KR102234210B1 - Security method for ethernet based network - Google Patents

Abstract

A security method for an Ethernet-based network is disclosed. The first communication node operation method includes: performing an authentication procedure with at least one communication node connected to the first communication node, generating a table including identification information of the authenticated communication node, and authenticating the identification information. It may include transmitting to the node. Accordingly, the performance of the vehicle network can be improved.

Description

Security method for Ethernet-based network {SECURITY METHOD FOR ETHERNET BASED NETWORK}

The present invention relates to a network security technology, and more particularly, to a security method for an Ethernet-based network.

[0003] As the electronicization of vehicle components proceeds rapidly, the types and numbers of electronic devices mounted on vehicles are greatly increasing. Electronic devices can be used in a power train control system, a body control system, a chassis control system, a vehicle network, a multimedia system, and the like. The powertrain control system may mean an engine control system, an automatic shift control system, or the like. The body control system may mean a body electronic component control system, a convenience device control system, a lamp control system, and the like. The chassis control system may mean a steering device control system, a brake control system, a suspension control system, and the like. The vehicle network may mean a controller area network (CAN), a FlexRay-based network, a media oriented system transport (MOST)-based network, and the like. The multimedia system may mean a navigation system system, a telematics system, an infotainment system, and the like.

These systems and electronic devices constituting each of the systems are connected through a vehicle network, and a vehicle network is required to support the functions of each of the electronic devices. CAN can support a transmission rate of up to 1Mbps, automatic retransmission of collided messages, and error detection based on cycle redundancy interface (CRC). A FlexRay-based network can support a transmission rate of up to 10Mbps, and can support simultaneous data transmission through two channels, synchronous data transmission, and the like. The MOST-based network is a communication network for high-quality multimedia and can support a transmission speed of up to 150Mbps.

On the other hand, vehicle telematics systems, infotainment systems, and improved safety systems require high transmission speeds and system scalability, and CAN and FlexRay-based networks do not support them sufficiently. MOST-based networks can support higher transmission rates than CAN and FlexRay-based networks, but it is expensive to apply MOST-based networks to all networks of vehicles. Due to these problems, an Ethernet-based network may be considered as a vehicle network. An Ethernet-based network can support bidirectional communication through a pair of windings, and can support a maximum transmission rate of 10 Gbps.

The Ethernet-based vehicle network is a fixed network, and a network security method based on these characteristics is required.

An object of the present invention for solving the above problems is to provide a security method for an Ethernet-based network.

An object of the present invention for solving the above problems is to provide a security device for an Ethernet-based network.

A method of operating a first communication node constituting a network according to an embodiment of the present invention for achieving the above object includes the steps of performing an authentication procedure with at least one communication node connected to the first communication node, and an authenticated communication node. Generating a table including identification information of, and transmitting the identification information to the authenticated communication node.

Here, the first communication node may be a switch or a bridge, and the at least one communication node connected to the first communication node may be an end node.

Here, the identification information of the authenticated communication node may include at least one of a MAC address, an IP address, and a port number.

Here, the MAC address may be obtained through the authentication procedure.

Here, the method of operating the first communication node includes receiving a message from a second communication node connected to the first communication node, and when a source address included in the message exists in the table, It may further include transmitting the message to a third communication node indicated by the destination address.

Here, the method of operating the first communication node may further include discarding the message if the source address included in the message does not exist in the table.

Here, the method of operating the first communication node includes receiving a message from a second communication node connected to the first communication node, and a source address included in the message and a port number corresponding to the source address in the table. If present, transmitting the message to a third communication node indicated by the destination address included in the message.

Here, the method of operating the first communication node may further include discarding the message if the source address and the port number corresponding to the source address do not exist in the table.

In order to achieve the above object, a method of operating a first communication node constituting a network according to another embodiment of the present invention includes: performing an authentication procedure with a second communication node connected to the first communication node, the second communication Receiving identification information of an authenticated communication node from a node, performing a procedure for obtaining an IP address with at least one communication node indicated by the identification information, and a table including the identification information and the obtained IP address ( table).

Here, the second communication node may be a switch or a bridge, and the first communication node and the at least one communication node may be an end node connected to the second communication node.

Here, the identification information of the authenticated communication node may include at least one of a MAC address and a port number.

Here, the IP address acquisition procedure may be performed based on ARP.

