KR101839048B1 - End-to-End Security Platform of Internet of Things - Google Patents

Abstract

The object Internet apparatus according to the present invention comprises: Security information including the security attribute value, key information, and identifier information issued in consideration of security association based on the physical and online separated security element issuing device and hardware security module (HSM) of the Internet server of the object, A security element (SE) in the form of a hardware security module that performs a decryption function; A lightweight cryptographic module that decrypts the session key of the object Internet user terminal encrypted and transmitted from the object Internet gateway using the object Internet device session key, and provides a transmission interval encryption and decryption function; A lightweight cryptographic module and a middle layer for providing an interface between the security element and the object Internet software security module; Software security module Self-verification, parsing of security policy and security message, invocation of encryption and decryption of lightweight cryptographic module using application program interface module Upper layer object performing security function call of security function Module.

Description

End-to-End Security Platform of Internet of Things [

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an end-to-end security platform for the Internet of Things, and more particularly to a security platform with improved security and improved processing performance as compared to a security protocol according to the prior art.

OneM2M, an international standard organization for the Internet, specifies that the Internet service environment for objects should be divided into a domain of objects, a domain of objects, a domain of objects, and a domain of objects.

oneM2M recommends configuring a secure channel in each section through SSL, TLS and DTLS based on identifiers, certificates, sensitive data, security association information, etc. in the four domains and encrypting and transmitting the message.

However, the following security vulnerabilities exist in this method.

First, if DTLS and SSL / TSL transmission interval security protocols are used in each section, information received in each domain must be decrypted and re-encrypted before being transmitted.

Second, in case of using SSL / TSL and DTLS transmission interval security protocol, security processing must be performed with a PKI structure that requires a trusted authority (CA) in order to guarantee mutual authentication. have.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a security platform for an object Internet environment that solves the above problems.

The object Internet apparatus according to the present invention comprises: Security information including the security attribute value, key information, and identifier information issued in consideration of security association based on the physical and online separated security element issuing device and hardware security module (HSM) of the Internet server of the object, A security element (SE) in the form of a hardware security module that performs a decryption function; A lightweight cryptographic module that decrypts the session key of the object Internet user terminal encrypted and transmitted from the object Internet gateway using the object Internet device session key, and provides a transmission interval encryption and decryption function; A lightweight cryptographic module and a middle layer for providing an interface between the security element and the object Internet software security module; Software security module Self-verification, parsing of security policy and security message, invocation of encryption and decryption of lightweight cryptographic module using application program interface module Upper layer object performing security function call of security function Module.
The object Internet gateway according to the present invention includes a security attribute value, a key information, an identifier information, a security attribute value, and a security attribute value in consideration of security association based on a security element issue device and a hardware security module (HSM) A security element (SE) in the form of a hardware security module that includes at least a security protocol and encryption and decryption functions; A lightweight cryptographic module that provides a function of encrypting and decrypting session key data of the object Internet user terminal in a transmission interval using the object Internet gateway session key; A lightweight cryptographic module and a middle layer for providing an interface between the security element and the object Internet software security module; A software security module self-verification, a high-level Internet software security module, which performs a security protocol calling function of a security element and an encryption / decryption calling function of a lightweight cryptographic module using an application program interface module, .
The object Internet user terminal according to the present invention includes a security attribute value, key information, an identifier (ID), a security attribute value, and a security attribute value in consideration of security association based on a security element issue device and a hardware security module (HSM) A security element (SE) in the form of a hardware security module that includes at least information and performs security protocol and encryption and decryption functions; A lightweight cryptographic module which is a lower layer that provides encryption and decryption functions for a transmission interval using the session key of the object Internet user terminal; A lightweight cryptographic module and a middle layer for providing an interface between the security element and the object Internet software security module; A software security module self-verification, a high-level Internet software security module for parsing a security policy and a security message, performing an encryption / decryption function call of the lightweight cryptographic module and a security protocol calling function of the security element using an application program interface module .
The object Internet server according to the present invention comprises: a lightweight cryptographic module which is a lower layer that provides a function of encrypting and decrypting session key data of a object Internet user terminal in a transmission interval using a session key of a object Internet server; A middle layer that provides an interface between the lightweight cryptographic module and the object Internet software security module; Software security module Self-verification, security policy and security message parsing, application program interface module to encrypt and decrypt the lightweight cryptographic module, physical and online separation of security elements and hardware security module (HSM) A mutual security association, and a high-level Internet software security module that performs security protocol functions.
A security information generation method according to the present invention is a security information generation method in which a thing Internet server issues a security element to a security element issuing device which is physically and electronically separated from each of the object internet devices, the object internet gateway, and the object internet user terminal A first step of requesting that The secure element issuing device issues the security attribute value, the key information and the identifier information generated for each of the object Internet device, the object Internet gateway, and the object Internet user terminal to the security element (SE) ; The object Internet server includes a third step of storing the security attribute value and the identifier information in a database of the object Internet server and storing the key information in a separate server-side hardware security module (HSM).

