WO2020106025A1

WO2020106025A1 - Gateway device and authority verification method therfor

Info

Publication number: WO2020106025A1
Application number: PCT/KR2019/015862
Authority: WO
Inventors: 성덕기; 강명구; 박민수; 이상돈
Original assignee: 주식회사 케이씨인더스트리얼
Priority date: 2018-11-21
Filing date: 2019-11-19
Publication date: 2020-05-28
Also published as: KR102016039B1

Abstract

According to the present invention, an arbitrary gateway device among a plurality of disclosed gateway devices connected with a node through a network includes: a random number generation unit for generating random numbers; a communication unit for transmitting and receiving information to/from other gateway devices among the plurality of gateway devices; a data storage unit in which hash values are stored; and a control unit, wherein the control unit controls the communication unit so as to receive random numbers respectively from at least two different gateway devices among the other gateway devices, calculates hash values by using the random numbers received through the communication unit and the random numbers generated from the random number generation unit, and verifies preset authorities for the arbitrary gateway device and the at least two different gateway devices on the basis of the calculated hash values and the hash values stored in the data storage unit.

Description

Gateway device and its authorization verification method

The present invention relates to a gateway device and a method for verifying a preset authority by the gateway device.

As is well known, a gateway device is a device that allows a protocol to connect to different communication networks, and is used to connect one network, such as a local area network (LAN), to another network.

An example in which a gateway device is used is a radio frequency identification (RFID) system, and a typical RFID system includes an RFID tag, an RFID reader, and a server device. In such an RFID system, an RFID reader is a gateway device that provides a protocol conversion function that enables RFID tags and server devices to exchange information with each other.

Such a gateway device is used in various communication networks, and in implementing a smart city where not only a small-scale RFID system but also a infrastructure for tele-communication is connected to every corner of the city like a human neural network. It is an essential skill.

Meanwhile, the gateway device is exposed to various types of security attacks as it is used in various communication networks, and preparations for this are necessary.

According to an embodiment, there is provided a gateway device and a method for verifying the authority of the gateway device, which mutually verifies predetermined rights in a block chain manner with neighboring gateway devices.

The technical problems are not limited to those mentioned above, and other technical problems that are not mentioned will be clearly understood by those skilled in the art from the following description.

According to a first aspect of the present invention, an arbitrary gateway device among a plurality of gateway devices connected through a node and a network transmits and receives information to and from other gateway devices among the plurality of gateway devices, and a random number generator for generating random numbers. It includes a communication unit, a data storage unit for storing hash values, and a control unit, wherein the control unit controls the communication unit to receive random numbers from two or more different gateway devices among the other gateway devices, and is received through the communication unit. A hash value is calculated using random numbers and a random number generated by the random number generator, and based on the calculated hash value and the hash value stored in the data storage unit, the random gateway device and the two or more other gateway devices Verify pre-set authority.

According to a second aspect of the present invention, a method for verifying the authority in an arbitrary gateway device among a plurality of gateway devices connected through a node and a network includes: the random gateway device includes a random number generator and a hash value for generating random numbers The method includes a stored data storage unit, and the method for verifying the authority includes receiving random numbers from two or more different gateway devices among the plurality of gateway devices, and receiving the random numbers and the random numbers generated by the random number generation unit. Calculating a hash value by using, and verifying predetermined authority of the arbitrary gateway device and the two or more other gateway devices based on the calculated hash value and the hash value stored in the data storage unit. .

According to a third aspect of the present invention, a computer readable computer storing a computer program including instructions for causing a processor to perform an authorization verification method performed on any gateway device among a plurality of gateway devices connected through a node and a network. As a recording medium, the arbitrary gateway device includes a random number generator for generating a random number and a data storage unit in which a hash value is stored, and when the computer program is executed by the processor, two or more other gateways among the plurality of gateway devices Receiving a random number from a device, calculating a hash value using the received random numbers and the random number generated by the random number generator, and calculating the hash value and the hash value stored in the data storage unit. On the basis of this, it includes instructions for causing the processor to perform the authorization verification method, including verifying predetermined authorizations of the arbitrary gateway device and the two or more other gateway devices.

