WO2023140595A1

WO2023140595A1 - Security construction system and method for gateway for iot device using identity-based security technique based on virtual block chain

Info

Publication number: WO2023140595A1
Application number: PCT/KR2023/000826
Authority: WO
Inventors: 송성면; 이상지; 박진하
Original assignee: 주식회사 푸시풀
Priority date: 2022-01-21
Filing date: 2023-01-18
Publication date: 2023-07-27
Also published as: KR20230112819A

Abstract

A security construction system for a gateway using an identity-based security technique based on a virtual block chain, according to the present invention, comprises: a wired/wireless communication module; a virtual block chain construction unit which forms, in the gateway, one or more virtual nodes having attribute information including an identifier (ID) and personal key information, and stores and manages, as a distributed ledger in the virtual nodes, a transaction data block agreed by the virtual nodes according to a predetermined agreement algorithm; a virtual block chain network connected by a network between the virtual nodes and neighboring virtual nodes; and a security module which performs security functions including access control through authentication and authorization with digital electronic devices using the identity-based security technique.

Description

Security establishment system and method of gateway for IOT devices using identity-based security technique based on virtual block chain

The present invention relates to a method for establishing security of a gateway for IoT devices using Identity-Based Cryptography (IBC) based on a virtual blockchain, and a system for establishing security for a gateway for IoT devices. It relates to a security construction system and method for a gateway for IoT devices using an identity-based security technique based on a virtual block chain that can maximize information security by protecting IoT devices, gateways, and data from hacking threats in IoT devices, data, and user access control management.

Recently, in the era of the Internet of Things (IoT), IoT devices are rapidly increasing. As a result, all kinds of physical and virtual objects will be connected to the Internet through IoT technology, especially those that were never thought of before. Objects to be connected to the Internet include everything from household devices such as door locks, thermometers, refrigerators, light bulbs, air purifiers, and washing machines to physical objects such as various industrial assets, wearable devices, smart devices, and smart cities, and virtual objects implemented as software in devices such as IoT gateways.

IoT is a technology that connects tangible or intangible devices with communication capabilities to a network to share information and provide various services. Products and services under the IoT environment are continuously evolving.

On the other hand, in configuring a network, a gateway refers to a computer or software that enables communication between networks using different communication networks or protocols in a computer network, and is a network point that serves as an entrance to another network. In other words, a gateway is a device that serves as a passage between different types of networks and serves to appropriately convert communication protocols on different networks.

Gateways are distinguished from routers and switches in that they communicate using one or more protocols, and can operate at any of the 7 layers of the OSI reference model.

The best-known example of a gateway is to connect a wired or wireless LAN to the Internet or other wide area network (WAN). In this case, the gateway connects a predetermined device to the Internet by connecting a LAN to a network specified by a provider.

Gateways connected to devices with high computing power, such as existing PCs, laptops, smartphones, tablets, etc., have simply played a role in connecting these devices to the Internet. On the other hand, now, a large number of low-end and low-cost small IoT devices with very low computing power are connected to the gateway, and the IoT gateway that performs a relay function for two-way data communication performs a data transmission protocol conversion function to connect a server and a user terminal, playing a different role than the existing gateway.

Most IoT devices communicate with mobile phones or gateways through wireless interfaces. Conventional gateways have lower computing power compared to existing PCs, laptops, smartphones, tablets, etc., and are highly likely to be destroyed by hacking attacks of the same level.

IoT devices, such as wristwatches, wearable devices for health, and CCTVs, have a lot of personal information, or if they are hacked for industrial use, a great disaster may occur. However, since it is not possible to make all of the enormous number of IoT devices that are incomparable to existing ones into high-performance devices such as PCs, laptops, smartphones, and tablets, gateways must take charge of a significant part of security performance, and research and development are being conducted on them.

In this regard, research and development of security technology related to the use of IoT is being conducted, but the development of the security control system of IoT is still insufficient.

Specifically, current encryption technologies can be largely divided into symmetric key technologies and asymmetric key technologies. Symmetric key technology has the advantage of having a short key length and fast execution time because the encryption key and the decryption key are the same, but the key must be delivered to the other party through the network, and in this process, it can be hacked. The asymmetric key technology has the advantage of avoiding the transfer of the private key to the other party through the network because the public key for encryption and the private key (or secret key) for decryption are different, but the key length is longer and the processing speed is slower than the symmetric key for the same performance.

In addition, among the existing asymmetric key technologies, the certificate-based public key infrastructure (PKI) depends on a third-party certification authority (CA) to link the public key and the identity of the entity, and when a party needs to authenticate through a certification authority (CA), it needs to support a large-capacity online authentication database (e.g., a lightweight directory access protocol (LDAP)-based authentication database) that initiates the circulation of a vast amount of network information. If a situation occurs in which security is vulnerable in a centralized certification authority (CA), it can become a single point of failure that negatively affects the security of the entire system.

In order to solve the problems of the certificate-based public key infrastructure (PKI), a security system applying Identity Based Cryptography (IBC), a new asymmetric key technology that uses the identity of an independent entity as a public key, selects and sets system parameters (SysParam, System Parameters) commonly applied to security systems in the initial setting stage of the private key generator (PKG, Private Key Generator), and creates a master secret key (MSK) to generate a private key It is safely stored and managed in the PKG, and the master public key (MPK) can be derived using the system parameter (SysParam) and the master private key (MSK).

