WO2016190663A1 - Security management device and security management method in home network system - Google Patents

Abstract

The present invention relates to a security management device for monitoring equipment that is connected to a plurality of devices so as to monitor the plurality of devices, the security management device comprising: a connection unit connected to the monitoring equipment; a monitoring unit for, upon being connected to the monitoring equipment through the connection unit, monitoring a task which is executed in the monitoring equipment; and a control unit for allowing or blocking the execution of the task in the monitoring equipment on the basis of the result of the task monitoring by the monitoring unit.

Description

Security Management Device and Security Management Method in Home Network System

The present invention relates to a security management apparatus and a security management method in a home network system, and more particularly, to an apparatus and method for monitoring security of a plurality of devices and managing security for monitoring equipment connected to a common server unit.

In general, a home network refers to a system for controlling home appliances such as TVs, refrigerators, and air conditioners and home appliances such as door locks, lights, gas, and fires through a network. This home network is applied to a common residential (residential) space such as an apartment or an officetel or an intelligent building system (IBS).

1 exemplarily illustrates such a home network system 40. Referring to FIG. 1, home network system 40 refers to a system that connects at least one generation 50 to a network. At this time, the monitoring device 52 is installed in each generation 50, which monitors a plurality of devices such as home appliances or home appliances, although not shown in FIG. In addition, the monitoring equipment 52 is connected to the communication object of the outside 10 via the network 20 through the common server unit 30. In addition, the plurality of monitoring equipment 52 is connected to each other by an internal network. Such monitoring equipment 52 may be, for example, a wallpad.

However, the home network system 40 shown in FIG. 1 may have security problems for the following reasons. For example, since the public server unit 30 is a kind of server, an attack on the server itself from the outside 10 can be blocked by a security technology such as a firewall, but such a security technology is hacked by the monitoring device 52 itself. This is because it is not possible to block. Thus, when hacking the monitoring equipment 52 from the outside 10, a plurality of devices (for example, CCTV, door locks, cameras, etc.) connected to the monitoring equipment 52 is deodorized or tampered with each generation access password, etc. Photographing means, voice input means such as a microphone or lighting) may be arbitrarily manipulated. In addition, the hacked monitoring equipment 52 may be exploited for DDos attacks. In addition, an attack on the monitoring device 52 due to malicious behavior may occur in an internal network between the plurality of monitoring devices 52.

Therefore, a technique for providing security to the monitoring equipment 52 is required.

An object of the present invention is to provide an apparatus and method for providing and managing security for monitoring equipment for monitoring a plurality of devices in a home network system.

However, the problem to be solved of the present invention is not limited to those mentioned above, another problem to be solved is not mentioned can be clearly understood by those skilled in the art from the following description. will be.

According to an embodiment of the present invention, a security management device for monitoring equipment that monitors a plurality of devices and is connected to a common server unit may include a connection unit electrically connected to the monitoring device and a monitoring unit for monitoring a task in the monitoring device. And a controller configured to allow or block the task based on a result of the monitoring by the monitoring unit.

In addition, the security management device may be implemented to be included in the monitoring equipment or may be separately implemented outside the monitoring equipment.

In addition, a first device, which is at least one of the plurality of devices, is connected to the monitoring device through a gateway unit, and the monitoring unit is a list of the first device or a list of second devices connected to the monitoring device without passing through the gateway unit. It may include a device list monitoring unit for monitoring.

In addition, the monitoring unit may include an initialization process monitoring unit for monitoring an initialization process that enables communication between the monitoring equipment and the gateway unit.

The monitoring unit may include a file monitoring unit for monitoring a file included in the monitoring device, a process monitoring unit for monitoring a process in the monitoring device, a connection to the network of the monitoring device, or data for transmitting and receiving data to and from the network. The network monitoring unit, a memory access monitoring unit for monitoring the access to the memory included in the monitoring equipment and a device communication monitoring unit for monitoring the communication between the monitoring equipment and the device.

The monitoring unit may monitor the task based on a preset whitelist or blacklist.

The monitoring unit may monitor the task through interworking with the public server unit.

The monitoring unit may monitor whether the response from the device to the monitoring device is a response when there is no request by the monitoring device.

The monitoring unit may monitor whether the request received by the monitoring device is a request from an unauthorized third party device.

