KR20220070875A - Smart home network system based on sdn/nfv - Google Patents

Abstract

Provided is an SDN/NFV-based smart home network system, which comprises: at least one apartment house-specific home network system including a first vCPE connected to a plurality of household-specific home network systems, and an L2 switch connected to the first vCPE; a main management server system including a management server within a complex, a second vCPE connected to the first vCPE by VPN to provide VPN communication between the management server and the household-specific home network systems, and a vCPE controller for setting the first and second vCPEs and network configuration; and an L3 switch for transmitting and receiving a packet between the apartment house-specific home network system and the main management server. Therefore, high security can be expected.

Description

SDN/NFV-based smart home network system {SMART HOME NETWORK SYSTEM BASED ON SDN/NFV}

The present invention relates to a smart home network system based on SDN/NFV.

Recently, various services such as community centers are being introduced into smart homes, and in particular, systems that require external linkage such as payment systems require stable external Internet connection and security. In addition, as the use of important data such as payment-related data or personal data increases, smart home network security reinforcement is essential.

Despite the expansion of the smart home service area, a corresponding security system has not yet been secured.

Registered Patent Publication No. 10-1935594 (2018.12.28)

The problem to be solved by the present invention is to provide an SDN/NFV-based smart home network system that provides high security of home networks for each generation by simultaneously applying SDN technology and NFV technology.

However, the problems to be solved by the present invention are not limited to the problems described above, and other problems may exist.

The SDN/NFV-based smart home network system according to the first aspect of the present invention for solving the above problems includes a first vCPE connected to a plurality of household home network systems, respectively, and a first vCPE connected to the first vCPE. at least one home network system for each apartment house including an L2 switch, a management server within the complex, and a second vCPE connected to the first vCPE to provide VPN communication between the management server and the home network system for each household; and a main management server system including a vCPE controller for setting and network configuration of the first and second vCPEs, and an L3 switch for transmitting and receiving packets between the home network system for each apartment house and the main management server.

In some embodiments of the present invention, the first vCPE and the second vCPE may transmit/receive data to/from each other through a VPN encryption protocol based on a VPN tunnel formed therebetween.

Some embodiments of the present invention may further include an SD-WAN vCPE for communication between an external public network and an internal network only provided through the L3 switch.

In some embodiments of the present invention, the vCPE controller may provide a flow rule to the first and second vCPEs to configure settings and networks of the first and second vCPEs.

In some embodiments of the present invention, the management server may provide at least one of network overall configuration status information, information on network configuration entities, real-time status information, information on abnormal status for each predetermined period or real-time, and current security status level information. have.

A computer program according to another aspect of the present invention for solving the above-described problems is combined with a computer that is hardware to execute a method of operating the virtual SDN/NFV-based smart home network system, and is stored in a computer-readable recording medium do.

Other specific details of the invention are included in the detailed description and drawings.

According to the present invention described above, by simplifying the network by the configuration of the aggregation type security equipment, the number of L2 switches is reduced and the number of security equipment is reduced, thereby reducing cost and high security can be expected.

In addition, it is possible to remotely access the apartment network without an external manager on site to update security patches, security policies, and settings of each equipment, and to easily determine the status and abnormality of equipment through real-time monitoring.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram for explaining a general home network system.
2 is a diagram for explaining an SDN/NFV-based smart home network system according to an embodiment of the present invention.
3 is a diagram for explaining contents accessed by an external administrator according to an embodiment of the present invention.
4 is a diagram illustrating an example of providing state information of an SDN/NFV-based smart home network system.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and those of ordinary skill in the art to which the present invention pertains. It is provided to fully understand the scope of the present invention to those skilled in the art, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components. Like reference numerals refer to like elements throughout, and "and/or" includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various elements, these elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may be the second component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein will have the meaning commonly understood by those of ordinary skill in the art to which this invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

Hereinafter, an SDN/NFV-based smart home network system 100 according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a diagram for explaining a general home network system.

In the case of the existing home network system, as a configuration to provide security, the firewall is installed only at the front end of the external connection, providing only partial security. has not been resolved (CASE 1).