According to a fourth aspect of the present invention, a computer program stored in a computer-readable recording medium including instructions for causing a processor to perform an authorization verification method performed in any gateway device among a plurality of gateway devices connected through a node and a network. The random gateway device includes a random number generator for generating a random number and a data storage unit in which a hash value is stored, and when the computer program is executed by the processor, two or more other gateway devices among the plurality of gateway devices Receiving a random number, calculating a hash value using the received random numbers and the random number generated by the random number generation unit, and based on the calculated hash value and the hash value stored in the data storage unit. And a command for causing the processor to perform the authorization verification method, including verifying predetermined authorizations of the arbitrary gateway device and the two or more other gateway devices.

According to an embodiment of the present invention, the gateway devices mutually verify the preset authority in a block chain manner with neighboring gateway devices. As described above, if mutual verification is performed in a block chain manner, when a problem occurs in any one of a plurality of gateway devices, security performance is improved because a nearby gateway device can accurately identify a problem occurrence situation.

In addition, since the server device does not need to be involved in mutual verification between gateway devices, it can be applied to a serverless environment.

In addition, by updating the unique values recorded in the nodes constituting the network to improve security and sharing information about the updated unique values with other gateway devices, there is an effect of maintaining the original network function by the node.

1 is a configuration diagram of a network system in which a gateway device according to an embodiment of the present invention can be operated.

2 is a block diagram of a gateway device according to an embodiment of the present invention.

FIG. 3 is a diagram illustrating a correlation between peripheral gateway devices when performing a method for verifying authority for a node according to an embodiment of the present invention.

4 is a flowchart illustrating a method for verifying authority for a node of a gateway device according to an embodiment of the present invention, and shows a method for verifying access authority for a node.

5 is a flowchart illustrating an information processing process for a node by a gateway device according to an embodiment of the present invention.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the embodiments allow the disclosure of the present invention to be complete, and common knowledge in the technical field to which the present invention pertains. It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims.

In describing embodiments of the present invention, when it is determined that a detailed description of known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to a user's or operator's intention or practice. Therefore, the definition should be made based on the contents throughout this specification.

1 is a configuration diagram of a network system in which a gateway device according to an embodiment of the present invention can be operated, and FIG. 2 is a configuration diagram of a gateway device according to an embodiment of the present invention.

As shown in FIG. 1, the network system 100 according to an embodiment includes a plurality of nodes 110, a plurality of gateway devices 120, and a server device 130. The number of nodes 110 and gateway devices 120 is not particularly limited. Although the configuration including the server device 130 is illustrated as an example in FIG. 1, the server device 130 when a plurality of gateway devices 120 serve as a host managing a plurality of nodes 110 Even if is omitted, the network system 100 can be configured. 1 illustrates a wireless communication connection between the node 110 and the gateway device 120, and illustrates a wired communication connection between the gateway device 120 and the server device 130, but the node 110 and the gateway device Between 120 and between the gateway device 120 and the server device 130 is not limited to a specific communication protocol.

The plurality of nodes 110 may be connected to other networks including the server device 130 through the gateway device 120. Each of these nodes 110 has an eigenvalue, and these eigenvalues are recorded in the internal memory of the node 110. In addition, the eigenvalue recording time may be recorded in the internal memory of the node 110 together. In addition, the eigenvalue and eigenvalue recording time recorded in the internal memory of the node 110 may be updated and recorded with new eigenvalue and new eigenvalue recording time by the gateway device 120. In addition, the nodes 110 may further include a counter that counts the number of times the eigenvalue is updated with a new eigenvalue, and information about the number of updates counted by the counter can be recorded in the internal memory. For example, the eigenvalue can include a unique identifier to identify an individual node. Also, the unique value may further include a unique key required when accessing the corresponding node. The gateway device 120 may read or write information after accessing the corresponding node using a unique key. For example, the nodes 110 may be radio frequency identification (RFID) tags.