According to the present invention, it is possible to store and manage the security attribute value, the key, the identifier information, and the like in the security element in the form of a hardware security module ensuring security in the Internet user terminal device of the object, It is easy to do. And the problem of performance degradation of the object Internet service processing, which occurs in the prior art requiring a trusted additional certification authority (CA), is resolved.

In addition, when the security element issuing device issues security elements, it pre-processes key security information such as security attribute value based on cryptographic operation considering security association, key generation and identifier generation, and injects it into a security element as a hardware security module, .

Furthermore, after the authentication process and the key synchronization process for each domain (object Internet device / gateway / server / user terminal) are performed, the control message information of the object Internet device is encrypted by the session key of the object Internet user terminal, The object Internet device processes the decryption and control message using the user terminal session key and then encrypts the processing result with the user terminal session key to bypass the object Internet gateway and the object internet server, And the control result message finally transmitted by the session key of the object Internet user terminal is decrypted, thereby improving the processing performance.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram illustrating a security module stack structure for each domain of a security platform according to the present invention; FIG.
2 is a diagram illustrating an overview of a security platform according to the present invention;

Hereinafter, the present invention will be described in detail.

Encryption / decryption may be applied to the information (data) transmission process performed in the present specification, and expressions describing the process of transmitting information (data) in the present specification and claims are not limited to encryption / decryption Should be construed as including. Expressions of the form "transfer from A to B" or "receive from A" in this specification include transmission (transfer) or reception of another medium in between, It does not just represent transmission (forwarding) or receiving. In the description of the present invention, the order of each step should be understood to be non-limiting, unless the preceding step must be performed logically and temporally before the next step. That is to say, except for the exceptional cases mentioned above, even if the process described in the following stage is carried out before the process described in the preceding stage, the nature of the invention is not affected and the scope of the right should be defined regardless of the order of the stages. &Quot; A " or " B " is defined herein to mean not only selectively pointing to either A or B, but also including both A and B. It is also to be understood that the term "comprising " is intended to encompass further including other elements in addition to the elements listed as being included.

As used herein, the term "module" refers to a logical combination of general purpose hardware and software that performs its functions.

FIG. 1 shows a security module stack structure for each domain of a security platform according to the present invention, and FIG. 2 shows an example of a security platform environment according to the present invention.

1 and 2 show an example of a security platform environment according to the present invention.

As shown in FIG. 2, the security platform environment according to the present invention includes the object Internet device 10, the object Internet gateway 20, the object Internet server 30, and the object Internet user terminal 40. The object Internet user terminal 40 may be any device capable of data communication such as a smart phone or a PC and capable of electronic computation.

Each component includes application modules 11, 21, 31, 41 and object Internet security modules 12, 22, 32, 42.

Specific security attributes to be installed in the object Internet security modules 12, 22 and 42 may be different, but the basic structure is the same, and therefore only the security module 12 of the object Internet device 10 will be described.

1, the security module 12 of the Internet device 10 includes a security element 121 for storing and managing a security protocol and an encryption function, a security attribute value, a key and an identifier information, A core API module 123 for providing an interface between the security element 121 and the lightweight cryptographic module 121 and a core API module 123 for performing software self-verification and security And an object Internet software security module 124 that performs parsing / encryption / decryption of security and policy messages.

Next, a method in which the object Internet server 30 generates security information will be described.

The object Internet server 30 requests the security element issuing device 50 to issue a security element to each of the object Internet device 10 and the object Internet user terminal 40 used in the object Internet environment. The security element issuing device 50 generates security attributes, keys, and identifier information for each of the object Internet device 10, the object Internet gateway 20 and the object Internet user terminal 40, And is transmitted to the object Internet server 30. The object Internet server 30 stores the security attribute and the identifier information in the database of the object Internet server 30, and stores the key information in a separate hardware security module (HSM).

The security element issued by the security element issuing device 50 is transmitted to the object Internet device 10 and the object Internet user terminal 40 and the object Internet gateway 20 in the object Internet server 30 and the hardware security module Secure elements (SEs) and secure information.

After the authentication process and the key synchronization process are performed for each domain (object Internet device / gateway / server / user terminal), control message information of the object Internet device is encrypted by the session key of the object Internet user terminal, The object Internet device processes the decryption and control message using the user terminal session key and then encrypts the processing result with the user terminal session key to bypass the object Internet gateway and the object internet server, And decrypts the control result message finally transmitted by the session key of the object Internet user terminal.

The security element issuing device 50 is a device that is physically and electronically separated from the object Internet device 10, the object Internet gateway 20, and the object Internet user terminal 40.

The security element issued by the security element issuing device 50 is mounted on a security card or a security chip as a hardware type and the security elements 121, 221 and 421 are connected to the object Internet device 10, 20, a manufacturer of the object Internet user terminal 40, and the like, and is installed in each device.