The controller may allow or block the file, the process, the connection to the network or the data transmitted or received from the network, the access to the memory, or the communication between the monitoring device and the device based on the monitored result. have.

According to another embodiment of the present invention, a security management method using a security management apparatus for monitoring equipment connected to a common server unit and monitoring a plurality of devices may include: electrically connecting to the monitoring equipment, and performing a task at the monitoring equipment. The monitoring may include allowing or blocking the task based on the monitoring result.

The first device, which is at least one of the plurality of devices, is connected to the monitoring device through a gateway unit, and the monitoring may include a second device connected to the monitoring device without a list of the first device or the gateway unit. You can monitor the list.

In addition, the monitoring may monitor an initialization process that enables communication between the monitoring equipment and the gateway unit.

In addition, the monitoring may include a file included in the monitoring device, a process in the monitoring device, a connection to the network of the monitoring device, or data transmitted to and received from the network, access to a memory included in the monitoring device, or the The communication between the monitoring equipment and the device can be monitored.

The monitoring may include monitoring the task based on a preset whitelist or blacklist.

The monitoring may monitor the task through interworking with the public server unit.

In addition, the monitoring may monitor whether the response from the device to the monitoring device is a response when there is no request by the monitoring device.

In addition, the monitoring may monitor whether the request received by the monitoring device is a request from an unauthorized third party device.

In addition, the step of allowing or blocking based on the monitoring result, the file, the process, access to the network or data transmitted and received with the network, access to the memory included in the monitoring equipment or the monitoring equipment and It may allow or block communication between the devices.

According to still another embodiment of the present invention, a computer readable recording medium having recorded thereon a program including instructions for performing each step according to the security management method may be included.

According to an embodiment of the present invention, only the authorized user or processor may access the monitoring device included in the home network system and the device connected to the monitoring device, and may block the creation or execution of malicious file itself. It can monitor the communication related to the monitoring equipment, and can block the taking or tampering with the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent privacy invasion from the outside through such monitoring equipment, and also to prevent the leakage of various information stored in the monitoring equipment (internal information or personal information of the company).

1 is a diagram illustrating a home network system to which a security management apparatus according to an embodiment of the present invention is applied.

2A and 2B are diagrams exemplarily illustrating a configuration of a security management apparatus according to an embodiment of the present invention.

3A to 3C are diagrams exemplarily illustrating a connection between a monitoring device and a plurality of devices.

4A and 4B are diagrams exemplarily illustrating a configuration in which a security management apparatus according to an embodiment of the present invention is connected to monitoring equipment.

5A to 5C are conceptual views illustrating a security management apparatus managing security for communication between a monitoring device and a device according to an embodiment of the present invention.

6 is a flowchart illustrating a security management method according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

2A and 2B are diagrams exemplarily illustrating a configuration of a security management apparatus according to an embodiment of the present invention, and FIGS. 3A to 3C are diagrams exemplarily illustrating a connection between monitoring equipment and a plurality of devices. 4A and 4B are diagrams exemplarily illustrating a configuration in which a security management apparatus according to an embodiment of the present invention is connected to monitoring equipment.

Referring to FIG. 2A, the security management apparatus 100 according to an embodiment of the present invention may include a connection unit 110 electrically connected to monitoring equipment, a monitoring unit 120 monitoring a task in the monitoring equipment, and a monitoring unit. The controller 130 may allow or block the task based on the result of monitoring, except that the configuration illustrated in FIG. 2A is exemplary and does not include or mention at least one or more of these components. It may further include a component. In addition, the security management apparatus 100 and components included therein to be described below include an electronic device including a memory for storing a processor and instructions executed by the processor, by a hybrid implementation of at least some software and hardware. It may be implemented on a programmable machine that is selectively activated or reconfigured by a device or computer program.

The security management apparatus 100 will be described on the premise that it is applied to each monitoring device 52 installed in each generation 50 of the home network system 40 shown in FIG. 1. Accordingly, hereinafter, the first embodiment will be described in more detail with reference to FIG. 1, but the present specification refers to a 'home' network system including at least one 'generation', but the spirit of the present invention is simply 'home' or 'generation'. It is not limited to being applied to. That is, according to an embodiment of the present invention, the security management device 100 may be applied to a common residential (resident) space, for example, officetel, office or IBS.