The gateway device 120 provides a protocol conversion function that allows the node 110 and the server device 130 to exchange information with each other. In addition, the gateway device 120 acts as a host managing a plurality of nodes 110, so that a serverless environment in which the network system 100 can be configured even if the server device 130 is omitted Can provide For example, when the nodes 110 are RFID tags, the gateway devices 120 may be RFID readers.

2, the gateway device 120 includes a random number generation unit 121, a communication unit 122, a data storage unit 123, and a control unit 124. Among them, the random number generation unit 121 generates random numbers and provides them to the control unit 124. The communication unit 122 provides a communication path between the node 110 and the other gateway device 120 and the server device 130, and other gateway devices 120 and nodes (via the communication path under the control of the control unit 124) 110). The data storage unit 123 stores various information including the random number generated by the random number generation unit 121 and the hash value calculated by the control unit 124. The control unit 124, through the communication unit 122, preset authority with other gateway devices 120, for example, access authority to the node 110, modification authority to the node 110, and sharing authority to the node 110 Etc. are mutually verified. The access authority to the node 110 may be an authority for the gateway device 120 to communicate and connect to the node 110 through a wireless communication connection, and the modification authority for the node 110 may be a node for the gateway device 120 to After accessing (110), it may be an authority to modify information of the node 110, and the sharing authority for the node 110 is an authority for the gateway device 120 to share the node 110 with other gateway devices. Can be For example, the control unit 124 may include computing computing means such as a microprocessor.

The functions of the gateway device 120 will be described in more detail with reference to FIGS. 1 and 2. In the following description, descriptions of "first", "second", "random", etc. are intended to aid understanding of the description, and do not designate specific objects, and the indications are as many changes as possible within the same object. It is possible.

The control unit 124 of the second gateway device 120 receives the random numbers generated by the random number generation unit 121 of the corresponding gateway device from the first gateway device 120 and the third gateway device 120 through the communication unit 122. To receive. Subsequently, the control unit 124 of the second gateway device 120 uses the random numbers received from the first gateway device 120 and the third gateway device 120 and the random numbers generated by the own random number generation unit 121. Calculate the hash value. Then, the control unit 124 of the second gateway device 120 verifies the preset authority of the first to third gateway devices 120 based on the calculated hash value and the hash value previously stored in the data storage unit 123. do. For example, if the calculated hash value and the pre-stored hash value match, the controller 124 may normally verify the access authority, modification authority, or sharing authority to the node 110 as a preset authority. Then, when the calculated hash value and the pre-stored hash value are different, the control unit 124 of the second gateway device 120 verifies that there is an abnormality in access authority, modification authority, or sharing authority to the node 110 as a preset authority. can do. Then, the control unit 124 of the second gateway device 120 transmits information including the verification result of the preset authority to one or more of the gateway devices 120 or to the server device 130 connected through the network. The communication unit 122 is controlled to transmit.

In addition, the control unit 124 of the second gateway device 120 has been verified that the preset authority of the first to third gateway devices 120, for example, access authority, modification authority, or sharing authority to the node 110 is normal. In the case, the new random number generated by the random number generation unit 121 of the corresponding gateway device from the first gateway device 120 and the third gateway device 120 is received through the communication unit 122. Subsequently, the control unit 124 of the second gateway device 120 receives the new random numbers received from the first gateway device 120 and the third gateway device 120 and the new random numbers generated by the random number generator 121. After calculating the new hash value by using, the hash value previously stored in the data storage unit 123 is updated with the calculated new hash value. For example, updating a previously stored hash value with a new hash value may be performed at every predetermined update period, so that even if the hash value is exposed, the exposed hash value becomes useless when the update period elapses.

Meanwhile, the control unit 124 of the second gateway device 120 mutually verifies the random numbers generated by the random number generation unit 121 and new gateway numbers by other gateway devices 120 including the first and third gateway devices. It transmits to the other gateway device 120 through the communication unit 122 to be used in. For example, the control unit 124 of the second gateway device 120 may generate a random number and a new random number at a predetermined period, or a random number and a new random number at a time specified by the user through a separate user interface.

