KR101209812B1 - Method for access controll of client in home network system and apparatus thereof - Google Patents

Abstract

When controlling access of a client on a home network, the home gateway receives a service request for the home device from a client with a previously issued access authority certificate, and the home gateway receives the home device and service type information included in the service request. Check and determine the type of access control policy matching the type information, and the home gateway performs an access control process according to the type of the access control policy, and in the access control process, the type of the access control policy is the first access control policy. In this case, the service request is transmitted to the home device, and if the type of the access control policy is a second access control policy having a lower security level than the first access control policy, the service request is directly processed.

Description

Method for controlling client access in home network system and apparatus therefor {METHOD FOR ACCESS CONTROLL OF CLIENT IN HOME NETWORK SYSTEM AND APPARATUS THEREOF}

The present invention relates to a method and apparatus for controlling access of a client to a home device on a home network system.

Home network technology is to access home devices (home appliances, heating and cooling facilities, gas facilities, etc.) at home and abroad to use and manage services provided by the home devices simply and conveniently.

To this end, a home gateway is configured on the home network system to connect an internal (ie, home) home device and an external (or internal) client. The home gateway discovers a device connecting to the home network system, generates and assigns an address for communication with the device, and registers it on the home network system as a home device. At this time, the home gateway registers the home device by storing the function, service, and performance of the registered home device.

In the conventional home network system, in order to provide a service requested by a client, the home gateway directly determines an access right of the client, checks the contents of the corresponding service request, and uses an access control process for processing a service. In addition, the home gateway simply handles the transfer of information between the home device and the client, and a method of performing all access control processes such as determining the access right of the client and processing a service request from the home device is also used.

However, as in the conventional access control method, when the home gateway performs all access control processing for the service requested by the client on the home network system, problems may occur in access control according to the security capability of the home gateway. That is, if the security is weak between the home gateway and the home device, there is a problem that the home network system can be operated by a forged access right and a service request when the attacker takes control of the home gateway. Therefore, a strong security processing method should be implemented on the home gateway to secure personal information and services that require a high security level present on each home device when accessed from the outside.

In addition, when a home device performs all access control processing for a service requested by a client on a home network system, as in the conventional access control method, service processing may be slowed down depending on the performance of the home device, resulting in a service error. May occur. Therefore, the performance of the home device, that is, the processing power, must be improved to match the home gateway level.

However, there is a problem that implementing such a strong security on the home gateway or improving the processing power of all home devices may require high cost or inefficient access control processing.

SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problem, and an object of the present invention is to provide an access control method and apparatus for performing differentiated access control processing for each security level when a client accesses a home device service in a home network environment.

As a technical means for achieving the above-described technical problem, the method for controlling the access of the client on the home network system according to an aspect of the present invention, the home gateway from the client possessing a previously issued access authority certificate to the home device Receiving a service request for the service; Checking, by the home gateway, type information of a home device and a service included in the service request, and determining a type of an access control policy matching the type information; And performing, by the home gateway, an access control process according to the type of the access control policy. If the type of the access control policy is a first access control policy, the service request is sent to the home device. And the service request is directly processed if the type of the access control policy is a second access control policy having a lower security level than the first access control policy.

In addition, a method for authorizing an access right to a client on a home network system according to another aspect of the present invention may include: receiving, by a home device, an access request of the client directly or through a home gateway; Determining, by the home device, an access control policy that satisfies a security credential of the client according to a preset security credential; And issuing, by the home device, an access right certificate according to a type of an access control policy in which the security right of the client is satisfied, to the client, wherein the security right of the client is preset when the access right certificate is issued. If the first access control policy is satisfied, the home device issues a first access right certificate to the client authorizing the access right according to the first access control policy, and the security entitlement of the client is greater than that of the first access control policy. If the second access control policy of the low security level is satisfied, the home device delegates to the home gateway to issue a second access right certificate for authorizing the client to access according to the second access control policy.