Referring to FIG. 1, the common server unit 30 is a device that manages the monitoring equipment 52 installed in each household 50. For example, the common server unit 30 may be a desktop or a server, and may be externally connected through the network 20. 10) can be connected.

The common server unit 30 may be connected to the monitoring equipment 52 installed in each generation 50 included in the home network system 40. At this time, in the connection between the monitoring equipment 52 and the common server unit 30, the monitoring equipment 52 is directly connected to the common server unit 30 as shown in FIG. 1 or otherwise shown in FIG. Although not yet, it may be connected to the public server unit 30 through a separate connection configuration (for example, a gateway).

Monitoring equipment 52 installed in each household 50 is connected to a number of devices, although not shown in FIG. 1. The plurality of devices may include various electronic products or electronic devices such as, for example, door locks, lighting or gas, TV, refrigerators, air conditioners, photographing means such as cameras, and voice input means such as microphones. The electronic device may support IP-based communication or other wired / wireless-based communication. Hereinafter, a connection method between the plurality of devices and the monitoring device will be described with reference to FIGS. 3A to 3C.

Referring to FIG. 3A, the first device 53 of the plurality of devices may be connected to the monitoring device 52 through the gateway unit 70, and the second device 55 of the plurality of devices may be the gateway unit 70. It may be directly connected to the monitoring equipment 52 without going through. The gateway unit 70 may monitor a plurality of devices such as RS-232, RS-485, RF, TCP / IP, Bluetooth, NFC, etc. regardless of a communication method supported by a plurality of devices. ), But the configuration and function of such a gateway unit 70 is already known, so a detailed description thereof will be omitted. In addition, hereinafter referred to as the 'devices 53 and 55' refers to either the first device 53 or the second device 55.

As shown in FIG. 3A, the gateway unit 70 may be implemented to be included in the monitoring device 52, or alternatively, the gateway unit 70 may be separately implemented outside the monitoring device 52 as shown in FIG. 3B. In addition, while being implemented to be included in the monitoring equipment 52 as shown in Figure 3c (gateway # 1 (70)) may be implemented separately at the same time outside the monitoring equipment 52 (gateway # 2 (71) Of course.

Referring back to FIG. 2A, the connection unit 110 electrically connects the security management apparatus 100 and the monitoring equipment 52. The security management apparatus 100 may monitor and control the monitoring equipment 52 through the connection unit 110.

In this case, referring to FIG. 4A, the security management apparatus 100 according to an embodiment of the present invention may be included in the monitoring equipment 52 to be electrically connected to the monitoring equipment through the connection unit 110. For example, the connection unit 110 may be connected to a part in which the monitoring device 52 controls files or processes, communication or memory therein, or a part in which the monitoring device 52 communicates with the outside. That is, the security management apparatus 100 is connected to the file 110 in the monitoring equipment 52, the process in the monitoring equipment 52, the monitoring equipment 52 and the external (for example, a common server unit or device) through the connection 110 Information regarding communication with or access to a memory included in the monitoring device 52 may be received.

On the contrary, referring to FIG. 4B, the security management apparatus 100 may not be included in the monitoring equipment 52 but may be separately implemented externally. At this time, the connection unit 110 is electrically connected between the monitoring device 52 and the security management device 100 implemented separately outside the monitoring device 52, for example, the connection unit 110 is the monitoring device 52 It may be connected to a part for controlling a file, a process, a communication, or a memory therein, or a part for monitoring device 52 to communicate with the outside. Accordingly, although the security management apparatus 100 is implemented outside the monitoring equipment 52 differently from FIG. 2A, the security management apparatus 100 is different from those of FIG. The same can be monitored.

Referring back to FIG. 2A, the monitoring unit 120 may monitor a task in the monitoring device 52. Specifically, when the security management apparatus 100 is connected to the monitoring equipment 52 through the connection unit 110, the monitoring unit 120 receives the information on the task from the monitoring equipment 52, and then to the task It can be monitored whether the information is included in a preset whitelist or blacklist. The whitelist includes a list of tasks that are allowed to run, and the blacklist includes a list of tasks that are not allowed to run.

Here, the task refers to a task performed by the monitoring equipment 52. For example, working with system hardening, working with code signing solutions, authenticating users or devices accessing monitoring equipment 52 based on certificates, encrypting data on communications, Work related to applying a one-time password to access to monitoring equipment 52, work on security control services, work on data leakage prevention, work on application protection technologies, work on ensuring service continuity, This may include, but is not limited to, operations related to data recovery in case of emergency or monitoring of abnormal use of the device.