When the object Internet user terminal 40 registers the object Internet service in the object internet server 30 and requests the service, mutual authentication is performed between the devices of the object internet user terminal 40 and the object Internet server 30 After configuring the secure channel, log in via ID / password or biometric authentication. Then, the control target object Internet device is selected and the control command is securely transmitted to the secure channel.

Subsequently, the object Internet server 30 performs mutual authentication between the security modules of the object Internet server 30 and the object internet gateway 20, and transmits the service requested by the object Internet user terminal 40 to the secure channel securely do.

Then, the object Internet gateway 20 mutually authenticates mutual authentication between the security modules of the object Internet gateway 20 and the object Internet apparatus 10, forms a secure channel, and transmits the control message to the secure channel securely.

The object Internet apparatus 10 decrypts the requested control message to control the apparatus and transmits the control result message in the reverse order of the above process.

While the present invention has been described with reference to the accompanying drawings, it is to be understood that the scope of the present invention is defined by the claims that follow, and should not be construed as limited to the above-described embodiments and / or drawings. It is to be expressly understood that improvements, changes and modifications that are obvious to those skilled in the art are also within the scope of the present invention as set forth in the claims.

10: Things Internet Devices
20: Things Internet gateway
30: Things Internet server
40: Things Internet user terminal

Claims (5)

An object Internet apparatus for use in an environment including an object Internet apparatus, an object Internet gateway, a object Internet server, and a destination Internet user terminal,
Security information including the security attribute value, key information, and identifier information issued in consideration of security association based on the physical and online separated security element issuing device and hardware security module (HSM) of the Internet server of the object, A security element SE in the form of a hardware security module that performs a decryption function,
A lightweight cryptographic module that decrypts the session key of the object Internet user terminal encrypted and transmitted from the object Internet gateway using the object Internet device session key and provides a transmission interval encryption and decryption function;
A lightweight cryptographic module and an application program interface module as a middle layer for providing an interface between the security element and the object Internet software security module,
Software security module Self-verification, parsing of security policy and security message, invocation of encryption and decryption of lightweight cryptographic module using application program interface module Upper layer object performing security function call of security function Module,
Things Internet Devices.
An object Internet gateway for use in an environment including an object Internet device, an object Internet gateway, an object Internet server, and an object Internet user terminal,
Security information including the security attribute value, key information, and identifier information issued in consideration of security association based on the physical and online separated security element issuing device and hardware security module (HSM) of the Internet server of the object, A security element SE in the form of a hardware security module that performs a decryption function,
A lightweight cryptographic module that provides a function of encrypting and decrypting the session key data of the object Internet user terminal in the transmission interval using the object Internet gateway session key,
A lightweight cryptographic module and an application program interface module as a middle layer for providing an interface between the security element and the object Internet software security module,
A software security module self-verification, a high-level Internet software security module, which performs a security protocol calling function of a security element and an encryption / decryption calling function of a lightweight cryptographic module using an application program interface module, / RTI >
Things Internet gateway.
An object user terminal for use in an environment including an object Internet device, an object Internet gateway, a object Internet server, and a object Internet user terminal,
Security information including the security attribute value, key information, and identifier information issued in consideration of security association based on the physical and online separated security element issuing device and hardware security module (HSM) of the Internet server of the object, A security element SE in the form of a hardware security module that performs a decryption function,
A lightweight cryptographic module that is a lower layer that provides encryption and decryption functions for a transmission interval using the session key of the object Internet user terminal,
A lightweight cryptographic module and an application program interface module as a middle layer for providing an interface between the security element and the object Internet software security module,
A software security module self-verification, a high-level Internet software security module for parsing a security policy and a security message, performing an encryption / decryption function call of the lightweight cryptographic module and a security protocol calling function of the security element using an application program interface module / RTI >
Objects Internet user terminal.
An object Internet server in an environment including a object Internet device, an object Internet gateway, a object Internet server, and an object Internet user terminal,
A lightweight cryptographic module that provides a function of encrypting and decrypting session key data of the object Internet user terminal in a transmission interval using the session key of the object Internet server;
An application program interface module as a middle layer for providing an interface between the lightweight cryptographic module and the object Internet software security module,
Software security module Self-verification, security policy and security message parsing, application program interface module to encrypt and decrypt the lightweight cryptographic module, physical and online separation of security elements and hardware security module (HSM) A high-level Internet software security module that performs mutual security interworking and security protocol functions,
Things Internet server.
A method for generating security information for each object Internet device, a destination Internet gateway, and a destination Internet user terminal,
A first step of requesting the object Internet server to issue a security element to a security element issuing device which is separate from the object internet device, the object internet gateway and the object internet user terminal physically and online,
The secure element issuing device issues the security attribute value, the key information and the identifier information generated for each of the object Internet device, the object Internet gateway, and the object Internet user terminal to the security element (SE) Step,
A third step of the object Internet server storing the security attribute value and the identifier information in a database of the object Internet server and storing the key information in a separate server-side hardware security module (HSM)
How to generate security information.

Images