In addition, an apparatus for controlling access of a client on a home network according to another aspect of the present invention, the access control policy management unit for receiving and storing the type of access control policy for each service provided by each home device from a plurality of home devices; A service request receiving unit receiving an access authority certificate and a service request from a client requesting a service provided by the home device; A service request confirmation unit determining a type of an access control policy corresponding to the requested service based on the information of the requested service included in the service request and the type of the access control policy for each service of the stored home device; And when the determined type of the access control policy corresponds to the first access control policy of the access control policy, transmits the access right certificate and the service request of the client to the home device, and the type of the determined access control policy is the first access control policy. And an access control processing unit for causing the home gateway to process an access right certificate and a service request of the client when the second access control policy is of a lower security level than the first access control policy, wherein the access right certificate of the client is the client. It is issued in advance from the home device based on the security qualification of the.

In addition, the apparatus for controlling the access of the client on the home network according to another aspect of the present invention, lower than the first access control policy and the first access control policy according to a predetermined security level for the service provided by the home device An access control policy setting unit configured to set an access control policy of any one of a second access control policy having a security level, match the set access control policy according to the type of the service, and transmit the matched access control policy to a storage and home gateway; Set an access control policy suitable for a client requesting access to the home device directly or through the home gateway according to a predetermined security credential, and the home device sends the access right certificate according to the set access control policy to the client. An access authority certificate issuer for directly issuing or delegating issuance through the home gateway; And checking the access control policy according to the type of service requested by the client and the type of the checked access control policy based on the service request and access authority certificate of the client received through the home gateway or directly to the home device. And an access control processing unit configured to perform an access control process according to claim 1, wherein the access control processing unit performs service processing for the client when the type of service requested by the client corresponds to the first access control policy. If the type of the requested service corresponds to the second access control policy, the home device receives and processes a service control message for service processing from the home gateway to the client.

According to any one of the problem solving means of the present invention described above, if the security level of the client and the security level of the requested service corresponds to the privacy policy, the home device performs access control and service processing for the client, the security level of the client And if the security level of the requested service corresponds to a general information policy, the home gateway may perform access control and service processing for the client. Therefore, the security level service according to the privacy policy can provide strong security by directly processing by the home device, and the security level service according to the general information policy can be quickly and efficiently performed by the home gateway. It can be effective.

1 is a block diagram of a home network system according to an embodiment of the present invention.
2 is a block diagram illustrating a configuration of an apparatus for controlling access of a home device according to an embodiment of the present invention.
3 is a block diagram illustrating a configuration of an access control apparatus of a home gateway according to an embodiment of the present invention.
4 is a flowchart illustrating a method for issuing an access right certificate according to an embodiment of the present invention.
5 is a flowchart illustrating an access control method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

1 is a block diagram of a home network system according to an embodiment of the present invention.

2 is a block diagram showing a configuration of an access control apparatus for a home device according to an embodiment of the present invention, and FIG. 3 is a block diagram showing a configuration of an access control apparatus for a home gateway according to an embodiment of the present invention. to be.

As shown in FIG. 1, the home network system 100 includes a plurality of home devices 110, a home gateway 120, and a client 130.

The home device 110 is a device that communicates with the home gateway 120 or another home device 110 and provides a service according to a control message for controlling device functions received from inside / outside. Means intelligent devices such as heating systems and PCs.

The home gateway 120 manages a plurality of home devices 110 to be connected and communicate with each home device 110 to provide a home network service.

The client 130 accesses the home device 110 or the home gateway 120 to make a service request for any one of the services provided by the home device 110. For example, the client 130 may be based on security credentials such as an administrator level having access to access all services in the home network system 100 and a general user level having lower service access rights than the administrator level. It may be classified into a plurality of security levels.

The client 130 refers to a user requesting to use any service provided by the home device 110 by accessing any one of the plurality of home devices 110. In practice, in one embodiment of the present invention, the client 130 is a user terminal generating data under the control of the user, or a user interface provided by the home device 110 or the home gateway 120. The user may input the data through the user itself.

On the other hand, the home device 110 and the home gateway 120 according to an embodiment of the present invention includes an access control device (200, 300) for controlling the access of the client 130, respectively. In FIG. 1, although the access control apparatuses 200 and 300 according to an embodiment of the present invention are shown to be included in the home device 110 and the home gateway 120, the two access control apparatuses 200 and 300 may be described. It may be configured independently on the home network system 100 as one device.