In addition, the private key generator (PKG) configures public parameters (PubParam, Public Parameters), which are composed of system parameters (SysParam) and master public key (MPK) as components, and shares them with entities using the corresponding security system. In order to uniquely identify each entity, a pre-registered entity identifier (ID, Identifier), public parameters (PubParam), and master secret key (MSK) are used to generate a private (private key) (PRK) based on entity ID. and provide it safely to the object, and the object safely stores and manages the provided private key (PRK).

It is implemented so that any entity that obtains the entity ID and public parameter (PubParam) can derive the public key (PUK) based on the entity ID, so that the entity ID can be used as the public key (PUK) of the entity, and if the entity ID belonging to the identity information (identity) of a specific entity is used as the public key (PUK) instead, it has the advantage that a certificate from a third certificate authority (CA) is unnecessary, unlike the existing CA-based public key infrastructure (PKI). In particular, the communication bandwidth is narrow and In the Internet of Things, where it is important to maintain an appropriate level of security performance as the number of devices connected to personal area networks (PANs) with small transmission data packet units increases, the identity-based security scheme (IBC) is a desirable technology that can implement and apply simple key management and efficient security.

On the other hand, in a conventional identity-based encryption (IBC) system, a centralized private key generator (PKG) is required to generate a private key (PRK) of an arbitrary entity including a user terminal, an IoT device, and a gateway, and since the private key generator (PKG) generates the private key (PRK) of an arbitrary entity and knows the provided private key (PRK), all entities must have trust that the private key generator (PKG) will not misuse their private key (PRK). Therefore, the conventional identity-based security (IBC) system has a weakness similar to the single point of failure of the existing third-party certificate authority (CA)-based public key infrastructure (PKI).

In order to solve the centralization and single point of failure, which are the weaknesses of the conventional identity-based security (IBC) system, a blockchain-based identity-based security (IBC) system using distributed ledger technology is configured, and it is necessary to implement it in a manner that grants user-centric distributed authority to the private key generator (PKG) so that each entity directly generates a private key (PRK). In addition, if an arbitrary entity is an IoT device that cannot directly generate its own private key (PRK) due to constraints such as computational capacity and storage space, it needs to be delegated to another entity (eg, the owner of the IoT device) that is trusted.

On the other hand, the block chain technology applied to the conventional block chain-based identity-based security (IBC) system is a conventional block chain (PB, Physical Blockchain) technology in which a number of physical entities participate as nodes and are connected by a physical network such as the Internet. For example, in the case of an individual access control system such as a detached house or warehouse, if the number of nodes connected to the blockchain network is only one IoT gateway and one or several digital door locks, the anti-hacking effect of the blockchain is difficult to expect. Moreover, considering the characteristics of the access control system as a service that operates in real time or is sensitive to delay time, when the blockchain network connected to the IoT gateway fails or is unstable and communication is interrupted or delayed, if security functions such as consensus algorithm, verification, authentication, and authorization of digital signatures are not performed smoothly, failure situations such as inoperability of digital door locks or long delays may occur, which can be a serious obstacle to commercialization and spread.

The present invention, which has been devised to solve the above conventional problems, uses an identity-based security technique (IBC) based on a virtual blockchain (VB) formed by forming a plurality of virtual entities inside IoT devices and gateways to form virtual nodes and configuring a blockchain network between these virtual nodes to implement access control and communication security through authentication / authorization between IoT devices and IoT gateway parties without the intervention of a centralized third-party certificate authority (CA) or a centralized private key generator (PKG). The purpose is to provide a security construction system and method for a gateway for an IoT device using an identity-based security technique (IBC) based on a virtual block chain (VB) that can establish communication security and maximize information security by protecting IoT devices, gateways, and data from hacking threats.

Solving problems of the present invention are not limited to those mentioned above, and other solving problems not mentioned will be clearly understood by those skilled in the art from the following description.

A system for establishing security of a gateway using an identity-based security method based on a virtual block chain according to the present invention comprises: a wired/wireless communication module; A virtual block chain configuration unit configured to form at least one virtual node having attribute information including an identifier (ID) and private key information in the gateway, and to store and manage a transaction data block for which an agreement between the virtual nodes has been reached according to a predetermined consensus algorithm in the virtual node as a distributed ledger; A virtual blockchain network connected between the virtual node and neighboring virtual nodes through a network: and a digital electronic device using the identity-based security scheme, and a security module that performs security functions including access control through authentication and authorization.

In addition, in the security establishment method of a gateway using an identity-based security scheme based on a virtual blockchain according to the present invention, a private key generator (PKG) generates a public parameter (PubParam) formed by combining a system parameter (SysParam) and a master public key (MPK), and distributes the public parameter (PubParam) to a digital electronic device using the identity-based security scheme; registering, by the digital electronic device, a digital electronic device identifier (ID) in the form of a string in an ID registration server (IPS); The digital electronic device implemented with the virtual blockchain constitutes a transaction data block including the public parameter and the digital electronic device identifier, distributes it to virtual blockchain nodes, and determines whether the transaction data block is agreed according to a predetermined consensus algorithm; and distributing the transaction data block for which an agreement has been made to a digital electronic device implemented with the virtual block chain and storing it in a distributed ledger.