Here, the method of operating the first communication node includes receiving a message from the second communication node, and decoding data included in the message when the source address included in the message is present in the table. It may contain more.

Here, the method of operating the first communication node may further include discarding the message if the source address included in the message does not exist in the table.

Here, the method of operating the first communication node includes receiving a message from the second communication node, and when a source address included in the message and an IP address corresponding to the source address exist in the table, the message It may further include the step of decoding the data included in the.

Here, the operation method of the first communication node further comprises the step of discarding the message if the source address (SA) included in the message and the IP address corresponding to the source address (SA) do not exist in the table. Can include.

According to the present invention, since traffic generated by a communication node that cannot exist in the vehicle network can be blocked, security in the vehicle network can be improved. Accordingly, the performance of the vehicle network can be improved.

1 is a block diagram illustrating an embodiment of a topology of a vehicle network.
2 is a block diagram showing an embodiment of a communication node constituting a vehicle network.
3 is a block diagram illustrating an embodiment of a network topology for explaining a network security method.
4 is a flowchart illustrating a method of generating a table including identification information of an authenticated communication node according to an embodiment of the present invention.
5 is a flowchart illustrating a method of securing a network according to an embodiment of the present invention.
6 is a flowchart illustrating a network security method according to another embodiment of the present invention.
7 is a block diagram showing an embodiment of a frame used in an Ethernet-based network.

In the present invention, various modifications may be made and various embodiments may be provided, and specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first and second may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another component. For example, without departing from the scope of the present invention, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. The term and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it is understood that it may be directly connected or connected to the other component, but other components may exist in the middle. It should be. On the other hand, when a component is referred to as being "directly connected" or "directly connected" to another component, it should be understood that there is no other component in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof does not preclude in advance.

Unless otherwise defined, all terms used herein including technical or scientific terms have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms as defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate an overall understanding, the same reference numerals are used for the same elements in the drawings, and duplicate descriptions for the same elements are omitted.

1 is a block diagram showing an embodiment of the topology of a vehicle network.

Referring to FIG. 1, a communication node constituting a vehicle network may mean a gateway, a switch (or, a bridge), or an end node. The gateway 100 may be connected to at least one switch 110, 110-1, 110-2, 120, 130, and may connect different networks. For example, the gateway 100 is a switch that supports a controller area network (CAN) (or FlexRay, media oriented system transport (MOST), a local interconnect network (LIN), etc.) protocol and an Ethernet. You can connect between switches that support the protocol. Each of the switches 110, 110-1, 110-2, 120, and 130 may be connected to at least one end node 111, 112, 113, 121, 122, 123, 131, 132, 133. Each of the switches 110, 110-1, 110-2, 120, and 130 can interconnect end nodes 111, 112, 113, 121, 122, 123, 131, 132, and 133, and are connected to the end nodes. Nodes 111, 112, 113, 121, 122, 123, 131, 132, 133 can be controlled.

The end nodes 111, 112, 113, 121, 122, 123, 131, 132, and 133 may refer to an electronic control unit (ECU) that controls various devices included in the vehicle. For example, the end nodes 111, 112, 113, 121, 122, 123, 131, 132, 133 are infotainment devices (e.g., display devices, navigation devices, around view devices). It may refer to an ECU constituting a monitoring (around view monitoring) device) or the like.

Meanwhile, communication nodes (ie, gateways, switches, end nodes, etc.) constituting the vehicle network are star topology, bus topology, ring topology, tree topology, and mesh. It can be connected by topology or the like. In addition, each of the communication nodes constituting the vehicle network may support CAN protocol, FlexRay protocol, MOST protocol, LIN protocol, Ethernet protocol, and the like. The embodiments according to the present invention may be applied to the network topology described above, and the network topology to which the embodiments according to the present invention are applied is not limited thereto and may be configured in various ways.

2 is a block diagram showing an embodiment of a communication node constituting a vehicle network.

Referring to FIG. 2, a communication node 200 constituting a network may include a PHY layer block 210 and a controller 220. In this case, the controller 220 may be implemented including a medium access control (MAC) layer. The PHY layer block 210 may receive a signal from another communication node or may transmit a signal to another communication node. The controller 220 may control the PHY layer block 210 and may perform various functions (eg, an infotainment function, etc.). The PHY layer block 210 and the controller 220 may be implemented as one SoC (System on Chip), or may be configured as separate chips.