In addition, the control unit 124 of the second gateway device 120 has been verified that the preset authority of the first to third gateway devices 120, for example, access authority, modification authority, or sharing authority to the node 110 is normal. In this case, the first node 110 of the plurality of nodes 110 is connected through the communication unit 122 that provides a communication path with the plurality of nodes 110. Then, the control unit 124 of the second gateway device 120 updates and records the eigenvalue recorded in the first node 110 with the new eigenvalue. In addition, the control unit 124 of the second gateway device 120 updates information on the first node 110 stored in the data storage unit 1230 based on the new eigenvalue. Then, the control unit 124 of the second gateway device 120 transmits information about the new eigenvalue to the other gateway device 120 through the communication path. In addition, the controller 124 of the gateway device 120 updates and records the eigenvalue recording time recorded in the first node 110 to the current time.

Then, the control unit 124 of the gateway device 120 is the first node 110 based on the result of comparing the list of management nodes stored in the data storage unit 123 and the eigenvalue recorded in the first node (110) Determine whether it is subject to management. Then, the controller 124 of the gateway device 120 generates a new eigenvalue when the first node 110 is the management target, erases the eigenvalue recorded in the first node 110 and removes the generated new eigenvalue. Write to 1 node 110. Here, when generating a new eigenvalue, the control unit 124 of the gateway device 120 may access the first node 110 included in the management node list or the first node 110 when the first node is the management target. Check the eigenvalue recording time recorded in). Then, the control unit 124 of the gateway device 120 generates a new eigenvalue when a preset time has elapsed after a previous access or recording based on the identified access time or the identified eigenvalue recording time. Then, after generating a new eigenvalue, the control unit 124 of the gateway device 120 updates the access time for the first node 110 to the current time and stores it in the list of management nodes of the data storage unit 123. .

The server device 130 may be connected to another network including the plurality of nodes 110 through the gateway device 120, and may serve as a host managing the plurality of nodes 110. Then, the server device 130 receives an alarm for a preset authority from the gateway devices 120, for example, an alarm indicating that there is an abnormality in an access authority, a modification authority, or a sharing authority for the node 110. Then, the server device 130 manages the gateway device 120 that has sent the alarm in a separate list form, or notifies other gateway devices 120 or solves a problem with the gateway device 120 to which the alarm has been transmitted. Can send various control commands.

The server device 130 may be omitted when the gateway device 120 serves as a host managing the plurality of nodes 110.

FIG. 3 is a diagram showing the mutual relationship between the peripheral gateway devices 120 when performing the authority verification method for the node 110 according to an embodiment of the present invention, and FIG. Flowcharts for explaining a method for verifying authority for the node 110 of the gateway device 120, and FIG. 5 illustrates an information processing process for the node 110 by the gateway device 120 according to an embodiment of the present invention. It is a flowchart for explanation.

Hereinafter, with reference to FIGS. 1 to 5, in the network system 100 according to an embodiment of the present invention, the plurality of gateway devices 120 will look at the process of mutually verifying the preset authority to the node 110. The process of mutually verifying access privileges will be described as an example. Here, the first gateway device 120A, the second gateway device 120B, the third gateway device 120C, the fourth gateway device 120D, which are part of the plurality of gateway devices 120 as shown in FIG. 4, and The mutual verification process by the fifth gateway device 120E will be described.

First, the control unit 124 of the third gateway device 120C communicates the random number generated by the random number generation unit 121 of the corresponding gateway device from the second gateway device 120B and the fourth gateway device 120D. To receive through. At this time, the random number generation unit 121 of the third gateway device 120C also generates random numbers and provides them to the control unit 124 of the third gateway device 120C. Then, the control unit 124 of the third gateway device 120C causes the communication unit 122 to transmit the random numbers generated by the random number generation unit 121 to the second gateway device 120B and the fourth gateway device 120D. It is controlled to transmit (S201).