Looking at some of these tasks in more detail, the system hardening work includes resources (such as apps, software) that can be installed on the monitoring device 52 and files, directories, and registries accessible to the monitoring device 52. After defining in advance (eg, based on a whitelist or a blacklist), it may refer to monitoring the installation or execution of an app or access to resources that are not predefined.

In addition, the work on the code signing solution may refer to the operation to ensure that the application distributed by the hacker or the like is not executed by allowing the code signing to be executed normally only for the application that has been code signing. This could mean signing code to the entire executable file based on the certificate.

In addition, authenticating a user or device based on a certificate may refer to allowing access only to a user or device that has a certificate installed. For example, a certificate of a device for low power short-range communication, a cable of US Cablelab It may include an international standard interface certificate of a modem, a European protocol certificate of DOCSIS, or a broadcast type certificate in which a security module is separated.

In addition, the operation of data encryption in communication refers to data encryption through SSL certificates. For example, if a tampered site does not have a normal SSL certificate, access to these sites is blocked, and data leakage is prevented for normal sites. May include preventing

In addition, the work on the security control service may refer to monitoring the malicious code for the endpoint at the gateway level by utilizing the function of monitoring the URL / IPS / FILE.

In addition, data leakage prevention refers to detecting, blocking, and reporting data containing confidential information or personal information from externally transmitted data, for example, from a device supporting IoT (Internet of Things) function. You can prevent the leakage of confidential or personal information.

In addition, the work on application protection technology refers to blocking external leakage of such data by applying encryption to data stored in the monitoring device 52 and separating secret data, for example, data separation and theft management. , Encryption and authentication.

In addition to the above-described operation, the monitoring unit 120 may monitor the file monitoring unit 121, the process monitoring unit 122, the network monitoring unit 123, the memory access monitoring unit 124, and the initialization process as illustrated in FIG. 2B. The unit 125 or the device communication monitoring unit 127 may be included, and various monitoring described below may be performed using this configuration. In addition, the monitoring unit 120 may not include at least one or more of the above-described components, or may further include other components not shown here.

The file monitoring unit 122 monitors a file in the monitoring equipment 52. For example, the file monitoring unit 122 may monitor the creation, copying, deleting, moving, accessing, reading, writing, changing or executing a file name based on a whitelist or a blacklist. In this case, the file to be monitored may include an executable file, a configuration file, an important data file, a registry file, or a system file. More specifically, a file storing a call content between generations using the monitoring device 52, a member of a household, or a vehicle may be accessed. Or a file that stores personal information such as visitor information, but is not limited thereto.

The process monitoring unit 122 monitors the process at the monitoring equipment 52. For example, the process monitoring unit 122 may monitor an intrusion or execution of a process to neutralize the operation of the security management apparatus 100 based on a white list or a black list.

The network monitoring unit 123 monitors a connection to the network of the monitoring device 52 or data transmitted / received through the network based on a white list or a black list, and the network to be monitored is, for example, a public server unit ( Network connection to the external network 30, other network connection to the external network 10, packets, data and commands transmitted and received through the network.

The memory access monitoring unit 125 monitors the access to the memory included in the monitoring device 52, and the memory included in the monitoring device 52 from the outside (such a memory may include, for example, intergenerational call content and vehicle access information. Can store whitelisted or blacklisted processes or users who have access to personal information, visitor information, etc.).

The initialization process monitoring unit 126 may monitor the initialization process of the monitoring device 52 and the gateway unit 70. That is, the initialization process monitoring unit 126 may monitor various initialization processes for setting communication between the monitoring equipment 52 and the gateway unit 70, and this initialization process may be performed by, for example, the gateway unit 70. It may include the process of delivering the IP of the monitoring equipment (52).

In addition, the device list monitoring unit 127 may monitor a list of a plurality of devices (53, 55) connected to the monitoring equipment (52). In more detail, the device list monitoring unit 127 may monitor the change or change of the device list, and may also monitor the connection of unauthorized devices not included in the device list to the monitoring device 52. Can be. In addition, the device list monitoring unit 126 may monitor a device list transmission process between the gateway unit 70 and the monitoring device 52. In the process of transmitting the device list, the monitoring device 52 receives information about the device (for example, the first device) connected to the gateway unit 70 from the gateway unit 70 to inquire and control the corresponding device. Refers to a process that can be performed.