The security construction method of a gateway for an IoT device using an identity-based security technique based on a virtual block chain according to the present invention provides the following effects.

First, the present invention, which does not require a certificate issued by a centralized third-party certificate authority (CA), implements an identity-based security technique (IBC) based on a virtual blockchain, enabling fast and safe authentication and authorization between gateways and IoT device parties. Therefore, P2P decentralization is implemented. In particular, when user-centered distributed authority is granted to the private key generator (PKG), a device (e.g., digital door lock, IoT sensor, user smartphone, etc.) including a gateway and IoT devices owned (or managed) by the authorized user (or manager) private key (PRK) is generated by the user himself without relying on a third-party certificate authority (CA), and privately and safely stored and managed, thereby solving problems similar to the single point of failure of existing CA-based PKI.

Second, unlike a normal blockchain connected to an external physical communication network such as the Internet, the present invention quickly determines whether to approve a transaction when a fast-processing consensus algorithm (e.g., PBFT, PoA, policy-based algorithm, etc.) is applied between trusted virtual nodes connected to a virtual blockchain network implemented inside a gateway, so that problems such as inoperability or long delay due to failure or failure of a physical communication network such as the Internet do not occur, and real-time application systems such as IoT devices (e.g., digital door locks) and gateway-connected access control systems or time delays Blockchain technology can be effectively applied to security systems that are sensitive to

Third, the present invention applies the weather blockchain-based identity-based security (IBC) technique to both the gateway and the IoT device, so that access by unauthorized persons to low-spec, small, low-power, and low-cost IoT devices with low processing speed can be quickly and efficiently blocked in advance in conjunction with the gateway and prevent hacking.

Fourth, unlike conventional block chain technology, the present invention utilizes virtual block chain technology to ensure security that can prevent unauthorized access to a number of virtual nodes implemented inside, even when an independent gateway is operated alone without any physical entity connected to the external node. Therefore, a smart home gateway for a single house, a gateway for an access control system such as an office or warehouse, an unauthorized access control gateway for personal terminals (smartphones, tablets, smart locations, laptops, PCs, etc.), processing time delay is a problem It can be expanded and applied to various equipment that operates independently in environments where it is difficult to connect to a normal blockchain network, such as edge gateways such as self-driving cars, cloud gateways where data is concentrated, and military equipment used in wartime operations with poor communication.

Fifth, when building a dual blockchain-based IoT platform in which an IoT gateway with a built-in virtual blockchain is connected to a node of a normal blockchain network (mainnet) to which real entities are connected, when the normal blockchain network (mainnet) fails or an unstable situation is detected, the IoT gateway with built-in virtual blockchain switches to safe mode and uses the internal virtual blockchain network to block access by unauthorized persons and prevent hacking and privacy invasion through security services such as quick and safe authentication and authorization using the internal virtual blockchain network. .

The effects of the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a schematic diagram of a security establishment system of a gateway for IoT devices based on a virtual block chain according to an embodiment of the present invention;

2 is a diagram of a gateway implemented in a Docker container virtualization method based on a virtual block chain according to an embodiment of the present invention;

3 is a dual block chain platform structure in which a gateway equipped with a virtual block chain according to an embodiment of the present invention is connected to a normal block chain node;

4 is a flowchart of establishing gateway security for IoT devices using an identity-based security technique based on a virtual block chain according to an embodiment of the present invention;

5 is a master key generation procedure for establishing gateway security for IoT devices using an identity-based security technique based on a virtual block chain according to an embodiment of the present invention;

6 is a diagram of a connection request and verification procedure between an IoT device and a gateway using an identity-based security technique based on a virtual block chain according to an embodiment of the present invention; and

7 is a diagram illustrating a procedure for verifying an access request token of an IoT device in a gateway according to an embodiment of the present invention.

Additional objects, features and advantages of the present invention may be more clearly understood from the following detailed description and accompanying drawings.

Prior to the detailed description of the present invention, the present invention may make various changes and may have various embodiments, and the examples described below and shown in the drawings are not intended to limit the present invention to specific embodiments, It should be understood to include all changes, equivalents or substitutes included in the spirit and technical scope of the present invention.

Hereinafter, a security construction method of a gateway for an IoT device using an identity-based security technique based on a virtual block chain according to a preferred embodiment of the present invention and a security construction system for a gateway for an IoT device will be described in detail with reference to the accompanying drawings.

Hereinafter, the IoT device will be applied to a digital door lock and the personal area communication network (PAN) will be applied to BLE (Bluetooth Low Energy).

1 is a schematic diagram of a security establishment system of a gateway for an IoT device based on a virtual block chain according to an embodiment of the present invention.

As shown in FIG. 1, the system for establishing security of a gateway 100 using an identity-based security technique based on a virtual block chain according to the present invention largely includes a communication module 110; Virtual block chain configuration unit 120; virtual blockchain network 130; security module 140; and a data storage unit 150 .

The communication module 110 is provided in the gateway 100 and communicates with the IoT device 200 wired or wirelessly. Meanwhile, the communication module according to an embodiment of the present invention may support one or more of personal area network (PAN) communication protocols including BLE, Z-Wave, and Zigbee. In addition, the communication module according to another embodiment of the present invention may include one or more of Low Power Wide Area Network (LPWAN) communication protocols including LoRa, Sigfox, and NB-IoT. In addition, the communication module according to another embodiment of the present invention may include one or more of local area network (LAN) communication protocols including WiFi and Ethernet. Also, the communication module according to another embodiment of the present invention may include one or more of serial communication protocols including RS-232 and RS-485.