Subsequently, the control unit 124 of the third gateway device 120C uses the random numbers received from the second gateway device 120B and the fourth gateway device 120D and the random numbers generated by the own random number generation unit 121. The hash value is calculated (S203).

Then, the control unit 124 of the third gateway device 120C is based on the hash value calculated in step S203 and the hash value previously stored in the data storage unit 123, the second gateway device 120B and the third The access authority to the node 110 of the gateway device 120C and the fourth gateway device 120D is verified. At this time, the controller 124 of the third gateway device 120C, if the hash value calculated in step S203 and the hash value previously stored in the data storage unit 123 coincide, the second gateway device 120B and the third gateway The access rights to the node 110 of the device 120C and the fourth gateway device 120D may be verified as normal. In addition, when the hash value calculated in step S203 is different from the hash value pre-stored in the data storage unit 123 of the third gateway device 120C, the second gateway device 120B and the third gateway device. It may be verified that the access authority to the node 110 of the 120C and the fourth gateway device 120D is abnormal (S205).

In step S205, the control unit 124 of the third gateway device 120C accesses the second gateway device 120B and access rights to the node 110 of the third gateway device 120C and the fourth gateway device 120D. When it is verified that there is an abnormality, it is possible to transmit to the

other gateway devices

120A, 120B, 120D, 120E and / or the server device 130 through the communication unit 122 to notify that the access authority to the node 110 is abnormal. have. When the server device 130 receives an alarm from the third gateway device 120C, it is determined that the access authority to the node 110 is abnormal based on the received alarm, that is, the agent related to calculating a hash value having a problem. The second gateway device 120B, the third gateway device 120C, and the fourth gateway device 120D may be managed in a separate list form. Alternatively, the server device 130 notifies

other gateway devices

120A and 120E based on the received alarm, or issues various control commands for solving the problem to the second gateway device 120B and the third gateway device 120C. And the fourth gateway device 120D (S207).

In step S205, the control unit 124 of the third gateway device 120C has access rights to the nodes 110 of the second gateway device 120B and the third gateway device 120C and the fourth gateway device 120D. If it is verified as normal, the random number generator 121 controls to generate a new random number. In addition, the control unit 124 of the third gateway device 120C transmits the new random number generated in the random number generation unit 121 to the second gateway device 120B and the fourth gateway device 120D. 120C) to control the communication unit 122.

In addition, the control unit 124 of the third gateway device 120C communicates the new random number generated by the random number generation unit 121 of the corresponding gateway device from the second gateway device 120B and the fourth gateway device 120D. ) (S209).

Subsequently, the control unit 124 of the third gateway device 120C receives the new random numbers received from the second gateway device 120B and the fourth gateway device 120D and the new random numbers generated by the own random number generation unit 121. Calculate the new hash value using (S211).

Then, the control unit 124 of the third gateway device 120C uses the new hash value calculated in step S211 to determine the hash value stored in the data storage unit 123, that is, the hash value verified to be normal in step S205 in S211. It is updated with the calculated new hash value (S213).

So far, the third gateway device 120C centers on itself, and the second gateway device 120B and the fourth gateway device 120D together with the node 110 of the

gateway devices

120B and 120D of itself and surroundings. Explained the process of verifying the access right for the user. Thereafter, the second gateway device 120B centers on itself and the first gateway device 120A and the third gateway device 120C together with the node 110 of its own and neighboring

gateway devices

120A and 120C. You can perform the process of verifying the access rights to the. In addition, the fourth gateway device 120D centers on itself and the third gateway device 120C and the fifth gateway device 120E together with the node 110 of the neighboring

gateway devices

120C and 120E together with the third gateway device 120C. You can perform the process of verifying the access rights to the.

Here, the first gateway device 120A, the second gateway device 120B, the third gateway device 120C, the fourth gateway device 120D, and the fifth gateway device 120E have access rights to the node 110 The order of verifying is not particularly limited. For example, the first gateway device 120A may be centered at the beginning, and a Verifying Authority process may be performed with the fifth gateway device 120E and the second gateway device 120B. Finally, the fifth gateway device 120E may perform an access authority verification process together with the fourth gateway device 120D and the first gateway device 120A.