The PHY layer block 210 and the controller 220 may be connected through a media independent interface (MII) 230. The MII 230 may mean an interface specified in IEEE 802.3, and may be configured as a data interface and a management interface between the PHY layer block 210 and the controller 220. Instead of the MII 230, one of RMII (reduced MII), GMII (gigabit MII), RGMII (reduced GMII), SGMII (serial GMII), and XGMII (10 GMII) interfaces may be used. The data interface may include a transmission channel and a reception channel, and each of the channels may have independent clocks, data, and control signals. The management interface may be composed of a two-signal interface, and one may be a signal for a clock and the other may be a signal for data.

The PHY layer block 210 may include a PHY layer interface unit 211, a PHY layer processor 212, and a PHY layer buffer 213. The configuration of the PHY layer block 210 is not limited thereto, and the PHY layer block 210 may be configured in various ways. The PHY layer interface unit 211 may transmit a signal received from the controller 220 to the PHY layer processor 212 and may transmit a signal received from the PHY layer processor 212 to the controller 220. The PHY layer processor 212 may control the operation of each of the PHY layer interface unit 211 and the PHY layer buffer 213. The PHY layer processor 212 may perform modulation of a signal to be transmitted or demodulation of a received signal. The PHY layer processor 212 may control the PHY layer buffer 213 to input or output a signal. The PHY layer buffer 213 may store the received signal and may output the stored signal according to the request of the PHY layer processor 212.

The controller 220 may monitor and control the PHY layer block 210 through the MII 230. The controller 220 may include a controller interface unit 221, a core 222, a main memory 223, an auxiliary memory 224, and the like. The configuration of the controller 220 is not limited thereto, and the controller 220 may be configured in various ways. The controller interface unit 221 may receive a signal from the PHY layer block 210 (ie, the PHY layer interface unit 211) or an upper layer (not shown), and transmit the received signal to the core 222. In addition, the signal received from the core 222 may be transmitted to the PHY layer block 210 or an upper layer. The core 222 may further include independent memory control logic or integrated memory control logic for controlling the controller interface unit 221, the main memory 223, and the auxiliary memory 224. The memory control logic may be implemented by being included in the main memory 223 and the auxiliary memory 224, or may be implemented by being included in the core 222.

Each of the main memory 223 and the auxiliary memory 224 may store a signal processed by the core 222 and may output the stored signal according to the request of the core 222. The main memory 223 may refer to a volatile memory (eg, random access memory (RAM)) that temporarily stores data necessary for the operation of the core 222. The auxiliary memory 224 includes operating system code (eg, a kernel and device driver) and an application program code for performing functions of the controller 220. It may mean a nonvolatile memory that is stored. Flash memory with high processing speed can be used as non-volatile memory, or hard disk drive (HDD), compact disc-read only memory (CD-ROM), etc. for storing large amounts of data Can be used. The core 222 may typically be composed of a logic circuit including at least one processing core. As the core 222, an ARM (Advanced RISC Machines Ltd.) series core, an atom series core, and the like may be used.

In the following, a method performed by a communication node belonging to the vehicle network and a counterpart communication node corresponding thereto will be described. Hereinafter, even when a method performed in the first communication node (for example, transmission or reception of a signal) is described, the corresponding second communication node is a method corresponding to the method performed in the first communication node (for example, For example, signal reception or transmission) can be performed. That is, when the operation of the first communication node is described, the second communication node corresponding thereto may perform an operation corresponding to the operation of the first communication node. Conversely, when the operation of the second communication node is described, the first communication node corresponding thereto may perform an operation corresponding to the operation of the switch.

3 is a block diagram illustrating an embodiment of a network topology for explaining a network security method.

3, switches 310, 320, 330 and end nodes 311, 312, 313, 321, 322, 323, 331, 332, 333 constitute the vehicle network described with reference to FIG. It can, and can support Ethernet protocols. Each of the switches 310, 320, 330 and end nodes 311, 312, 313, 321, 322, 323, 331, 332, 333 may mean the communication node 200 described with reference to FIG. have. The switch 1 310 may be connected to the end node 1 311 through port 1, may be connected to the end node 2 312 through port 2, and may be connected to the end node 3 313 through port 3, , It may be connected to the switch 2 (320) through the port 4. Here, the end node 3 313 may mean a node illegally invading the vehicle network, and unnecessary traffic may be generated in the vehicle network by the end node 3 313.

