters; and matching information carried in the response with the obtained access information on the meters to establish mutual access.

Description

A secure access method for an instrument and an access terminal performing the same

The present invention relates to a method for secure access to a meter, such as a meter, and an access terminal for performing the same, and more particularly, to a secure access method for a secure watt-hour meter having a built-in wireless communication function in the access terminal as a field portable terminal.

In general, the meter is installed in each home, reads the numerical value of a predetermined physical quantity measured from the meter, and the user pays a usage fee corresponding to the numerical value to the provider.

In this way, in order for the supplier who supplies water, electricity, gas, etc. to pay the user a fee for the amount of physical quantity used, a meter reader is hired and the meter reads the number displayed on the number plate of the meter installed in each building or home with the naked eye. I have read and read In order to solve the inconvenience of such visual inspection, and for various applications of inspection information, an electronic or smart meter is being installed.

In particular, the current power meter in Korea uses a low-speed wired method such as an RS-485 cable for direct connection to a field connection terminal for setting and fault analysis. This method is always exposed to risks such as safety accidents because it requires the opening of the low-voltage equipment installed on the site, the opening of the protective housing of the meter, and the process of connecting the meter to the wire.

Although it is common to use wireless communication in machine-to-machine communication, it is a method of collecting all meter information in the local area where the wireless terminal device is currently located, and accurately identifying a specific meter connected with the current billing and customer information to be connected and performing communication is of low interest, and most of the development technology is focused on remote meter reading technology.

For wireless connection of the watt-hour meter, it may be thought that communication can be performed simply by embedding a wireless modem in the wireless terminal and instrument. Wireless communication method cannot be applied.

Therefore, in order to set the field terminal through the wireless connection of the meter, the information model characteristics of the meter, the communication of the modem used by the meter, the encryption method of information between devices, and customer information in the security upper system used by KEPCO are combined to operate. A plan must be devised.

Currently, the only way to control the electronic watt-hour meter is to control it using low-speed wired unencrypted communication. However, the meter must legally protect customer information through encryption, etc., and it is difficult to simply apply the general wireless access method due to the characteristics of the meter information model.

In the case of security-enhanced watt-hour meters that are being recently developed/distributed, a wireless function is built-in, but there is no suitable method for secure communication, connection, and management between a portable terminal and a wireless built-in watt-hour meter.

From the point of view of the modem system, the existing modem system does not have a standardized common control method, and the data processing method between the device and the modem connection is unclear, so there is a problem of lack of interoperability.

Republic of Korea Registration No. 10-1766681

An object of the present invention is to provide a method for secure access to an instrument and an access terminal for performing the same, with improved convenience and compatibility between instruments for on-site operation of instruments such as inspection.

According to an aspect of the present invention, there is provided a method for secure access between an access terminal having a built-in short-distance wireless modem and a security device and devices, the method comprising: securing access information for devices in an inspection area in the access terminal; broadcasting a check access request from the access terminal to one or more of the triggers; sending, by the instrument, a response to the check connection request; and matching the information included in the response with the obtained access information for the instruments in the access terminal, and establishing an interconnection.

Here, in the step of broadcasting the inspection access request as the trigger, when an Enhanced Beacon request conforming to the IEEE 802.15.4 standard MAC frame is transmitted, a predefined special address may be recorded in the source address and broadcast.

Here, in the step of transmitting the response, the ID information of the device may be transmitted by attaching a special code using a vendor specific nested IE in the IEEE 802.15.4 Enhanced Beacon.

Here, the instrument and the access terminal may further include the step of exchanging data with each other coupled modems.

Here, the step of establishing the interconnection may include: releasing the existing connection of the device according to the request of the access terminal; performing mutual authentication between the access terminal and the instrument; and interconnecting the access terminal and the instrument.

Here, the step of performing mutual authentication between the access terminal and the instrument includes: receiving, by the access terminal, the instrument public key of the instrument; generating, by the access terminal, a temporary public key with the instrument public key; and verifying each other by the access terminal and the instrument with the temporary public key.

Here, in the step of generating the temporary public key, the ID information of the device may be applied as one of the seeds for generating the temporary public key.

Here, the step of concluding the interconnection may further include the step of confirming a security level set with the corresponding instrument.