The virtual block chain configuration unit 120 forms a virtual node (software virtual node) for the IoT device 200 in the gateway 100, connects the virtual nodes through a P2P network to form a virtual block chain network 130, and forms a gateway identifier (ID_Gateway), gateway attribute information (Attributes_Gateway), IoT device identifier (ID_Device), IoT device attribute information (Attributes_Device), public parameters (PubParam), IoT device 200 At least one of data, event information, and user (accessor) information from ) is encrypted and stored and managed as a distributed ledger (virtual blockchain) in a virtual node of a virtual blockchain network.

On the other hand, the virtual block chain configuration unit 120 forms virtual nodes to satisfy predetermined requirements in common and connects them to a block chain network. Here, the predetermined requirements may include performing functions related to ID-based security (IBC) techniques, performing consensus algorithms, and storing blockchains in a distributed ledger.

Further, the virtual block chain configuration unit 120 may form a preset number (number) of virtual nodes and, if necessary, create and add a new virtual node or activate a deactivated virtual node to add a virtual node.

Illustratively, the virtual block chain configuration unit 120 may form a virtual block chain through a virtual machine (VM) method or a Docker container virtualization method in forming a virtual block chain. Preferably, it is formed by applying the Docker container virtualization method.

Specifically, the virtual block chain configuration unit 120 may implement a virtual block chain in a general virtual machine (VM) method using a hypervisor. This virtual machine method can be implemented by installing a hypervisor (software dedicated to virtualization) used in servers, PCs, desktops, embedded systems (e.g., smartphones, IoT gateways), and on top of it, a guest operating system (OS) is installed and virtualized for each application driving environment.

Or, in the virtual block chain configuration unit 120, the virtual block chain is a Docker container virtualization method in which Docker, a platform (software) for managing containers, is installed on the same host operating system (OS) in servers, PCs, desktops, embedded systems (eg, smartphones, IoT gateways), etc., and each isolated container is composed of an application program (eg, an App that supports a virtual block chain) and a running environment (eg, a virtualized operating system (OS) that shares a kernel with the host operating system (OS)). A virtual blockchain can be implemented. This Docker container virtualization method can be reduced in size by MB (megabytes), so the number (or number) of virtualized software nodes (virtual nodes) can be dramatically increased compared to virtual machines (VMs) implemented in one processing. It is preferable because it is light and fast because there is no separate operating system (OS) that requires booting in the container.

Meanwhile, the virtual block chain configuration unit 120 can be applied to a virtual block chain through any virtualization method other than the virtual machine method and the Docker container virtualization method.

The virtual block chain component 120 organizes transaction data that needs to be stored and shared in a distributed ledger in a virtual node, including the gateway ID (ID_G/W) and public parameter (PubParam) provided from the security module 140, into blocks, distributes the block to virtual nodes connected to the virtual block chain network 130 in the gateway 100, and when an agreement is reached according to a predetermined consensus algorithm, the block is shared among all virtual nodes connected to the virtual block chain network 130. It is distributed and stored and managed as a blockchain distributed ledger. Here, the consensus algorithm according to the present invention may include a protocol for proving the validity of a transaction constituting a block using any one of a token-based consensus protocol, a lightweight cryptographic consensus protocol, a variable cryptographic consensus protocol, and a policy-based consensus protocol, or a combination thereof.

The virtual blockchain network 130 may be formed in a manner in which a plurality of virtual nodes created through the virtual blockchain configuration unit 120 are connected through a P2P network. Here, the virtual node may be implemented by at least an application program that performs a predetermined consensus algorithm on a block composed of transaction data and a memory that stores and manages an agreed block as a distributed ledger. For example, the virtual blockchain network 130 is configured by forming

virtual nodes

131, 132, and 133 (a preset number of virtual nodes) in advance in the gateway 100, and adding virtual nodes 134 and 135 (additionally formed virtual nodes) when necessary, and connecting the preset virtual nodes and additional nodes to the virtual blockchain network.

The security module 140 is to perform security functions according to the blockchain-based identity-based security technique (IBC), and performs security functions such as authentication, authorization, digital signature, verification, encryption, and decryption with an identity-based security technique between the IoT device 200 and the gateway 100.

The security module 140 stores and manages the gateway private key (PRK_G/W), gateway ID (ID_G/W), and public parameter (PubParam), stores and manages the gateway ID (ID_G/W) and public parameter (PubParam) as a blockchain distribution ledger in all virtual nodes connected to the virtual blockchain network 130 in the corresponding gateway 100 according to a predetermined procedure, and provides them to the virtual blockchain configuration unit 120 so that they can be shared.

In addition, the security module 140 provides security services such as digital signature and verification, data encryption and decryption, and device access control using gateway ID (ID_G/W), gateway private key (PRK_G/W) and public parameter (PubParam).

The data storage unit 150 stores and manages data that does not need to be stored or is difficult to store in the distributed ledger of the virtual block chain and data that needs to be backed up among data stored in the distributed ledger.

Meanwhile, the gateway may be implemented in smart devices including smart phones, tablet computers, PCs, laptops, etc. having an interface supporting some or all of communication protocols including personal area network (PAN), low power wide area network (LPWAN), WiFi, and Ethernet.