In addition, the control unit 124 of the third gateway device 120C access rights to the node 110 of the second gateway device 120B and the third gateway device 120C and the fourth gateway device 120D in step S205. If it is verified as normal, the first node 110 of the plurality of nodes 110 is accessed through the communication unit 121 providing a communication path with the plurality of nodes 110 (S301).

Then, the control unit 124 of the third gateway device 120C compares the eigenvalues recorded in the first node 110 with the list of management nodes stored in the data storage unit 123, and then the first node 110 ) Is determined to be managed. For example, if the controller 124 matches any one of the unique values recorded in the first node 110 and the unique identifiers of the nodes included in the list of managed nodes stored in the data storage unit 123, the first value is the first. It may be determined that the node 110 is the management target (S303).

Subsequently, the control unit 124 of the third gateway device 120C checks the access time to the first node 110 stored in the management node list of the data storage unit 123 (S305). Then, the controller 124 of the third gateway device 120C generates a new eigenvalue when a predetermined time has elapsed since the previous access, that is, the last access, based on the identified access time. Alternatively, the control unit 124 of the third gateway device 120C checks the eigenvalue recording time recorded in the first node 110. In addition, the controller 124 of the third gateway device 120C may generate a new eigenvalue based on the identified eigenvalue recording time, that is, when a predetermined time has elapsed since the previous recording, that is, the last recording. For example, the control unit 124 of the third gateway device 120C generates its own eigenvalue, that is, the eigenvalue of the third gateway device 120C and the first when generating a new eigenvalue of the first node 110. A new eigenvalue may be generated including the eigenvalue recorded in the node 110 and a hash value calculated using the access time to the first node 110. As described above, since the previous eigenvalue calculated using the hash function is included in the hash function for calculating the new eigenvalue, the security of the eigenvalue improves as much as the data that hash the previous hash becomes the current hash. It becomes (S307).

In addition, the control unit 124 of the third gateway device 120C updates and stores the access time to the first node 110 stored in the management node list of the data storage unit 123 as the current time (S309).

Then, the controller 124 of the third gateway device 120C erases the eigenvalue recorded in the first node 110 and records the new eigenvalue generated in step S307 in the first node 110, thereby The eigenvalue of (110) is updated with the new eigenvalue. At this time, the number of updates counted by the counter for counting the number of times the eigenvalue is updated with the new eigenvalue is increased once and stored in the internal memory of the first node 110. In addition, the controller 124 of the third gateway device 120C may update and record the eigenvalue recording time recorded in the first node 110 to the current time (S311).

In addition, the control unit 124 of the third gateway device 120C updates the data storage unit 123 in which information about the first node 110 is stored based on the new eigenvalue of the first node 110 (S313) ). Then, the control unit 124 of the third gateway device 120C transmits information on the new eigenvalue to

other gateway devices

120A, 120B, 120D, and 120E through the communication path provided by the communication unit 122, The updated information of the data storage unit 123 is shared with

other gateway devices

120A, 120B, 120D, and 120E (S315).

As described so far, according to an embodiment of the present invention, gateway devices perform mutual verification with neighboring gateway devices in a block chain manner.

As described above, when mutual verification is performed in a blockchain manner, when a problem occurs in any one of a plurality of gateway devices, it is possible to accurately identify a problem occurrence situation in a nearby gateway device, thereby providing improved security performance.

In addition, by updating the unique values recorded in the nodes constituting the network, while improving the security, by sharing information about the updated unique values with other gateway devices, the original network function by the node is maintained.