Here, the access information on the devices may include IDs of the devices to be inspected.

Here, the step of securing information on the devices includes: transmitting location information of an area in which the access terminal is located to a higher level server; transmitting information including IDs of devices installed in an area according to the location information from the upper server to the access terminal; and storing information including IDs of the devices transmitted from the access terminal.

Here, after the step of assembling the interconnection, forming a communication channel for transmitting the measurement information of the instrument; And it may further include the step of receiving the measurement information of the instrument through the formed communication channel.

Here, the communication channel may be formed with a security level according to the type of the instrument identified by the instrument ID.

Here, after the step of responding to the access request, the step of confirming the response in the access terminal and requesting interconnection to the corresponding device may be further included.

An access terminal for accessing and checking a plurality of instruments according to another aspect of the present invention includes: a location information check unit for obtaining location information of an area in which the access terminal is located; a downloading unit for downloading access information of instruments to be inspected corresponding to the location information to an external server; an access control unit for performing an access process including scanning and authentication for the devices using the access information; a wireless communication unit forming a short-range wireless communication channel with the instruments; an inspection information collecting unit receiving inspection information on which inspection has been performed from the instruments through the short-range wireless communication channel; and a storage unit for storing access information on the instruments and inspection information transmitted from the instruments.

Here, the access control unit may use the access information on the devices to identify each device by transmitting the message twice with each device.

Here, the downloading unit performs the step of securing information on instruments in the area,

The access control unit may include: broadcasting a check connection request to one or more of the triggers; and when the instrument sends a response to the inspection connection request, the step of matching the information contained in the response with the information on the secured instruments and establishing an interconnection may be performed.

Here, the step of assembling the interconnection includes: requesting to release the existing connection of the instrument; checking the corresponding instrument and the set security level; performing mutual authentication between the access terminal and the device according to the security level; and interconnecting the access terminal and the instrument.

When the method for secure access to the instrument and/or the access terminal for performing the method according to the spirit of the present invention of the above configuration is implemented, there is an advantage in that it is possible to increase the convenience and compatibility between the instruments for on-site work on the instrument such as inspection. .

The secure access method for the instrument and/or the access terminal performing the same according to the present invention has the advantage of high interoperability between the communication system and each device in the existing industrial remote meter reading system and measurement system. More specifically, the present invention has the advantage of ensuring interoperability without damaging each device and protocol applied mutatis mutandis by international standards by inserting a middleware-type procedure between each modem and the device.

The secure access method for the instrument and/or the access terminal for performing the same of the present invention provides faster and simpler metering (metering) than the existing wired by sharing modem and instrument identification information between the secure communication of the meter and the communication modem device. It has the advantage of being able to set the flag. In particular, there is an advantage that can be applied immediately to the standards without violating the standard operation method and security method of the existing meter and the standard protocol of the communication modem.

1 is a flowchart illustrating a secure access method between an access terminal and devices according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating in detail a secure access process between a wireless access access terminal and an instrument in the secure access method of FIG. 1 .
3 is a conceptual diagram illustrating the above-described modem security instrument registration procedure.
4 is a conceptual diagram illustrating a method for transmitting and receiving a channel information message.
5 is a conceptual diagram illustrating a data interchange and connection termination process.
6 is a flowchart illustrating an encryption connection process between a program of an access terminal and an instrument that is a security-enhanced watt-hour meter.
7 is a block diagram illustrating an embodiment of a radio access terminal as a check terminal according to the spirit of the present invention.

In describing the present invention, terms such as first, second, etc. may be used to describe various components, but the components may not be limited by the terms. The terms are only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component.

When a component is referred to as being connected or connected to another component, it may be directly connected or connected to the other component, but it can be understood that other components may exist in between. .

The terminology used herein is used only to describe specific embodiments, and is not intended to limit the present invention. The singular expression may include the plural expression unless the context clearly dictates otherwise.

In this specification, the terms include or include are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, and includes one or more other features or numbers, It may be understood that the existence or addition of steps, operations, components, parts, or combinations thereof is not precluded in advance.

In addition, shapes and sizes of elements in the drawings may be exaggerated for clearer description.