2 is a block diagram of a gateway implemented in a Docker container virtualization method based on a virtual blockchain according to an embodiment of the present invention. The gateway 100 implemented in the Docker container virtualization method executes a predetermined consensus algorithm on a transaction data block as a virtual node connected to the virtual blockchain network 130 through App (A, B, C, D, E, F) included in each container, and stores and manages the agreed block as a distributed ledger.

Figure 3 is a dual block chain platform structure diagram in which a gateway equipped with a virtual block chain according to an embodiment of the present invention is connected to a normal block chain node.

According to an embodiment of the present invention, in an individual house equipped with a smart home system, IoT devices such as digital door locks, wall pads, and home appliances are connected through a personal area network (PAN: BLE, Z-Wave, Zigbee, etc.), and a user's smartphone, etc. are connected to a LAN (e.g., WiFi). In the case of an apartment complex in which a virtual block chain is embedded and implemented, and a plurality of home gateways implemented with the virtual block chain are connected to a node of a normal block chain network (mainnet), it can be based on a double block chain. .

A virtual blockchain can be formed by applying a virtual machine (VM) or Docker container-type virtualization technology inside a cloud, fog, edge, server, PC, desktop, or embedded device (smartphone, tablet computer, IoT gateway, etc.) to form multiple virtual nodes and connect the virtual nodes through a P2P network.

A normal blockchain is made in such a way that each node (usual node) participating in a transaction, such as a gateway, PC, or smartphone, is connected to the Internet (P2P network), confirms each other's transaction details between the nodes, encrypts the ledger, and makes it into a block to chain (blockchainization) to make data hacking impossible.

Such a normal block chain has the following problems.

First, it cannot be used in remote areas where the Internet is broken or there is no Internet. Second, it takes a lot of time to make a transaction or you have to keep all the transaction details of others. Third, even though it is encrypted, there are limitations such as the possibility that numerous other people keep and view personal information.

In contrast, in the present invention, the virtual block chain is implemented in a software method (possible node) in each device, so that even if the Internet is not present or broken, the security characteristics of the block chain can still be utilized, and authentication/authorization of IoT devices accessing the gateway. It is also possible to solve problems such as transaction time, memory, personal information sharing, etc.

According to one embodiment of the present invention, in the initial setting stage of the security system, the private key generator (PKG) selects and sets the system parameter (SysParam) to be applied to the security system, generates the master secret key (MSK) based on the random secret parameter (SecParam), and derives the master public key (MPK) using the preset system parameter (SysParam) and the master secret key (MSK). Next, the private key generator (PKG) generates an ID-based gateway private key (PRK_G/W) according to a predetermined private key generation algorithm using a public parameter (PubParam) and a master secret key (MSK) formed by combining a preset system parameter (SysParam) and a master public key (MPK) as components, and a gateway ID (ID_G/W) registered by a user (gateway owner or manager) according to a predetermined private key generation algorithm and provides the gateway with the generated key. The gateway private key (PRK_G/W) is stored in the security module 140 together with the gateway ID (ID_G/W) and public parameter (PubParam).

4 is a flowchart of security construction of a gateway for IoT devices using an identity-based security technique based on a virtual block chain according to the present invention, and a security construction method is as follows.

The private key generator (PKG) sets a system parameter (SysParam) to be applied for security calculation, including selecting a predetermined security system or function from a set of security systems or functions or a set of techniques in the mathematical domain (S410). Here, according to one embodiment of the present invention, the private key generator (PKG) may be mounted in the server. In addition, according to another embodiment of the present invention, when user (or administrator)-centered distributed authority is granted, the private key generator (PKG) can be installed in an administrator terminal (eg, smartphone, PC, etc.).

The private key generator (PKG) generates a master secret key (MSK) according to a predetermined master secret key generation algorithm, and derives a master public key (MPK) using the master secret key (MSK) and a system parameter (SysParam) (S420).

The private key generator (PKG) generates a public parameter (PubParam) formed by combining the system parameter (SysParam) and the master public key (MPK), and distributes the public parameter (PubParam) to digital electronic devices using the identity-based security scheme (IBC) according to the present invention (S430). Here, the digital electronic device should be understood as a concept including cloud, fog, edge, server, PC, desktop, embedded device (smartphone, tablet computer, etc.), IoT device, and gateway using identity-based security (IBC) service. In addition, the private key generator (PKG) can be distributed by storing and notifying so that the public parameters can be safely downloaded from a server equipped to provide the public parameters through a secure communication network.

The digital electronic device registers an identifier (ID) in the form of a string that can uniquely identify itself with the ID registration server (IPS) (S440). Here, the ID registration server (IPS) may be implemented in a manner integrated with the private key generator (PKG).

The private key generator (PKG) generates and provides an ID-based private key (PRK) for the corresponding digital electronic device according to a predetermined private key generation algorithm, and the security module 140 of the digital electronic device stores the ID-based private key (PRK) (S450). Here, a predetermined private key generation algorithm is determined using a master secret key (MSK), a digital electronic device identifier (ID), and a public parameter (PubParam).

Access control is performed between digital electronic devices by requesting and verifying access to each other using the identifier (ID), public parameter (PubParam), and ID-based digital electronic device private key (PRK) of the digital electronic device. For example, the IoT device 200 requests access by sending an access request message to the gateway 100, and the gateway 100 performs verification (S460).