In the home network system 100 according to an embodiment of the present invention, the home device 110 and the home gateway 120 may have a 'privacy policy' according to a preset security importance for a service provided for each home device 110. Apply an access control policy that is classified as a general information policy with a lower security level than a privacy policy.

In this case, when the client 130 requests access to the home device 110, the access control apparatus 200 of the home device 110 checks the security credentials of the client 130 and sets a corresponding access control policy. After that, the certificate of access authority is issued according to the access control policy. In addition, the access control apparatus 200 of the home device 110 performs an access control process and a service process according to the type of access control policy applied based on the information of the service requested by the client 130 and the access authority certificate.

Specifically, as shown in FIG. 2, the home device 110 according to an embodiment of the present invention may include an access control policy setting unit 210, an access authority certificate issuing unit 220, and an access control processing unit 230. It is configured to include an access control device 200 that includes.

The access control policy setting unit 210 sets an access control policy of any one of a personal information policy and a general information policy for at least one service provided by the home device 110, and sets the set access control policy to the service type. Match and save. The access control policy setting unit 210 transmits the type of the stored access control policy to the home gateway 120 to be stored.

At this time, the access control policy setting unit 210 according to an embodiment of the present invention receives the type of access control policy for each service from the home network system administrator connected to the home device 110 in advance and the range of authority for each service type. You can set an access control policy.

To this end, the access control policy setting unit 210 according to an embodiment of the present invention for the access rights setting management to enable the administrator (or authority) of the home network system to change or delete the preset access control policy for each service. The interface may be provided through the home device 110. In addition, the access control policy setting unit 210 stores the access control policy information for each service of the home device 110 set by the administrator in all the home devices 110 and the home gateway 120 registered in the home network system 100. By transmitting to and stored in, the client 130 can check the access control policy of the service for each home device no matter what home device and home gateway access.

The access authority certificate issuer 220 directly accesses the home device 110 or receives an access request from the client 130 connected through the home gateway 120, and the client 130 according to a predetermined security credential. Determine and set the access control policy suitable for the security qualification.

In this case, when the security entitlement of the client 130 satisfies the personal information policy, the access right certificate issuing unit 220 generates a personal information certificate authorizing the access right according to the personal information policy and issues it to the client 130. . In addition, when the security entitlement of the client 130 satisfies the general information policy, the access right certificate issuing unit 220 may issue the general information certificate for authorizing the access right according to the general information policy. The authority delegation certificate is delegated so as to be issued to the home gateway 120.

For reference, the access right certificate issuing unit 220 may sign the generated access right certificate with the authentication information (eg, the secret key) of the home device 110 and transmit it to the client 130. At this time, the home gateway 120 and the client 130 have received and stored authentication information of the home device 110 corresponding to the authentication information used for the signature in advance.

The access right certificate issuer 220 according to an embodiment of the present invention may generate an access right certificate in the form of a Simple Public Key Infrastructure (SPKI) and issue it to the client 130. For reference, the SPKI certificate may contain the certificate issuer's certificate information (e.g., the signer's public key or hash value of the key), the issuer's certificate information (e.g., public key or key's hash value), and delegation of authority. Information includes, for example, an identification value preset according to whether there is a right to be delegated, an access value information (that is, identification information of an authorized access control policy), and a validity period information.

For example, the personal information certificate issued by the access right certificate issuing unit 220 may include authentication information of the home device 110 (eg, a predetermined public key of the home device) and authentication information of the client 130 ( For example, it may be configured to include a public key received from the client), non-delegated information, privacy policy identification information, and a validity period value.

The authority delegation certificate issued by the access right certificate issuing unit 220 may include authentication information (eg, a predetermined public key of the home device) of the home device 110 and authentication information (eg, the home gateway 120). For example, it may be configured to include a public key received from the home gateway), authority delegation permission information, general information policy identification information, and a validity period value.

For reference, the home gateway 120 that has received the authority delegation certificate uses an authority delegation certificate and authentication information of the client 130, and an access authority certificate authorizing a part or all of the access authority delegated through the authority delegation certificate. (Ie, a general information certificate) is generated and issued to the client 130.

The access control processor 230 receives a service request and an access authority certificate of the client 130 received directly from the home device 110 or through the home gateway 120. For reference, the service request includes information of the home device and the requested service type information of the client 130 to receive the service.