The switch 2 320 may be connected to the switch 1 310 through port 1, may be connected to the end node 4 321 through port 2, and may be connected to the end node 5 322 through port 3, It may be connected to the end node 6 (323) through port 4, it may be connected to the switch 3 (330) through port 5. The switch 3 330 may be connected to the switch 2 320 through port 1, may be connected to the end node 7 331 through port 2, and may be connected to the end node 8 332 through port 3, It may be connected to the end node 9 (333) through port 4.

Each of the switches 310, 320, 330 and end nodes 311, 312, 321, 322, 323, 331, 332 and 333 may have topology information of a vehicle network. For example, each of the switches 310, 320, 330 and end nodes 311, 312, 321, 322, 323, 331, 332, and 333 is when power is applied to the vehicle network (e.g., vehicle When a battery is installed in the device), a message including the topology information of the vehicle network can be received from an upper communication node (for example, a switch, a gateway, etc.), and the topology of the vehicle network can be checked through the received message. have. Alternatively, topology information of the vehicle network may be stored in advance in each of the switches 310, 320, and 330 and the end nodes 311, 312, 321, 322, 323, 331, 332, and 333, and power supply to the vehicle network. When this is applied, each of the switches 310, 320, 330 and the end nodes 311, 312, 321, 322, 323, 331, 332, and 333 can check the topology of the vehicle network based on the stored information.

Each of the end nodes 311, 312, 321, 322, 323, 331, 332, and 333 may have a unique Internet Protocol (IP) address. When power is applied to the vehicle network (for example, when a vehicle is equipped with a battery), an IP address can be set for each of the end nodes 311, 312, 321, 322, 323, 331, 332, and 333. have. For example, each of the end nodes 311, 312, 321, 322, 323, 331, 332, 333 may receive a message including an IP address from an upper communication node (eg, switch, gateway, etc.) , You can set the IP address included in the received message as your own IP address. Alternatively, an IP address may be stored in advance in each of the end nodes 311, 312, 321, 322, 323, 331, 332, and 333, and when power is applied to the vehicle network, the end nodes 311, 312, 321 , 322, 323, 331, 332, 333) Each can set the stored IP address as its own IP address. The IP address may have the form "10.xxx.yyy.zz". Each of the end nodes 311, 312, 321, 322, 323, 331, 332, and 333 may have different IP addresses. For example, the IP addresses of each of the end nodes 311, 312, 321, 322, 323, 331, 332, and 333 may be set as shown in Table 1 below.

The method of setting the IP address of the communication node constituting the vehicle network is not limited to the above description, and the IP address of the communication node may be set through various methods.

4 is a flowchart illustrating a method of generating a table including identification information of an authenticated communication node according to an embodiment of the present invention, and FIG. 5 is a network security method according to an embodiment of the present invention. Fig. 6 is a flow chart showing a network security method according to another embodiment of the present invention.

4 to 6, the switch 1 310 and the end nodes 311, 312, 313 may configure the vehicle network described with reference to FIG. 3. That is, each of the switch 1 310 and the end nodes 311, 312, and 313 may correspond to a configuration having the same reference symbol among the vehicle networks shown in FIG. 3. Each of the switch 1 310 and the end nodes 311 and 312 may have topology information of the vehicle network. Here, the end node 3 313 may mean a node illegally invading the vehicle network, and unnecessary traffic may be generated by the end node 3 313.

The network to which the table generation method and the network security methods according to the embodiments of the present invention are applied is not limited to the vehicle network shown in FIG. 3, and the table generation method and the network security methods according to the embodiments of the present invention are It can be applied to various networks. In addition, a table generation method and a network security method according to embodiments of the present invention will be described below based on the end nodes 311 and 312 connected to the switch 1 310 and the switch 1 310. End nodes 321, 322, 323 connected to switch 2 320 and switch 2 320 similar or identical to the methods described in (or, end connected to switch 3 330 and switch 3 330) Each of the nodes 331, 332, and 333 may perform a table generation method and a network security method according to embodiments of the present invention.