The digital electronic device in which the virtual blockchain is implemented configures the transaction data block and distributes it to the virtual blockchain node to determine whether the transaction data block is agreed upon through a predetermined consensus algorithm (S470). Here, the transaction data block includes at least one of a digital electronic device identifier (ID), a public parameter (PubParam), event-related information such as distribution and storage of the corresponding public parameter, and event-related information including access control between an IoT device and a gateway.

When an agreement is reached on the transaction data block, the transaction data block with the agreement is stored and shared in the distributed ledger of the virtual node in the virtual blockchain network (S480).

Meanwhile, according to an embodiment of the present invention, when the digital electronic device is an IoT device, the connected digital electronic device may be a gateway. Also, according to another embodiment of the present invention, when the digital electronic device is a gateway, the connected digital electronic device may be an IoT device. Also, according to another embodiment of the present invention, when the digital electronic device is an IoT device, the connected digital electronic device may be an IoT device.

Here, the target to which the private key generator (PKG) provides the public parameters and private key is any digital electronic device using an identity-based security technique (IBC) regardless of whether a virtual block chain is implemented, and the target to which the transaction data block is distributed to the virtual node is a digital electronic device implemented with a virtual block chain.

5 is a master key generation procedure diagram for building gateway security for IoT devices using an identity-based security technique based on a virtual block chain according to an embodiment of the present invention, in which the master key generation step (S420) is as follows.

The private key generator (PKG) generates a random random number and sets it as a secret parameter (SecParam) (S421).

The private key generator (PKG) generates a master secret key (MSK) according to a predetermined algorithm based on the secret parameter (SecParam) (S422).

The private key generator (PKG) derives the master public key (MPK) using the master private key (MSK) and a predetermined system parameter (SysParam) (S423).

The private key generator (PKG) stores the public parameter (PubParam) and the master secret key (MSK) formed by combining the system parameter (SysParam) and the master public key (MPK) in the security module (140, SecM) (S424).

6 is a diagram of a connection request and verification procedure between an IoT device and a gateway using an identity-based security technique based on a virtual block chain according to an embodiment of the present invention, and a device access control step 460 according to an embodiment of the present invention. Step 460 is as follows.

The IoT device 200 generates a random secret number 1 (RS1) for composing an access request message to access the gateway 100 (S461).

The IoT device 200 signs the random secret number 1 (RS1) with its IoT device private key (PRK_IoT) (S462).

The IoT device 200 constructs an access request message with random secret number 1 (RS1), IoT device identifier (ID_IoT), and IoT device signature (IoT Sign.), encrypts the access request message according to a predetermined algorithm using the gateway identifier (ID_G/W) and a pre-shared public parameter (PubParam) (S463), and transmits the encrypted access request message to the gateway 100 (S463). 464).

Upon receiving the encrypted access request message, the gateway 100 decrypts and verifies the encrypted access request message (S465). Specifically, the gateway 100 decrypts the encrypted access request message using its private key (PRK_G/W), and compares the decrypted result of the IoT device signature (IoT Sign.) with the random secret number 1 (RS1) using the IoT device identifier (ID_IoT) constituting the decrypted access request message. If the decrypted result value (Decrypted Result) and the random secret number 1 (RS1) match, the IoT device 200 is authenticated, and if the decrypted result value (Decrypted Result) and the random secret number 1 (RS1) do not match, authentication is rejected.

If the connection request from the IoT device passes verification, the gateway 100 generates a separate random secret number 2 (RS2) (S466) and signs the random secret number 2 (RS2) with its own private key (PRK_G/W) (S467).

Thereafter, the gateway 100 constructs a verification result message with the random secret number 2 (RS2), the gateway identifier (ID_G/W), and the gateway signature (G/W Sign.), and encrypts the verification result message (Verification Result Message) according to a predetermined algorithm using the IoT device identifier (ID_IoT) and the public parameter (PubParam) shared in advance (S468).

The gateway 100 transmits an encrypted verification result message to the IoT device 200 (S469).

If the connection request from the IoT device does not pass verification, the gateway 100 constructs a Verification Result Message notifying verification failure (S468), encrypts the Verification Result Message according to a predetermined algorithm using the IoT device identifier (ID_IoT) and a pre-shared public parameter (PubParam), and transmits the encrypted verification result message to the IoT device 200 (S469 ).

Thereafter, the IoT device 200 verifies the digital signature of the gateway 100 according to the same procedure as above, so that both parties can be authenticated between the gateway and the IoT device.

7 is a procedure diagram for transmitting an access request token including a time-varying parameter (TVP) of an IoT device and verifying the access request token of an IoT device at a gateway according to an embodiment of the present invention. The protocol for verifying the access request token of the IoT device received by the gateway is described step by step. Here, the access request token is used when the IoT device accesses the gateway using an identity-based security technique and transmits to share a random secret number for generating a secret key (SecKey) for encryption, decryption, and authentication of messages exchanged thereafter.

The IoT device 200 generates a random secret number (RS) of a required length (S501).

The IoT device 200 generates an IoT device signature by signing the random secret number (RS) according to a predetermined Identity Based Signature (IBS) algorithm using the IoT device private key (PRK_IoT) (S502).