The present invention is a secure connection method between a wireless connection inspection terminal for inspection, which is a field portable terminal, and a wireless modem built-in/external instrument (eg, electronic watt-hour meter), and proposes a method that can guarantee field convenience and notarization for policy encryption. . Specifically, the inspection terminal can download the information of the instruments to be inspected in advance. Through this, information model characteristics of the instrument, communication of the modem used by the instrument, the encryption method of inter-device information, and the higher level of security used by the electric power company You can operate by combining customer information in the system.

The technology of the present invention can be applied not only to the inspection terminal but also to other terminals that connect to the instrument in the field (site) for other purposes, and it is natural that this also falls within the scope of the present invention. In order to make this clearer, even in the following description of the embodiment embodied as a terminal for inspection, it is clarified that it is called an access terminal in a broader sense than the name of a terminal for inspection.

1 is a flowchart illustrating a method of secure access between an access terminal and devices according to an embodiment of the present invention.

A method of secure access between an access terminal and instruments according to the flowchart shown includes: securing information on instruments in an inspection area from the access terminal (S200); Broadcasting a check access request to one or more of the triggers in the access terminal (S400); sending a response from the instrument to the inspection connection request (S500); The access terminal may include the step (S600) of matching the information on the response with the information on the secured instruments and establishing an interconnection in the access terminal.

The instrument and the access terminal may combine a modem for short-range wireless communication for performing wireless communication with each other in the form of an internal or external, respectively. Considering the existence of an independent modem in this communication procedure, before the step (S400) of broadcasting the check connection request, the instrument and the access terminal perform a step (not shown) of exchanging data with each coupled modem. it can be seen that

With respect to the step (S600) of establishing the interconnection, according to the spirit of the present invention, the information of the device is checked in the access terminal, the device terminates the existing connection, exchange of certificates, etc. can be performed. there is.

As shown, after the step (S600) of assembling the interconnection, forming a communication channel for transmitting the measurement information of the instrument, further comprising the step (S800) of receiving the measurement information of the instrument through the communication channel can do.

According to the implementation, the wireless modem coupled (internal/external attachment) to the instrument (meter) receives and stores the ID of the instrument (meter) at the time of production in advance, and transmits a separate instrument (meter) identification message from the access terminal, etc. When a request is received, the meter identification information can be directly transmitted without the meter information transmission/reception process handled by the upper program.

In the step S200, in the wireless modem coupled to the access terminal, IDs of the devices to be inspected at the time of production may be transmitted and stored from an upper server or the like. That is, the information on the instruments handled according to the spirit of the present invention may include IDs (unique identification IDs of the instruments at the time of production) of the instruments to be inspected.

The method of receiving the information on the instruments from the upper server may be transmitted through wireless communication or wired communication, or may be transmitted through a USB storage device. The upper server may search the DB for information on instruments located in an area (site) to be inspected by the corresponding access terminal, and transmit/deliver to the access terminal.

Accordingly, the instrument and the access terminal can perform communication by specifying one instrument using the unique identification ID of the instrument at the time of production.

Accordingly, the device can be identified by two message transmissions (exchange) by integrating the modem and meter information request messages in at least four mutual information exchange methods consisting of a modem access request and response and a meter information request and response.

On the other hand, in the existing wired system, device identification information in a separate program processed in the OSI 7 layer is used for device-to-device communication, so information can be identified and accessed between devices after exchanging messages multiple times.

FIG. 2 is a flowchart illustrating in detail a secure connection process between a wireless access access terminal and an instrument (watt-hour meter) in the secure access method of FIG. 1 .

In the illustrated flowchart, after the access request response step (S500), it can be seen that the access terminal further includes a step (S550) of confirming the response and requesting interconnection to the corresponding instrument.

Broadcasting the check access request (S400) and sending the access request response (S500) may execute a scan process for a kind of instrument.

In the flowchart of FIG. 2, it is expressed that the instrument access program of the radio access terminal can collect information of adjacent instruments located within the range where radio access is possible by issuing single channel scan and full channel scan commands to the modem of the terminal. In reality, only one selected process among the processes serialized in the full-channel scan operation and the processes sequenced in the single-channel scan operation will be performed.