Each of the network security method illustrated in FIG. 5 and the network security method illustrated in FIG. 6 may be performed based on a table generated by the method of generating the table illustrated in FIG. 4. The network security method shown in FIG. 5 may be performed by the switch 1 310. The network security method illustrated in FIG. 6 may be performed by each of the end nodes 311 and 312. Meanwhile, a message used in embodiments of the present invention (e.g., a message used to perform an authentication procedure, a message used to transmit identification information of an authenticated communication node, and an IP address acquisition procedure) The message to be used, etc.) may mean a message generated based on the Ethernet protocol. A message generated based on the Ethernet protocol may be as follows.

7 is a block diagram illustrating an embodiment of a message used in an Ethernet-based vehicle network.

Referring to FIG. 7, an Ethernet protocol-based message 700 may include a physical (PHY) header, a MAC frame, and a frame check sequence (FCS) field 708. The MAC frame may be generated by the controller 220 of the communication node 200. The PHY header may include a preamble 701 and a start frame delimiter (SFD) field 702. The preamble 701 may have a size of 7 octets and may be used for timing synchronization. The SFD field 702 may have a "10101011" sequence.

The MAC frame may be located after the SFD field 702. The MAC frame may include only the MAC header, or may include a MAC header and a logic link control (LLC) frame. The MAC header may include a destination address (DA) field 703, a source address (SA) field 704, and a length/type field 705. The DA field 703 may have a size of 6 octets, and may include identification information (eg, MAC address) of a communication node that receives the corresponding MAC frame. The SA field 704 may have a size of 6 octets, and may include identification information (eg, MAC address) of a communication node transmitting the corresponding MAC frame.

The length/type field 705 may have a size of 2 octets, and may indicate the length of the data field 706 or the Ethernet type supported by the communication node that transmitted the Ethernet frame 700 based on the protocol. For example, when the value of the first octet included in the length/type field 705 is less than or equal to 1500 decimal, the corresponding length/type field 705 may indicate the length of the data field 706. When the value of the first octet included in the length/type field 705 is greater than or equal to 1536 decimal, the corresponding length/type field 705 may indicate the Ethernet type. The LLC frame may include a data field 706 and may further include a pad field 707 as needed (eg, to meet the size of the minimum MAC frame). In this case, the pad field 707 may be added after the data field 706.

Referring back to FIGS. 4 to 6, the switch 1 310 may determine whether it is necessary to generate a table including identification information of an authenticated end node. For example, the switch 1 310 may be configured when the battery is installed in the vehicle (for example, when the battery is first installed in the vehicle in a vehicle manufacturing plant) or remounted (for example, the battery is installed in the vehicle after replacing the parts of the vehicle). If it is re-installed), it may be determined that it is necessary to create a table including identification information of the authenticated end node. When it is determined that it is necessary to create a table including identification information of an authenticated end node, the switch 1 310 may perform an authentication procedure with each of the end nodes 311, 312, and 313 connected to it. Yes (S400, S410, S420). The switch 1 310 may perform authentication for each of the end nodes 311, 312, and 313 using an authentication procedure specified in the IEEE 802.1X standard. For example, the switch 1 310 may perform authentication by exchanging messages with each of the end nodes 311, 312, and 313 based on an open system algorithm. Alternatively, the switch 1 310 may perform authentication by exchanging a message including the shared key with each of the end nodes 311, 312, and 313 based on a shared key algorithm. Here, the authentication procedure is not limited to the above-described contents, and the switch 1 310 may perform authentication with each of the end nodes 311, 312, and 313 using various authentication procedures.

Since end node 1 311 and end node 2 312 are normal communication nodes existing in the vehicle network, switch 1 310 successfully authenticates each of end node 1 311 and end node 2 312. You can complete it. On the other hand, since the end node 3 313 is a communication node illegally invading the vehicle network, the switch 1 310 may fail to authenticate to the end node 3 313.