The combination of each block in the block diagram and each step of the flowchart attached to the present invention may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, so that instructions executed through a processor of a computer or other programmable data processing equipment may be used in each block or flowchart of the block diagram. In each step, means are created to perform the functions described. These computer program instructions can also be stored in computer readable or computer readable memory that can be oriented to a computer or other programmable data processing equipment to implement a function in a particular way, so that computer readable or computer readable memory The instructions stored in it are also possible to produce an article of manufacture containing instructions means for performing the functions described in each step of each block or flowchart of the block diagram. Computer program instructions can also be mounted on a computer or other programmable data processing equipment, so a series of operational steps are performed on a computer or other programmable data processing equipment to create a process that is executed by the computer to generate a computer or other programmable data. It is also possible for instructions to perform processing equipment to provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

Further, each block or each step can represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments it is possible that the functions mentioned in blocks or steps occur out of order. For example, two blocks or steps shown in succession may in fact be executed substantially simultaneously, or it is also possible that the blocks or steps are sometimes performed in reverse order depending on the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and variations without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the claims below, and all technical thoughts within the equivalent range should be interpreted as being included in the scope of the present invention.

Claims

As a gateway device among a plurality of gateway devices connected through a node and a network,

A random number generator for generating random numbers,

A communication unit for transmitting and receiving information to and from other gateway devices among the plurality of gateway devices,

A data storage unit that stores hash values,

It includes a control unit,

The control unit,

Control the communication unit to receive random numbers from two or more different gateway devices among the other gateway devices,

The hash value is calculated by using the random numbers received through the communication unit and the random numbers generated by the random number generation unit,

On the basis of the calculated hash value and the hash value stored in the data storage unit, the predetermined authority of the arbitrary gateway device and the two or more other gateway devices is verified.

Gateway device.
According to claim 1,

When the calculated hash value and the hash value stored in the data storage unit are different, the controller verifies that there is an abnormality in the predetermined authority of the arbitrary gateway device and the two or more other gateway devices.

Gateway device.
According to claim 1,

The control unit controls the communication unit to transmit information including the verification result of the preset authority to one or more gateway devices among the plurality of gateway devices or to a server device connected through the network.

Gateway device.
According to claim 1,

The control unit,

New random numbers are respectively received from the two or more different gateway devices through the communication unit,

A new hash value is calculated using the new random number generated by the random number generator and the received new random numbers,

The hash value previously stored in the data storage unit is updated with the calculated new hash value.

Gateway device.
The method of claim 4,

The control unit,

Controlling the communication unit to transmit the random number generated by the random number generation unit or a new random number to two or more other gateway devices of the plurality of gateway devices

Gateway device.
According to claim 1,

The node is plural,

The preset authority is the authority to access the node,

The control unit,

When the access authority to the node is verified as normal, after accessing the first node among the plurality of nodes through the communication unit, the unique value recorded in the first node is updated and recorded with a new unique value,

Store information on the first node based on the new eigenvalue in the data storage,

Controlling the communication unit to transmit information on the new eigenvalue to at least one other gateway device among the plurality of gateway devices

Gateway device.
The method of claim 6,

In the data storage unit, a list of management nodes including information on a management target among the plurality of nodes is stored,

The control unit,

After accessing the first node among the plurality of nodes through the communication unit, it is determined whether the first node is a management target based on a result of comparing the eigenvalue recorded in the first node and the management node list,

When the first node is the management target, the new eigenvalue is generated,

Erasing the eigenvalue recorded in the first node and writing the generated new eigenvalue to the first node

Gateway device.
The method of claim 7,

The control unit,

When the first node is the management target, check the access time for the first node included in the management node list or the eigenvalue recording time recorded in the first node,

The new eigenvalue is generated when a preset time has elapsed after a previous approach or record based on the identified access time or the identified eigenvalue recording time

Gateway device.
The method of claim 8,

The control unit,

After generating the new eigenvalue, update the access time for the first node to the current time and store it in the management node list or update and record the eigenvalue recording time recorded in the first node with the current time

Gateway device.
As a method of verifying authority in any gateway device among a plurality of gateway devices connected through a node and a network,

The random gateway device includes a random number generator for generating random numbers and a data storage unit for storing hash values,

How to verify the authority,

Receiving random numbers from two or more different gateway devices among the plurality of gateway devices,

Computing a hash value using the received random number and the random number generated by the random number generation unit,

And verifying predetermined authority of the arbitrary gateway device and the two or more other gateway devices based on the calculated hash value and the hash value stored in the data storage unit.