In the case of performing a single channel scan, as shown in the figure, from the access information on the devices secured in step S200, the channel assigned to the device to be checked is checked, the channel is set as the checked channel, and an information request message is transmitted. Then, the received collected information is stored, and when the number of transmissions for the set channel expires, it is checked whether the instrument according to the on-site collection information and the access information transmitted from the server in step S200 match (S590).

In the case of performing a full channel scan, if the scan is not completed for all allocated channels, when the number of transmissions for the set channel expires, the setting may be changed to the next channel (S559). Although not shown, if the channel is changed to the next channel (S559), the process returns to the process of setting the assigned channel to the changed channel (S409).

The modem of the wireless access terminal stores the identification information (ID) of the instrument before access as a result of performing the step S200, and can perform instrument scan without a separate upper program command.

In the step S200, the instrument access program may transmit current location identification information (bandage information, GPS coordinate information, and other customer information) to the upper server to collect channel information and instrument IDs of adjacent instruments. The collected instrument information may be used to search for instruments existing in a specific wireless channel, and separately from this, the instrument access program may scan all channels of an area (site) to search all instruments in an adjacent area.

The modem coupled to the access terminal transmits a device information identification request message having a special address when performing a full-channel or single-channel scan operation (S400). In response, the modem coupled to each device receives the terminal information request message of the modem Both the address and the address of the device may respond (S500).

The modem coupled to the access terminal collects access information while waiting for the number of transmissions per channel and the waiting time for a reply per channel during the channel scan in steps S400 and S550, and the collected information can be transmitted to the instrument access program. Here, the access information may be composed of device identification information used by a higher-level program and address information of a modem possessed by the device.

For the user, the instrument access program can check whether the field instrument scan result and the received information from the server match. .

FIG. 3 illustrates the flow of the modem security device registration procedure described above, and the process of accessing and canceling in the illustrated flowchart is as follows.

A registration procedure and method for the wireless access terminal when the modem of the security instrument is connected to the wireless access terminal. First, modem registration is performed with the AT+NEWPAND command to the SMGW when the LMN section security instrument network connection is completed, and the instrument is registered may be performed in a security-enhanced instrument information collection method using registered modem information. In this case, the collection of the meter reading data may be performed through a process such as collection of the meter reading data using the LMN modem.

When the device receives an existing connection termination and terminal access request, it performs a mutual certificate exchange for non-repudiation in step S600, completes the connection if the certificate (eg, a certificate according to DLMS) is mutually valid, and establishes the existing connection After releasing, the measurement information can be transmitted while interconnected with a specific instrument by performing a security procedure.

In the step (S400) of broadcasting the check access request, the information request message configuration and transmission process will be described as a specific example.

In the case of the information request message, when the Enhanced Beacon request is transmitted when the IEEE 802.15.4 wireless access method is used, a special address predefined for the source address shown in Table 1 below may be used. Table 1 below shows the structure of using the source address in the IEEE 802.15.4 standard MAC frame. Thus, the instrument can send information immediately when a beacon request sent from a specific address is received.

The method of processing the counterpart device to perform an operation by sending a special address as described above is a technique not processed by the existing modem. It has the distinction of scanning very quickly.

4 is a conceptual diagram illustrating a method for transmitting and receiving a channel information message.

The operation method of the information request message may be performed for a plurality of channels in an inspection area (site) for each channel as shown in FIG. 4 . That is, the illustrated access terminal modem (access terminal modem) may transmit an Enhanced Beacon Request (EBR) to a specific address for all channels. For example, as shown in Table 2 below, a command may be transmitted to the address FFFFF0000000001 in channel #1. In the case of all meters on channel 1, the corresponding message can be received, and the corresponding meter selects a certain random time when transmitting, and transmits information after waiting for a certain random time to prevent collision between the meters on channel 1. The random time may be selected using an existing CSMA/CA method such as IEEE 802.15.4. In FIG. 4, meter #1 and meter #3 also have random times, but it is assumed that they have the shortest random time, so that after the RANDOM time is not described.

When all the processes shown in FIG. 4 are performed, the modem of the access terminal transmits the information collected for all last channels to the access terminal program.