In this case, the access control processor 230 transmits the service request and the access right certificate through the home gateway 120 when the access control policy according to the type of the requested service included in the service request of the client 130 is a personal information policy. Will receive. Then, the access control processor 230 directly performs service processing for the client 130 when the type of service requested by the client 130 corresponds to the privacy policy.

In detail, the access control processor 230 refers to the type of the access control policy for each service type pre-stored by the access control policy setting unit 210, and corresponds to the type of service requested by the client 130. Check the type. Then, the access control processor 230 confirms the access authority granted to the client 130 through the access authority certificate of the client 130, and the security level according to the confirmed access authority is determined by the access control policy. It is determined whether it is included in the security level according to the type. In this case, when the identified access right is included in the security level according to the type of the identified access control policy, the service is processed based on the service request, and when the service access is not included in the security level, the service request is not processed. . That is, the access control processor 230 restricts the access of the client 130 when the access right donated to the client 130 is not sufficient for the preset access control policy for the service requested by the client 130.

 In addition, when the access control policy according to the type of request service included in the service request of the client 130 is a general information policy, the access control processor 230 generates a service control message generated by the home gateway 120 according to the service request. Will be received. At this time, the access control processor 230 performs service processing based on the service control message received from the home gateway 120, and transmits the service processing result to the client 130 through the home gateway 120.

Referring back to FIG. 1, when the client 130 requests a service to the home device 110 through the home gateway 120, the access control device 300 of the home gateway 120 requests the service requested by the client 130. The access control policy applied based on the information and the access authority certificate of the server performs access control processing and service processing according to the type.

Specifically, as shown in Figure 3, the home gateway 120 according to an embodiment of the present invention is the access control policy management unit 310, access authority certificate issuing unit 320, service request receiving unit 330, service request It is configured to include an access control device 300 including a confirmation unit 340, an access control processing unit 350.

The access control policy manager 310 receives and stores a type of access control policy for each service provided by each home device from the plurality of home devices 110.

The access right certificate issuer 320 receives the access right certificate issued for the client 130 from the home device 110 and transfers the access right certificate to the client 130 according to the type of the received access right certificate. Or issue directly.

In detail, the access right certificate issuing unit 320 transmits the personal information certificate to the client 130 when the received access right certificate is a personal information certificate according to the personal information policy. And, the access authority certificate issuing unit 320, the received access authority certificate, if the authority delegation certificate that includes the authority delegation information that permits to authorize some or all of the access authority according to the general information policy, the authorized access A general information certificate that authorizes a right is generated and issued directly to the client 130.

For reference, the general information certificate issued by the access right certificate issuing unit 320 may be an access right certificate in the SPKI format, authentication information of the home gateway 120 (for example, a public key preset in the home gateway), It may be configured to include authentication information of the client 130 (eg, a public key received from the client), non-authoritative information, general information policy identification information, and a validity period value. In addition, the access right certificate issuing unit 320 may sign the generated access right certificate with the authentication information (for example, a secret key) of the home gateway 120 and transmit it to the client 130. At this time, the client 130 has previously received and stored authentication information of the home gateway 120 corresponding to the authentication information used for the signature.

The service request receiver 330 receives a service request and an access authority certificate for the home device 110 from the client 130 and transmits the received service request to the service request checker 340.

The service request confirmation unit 340 corresponds to the request service based on the information of the request service included in the received service request and the type of the access control policy for each service of the home device previously stored through the access control policy manager 310. Determine the type of access control policy. In addition, the service request confirmation unit 340 transmits the type of the identified access control policy to the access control processor 350.

The access control processor 350 transmits the access authority certificate and the service request of the client 130 to the home device 110 when the determined type of the access control policy corresponds to the personal information policy.

If the type of the determined access control policy is a general information policy, the access control processor 350 directly processes the access authority certificate and the service request of the client 130.

In detail, if the type of the access control policy determined is the general information policy, the access control processor 350 determines whether the access right according to the access authority certificate of the client 130 is included in the security level of the general information policy, and the access When the authority is included in the general information policy, the service control message according to the service request of the client 130 is generated and transmitted to the home device 110. On the other hand, if the access authority is not included in the general information policy, the access control processor 350 disallows the service of the client 130 to limit the access of the client 130.

