System and method for providing authentication service for internet of things security

• US 9,882,912 B2
• Filed: 12/14/2015
• Issued: 01/30/2018
• Est. Priority Date: 12/16/2014
• Status: Active Grant

• Current Assignee: WINS CO., LTD.
• Original Assignee: WINS CO., LTD.
• Inventors: Joo, Eun Young
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/968,856
• Publication Number:
  US 20160173495A1
• Time in Patent Office: 778 Days
• Field of Search: 726 2- 6, 726 22- 23, 713168-171
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system and method for providing authentication service for IoT security are disclosed herein. The system for providing authentication service for IoT security includes an Internet of Things (IoT) service server, and an IoT gateway node. The IoT service server supports an IoT communication service in accordance with an IoT communication service policy. The IoT gateway node receives an IoT service request from a terminal attempting to control an IoT device that supports the IoT communication service while operating in conjunction with the IoT service server, identifies whether the terminal attempting to control the IoT device is a normal user based on profile information, collected from the terminal via the IoT service request, via the IoT service server, and performs the security authentication of the IoT device.

Claims

1. A method of providing authentication service for Internet of Things (IoT) security, comprising:

sending, by a terminal attempting to control an IoT device that supports an IoT communication service via the IoT communication service, an IoT service request to an IoT gateway node by executing an IoT service-related browser;

determining whether the terminal attempting to control the IoT device is a normal user, based on profile information collected from the terminal via the IoT service request, and determining whether a control command to control the IoT device has been generated if, as a result of the determination, the terminal is a normal user;

if a control command has been generated, monitoring an interval of each occurrence period of the control command, and determining a malicious behavior type based on a result of checking whether the interval exceeds a predetermined interval threshold; and

blocking the IoT communication service or attempting re-authentication of the terminal based on the malicious behavior type.

2. The method of claim 1, wherein determining whether the terminal attempting to control the IoT device is a normal user is performed by determining, by the IoT gateway node, whether the profile information included in a message when the IoT service request is received matches authentication information of the terminal that has been registered with an IoT service server.

3. The method of claim 2, wherein the authentication information comprises one or more of ID information required to identify the terminal, information about a MAC address of the terminal, and encryption key information based on a public key-based key sharing mechanism.

4. The method of claim 1, further comprising, if the control command has not been generated, recognizing a state monitoring message for the IoT device supporting the IoT communication service in accordance with an IoT communication service policy, and detecting an event by monitoring information about a state of each of IoT devices distributed in a network.

5. The method of claim 1, wherein if it is determined that the terminal is not a normal user, the IoT gateway node detects an authentication history from an IoT service server based on the collected profile information, blocks the authentication of the terminal if the authentication history of the terminal exceeds a predetermined authentication request count, and outputs an authentication request message including authentication permission information if the authentication history of the terminal does not exceed the predetermined authentication request count.

6. The method of claim 1, wherein monitoring the interval of each occurrence period of the control command comprises:

determining whether the control command is a single-period repetitive control command in accordance with a predetermined security policy;

comparing the interval with the predetermined interval threshold if, as a result of the determination, it is determined that the control command is a repetitive control command;

checking whether the control command is a state change message for all or a specific one of IoT devices distributed in a network if, as a result of the determination, it is determined that the control command is not a repetitive control command; and

neglecting IoT service logging and IoT device control of the terminal, or performing the IoT logging and IoT device control via a notification service based on a result of the checking.

7. The method of claim 1, wherein the malicious behavior type comprises a flooding attack and a replaying attack.

8. The method of claim 1, further comprising:

controlling IoT service logging and IoT device control of the terminal if the interval does not exceed the predetermined interval threshold;

determining whether the control command is a replaying attack defined in a predetermined security policy if the interval exceeds the predetermined interval threshold; and

determining a period type of the repetitive control command based on a result of the determination.

9. The method of claim 8, wherein:

the period type is a regular period or a common period defined in the IoT service policy; and

if the repetitive control command is regular, re-authentication is requested from the terminal, and control via the IoT device control logging and notification service is performed.

10. A system for providing authentication service for IoT security, comprising:

an Internet of Things (IoT) service server configured to support an IoT communication service in accordance with an IoT communication service policy; and

an IoT gateway node configured to receive an IoT service request from a terminal attempting to control an IoT device that supports the IoT communication service while operating in conjunction with the IoT service server, to identify whether the terminal attempting to control the IoT device is a normal user based on profile information, collected from the terminal via the IoT service request, via the IoT service server, and to perform security authentication of the IoT device,

wherein the IoT the IoT gateway node comprises a control unit configured to collect the profile information of the terminal included in a message output by a communication unit when the IoT service request is received via a collection unit, to identify whether the terminal is a normal user based on the collected profile information, to determine whether a control command to control the IoT device has been generated via a monitoring unit if the terminal is a normal user, to monitor an interval of each control command period if the control command has been generated, to compare the interval with a predetermined interval threshold, and to determine a malicious behavior type based on a result of the comparison.

11. The system of claim 10, wherein the control unit blocks the IoT communication service of the terminal requesting the IoT service based on the determined malicious behavior type, or performs control so that the re-authentication of the terminal is performed.

12. The system of claim 10, wherein the control unit identifies whether the terminal is a normal user by performing control so that it is determined via an authentication unit whether the profile information, included in the message when the IoT service request is received, matches authentication information of the terminal that has been registered with the IoT service server.

13. The system of claim 10, wherein the authentication information comprises one or more of ID information required to identify the terminal, information about a MAC address of the terminal, and encryption key information based on a public key-based key sharing mechanism.

14. The system of claim 10, wherein if the control command has not been generated, the control unit recognizes a state monitoring message for the IoT device supporting the IoT communication service in accordance with an IoT communication service policy, and detects an event by monitoring information about a state of each of IoT devices distributed in a network.