The device communication monitoring unit 127 may monitor communication between the monitoring device 52 and the plurality of devices 53 and 55. For example, abnormal access from the outside to a photographing means such as a camera connected to or built into the monitoring equipment 52 or a voice input / output means such as a microphone can be monitored.

In addition, the device communication monitoring unit 127 may monitor the communication (for example, control commands or events, hereinafter referred to as device-related communication) transmitted to or from the devices 53 and 55. In the following description, a communication method between the monitoring device 52 and the devices 53 and 55 is a half-duplex and polling method, which will be described with reference to FIGS. 5A to 5C. In the half-duplex and polling communication method, the master must make a request so that the slave can perform the response. The master's request is sent to all slaves, and the response of one slave is sent to the other slave and the master.

FIG. 5A is a diagram conceptually illustrating a case in which a communication method between the monitoring device 52 and the plurality of devices 53 and 55 is a half-duplex method in a home network system. Referring to FIG. 5A, in the case of half-duplex and polling, the monitoring equipment 52 is a master requesting communication 60 and the devices 53, 55 are slaves responding 61 to the request 60. (slave). That is, in the half-duplex and polling home network system, the plurality of devices 53 and 55 may respond to the request 61 only when the request 60 of the monitoring device 52 is received. In addition, when the monitoring device 52, which is a master, makes a request 60, the devices 53 and 55, which are slaves, may perform a response, and the request of the monitoring device 52 may include all devices 53 and 55. The response of one of the devices 53 and 55 is transmitted to the other device and the monitoring equipment 52.

FIG. 5B illustrates a case in which there is a response 61 from the devices 53 and 55 even when there is no request 60 of the monitoring equipment 52 in the home network system. The device communication monitoring unit 127 may analyze this situation when there is a response 61 from the devices 53 and 55 even though there is no request from the monitoring equipment 52. Such a situation may be, for example, a case in which the devices 53 and 55 are infected with a malicious code, and thus transmit a response 61 by themselves even without a request of the monitoring device 52. In contrast, as shown in FIG. When the third device 56 other than 52 transmits a request 62 for attacking the devices 53 and 55 to the devices 53 and 55, and the devices 53 and 55 respond. Can be.

Meanwhile, in FIG. 5C, when the third device 56, not the devices 53 and 55, transmits a request 62 for attacking the devices 53 and 55 to the devices 53 and 55, the request 62. May be transmitted to the monitoring equipment 52 serving as the master. In this case, the device communication monitoring unit 127 may analyze the request 62.

Meanwhile, the monitoring unit 120 may monitor the monitoring equipment 52 through interworking with the common server unit 30. For example, when the monitoring unit 120 cannot perform monitoring, the common server unit 30 may perform monitoring on behalf of the monitoring unit 120. In addition, the monitoring result of the monitoring unit 120 may be delivered to the common server unit 30, the public server unit 30 may analyze the monitoring result and then transfer it to the monitoring unit 120 again. The analysis result received from the monitoring unit 120 from the common server 30 may be used to determine whether to allow or block a task.

2A, the control unit 130 analyzes the monitoring result of the monitoring unit 120. In addition, the control unit 130 may allow or block the execution of the task based on the analysis result. Or you can use blacklists.

For example, the controller 130 may block (lock down) the installation or execution of an undefined app or access to resources in a task related to system hardening, and code signing in a task related to a code signing solution. It is possible to block (lock down) the execution of a non-certified application and to block access only to users or devices that do not have a certificate in authenticating users or devices based on certificates. In addition, it is possible to block access to a site that has been tampered with in a communication data encryption operation, and to prevent data leakage of a normal site. In addition, it is possible to block (lock down) the creation, copying, deleting, moving, accessing, reading, writing, renaming or executing a file, and invading a process to disable the operation of the security management device 100 itself. It can block the execution, etc., can block the network connection to the common server unit 30, or other network connection to the external network 10, and the like to process a user or a process that accesses the memory included in the monitoring equipment 52 from the outside Can be blocked based on. In addition, the controller 130 may block abnormal access to, for example, a recording means such as a camera connected to or embedded in the monitoring device 52 or a voice input / output means such as a microphone, or may include intergenerational call contents stored in a memory or a file. The leakage of personal information and internal company information can be blocked.