As such, the access control apparatuses 200 and 300 of the home device 110 and the home gateway 120 according to an embodiment of the present invention may secure the service requested by the client 130 that has previously issued the access authority certificate. When the level is in accordance with the privacy policy, the home device 110 directly processes the access authority determination and the request service processing of the client 130. In addition, when the security level of the service requested by the client 130 is an access right according to the general information policy, the home gateway 120 processes the access right determination and the request service processing of the client 130 so that the security level is increased. Ensure that access control processing is done quickly and efficiently.

Next, a client access control method in a home network system according to an embodiment of the present invention will be described in detail with reference to FIGS. 4 and 5.

4 is a flowchart illustrating a method for issuing an access right certificate according to an embodiment of the present invention.

As shown in FIG. 4, when issuing an access right certificate according to an embodiment of the present invention, the home device 110 first receives an access request of the client 130 directly or through the home gateway 120 (S410). ).

Thereafter, the security level according to the security qualification of the received client 130 is checked to set an access control policy that authorizes the corresponding authority (S420).

In this case, the access control policy is classified into a personal information policy having a relatively high security level and a general information policy having a lower security level than the personal information policy according to the security level.

Thereafter, the access right information issues a different access right certificate to the client 130 according to the type of the access control policy set (ie, security level) (S430).

In detail, in operation S430, when the set type of the access control policy is a personal information policy, a personal information certificate is generated and issued to the client 130, and when the set type of the access control policy is a general information policy, general information. The authority delegation certificate which delegates part or all of the access rights according to the policy is generated and transmitted to the home gateway 120. Then, the home gateway 120 generates a general information certificate based on the issued authority delegation certificate and transmits it to the client 130.

As such, when issuing an access right certificate according to an embodiment of the present invention, the home device 110 directly issues the access right certificate to the client 130 or through the home gateway 120 according to the security credentials of the client 130. Delegation can be issued.

5 is a flowchart illustrating an access control method according to an embodiment of the present invention.

As shown in FIG. 5, in the access control process according to an embodiment of the present invention, the home gateway 120 first services the home device 110 of the client 130 directly or through the home device 110. Receive the request (S510).

In this case, the home gateway 120 may include a service request including information of the home device 110 that the client 130 requests for the service and information on the type of the requested service, and the client 130 may issue a request from the home device 110. Receive the received access certificate.

Then, the security level of the access control policy according to the received service request is determined (S520).

In this case, an access control policy corresponding to each service of each home device 110 is preset, and in step S520, the received service request corresponds to the type of the access control policy for each service. Check the type of control policy (ie security level).

Thereafter, according to the security level of the determined access control policy, the home device 110 or the home gateway 120 performs access control processing and service processing (S530).

In detail, when the type of the access control policy (ie, the security level) according to the requested service type is the privacy policy, the service request and the access right certificate are transmitted to the home device 110 to the home device 110. To perform the access right determination and service processing of the client 130. In addition, when the type (ie, security level) of the access control policy according to the requested service type is a general information policy, the home gateway 120 directly performs the access control process and the service process. For reference, the home gateway 120 performs an access control process to determine whether to process the service by comparing the type of the access control policy according to the service request with the access authority according to the access authority certificate of the client 130.

On the other hand, the above description of the present invention is intended for illustration, and those skilled in the art can understand that the present invention can be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. There will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

And the scope of the present invention is represented by the appended claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts are included in the scope of the present invention. Should be.

100: home network system
110: home device
120: home gateway
130: client
200, 300: access control device

Claims (14)