At the same time, security problems such as stealing personal information or forcibly attempting remote control by maliciously hacking into another generation from one generation may occur. For example, in Issue 2001, by removing the wall pad and directly connecting it to the L2 switch, it is possible to maliciously invade a management server, business network, or other generation to steal information and control it (CASE 2).

In addition, switch-based products applied to the existing home network system do not guarantee the connection to the external Internet and the cloud and do not provide satisfactory security. There is a problem with cost.

In addition, the existing home network system cannot keep up with new industrial paradigms such as 5G, IoT, AI, and big data in terms of network structure and security, so it is easy to strengthen security and expand services. The situation is required for a new smart home network system 100 that can ensure security.

As such, the existing home market is not mature enough to require SDN/NFV technology, but it is necessary to introduce the technology to accommodate the requirements of smart cities and smart homes that are advanced through the 4th industrial revolution.

In addition, in terms of service, the evolution of network infrastructure is also essential for the activation of smart home services. Since infrastructure changes are relatively later than services, it is necessary to prepare for this in advance and respond to market changes.

In addition, in terms of security, the existing home network configuration is weak in inter-generational/facility security, and there is a problem that only the stability and security of connection to the outside cannot be guaranteed. There is a need for a smart home network system 100 that does.

In this existing home network system, security equipment has to be added to each household to strengthen network security. As a result, the number of vCPE equipment increases and costs are increased. There is a problem that takes a lot of time because you have to check and work directly on site.

To this end, an embodiment of the present invention provides an SDN/NFV-based smart home network system 100 that provides high security of a home network for each generation by simultaneously applying the SDN technology and the NFV technology.

Hereinafter, the SDN/NFV-based smart home network system 100 according to an embodiment of the present invention will be described with reference to FIGS. 2 to 4 .

2 is a diagram for explaining the SDN/NFV-based smart home network system 100 according to an embodiment of the present invention. 3 is a diagram for explaining contents accessed by an external administrator according to an embodiment of the present invention.

The SDN/NFV-based smart home network system 100 according to an embodiment of the present invention comprises a home network system 110 for each apartment house, a main management server system 120 , and an L3 switch 130 . do.

First, one or more home network systems 110 for each apartment house are provided according to the number of buildings in the complex, and a plurality of household home network systems 111 , a first vCPE 112 , and an L2 switch 130 . includes

The home network system 111 for each household includes a wall pad as a representative configuration, and calls with other households through the wall pad, provides an entrance video, controls the common entrance door, turns on/off lighting, locks the gas stove valve, etc. perform the function of

Data transmitted and received between the plurality of household home network systems 111 are first transmitted to the management server 121 and then transmitted to the home network system 111 of the destination household. Data transmitted and received by the first vCPE 112 at the front end of the system 111 and the second vCPE 122 at the front end of the management server can be encrypted and safely protected through VPN communication.

For example, when a malicious user accesses the L2 switch 113 and eavesdrops on a packet, the malicious user cannot find out information from the eavesdropping packet because the data is encrypted through the VPN.

The first vCPE 112 is connected and connected to the home network system 111 for each generation, respectively, and provides a virtualized secure connection to the home network system 111 for each generation through NFV (Network Function Virtualization) technology. do. The home network system 111 for each household needs to establish a secure and secure connection with the management server 121 , and the first vCPE 112 provides this secure connection to the home network system 111 for each household.

NFV technology is a technology that virtualizes network service functions, such as middle box, by separating them from hardware-only equipment to high-performance general-purpose servers so that they can be controlled and managed flexibly in software.

In the existing CPE, the process of installing, configuring, operating, and updating each device for a firewall or VPN is performed on a hardware basis. That is, if a new network function or security function is to be added, new equipment must be additionally installed or equipment must be replaced, and thus a lot of construction and operation costs are required.

In order to solve this problem, an embodiment of the present invention virtualizes network functions by applying vCPE technology to the smart home network system 100, and does not perform network functions based on dedicated hardware functions, but general x86 The network function can be processed by software by loading the network function into the equipment.