In addition, the controller 130 may block the corresponding communication when data is modulated or taken over during the initialization process or when a list of devices connected to the monitoring device 52 is tampered with or taken over during the device list transmission process.

In addition, the controller 130 may respond to the response (61) even if the device (53, 55) does not have a request (60) from the monitoring device 52, or the third device 56 is connected to the device (53, 55) If a request 62 for attack is passed, this response 61 or request 62 can be blocked.

In addition, although not shown in FIG. 2A, the storage unit may store the monitoring result of the monitoring unit 120. Such storage may be in the form of a memory for storing data. Through this, the administrator or the public server unit 30 of the home network system 40 can recognize, manage and process the security problem for the home network system 40 based on the data stored in the storage unit at any time.

In addition, although not shown in FIG. 2A, the alarm unit may transmit a task history allowed or blocked by the controller 130 to a user or an administrator. For example, the alarm unit installs or executes a blocked app or accesses a resource, blocks the execution of an application without code signing, accesses to a tampered site, intrudes, executes, or monitors a process that attempts to neutralize the operation itself. Abnormal access to a recording means such as a camera connected to or embedded in the equipment 52 or a voice input / output means such as a microphone, or an attempt to leak an intergenerational call or personal (or corporate) information stored in a memory or a file; It can be delivered as a notification message to the administrator, but this is only an example, and the notification message may be SMS, MMS, LMS, applications of the smartphone and various other forms.

In addition, the alarm unit may respond to a response 61 even when the device 53 or 55 does not have a request 60 from the monitoring device 52 or the third device 56 may attack the device 53 or 55. When forwarding the request 62, the details can be informed to the user or administrator.

As described above, the security management device may allow only authorized users or processors to access the monitoring devices included in the home network system and the devices connected to the monitoring devices, and may block the creation or execution of malicious files themselves. In addition, it can monitor the communication related to the monitoring equipment, and can block the taking or tampering with the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent privacy invasion from the outside through such monitoring equipment, and also to prevent the leakage of various information stored in the monitoring equipment (internal information or personal information of the company).

In addition, hereinafter, a method of managing security in a home network system using a security management apparatus will be described.

6 is a flowchart illustrating a security management method according to an embodiment of the present invention.

Referring to FIG. 6, in the security management method according to an embodiment of the present invention, the step of electrically connecting with the monitoring device (S100), the step of monitoring a task in the monitoring device (S200), and the result of the monitoring Allowing or blocking the task on the basis of the step (S300) may be included, but the spirit of the present invention is not limited to that shown in FIG.

The step S100 of being electrically connected is performed by, for example, the connection unit 110 of the security management apparatus 100, through which the security management apparatus 100 may be connected to the monitoring equipment 52. In this case, when the security management apparatus 100 is included in the monitoring equipment 52 and when the security management apparatus 100 is separately implemented outside the monitoring equipment 52, the connection unit 110 is connected to the monitoring equipment 52. ) And the security management device 100 may be electrically connected as described above.

Monitoring step (S200) is performed by the monitoring unit 120 of the security management device 100, for example, through the file or process, network access or memory access, initialization process in the monitoring equipment 52 through this Alternatively, the device list transmission process and communication between the monitoring device 52 and the device may be monitored, as described above.

The allowing or blocking step S300 may block or allow the task based on the whitelist or the blacklist based on the monitoring result in the monitoring step S200. For example, working on system hardening or working on code signing solutions, creating, copying, deleting, moving, accessing, reading, writing, renaming or executing files, invading or executing processes, etc. As described above, it may allow or block based on a list or a blacklist.

As described above, only authorized users or processors may access the monitoring devices included in the home network system and the devices connected to the monitoring devices, and may block the creation or execution of malicious files themselves, It can monitor the related communication and block the taking or tampering with the unique information stored in the monitoring equipment. Accordingly, it is possible to prevent privacy invasion from the outside through such monitoring equipment, and also to prevent the leakage of various information stored in the monitoring equipment (internal information or personal information of the company).