Authorization verification method.
The method of claim 10,

In the step of verifying the preset authority, when the calculated hash value and the hash value stored in the data storage unit are different, verifying that there is an abnormality in the preset authority of the arbitrary gateway device and the two or more other gateway devices.

Authorization verification method.
The method of claim 10,

The verifying of the preset authority may include transmitting information including a verification result of the preset authority to one or more gateway devices among the plurality of gateway devices or to a server device connected through the network.

Authorization verification method.
The method of claim 10,

The authorization verification method,

Receiving new random numbers from the two or more different gateway devices,

Calculating a new hash value using the new random number generated by the random number generation unit and the received new random numbers,

Further comprising the step of updating the hash value previously stored in the data storage unit with the calculated new hash value.

Authorization verification method.
The method of claim 13,

The authorization verification method,

The method further includes transmitting the random number generated by the random number generation unit or a new random number to two or more other gateway devices among the plurality of gateway devices.

Authorization verification method.
The method of claim 10,

The node is plural,

The preset authority is the authority to access the node,

The authorization verification method,

If the access authority to the node is verified as normal, after accessing the first node among the plurality of nodes, updating and recording the unique value recorded in the first node with a new unique value,

Storing information on the first node based on the new eigenvalue in the data storage unit;

And transmitting information on the new eigenvalue to at least one other gateway device among the plurality of gateway devices.

Authorization verification method.
The method of claim 15,

In the data storage unit, a list of management nodes including information on a management target among the plurality of nodes is stored,

The authorization verification method,

Determining whether the first node is a management target based on a result of comparing the eigenvalues recorded in the first node and the management node list after accessing the first node among the plurality of nodes;

Generating the new eigenvalue when the first node is a management target;

And deleting the eigenvalue recorded in the first node and recording the generated new eigenvalue in the first node.

Authorization verification method.
The method of claim 16,

The step of generating the new eigenvalue,

When the first node is a management target, checking an access time for the first node included in the management node list or a eigenvalue recording time recorded in the first node,

And generating a new eigenvalue when a preset time elapses after a previous approach or record based on the identified access time or the identified eigenvalue recording time.

Authorization verification method.
The method of claim 17,

After generating the new eigenvalue, updating the access time for the first node to the current time and storing it in the management node list or updating and recording the eigenvalue recording time recorded in the first node to the current time Containing more

Authorization verification method.
A computer-readable recording medium storing a computer program including instructions for causing a processor to perform an authorization verification method performed on any gateway device among a plurality of gateway devices connected through a node and a network.

The random gateway device includes a random number generator for generating random numbers and a data storage unit for storing hash values,

When the computer program is executed by the processor,

Receiving random numbers from two or more different gateway devices among the plurality of gateway devices,

Computing a hash value using the received random number and the random number generated by the random number generation unit,

Based on the calculated hash value and the hash value stored in the data storage unit, the processor performs the authorization verification method, including verifying predetermined authorizations of the arbitrary gateway device and the two or more other gateway devices. A computer readable recording medium comprising instructions for doing so.
A computer program stored in a computer-readable recording medium including instructions for causing a processor to perform an authorization verification method performed in any gateway device among a plurality of gateway devices connected through a node and a network.

The random gateway device includes a random number generator for generating random numbers and a data storage unit for storing hash values,

When the computer program is executed by the processor,

Receiving random numbers from two or more different gateway devices among the plurality of gateway devices,

Computing a hash value using the received random number and the random number generated by the random number generation unit,

Based on the calculated hash value and the hash value stored in the data storage unit, the processor performs the authorization verification method, including verifying predetermined authorizations of the arbitrary gateway device and the two or more other gateway devices. A computer program comprising instructions for doing.