Meanwhile, a message transmitted and received for the authentication procedure may include a source address (SA) and a destination address (DA) of the corresponding message. Accordingly, the switch 1 310 may obtain identification information (eg, MAC address, etc.) of each of the end nodes 311, 312, and 313 participating in the authentication procedure. The switch 1 310 may generate a table including identification information of authenticated end nodes (ie, end node 1 311 and end node 2 312) among the identification information obtained through the authentication procedure ( S403). That is, a table including identification information of each of the end nodes 311, 312, and 313 participating in the authentication procedure may be generated by the authentication procedure. In this case, the switch 1 310 may reconfigure the table to include identification information of only the authenticated end nodes 311 and 312. The table may include the MAC address of the authenticated end nodes 311 and 312 and the port number to which the authenticated end nodes 311 and 312 are connected. For example, the switch 1 310 may map the MAC address of the end node 1 311 to the port number (ie, port 1) of the end node 1 311, and the mapped "end node 1 A table including the MAC address of 311-port 1" may be created. In addition, the switch 1 310 may map the MAC address of the end node 2 312 to the port number (ie, port 2) of the end node 2 312, and the mapped "MAC of the end node 2 312" You can create a table containing "address-port 2". The switch 1 310 may store the generated table in a nonvolatile memory (for example, the auxiliary memory 224), and may update a table stored in the nonvolatile memory when an authenticated end node is changed. A table created through such a procedure may be shown in Table 2 below. Here, the type of identification information included in the table is not limited thereto, and the identification information may be configured in various ways.

Meanwhile, each of the switch 2 320 and the switch 3 330 performs an authentication procedure for the end nodes 321, 322, 323, 331, 332, and 333 connected to itself as described above, thereby identifying information of the authenticated end nodes. You can create a table including. Switch 2 (320) may generate a message including identification information included in the table, and the generated message to switch 1 (310), switch 3 (330) and connected end nodes (321, 322, 323). Can be transmitted. In addition, the switch 3 330 may generate a message including the identification information included in the table, and the generated message may be converted to the switch 1 310, the switch 2 320 and the connected end nodes 331, 332, and 333. ). Here, the identification information may be included in at least one of the MAC header or the data field of the message. When the switch 1 310 receives the identification information from each of the switch 2 320 and the switch 3 330, the identification information received from the switch 2 320 and the identification information received from the switch 3 330 are displayed in the table shown in Table 2. Identification information can be added.

The switch 1 310 sends a message including the identification information included in the table (that is, "the MAC address of the end node 1 311-port 1" and "the MAC address of the end node 2 312-port 2"). Can be generated. Alternatively, when the switch 1 310 receives the identification information from each of the switch 2 320 and the switch 3 330, the identification information shown in Table 2 and the switch 2 320 and the switch 3 330 respectively A message containing identification information can be generated. The switch 1 310 may transmit a message including identification information to the authenticated end nodes 311 and 312 among the end nodes 311, 312, and 313 connected to it (S404, S405). Here, the identification information may be included in at least one of the MAC header and the data field of the message.

The end node 1 311 may receive a message from the switch 1 310 and may verify identification information of the authenticated end nodes by decoding the message. End node 1 311 may obtain the IP address of the authenticated end node (ie, end node 2 312) (S406). For example, the end node 1 311 may obtain the IP address of the end node 2 312 by exchanging messages with the end node 2 312 based on an address resolution protocol (ARP). Here, the procedure for obtaining the IP address is not limited to the ARP-based procedure, and the IP address can be obtained through various methods. In addition, the end node 2 312 may receive a message from the switch 1 310 and may verify identification information of an authenticated end node (ie, end node 1 311) by decoding the message. The end node 2 312 may acquire the IP address of the end node 1 311 by performing an IP address acquisition procedure (eg, an ARP-based procedure) with the end node 1 311 (S407). Here, it has been described that the IP address acquisition procedure (S406) at the end node 1 311 is performed prior to the IP address acquisition procedure (S407) at the end node 2 312, but the order of performing the IP address acquisition procedure is not limited thereto. Does not. For example, the IP address acquisition procedure S407 at the end node 2 312 may be performed prior to or concurrently with the IP address acquisition procedure S406 at the end node 1 311.

When the end node 1 311 obtains the IP address of the authenticated end node, the end node 1 311 may generate a table including identification information of the authenticated end node (S408). For example, the table may include the MAC address, port number, and IP address of the authenticated end node, or may include the MAC address and IP address of the authenticated end node. For example, the end node 1 311 may map the IP address of the end node 2 312 to the "MAC address-port 2" or "MAC address" of the end node 2 312, and the mapped "MAC address" You can create a table containing "Address-Port 2-IP Address" or "MAC Address-IP Address". The end node 1 311 may store the generated table in the nonvolatile memory (eg, the auxiliary memory 224), and may update the table stored in the nonvolatile memory when the authenticated end node is changed. A table created through such a procedure may be shown in Table 3 or Table 4 below. Here, the type of identification information included in the table is not limited thereto, and the identification information may be configured in various ways.