In the past, a 1:1 wired connection method was used, but if a wireless connection method is used, a collision may occur when the connection meter replies with response information. Therefore, it is possible to selectively use the method of requesting information from the meter sequentially, the method of requesting only information from a specific meter using previously recorded information, or the method of requesting all information by broadcasting.

In the step (S500) of sending the access request response, the information request response message configuration and transmission process will be described as a specific example.

When the information request message is identified through specific address information, the device (specifically, the modem) transmits a response message.

In the case of an information request/response message, a special processing method may be provided as in the examples shown in Tables 3 and 4 below so as not to violate the standard when the IEEE 802.15.4 wireless access method is used.

Table 3 exemplifies the configuration of the standard Enhanced Beacon frame, and Table 4 exemplifies the configuration of the meter identification information in the Beacon Payload IE.

As the corresponding messages in Tables 3 and 4, ID information of the meter may be transmitted using the vendor specific nested IE in the IEEE802.15.4 Enhanced Beacon.

In the case of the above information, even when IEEE 802.15.4 is not used, meter identification information is inserted after the header of each communication modem to enable processing. In this case, separate information that does not conflict with the standard can be exchanged by inserting “FFFF”, which is specified as a special message as shown in Table 5 below, into the meter identification information. Table 5 below illustrates a method for transmitting meter identification information in other wireless protocols.

5 shows the data interchange and connection termination process.

A specific example of FIG. 5 will be described with respect to the processing method and termination process of the meter security data and the upper program performed in the step (S600) of establishing the interconnection between the access terminal and the instrument.

Access (check) When the terminal program requests a connection after the scan is completed, the connection request can be made using DLMS communication. At this time, the modem directly transmits the corresponding information to the upper program. After the connection is terminated, a DLMS termination message is transmitted, and the modem of the instrument can perform normal meter reading operations prior to connection to the connection terminal, such as initializing all information.

Next, from a security point of view, a security processing process when connecting between an instrument that is a security meter and an access terminal is exemplified in relation to the standard.

In the DLMS/COSEM standard method, a method of accessing based on a separate access authority number method can be applied. As described above, when disconnecting after use, Disconnection is transmitted so that the modem and the upper level program of the instrument can perform remote meter reading again.

In the existing meter access method, there was no distinction of access authority, but in the present invention, a separate authority number can be used as a method to identify authority of terminals accessing from the meter and provide information separately. Through this authorization method, the remote meter reading of the server and the field access device can be clearly distinguished.

Next, the operation of the two modems respectively mounted on the instrument and the access terminal will be described.

As for the basic structure of modem operation, it is advantageous to have a common control structure according to the power company (eg, Korea Electric Power) without distinction of internal/external modem, instrument side modem, and access terminal side modem.

For example, in the case of a watt-hour meter and a control modem for AMI as an instrument, information on the attached modem can be identified in the following order (method). This is a method for common control of which modem is used, and the order of combinations of commands is characteristic. First, the detachable modem uses control pins (IO pins, SW interrupt, etc.) as soon as it connects to each device to transmit information to the connected device.

First, as soon as power is applied and the modem boots normally, it transmits modem information to the host device using the standard pin (PIN) UART connected to the AT+BEAR Trap. Next, the upper device collects the detachable modem ID through the AT+MMID command for the modem collected by generating an interrupt.

Table 6 below shows an example of a modem control command.

The device connected to the modem may follow the following method to control the currently inserted modem. In the case of a built-in modem, it is necessary to communicate closely with the meter reading program such as DLMS, but the implementation method is not standardized and there is currently no clear command control system for each other. In this situation, the method proposed in the present invention inserts specific information into the AT COMMAND and transmits the command using a physical communication method such as UART. In this case, the set of commands to be used is shown in Table 6 above.

In Table 6, the commands for changing the channel and acquiring information about the surrounding modem for the modem may be combined as follows. For example, after channel 3, modem reception status change, change channel inquiry, and surrounding modem search command combination AT+CHAN:<3>, AT+CHAN?, AT+EBR?, AT+EBLIST? This can be applied.

The modem and the instrument or AMI device exchange commands with each other may follow one of the following two methods.