Accordingly, one embodiment of the present invention has an advantage that it is possible to operate at a low cost by upgrading the software of the vCPE, rather than having to replace it with a new device when a new function is added.

The first vCPE 112 is sufficient when one vCPE device is connected and connected to a plurality of home network systems 111 for each generation. However, the number of vCPE devices in the first vCPE 112 is not necessarily limited thereto, and a plurality of vCPE devices may be implemented as one device to provide higher performance.

The L2 switch 113 included in the home network system 110 for each apartment is connected to the first vCPE 112 and connected to the L3 switch 130 to be described later, so that the packet through the external public network and the internal network only. send and receive

In the case of the prior art, a plurality of home network systems for each generation are directly connected and connected to a plurality of L2 switches, and thus the L2 switches must also be provided as many as a plurality of households. Only one L2 switch 113 needs to be provided for each apartment house through the

The main management server system 120 includes a management server 121 within the complex, a second vCPE 122 , and a vCPE controller 123 .

The management server 121 is a configuration for integrated management of various equipment in the complex, and performs functions such as CCTV, front door, parking management, wall pad control, etc. existing in an apartment.

The second vCPE 122 is connected to the first vCPE 112 to provide VPN communication between the management server 121 and the home network for each household. The second vCPE 122 transmits/receives data to and from the first vCPE 112 through a VPN encryption protocol based on the VPN tunnel formed therebetween.

As such, an embodiment of the present invention securely protects data through a VPN encryption protocol based on a VPN tunnel formed between the first and second vCPEs 112 and 122 so that a hacker or a malicious user steals or controls data. can prevent

The vCPE controller 123 configures settings and networks of the first and second vCPEs 112 and 122 . This vCPE controller 123 provides flow rules to the first and second vCPEs 112 and 122 to provide flow rules to the first and second vCPEs 112 and 122 to provide flow rules to the first and second vCPEs 112 and 122. 122) and configure the network.

Referring to FIG. 3 , when the external administrator monitors the situation in real time and checks that malicious intrusion or abnormal traffic to at least one of the first and second vCPEs 112 and 122 is generated, the vCPE controller 123 is controlled. Through this, you can set and control security rules, such as blocking access by providing flow rules.

This embodiment of the present invention is characterized in that the SDN technology is applied to the vCPE controller 123 and the first and second vCPEs 112 and 122 .

Software Defined Networking (SND) is a technology that controls and manages the network traffic forwarding operation in a software-based central controller through a developed API. In SDN, the control plane that designates the traffic path and the data plane that performs traffic transmission are separated, so that the network can be managed according to the requirements without being bound by the detailed configuration information of the network.

In one embodiment of the present invention, according to the setting of the administrator, the vCPE controller 123 of the main management server system 120 performs the function of the SDN controller, and flows to the first and second vCPEs 112 and 122. provides

In this case, as an embodiment of the provided flow rule, an Accept/Drop rule of a specific flow based on OpenFlow (eg, only a packet from a host having a specific MAC address is allowed), firewall setting It is possible to provide flow rules for various network functions and settings, such as rules for (eg, blocking UDP packets from a specific IP) and rules for VPN settings.

Control functions such as SDN flow rules are advantageous in that network functions can be processed in software in vCPE virtualized through NFV technology in the present invention, even if a dedicated SDN switch is not provided.

In addition, an embodiment of the present invention does not require direct access to the vCPE device or access through the internal network of the device for network configuration, but can individually manage multiple vCPEs from the outside, allowing a flexible network through SDN It has the advantage of being able to set, integrated setting management and fault handling.

The L3 switch 130 transmits and receives packets between the home network system 110 for each apartment house and the main management server system 120 . The L3 switch 130 sees the destination IP address of the packet and transmits the IP packet to the correct destination by referring to its routing table.

SD-WAN vCPE 140 provides communication between the external public network and only the internal network provided through the L3 switch 130 . SD-WAN vCPE 140 provides a secure internal network environment from external public networks through functions such as a firewall, VPN, and Web filter.