In addition, when the end node 2 312 obtains the IP address of the authenticated end node, the end node 2 312 may generate a table including identification information of the authenticated end node (S409). For example, the table may include the MAC address, port number, and IP address of the authenticated end node, or may include the MAC address and IP address of the authenticated end node. For example, the end node 2 312 may map the IP address of the end node 1 311 to the "MAC address-port 1" or "MAC address" of the end node 1 311, and the mapped "MAC address" You can create a table containing "Address-Port 1-IP Address" or "MAC Address-IP Address". The end node 2 312 may store the generated table in the nonvolatile memory (eg, the auxiliary memory 224), and may update the table stored in the nonvolatile memory when the authenticated end node is changed. Here, it has been described that the table creation step S408 in the end node 1 311 is performed before the table creation step S409 in the end node 2 312, but the order of performing the table creation step is not limited thereto. For example, the step of creating a table (S409) in the end node 2 312 may be performed earlier than the step (S408) of creating the table in the end node 1 311 or may be performed simultaneously.

Next, a network security method performed in the switch will be described. The network security method may be performed based on a table including identification information of an authenticated end node generated previously. The switch 1 310 may receive a message from any end node (S500), and may check the end node that transmitted the message by checking the SA field included in the MAC header of the message. The switch 1 310 may determine whether the MAC address of the end node that transmitted the message exists in a table including identification information of the authenticated end node (S501).

For example, when the MAC address of the end node that has transmitted the message exists in the table including the identification information of the authenticated end node, the switch 1 310 may perform step S502 as a next step. Alternatively, the switch 1 310 may skip step S502 and perform step S503 as a next step. That is, the switch 1 310 may transmit the message to the end node indicated by the DA address included in the MAC header of the message. On the other hand, switch 1 310 may discard the message if the MAC address of the end node that has transmitted the message does not exist in the table including the identification information of the authenticated end node (S504). That is, the switch 1 310 may discard the message when the message is transmitted from the unauthenticated end node 3 313.

If the MAC address of the end node that transmitted the message is present in the table including the identification information of the authenticated end node, the switch 1 310 includes the identification information of the end node where the port number of the end node that transmitted the message is authenticated. It can be determined whether it exists in the table to be used (S502). For example, switch 1 310 is an end node indicated by the DA address included in the MAC header of the message when the port number of the end node that transmitted the message exists in the table including the identification information of the authenticated end node. The message can be transmitted to (S503). On the other hand, switch 1 310 may discard the message if the port number of the end node that transmitted the message does not exist in the table including the identification information of the authenticated end node (S504). That is, the switch 1 310 may discard the message when the message is transmitted from the unauthenticated end node 3 313.

Meanwhile, in the present invention, it has been described that step S502 is performed after step S501 is performed, but step S502 may be performed earlier than step S501. In this case, switch 1 310 first determines whether the port number of the end node that has transmitted the message exists in the table including the identification information of the authenticated end node, and according to the result, the MAC address of the end node that has transmitted the message. It can be determined whether is present in the table including the identification information of the authenticated end node.

Next, a network security method performed in an end node will be described. The network security method may be performed based on a table including identification information of an authenticated end node generated previously. End node 1 311 may receive a message from any end node (S600), and may check the end node that transmitted the message by checking the SA field included in the MAC header of the message. The end node 1 311 may determine whether the MAC address of the end node that has transmitted the message exists in the table including identification information of the authenticated end node (S601).

For example, the end node 1 311 may perform step S602 as a next step when the MAC address of the end node that has transmitted the message exists in the table including the identification information of the authenticated end node. Alternatively, the end node 1 311 may skip step S602 and perform step S603 as the next step. That is, when the DA address included in the MAC header of the message indicates itself, the end node 1 311 may decode a corresponding message (eg, a data field included in the message) (S603). On the other hand, the end node 1 311 may discard the message if the MAC address of the end node that transmitted the message does not exist in the table including the identification information of the authenticated end node (S604). That is, the end node 1 311 may discard the message when the message is transmitted from the unauthenticated end node 3 313.

End node 1 (311), if the MAC address of the end node that transmitted the message exists in the table including the identification information of the authenticated end node, the IP address of the end node that transmitted the message is the identification information of the authenticated end node. It can be determined whether it exists in the included table (S602). For example, if the IP address of the end node that transmitted the message is present in the table containing the identification information of the authenticated end node, the end node 1 311 may display the message (i.e., a data field included in the message). It can be decoded (S603). On the other hand, the end node 1 311 may discard the message if the IP address of the end node that has transmitted the message does not exist in the table including the identification information of the authenticated end node (S604). That is, the end node 1 310 may discard the message when the message is transmitted from the unauthenticated end node 3 313.