In method 1), when only one upper terminal that can be accessed, such as an instrument, appears, separate modem information is not required, so the counterpart MAC address is fixed, and the corresponding information can be managed separately by the modem. In this case, therefore, the instrument prepares only the data to be sent as follows and transmits it to the modem as follows.

- Meter reading data protocol: HDLC-based DLMS/COSEM protocol is used

- Modem control protocol: using AT Command

- An example of an HDLC frame format for meter reading data is shown in Table 7 below

- Examples of AT Command frame information for modem network information collection and management are shown in Table 8 below.

As method 2), if a non-standardized general modem is attached to the device, it is not possible to create a communication header including the address of the destination modem. A method of forwarding to the modem can be used.

- Meter reading data protocol: HDLC-based DLMS/COSEM protocol is used

- Modem control protocol: using AT Command

- An example of an HDLC frame format for meter reading data is shown in Table 9 below

In Table 9 above, it can be seen that LMN Frame Description (Big-endian), STX: Start of Text [0x51F8 (2bytes)], Packet Length: HDLC Frame full length, MAC Addr: Destination modem MAC address of this packet (HDLC). there is.

6 is a flowchart illustrating an encryption connection process between a program of an access terminal and an instrument that is a security-enhanced watt-hour meter.

The illustrated flowchart includes the steps of sending a response to the inspection connection request in the instrument of FIGS. 1 and 2 (S500); and confirming the response from the access terminal, and establishing the interconnection subsequent to the step (S550) of requesting the interconnection to the corresponding instrument (S600) is concretely shown.

The illustrated step of assembling the interconnection (S600) can be roughly divided into two, the process of releasing the existing connection (DLMS connection) in the instrument (S602 ~ S604); And it can be divided into the mutual authentication process (S610 ~ S690) of the instrument and the secure access terminal.

In the illustrated flowchart, the process (S602 to S604) of releasing the existing connection (DLMS connection) was first performed, which is to minimize the change in the operation of the device according to the prior art. In this case, the device sends the connection release request (S602) In the verification process, the authenticity of the connection release request can be confirmed according to the prior art.

In another implementation, the process of releasing the existing connection (DLMS connection) (S602 ~ S604) may be performed after the mutual authentication process (S610 ~ S690) of the instrument and the secure access terminal, in this case the mutual authentication process (S610) ~ S690), since the secure access terminal is checked, the instrument can immediately release the existing access (DLMS access) without additional confirmation.

The basic encryption methods of the security-enhanced watt-hour meter, such as symmetric key, digital signature, hash and pure random number generator, can be applied as it is. The wireless access terminal uses ECDH-based key exchange, and can be used by embedding an encryption device or program required by a power company (eg, Korea Electric Power Corporation). Upon receiving the special address code of the wireless access terminal (S500), the meter prepares to cancel the existing connection process (S606), and the wireless access terminal sends a Disconnection message (S602) to the specific device to be inspected and the instrument The public key may be requested (S610), the existing connection may be disconnected, and a self-connection preparation process may be performed.

The instrument transmits the instrument public key at the same time as the existing connection is canceled (S606) (S620), and the field access terminal may generate and transmit a public key pair that is a temporary key (S630). The moment receiving the public key, which is the temporary key, obtains the public key of the access terminal to generate the temporary public key, and in this case, the key of the field access device may be used as a parameter such as a nonce. Thereafter, mutual keys are exchanged, a shared key to be used for communication for the corresponding purpose is secured (S670, S680), temporary keys are deleted (S690), and the encryption connection process is completed.

In the flowchart, a temporary public key is generated as a temporary key based on the instrument public key (S630, S650), and a temporary shared key is generated again using the temporary public key (S660, S680). Depending on the implementation, in generating the temporary public key (S630, S650) and/or generating the temporary shared key (S660, S680), one of the seeds for generating the temporary public key (or shared key) As such, the ID information of the instrument can be applied.

Although not shown, the step (S600) of establishing the interconnection may further include the step of confirming a security level set with the corresponding instrument. In this case, the communication channel between the secure access terminal and the corresponding instrument is the instrument. It may be formed into a security level according to the type of device identified by ID. That is, a communication channel provided with a security means suitable for the security level may be formed.