The IoT device 200 generates a transmission token (KTA, Knowledge To Action) in which a random secret number (RS), an IoT device signature, an IoT device identifier (ID_IoT), a time-variant parameter (TVP) (eg, a time stamp or sequence number, etc.), and predetermined string information 2 (Text2) are combined (S503). Here, the connection request token (KTA) may be formed by sequentially combining a random secret number (RS), an IoT device signature, an IoT device identifier (ID_IoT), a time-varying parameter (TVP), and predetermined string information 2 (Text2).

The IoT device 200 encrypts the access request token (KTA) using the counterpart gateway identifier (ID_G/W) and the public parameter (PubParam), and transmits the encrypted access request token (Encrypted KTA) to the gateway 100 (S504).

After receiving the encrypted access request token (Encrypted KTA), the gateway 100 decrypts it using its own private key (PRK_G/W) (S505).

The gateway 100 determines the validity of the time-varying parameter (TVP) of the access request token (KTA) and rejects the access request token if it is not valid (S506). Specifically, according to one embodiment of the present invention, if the time-varying parameter (TVP) included in the access request token (KTA) is a time stamp, it is determined whether or not it is within a valid time range, and if it is out of range, the token (KTA) can be rejected. In addition, according to another embodiment of the present invention, if the IoT device ID (ID_IoT) can be obtained by other means and the time-varying parameter (TVP) included in the connection request token (KTA) is a sequence number, the gateway 100 If it is not larger than the sequence number, the token can be rejected.

If the IoT device ID (ID_IoT) can be obtained by other means, the gateway 100 verifies the validity of the signature (Sign.) included in the access request token according to a predefined verification protocol using the IoT device ID (ID_IoT) and the public parameter (PubParam). If the signature is not valid, the access request token (KTA) is rejected (S507).

The gateway 100 verifies the recency of the time-varying parameter (TVP) included in the access request token (KTA) (S508). Specifically, when the TVP is a sequence number, the signature is verified if the TVP is the latest number, and the access request token (KTA) is rejected if the TVP is not the latest number (S508).

If all of the verification steps are passed, the gateway 100 generates a secret key (SecKey) for encryption, decryption, and message authentication according to a key derivation function (KDF) determined in advance using the random secret number (RS) (S509).

As described above, according to the security construction method of a gateway for an IoT device using an identity-based security technique based on a virtual block chain and the security construction of a gateway for an IoT device using an identity-based security technique based on a virtual block chain according to the present invention, it is possible to implement communication security for an IoT device in which software for securing various security cannot be built by enabling encrypted communication between the gateway and the IoT device. It is possible to protect IoT devices and data from hacking threats in ID registration, data and user access control and management of IoT devices, and security enhancement, one of the unique characteristics of blockchain, can be applied to IoT devices. It has the advantage of being able to protect users and information from the ever-increasing threat of hacking.

Although the embodiments as described above have been described with limited drawings, those skilled in the art can apply various technical modifications and variations based on the above. For example, even if the described techniques are performed in an order different from the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or replaced or substituted by other components or equivalents, appropriate results can be achieved.

The embodiments described in this specification and the accompanying drawings merely illustrate some of the technical ideas included in the present invention by way of example. Therefore, since the embodiments disclosed in this specification are not intended to limit the technical idea of the present invention but to explain it, it is obvious that the scope of the technical idea of the present invention is not limited by these embodiments. All modified examples and specific examples that can be easily inferred by those skilled in the art within the scope of the technical idea included in the specification and drawings of the present invention should be construed as being included in the scope of the present invention.

Claims

In the security establishment system of a gateway using an identity-based security technique based on a virtual block chain,

wired/wireless communication module;

A virtual block chain configuration unit configured to form at least one virtual node having attribute information including an identifier (ID) and private key information in the gateway, and to store and manage a transaction data block for which an agreement between the virtual nodes has been reached according to a predetermined consensus algorithm in the virtual node as a distributed ledger;

A virtual blockchain network connected by a network between the virtual node and neighboring virtual nodes: and

A security module that performs security functions including access control through digital electronic devices and authentication and authorization using the identity-based security scheme.

Gateway security construction system using an identity-based security technique based on a virtual block chain that includes.
The method of claim 1,

The security module stores a gateway private key (PRK_GW), a public parameter (PubParam), and a gateway identifier (ID) provided from a private key generator,

The private key generator sets a system parameter (SysParam) to be applied for security calculation, derives a master public key (MPK) using a predetermined master secret key (MSK) and the system parameter (SysParam), generates a public parameter (PubParam) formed by combining the system parameter (SysParam) and the master public key (MPK), and transmits the public parameter (PubParam) to a digital electronic device using an identity-based security technique based on the virtual block chain network. Distributing, generating and providing a private key (PRK) based on an identifier (ID) for the digital electronic device

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method according to claim 2, wherein the digital electronic device,

Constructing a transaction data block including an identifier (ID) of the digital electronic device and the public parameter (PubParam) and distributing it to the virtual node;

Determining whether to agree on the transaction data block according to a consensus algorithm determined for the transaction data block distributed to the virtual node, and storing the transaction data block in a distributed ledger of the virtual node.