In an embodiment of the present invention, unlike the prior art, by additionally providing the SD-WAN vCPE 140 on the smart home network system 100, remote data centers, headquarters, and other apartment complexes are configured as WANs using general Internet lines. can do. Through this, it is possible to reduce costs by not installing or using a separate private line, and by establishing SD-WAN, an external administrator in a remote location can manage and operate it, and the data managed by the data center can be provided to residents. It has the advantage of being able to provide various smart home services.

In addition, an embodiment of the present invention can provide visualization of the state information of the SDN/NFV-based smart home network system 100 .

4 is a diagram illustrating an example of providing state information of the SDN/NFV-based smart home network system 100 .

In one embodiment, the management server 121 provides a UI for monitoring the configured network. The management server 121 may provide at least one of network-wide configuration status information, information on network configuration entities, real-time status information, information about a predetermined period or real-time abnormal status, and current security status level information. Through this, anyone, such as an external manager or a home user, can easily observe an abnormal situation and take immediate action.

One embodiment of the present invention described above may be implemented as a program (or application) to be executed in combination with a computer, which is hardware, and stored in a medium.

The above-mentioned program, in order for the computer to read the program and execute the methods implemented as a program, C, C++, JAVA, Ruby, which the processor (CPU) of the computer can read through the device interface of the computer; It may include code coded in a computer language such as machine language. Such code may include functional code related to a function defining functions necessary for executing the methods, etc., and includes an execution procedure related control code necessary for the processor of the computer to execute the functions according to a predetermined procedure. can do. In addition, the code may further include additional information necessary for the processor of the computer to execute the functions or code related to memory reference for which location (address address) in the internal or external memory of the computer to be referenced. have. In addition, when the processor of the computer needs to communicate with any other computer or server located remotely in order to execute the above functions, the code uses the communication module of the computer to determine how to communicate with any other computer or server remotely. It may further include a communication-related code for whether to communicate and what information or media to transmit and receive during communication.

The storage medium is not a medium that stores data for a short moment, such as a register, a cache, a memory, etc., but a medium that stores data semi-permanently and can be read by a device. Specifically, examples of the storage medium include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. That is, the program may be stored in various recording media on various servers accessible by the computer or in various recording media on the computer of the user. In addition, the medium may be distributed in a computer system connected to a network, and a computer-readable code may be stored in a distributed manner.

The description of the present invention described above is for illustration, and those of ordinary skill in the art to which the present invention pertains can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a dispersed form, and likewise components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the above detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present invention. do.

100: smart home network system
110: Home network system for each apartment house
111: home network system by household
112: first vCPE
113: L2 switch
120: main management server system
121: management server
122: second vCPE
123: vCPE controller
130: L3 switch
140: SD-WAN vCPE

Claims (5)

At least one home network system for each apartment house, the home network system comprising a first vCPE connected to each of the plurality of household home network systems, and an L2 switch connected to the first vCPE;
A management server in the complex, a second vCPE connected to the first vCPE by VPN to provide VPN communication between the management server and a home network system for each household, and a vCPE controller for setting up and configuring the first and second vCPEs and network configuration A main management server system comprising a
Including an L3 switch for transmitting and receiving packets between the home network system for each apartment house and the main management server,
Smart home network system based on SDN/NFV.
According to claim 1,
The first vCPE and the second vCPE transmit and receive data to and from each other through a VPN encryption protocol based on a VPN tunnel formed therebetween;
Smart home network system based on SDN/NFV.
According to claim 1,
Further comprising an SD-WAN vCPE for communication between an external public network and an internal network provided through the L3 switch,
Smart home network system based on SDN/NFV.
According to claim 1,
wherein the vCPE controller provides flow rules to the first and second vCPEs to configure settings and networks of the first and second vCPEs;
Smart home network system based on SDN/NFV.
According to claim 1,
The management server is to provide at least one of network overall configuration status information, information of network configuration entities, real-time status information, predetermined period or real-time abnormal status information, and current security status level information,
Smart home network system based on SDN/NFV.

Images