An example of a meter program that can be applied according to the security level and a method of differential access processing of access terminals is exemplified. When connecting to the meter (meter), the security information of the meter can be divided into a code. In this case, in the DLMS, devices can be classified according to the Association number in the logical device item in the OBIS code, for example, as shown in Table 10 below. However, there is no standard/regulation for an explicit definition of which devices are used by specific types of terminals. The secure access terminal in the field according to an embodiment of the present invention can process by simulating an association, and can differentially grant read/write access rights for each COSEM object to each association. In this case, the secure access terminal on the site can have only one client connection among the associations when connecting to the instrument. (Multiple access is not possible)

Thereafter, the step ( S800 ) of receiving the measurement information of the instrument of FIG. 1 through the communication channel having the security level may be performed using an encryption packet according to the security level or the like.

7 is a block diagram illustrating an embodiment of a radio access terminal 200 as a check terminal according to the spirit of the present invention.

The illustrated access terminal 200 is a terminal that connects and checks a plurality of instruments 101, 102 to 10n, and includes: a location information check unit 220 for obtaining location information of an area in which the access terminal is located; a downloading unit 230 for downloading access information of instruments to be inspected corresponding to the location information to an external server 300; an access control unit 240 for performing an access process including scanning and authentication for the devices 101, 102 to 10n using the access information; a wireless communication unit 250 for forming a short-range wireless communication channel with the instruments 101 and 102 to 10n; an inspection information collecting unit 280 for receiving inspection information on which inspection has been performed from each of the instruments 101, 102 to 10n through the short-range wireless communication channel; and a storage unit 290 for storing access information for each of the instruments and inspection information received from each of the instruments 101 and 102 to 10n.

The downloading unit 230 is a wired/wireless communication means for forming a wired/wireless data communication channel with the upper management server 300 and/or physical storage such as a USB storage medium in which access information of the instruments to be inspected are recorded. A reading means for reading a medium may be provided.

The location information check unit 220 may check the current location from a GPS satellite reception signal, a wireless communication base station signal, or a beacon signal.

The storage unit 290 may be implemented as a storage medium (eg, flash memory, HDD, etc.) provided in the access terminal.

The wireless communication unit 250 may be implemented in the form of a separately mounted (combined) modem, and a short-range wireless communication module (eg: Bluetooth, Wi-Fi, Zigbee, etc.) may be provided.

The connection control unit 240 and the inspection information collection unit 280 may be implemented in a form that is distributed to the modem and the connection terminal program.

The access control unit 240 uses the unique identification ID at the time of production of the instrument to be inspected from the access information of the instruments to be inspected downloaded in advance to the storage unit to specify the instrument by exchanging messages twice. can be identified.

The location information check unit 220 and the download unit 230 may perform the step (S200) of securing access information for devices in the secure access method shown in FIG. 1 .

The access control unit 240 and the wireless communication unit 250 broadcast a check access request among the secure access method shown in FIGS. 1 and 2 (S400); confirming a response from the device and requesting interconnection to the corresponding device (S550); And it may perform a step (S600) of fastening the interconnection.

The inspection information collecting unit 280 and the wireless communication unit 250 may perform a step (S800) of receiving the measurement information of the instrument in the secure access method shown in FIG. 1 .

To summarize the secure access method of FIGS. 1 and 2 , the downloading unit 230 performs the step (S200) of securing information on the instruments 101 and 102 to 10n in the area, and the The access control unit 240, broadcasting the check connection request to the one or more of the trigger (S400); And when the instrument sends a response to the inspection connection request (S500), it is possible to perform a step (S600) of matching the information in the response with the information on the secured instruments and concluding the interconnection (S600).

In addition, the step of assembling the interconnection (S600) includes the steps of requesting to release the existing connection of the instrument; checking the corresponding instrument and the set security level; performing mutual authentication between the access terminal and the device according to the security level; and interconnecting the access terminal and the instrument. In the case of an implementation in which the security level is unified, the step of confirming the security level may be omitted.

Those skilled in the art to which the present invention pertains should understand that the present invention may be embodied in other specific forms without changing the technical spirit or essential characteristics thereof, so the embodiments described above are illustrative in all respects and not restrictive. only do The scope of the present invention is indicated by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present invention. .