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method according to claim 3, wherein the digital electronic device,

Using the identifier (ID) of the corresponding digital electronic device and the digital electronic device private key (PRK) based on the identifier (ID), access control is performed on interconnected devices through mutual access request and verification,

The device access control is a security construction system of a gateway using an identity-based security technique based on a virtual block chain, characterized in that generated using the identifier of the connected digital electronic device, a public parameter, and its own private key.
The method according to claim 2, wherein the private key generator,

Ability to generate random random numbers and set them as secret parameters;

a function of generating a master secret key based on the secret parameter;

a function of deriving a master public key using the master private key and predetermined system parameters; and

A function of storing a public parameter obtained by combining the system parameter and the master public key and the master private key in the security module

Gateway security construction system using an identity-based security technique based on a virtual block chain that performs
The method of claim 3,

The digital electronic device generates a random secret number 1, signs the random secret number 1 with its own private key to generate a digital electronic device signature, constructs the access request message using the random secret number 1, the digital electronic device identifier, and the digital electronic device signature, encrypts it using the identifier (ID) of the connected digital electronic device and public parameters, and transmits the encrypted access request message to the connected digital electronic device;

The connected digital electronic device decrypts the encrypted access request message using its own private key and compares the result of decrypting the digital electronic device signature using the digital electronic device identifier constituting the decrypted access request message with the random secret number 1 to verify authentication

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method of claim 6,

If the verification passes, the connected digital electronic device generates a random secret number 2, signs the random secret number 2 with its own private key to generate a connected digital electronic device signature, configures a verification result message with the random secret number 2, a gateway identifier, and a connected digital electronic device signature, and encrypts and transmits the message using the digital electronic device identifier and public parameters.

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method according to claim 2, wherein the digital electronic device,

Signing a transmission message using its private key to generate a digital electronic device signature, generating an access request token using the transmission message, digital electronic device signature, digital electronic device identifier, and time-varying parameters, encrypting using the identifier of the connected digital electronic device and public parameters, and transmitting the encrypted access request token to the connected digital electronic device.

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method according to claim 8, wherein the connected digital electronic device,

Decrypting the encrypted access request token using its own private key;

determining validity of a time-varying parameter of the access request token;

verifying the validity of the digital electronic device signature of the access request token;

verifying recency of a time-varying parameter of the access request token;

Gateway security construction system using an identity-based security technique based on a virtual block chain.
The method of claim 1,

The communication module supports at least one of personal area network (PAN) communication protocols including BLE, Z-Wave, and Zigbee, or includes at least one of low power wide area network (LPWAN) communication protocols including LoRa, Sigfox, and NB-IoT, or includes WiFi and Ethernet. At least one of local area network (LAN) communication protocols, or at least one of serial communication protocols including RS-232 and RS-485 Gateway security construction system using an identity-based security technique based on a virtual block chain.
In the security construction method of a gateway using a virtual blockchain-based identity-based security technique,

A private key generator (PKG) generates a public parameter (PubParam) formed by combining a system parameter (SysParam) and a master public key (MPK), and distributes the public parameter (PubParam) to a digital electronic device using the identity-based security scheme;

registering, by the digital electronic device, a digital electronic device identifier (ID) in the form of a string in an ID registration server (IPS);

The digital electronic device implemented with the virtual blockchain constitutes a transaction data block including the public parameter and the digital electronic device identifier, distributes it to virtual blockchain nodes, and determines whether the transaction data block is agreed according to a predetermined consensus algorithm; and

distributing the transaction data block for which an agreement has been made to a digital electronic device implemented with the virtual block chain and storing it as a distributed ledger

Gateway security construction method using a virtual blockchain-based identity-based security technique comprising a.
The method of claim 11,

The digital electronic device further performs a device access control step,

The device access control step,

the digital electronic device generating a random secret number 1, signing the random secret number 1 with its own private key to generate a digital electronic device signature, constructing the access request message with the random secret number 1, the digital electronic device identifier, and the digital electronic device signature, encrypting the access request message using the identifier of the connected digital electronic device and public parameters, and transmitting the encrypted access request message; and

The connected digital electronic device decrypts the encrypted access request message using its own private key, and compares the result of decrypting the digital electronic device signature using the digital electronic device identifier and public parameters constituting the decrypted access request message with the random secret number 1 to verify authentication.

Gateway security construction method using a virtual blockchain-based identity-based security technique comprising a.
The method of claim 12,

If the verification passes, the connected digital electronic device generates a random secret number 2, signs the random secret number 2 with its own private key to generate a connected digital electronic device signature, constructs a verification result message with the random secret number 2, the connected digital electronic device identifier, and the connected digital electronic device signature, encrypts it using the digital electronic device identifier and public parameters, and transmits the encrypted verification result message to the digital electronic device.

Gateway security construction method using a virtual blockchain-based identity-based security technique further comprising a.
The method according to claim 12, wherein the digital electronic device,

Signing a specific transmission message with its own private key (PRK) to generate a digital electronic device signature, generating an access request token using the transmission message, digital electronic device signature, and a time-varying parameter (TVP), encrypting the access request token using an identifier of the connected digital electronic device and the public parameter, and transmitting the access request token to the connected digital electronic device.

Gateway security construction method using a virtual blockchain-based identity-based security technique further comprising a.
The method according to claim 14, wherein the connected digital electronic device,

Receiving the encrypted access request token and decrypting it with its own private key, determining validity of a time-varying parameter of the access request token, verifying validity of a digital electronic device signature of the access request token, and verifying recency of the time-varying parameter of the access request token.