Meanwhile, in the present invention, it has been described that step S602 is performed after step S601 is performed, but step S602 may be performed earlier than step S6501. In this case, the end node 1 311 first determines whether the IP address of the end node that has transmitted the message exists in the table including the authentication information of the end node, and according to the result, the MAC of the end node that has transmitted the message. It can be determined whether the address exists in a table including identification information of an authenticated end node. Meanwhile, step S601 may be omitted in the present invention. That is, step S602 may be performed after step S600. In this case, the end node 1 311 does not determine whether the MAC address of the end node that has transmitted the message exists in the table including the identification information of the authenticated end node, but does not determine whether the MAC address of the end node that has transmitted the message. If the IP address exists in the table containing the identification information of the authenticated end node, the message can be decoded.

The methods according to the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded on the computer-readable medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software.

Examples of computer-readable media include hardware devices specially configured to store and execute program instructions, such as rom, ram, flash memory, and the like. Examples of program instructions include machine language codes such as those produced by a compiler, as well as high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as at least one software module to perform the operation of the present invention, and vice versa.

Although described with reference to the above embodiments, those skilled in the art will understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention described in the following claims. I will be able to.

Claims (16)

As a method of operating a first communication node constituting a network,
Performing an authentication procedure with at least one communication node connected to the first communication node;
Generating a table including an address of an authenticated communication node and a port number corresponding to the address;
Transmitting the information of the table to the authenticated communication node;
Receiving a message from a second communication node connected to the first communication node;
Checking whether an address of the second communication node, which is a source address (SA) of the message, exists in the table;
If the address of the second communication node exists in the table, checking whether a port number corresponding to the address of the second communication node exists in the table; And
If the port number corresponding to the address of the second communication node exists in the table, transmitting the message to a third communication node indicated by a destination address (DA) included in the message. A method of operating the first communication node. The method according to claim 1,
The first communication node is a switch or a bridge, and the at least one communication node connected to the first communication node is an end node. The method according to claim 1,
The address of the authenticated communication node is a medium access control (MAC) address or an internet protocol (IP) address. The method of claim 3,
The MAC address is obtained through the authentication procedure, the operating method of the first communication node. delete The method according to claim 1,
The operating method of the first communication node,
If the address of the second communication node does not exist in the table, further comprising the step of discarding the message (discard), the operating method of the first communication node. delete The method according to claim 1,
The operating method of the first communication node,
If the address of the second communication node exists in the table, and if the port number corresponding to the address of the second communication node does not exist in the table, discarding the message, the first communication node Method of operation. As a method of operating a first communication node constituting a network,
Performing an authentication procedure with a second communication node connected to the first communication node;
Receiving an address of an authenticated communication node from the second communication node;
Performing an IP (internet protocol) address acquisition procedure with at least one communication node indicated by the address;
Generating a table including the address and an IP address corresponding to the address;
Receiving a message transmitted from a third communication node from the second communication node;
Checking whether an address of the third communication node, which is a source address (SA) of the message, exists in the table;
If the address of the third communication node exists in the table, checking whether an IP address corresponding to the address of the third communication node exists in the table; And
And decoding the message when the IP address corresponding to the address of the third communication node exists in the table. The method of claim 9,
The second communication node is a switch or a bridge, and the first communication node and the at least one communication node are end nodes connected to the second communication node. How it works. The method of claim 9,
The address is a medium access control (MAC) address,
Receiving the address of the authenticated communication node from the second communication node,
The method of operating a first communication node, characterized in that further receiving a port number of the authenticated communication node. The method of claim 9,
The IP address acquisition procedure is performed based on an address resolution protocol (ARP). delete The method of claim 9,
The operating method of the first communication node,
If the address of the third communication node does not exist in the table, further comprising the step of discarding the message (discard), the operating method of the first communication node. delete The method of claim 9,
The operating method of the first communication node,
When the address of the third communication node exists in the table, the first communication node further comprising the step of discarding the message if the IP address corresponding to the address of the third communication node does not exist in the table. Method of operation.

Images