Combinations of each block of the block diagrams and respective steps of the flowcharts attached to the present invention may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may also be stored in a computer usable or computer readable memory, recording medium that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer. Instructions stored in the readable memory may also produce an article of manufacture containing instruction means for performing the functions described in each block of the block diagram or in each step of the flowchart. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas falling within the scope of the present invention should be construed as being included in the scope of the present invention.

Claims (20)

1. In the security management device for monitoring equipment that monitors multiple devices and is connected to the common server unit,

   A connection part electrically connected to the monitoring equipment;

   A monitoring unit for monitoring a task in the monitoring equipment; And

   And a controller configured to allow or block the task based on a result of the monitoring by the monitoring unit.

   Security management device.
2. The method of claim 1,

   The security management device,

   It may be implemented to be included in the monitoring equipment or implemented separately outside the monitoring equipment

   Security management device.
3. The method of claim 1,

   A first device of at least one of the plurality of devices is connected to the monitoring equipment through a gateway unit,

   The monitoring unit,

   A device list monitoring unit configured to monitor a list of the first device or a list of second devices connected to the monitoring device without passing through the gateway unit;

   Security management device.
4. The method of claim 3, wherein

   The monitoring unit,

   Including an initialization process monitoring unit for monitoring the initialization process to enable communication between the monitoring device and the gateway unit;

   Security management device.
5. The method of claim 1,

   The monitoring unit,

   A file monitoring unit for monitoring a file included in the monitoring device;

   A process monitoring unit for monitoring a process in the monitoring equipment;

   A network monitoring unit configured to monitor access to a network of the monitoring equipment or data transmitted and received with the network;

   A memory access monitor configured to monitor access to a memory included in the monitoring device; And

   A device communication monitor configured to monitor communication between the monitoring device and the device;

   Security management device.
6. The method of claim 1,

   The monitoring unit,

   Monitoring the task based on a preset whitelist or blacklist

   Security management device.
7. The method of claim 1,

   The monitoring unit,

   Monitoring the task through interworking with the common server unit

   Security management device.
8. The method of claim 1,

   The monitoring unit,

   Monitoring whether the response from the device to the monitoring equipment is a response when there is no request by the monitoring equipment

   Security management device.
9. The method of claim 1,

   The monitoring unit,

   To monitor whether the request received at the monitoring device is from an unauthorized third party device

   Security management device.
10. The method of claim 5,

    The control unit,

    Allow or block the file, the process, data connected to the network or transmitted / received from or to the network, access to the memory or communication between the monitoring device and the device based on the result of the monitoring;

    Security management device.
11. In the security management method using a security management device for monitoring equipment connected to a common server unit for monitoring a plurality of devices,

    Electrically connecting with the monitoring equipment;

    Monitoring a task at the monitoring equipment; And

    Allowing or blocking the task based on the monitored result;

    How to manage security.
12. The method of claim 11,

    A first device of at least one of the plurality of devices is connected to the monitoring equipment through a gateway unit,

    The monitoring step,

    Monitoring a list of the first device or a list of second devices connected to the monitoring device without passing through the gateway;

    How to manage security.
13. The method of claim 12,

    The monitoring step,

    Monitoring an initialization process that enables communication between the monitoring device and the gateway unit

    How to manage security.
14. The method of claim 11,

    The monitoring step,

    A file included in the monitoring device, a process in the monitoring device, a connection to the network of the monitoring device or data transmitted to and received from the network, access to a memory included in the monitoring device or communication between the monitoring device and the device. To guard

    How to manage security.
15. The method of claim 11,

    The monitoring step,

    Monitoring the task based on a preset whitelist or blacklist

    How to manage security.
16. The method of claim 11,

    The monitoring step,

    Monitoring the task through interworking with the common server unit

    How to manage security.
17. The method of claim 14,

    The monitoring step,

    Monitoring whether the response from the device to the monitoring equipment is a response when there is no request by the monitoring equipment

    How to manage security.
18. The method of claim 11,

    The monitoring step,

    To monitor whether the request received at the monitoring device is from an unauthorized third party device

    How to manage security.
19. The method of claim 14,

    The allowing or blocking step,

    Allow access to the file, the process, the connection to the network of the monitoring device or the data transmitted and received with the network, the memory included in the monitoring device or the communication between the monitoring device and the device based on the monitored result; Doing or blocking

    How to manage security.
20. A computer-readable recording medium having recorded thereon a program including instructions for performing each step according to the method for managing security of any one of claims 11 to 19.

Images