101, 102 ~ 10n: instrument
200: secure access terminal
220: location information confirmation unit
230: downloading part
240: access control
250: wireless communication unit
280: inspection information collection unit
290: storage
300 : parent server

Claims (17)

A method for secure access between an access terminal and devices, the method comprising:
securing access information for instruments in the inspection area in the access terminal;
broadcasting a check access request from the access terminal to one or more of the triggers;
sending, by the instrument, a response to the check connection request; and
In the access terminal, matching the information in the response with the obtained access information for the devices and concluding an interconnection
A secure access method comprising a.
According to claim 1,
In the step of broadcasting the inspection connection request as the trigger,
When transmitting an Enhanced Beacon request that conforms to the IEEE 802.15.4 standard MAC frame, a secure access method that broadcasts a predefined special address in the source address.
3. The method of claim 2,
In the step of sending the response,
A secure access method for transmitting the ID information of the device by attaching a special code using a vendor specific nested IE within the IEEE 802.15.4 Enhanced Beacon.
According to claim 1,
The step of exchanging data between the instrument and the access terminal, respectively, with a modem coupled thereto
A secure access method further comprising a.
According to claim 1,
The steps of establishing an interconnection are:
releasing the existing connection of the device according to the request of the access terminal;
performing mutual authentication between the access terminal and the instrument; and
Interconnecting the access terminal and the instrument
A secure access method comprising a.
6. The method of claim 5,
The step of performing mutual authentication between the access terminal and the instrument comprises:
receiving, by the access terminal, the instrument public key of the instrument;
generating, by the access terminal, a temporary public key with the instrument public key; and
Confirming each other by the access terminal and the instrument with the temporary public key
A secure access method comprising a.
7. The method of claim 6,
In the step of generating the temporary public key,
A secure access method for applying the ID information of the device as one of the seeds for generating the temporary public key.
6. The method of claim 5,
The steps of establishing an interconnection are:
Steps to check the instrument and the set security level
A secure access method further comprising a.
According to claim 1,
The access information for the devices is a secure access method including IDs of the devices to be checked.
According to claim 1,
The step of securing information about the instruments is,
transmitting location information of a region in which the access terminal is located to an upper server;
transmitting information including IDs of devices installed in an area according to the location information from the upper server to the access terminal; and
Storing information including IDs of the devices transmitted from the access terminal
A secure access method comprising a.
9. The method of claim 8,
After the step of fastening the interconnection,
establishing a communication channel for transmitting measurement information of the instrument; and
Receiving the measurement information of the instrument through the formed communication channel
A secure access method further comprising a.
12. The method of claim 11,
The communication channel is a secure access method in which the security level is formed according to the type of the instrument identified by the instrument ID.
According to claim 1,
After the access request response step,
Checking the response in the access terminal, and requesting interconnection to the corresponding instrument
A secure access method further comprising a.
As an access terminal for connecting and checking a plurality of instruments,
a location information check unit for obtaining location information of a region in which the access terminal is located;
a downloading unit for downloading access information of instruments to be inspected corresponding to the location information to an external server;
an access control unit for performing an access process including scanning and authentication for the devices using the access information;
a wireless communication unit forming a short-range wireless communication channel with the instruments;
an inspection information collecting unit receiving inspection information on which inspection has been performed from the instruments through the short-distance wireless communication channel; and
A storage unit for storing access information for the instruments and inspection information transmitted from the instruments
Access terminal comprising a.
15. The method of claim 14,
The connection control unit,
An access terminal for identifying each instrument by transmitting a message with each instrument twice by using the access information on the instruments.
15. The method of claim 14,
The downloading unit,
performing the steps of securing information about the instruments in the area;
The connection control unit,
broadcasting a check connection request to one or more of the occasions; and
When the instrument sends a response to the inspection connection request, the access terminal performs the step of matching the information included in the response with the information on the secured instruments and establishing an interconnection.
17. The method of claim 16,
The steps of establishing an interconnection are:
requesting to disconnect the existing connection of the device;
checking the corresponding instrument and the set security level;
performing mutual authentication between the access terminal and the device according to the security level; and
Interconnecting the access terminal and the instrument
Access terminal comprising a.

Images