In the method of controlling a client's access on a home network system,
(a) the home gateway receiving a service request for the home device from a client possessing a previously issued access right certificate;
(b) checking, by the home gateway, type information of a home device and a service included in the service request, and determining a type of an access control policy matching the type information; And
(c) the home gateway performing access control processing according to the type of the access control policy,
The step (a)
The home gateway receiving an access right certificate issued for the client from the home device; And
According to the type of the received access right certificate, the home gateway transferring or directly issuing the received access right certificate to the client,
The step (c)
If the type of the access control policy is a first access control policy, the service request is delivered to the home device for processing, and if the type of the access control policy is a second access control policy of a lower security level than the first access control policy. Process the service request directly;
If the type of the determined access control policy is the second access control policy,
Checking the access right certificate presented by the client to determine whether the access right authorized to the client is included in the second access control policy; And
If the access right is included in the second access control policy, generating and transmitting a home device control message according to the service request to the home device,
If the type of the determined access control policy is the first access control policy,
And transmitting the access right certificate and the service request presented by the client to the home device. The method of claim 1,
Before the step (a)
Receiving type information of a service according to the first access control policy and type information of a service according to the second access control policy that the home device sets and transmits; And
And matching and storing the type information of the service according to the type of the access control policy. The method of claim 1,
The access authority certificate,
A first access right certificate having a right to access a service according to the first access control policy and a second access right certificate having a right to access a service according to the second access control policy,
And at least one of issuer authentication information, issuer authentication information, authority delegation information, access control policy type information, and validity period information. delete In a method for authorizing access rights to a client on a home network system,
(a) a home device receiving an access request of the client directly or through a home gateway;
(b) determining, by the home device, an access control policy that satisfies the security credential of the client according to a preset security credential; And
(c) the home device issuing an access right certificate to the client according to a type of access control policy in which the security credentials of the client are satisfied,
When issuing the access right certificate,
When the security credential of the client satisfies a preset first access control policy, a first access right certificate for authorizing an access right according to the first access control policy is issued to the client.
A second access right for authorizing the client with access rights according to the second access control policy to the home gateway when the security entitlement of the client satisfies a second access control policy having a lower security level than the first access control policy. Delegates to issue certificates,
In the step (c)
And transmitting a third access authority certificate to the home gateway, the third access authority certificate including authority delegation information for authorizing a part or all of the access authority according to the second access control policy. . delete The method of claim 5, wherein
Before the step (a)
Setting, by the home device, a type of an access control policy corresponding to each type of service based on a preset security level; And
And matching, by the home device, the type of the access control policy according to the type of the service, and transmitting the same to the home gateway. The method according to claim 5 or 7,
And a type and a range of authority of the access control policy are set according to configuration information inputted from an administrator authorized to access the home device in advance. An apparatus for controlling client access on a home network, the apparatus comprising:
An access control policy manager to receive and store types of access control policies for each service provided by each home device from a plurality of home devices;
A service request receiving unit receiving an access authority certificate and a service request from a client requesting a service provided by the home device;
A service request confirmation unit determining a type of an access control policy corresponding to the requested service based on the information of the requested service included in the service request and the type of the access control policy for each service of the stored home device;
When the determined type of the access control policy corresponds to the first access control policy among the access control policies, the client access rights certificate and the service request are transmitted to the home device, and the determined type of the access control policy is the first. An access control processor configured to cause a home gateway to process an access right certificate and a service request of the client when the second access control policy has a lower security level than an access control policy; And
An access right certificate received for the client from the home device, and according to the type of the received access right certificate, the home gateway to forward or directly issue the received access right certificate to the client Including issuers,
And the access right certificate of the client is previously issued from the home device based on the security credentials of the client. The method of claim 9,
The access control processing unit,
When the type of the determined access control policy corresponds to the second access control policy, it is determined whether an access right according to the access right certificate of the client is included in the second access control policy,
And when the access right is included in the second access control policy, the home gateway generates a service control message according to the service request and transmits the service control message to the home device. The method of claim 9,
The access right certificate issuing unit,
When the received access right certificate is a first access right certificate according to the first access control policy, to deliver the first access right certificate to the client,
A second access right certificate for authorizing the authorized access right when the received access right certificate is access right certificate including authority delegation information for authorizing a part or all of the access right according to the second access control policy; Access control device for generating and issuing directly to the client. An apparatus for controlling client access on a home network, the apparatus comprising:
Set an access control policy of any one of a first access control policy and a second access control policy having a lower security level than the first access control policy according to a security level preset for a service provided by a home device, An access control policy setting unit that matches the set access control policy for each type and transmits the stored access control policy to a home gateway;
Set an access control policy suitable for a client requesting access to the home device directly or through the home gateway according to a predetermined security credential, and the home device sends the access right certificate according to the set access control policy to the client. An access authority certificate issuer for directly issuing or delegating issuance through the home gateway; And
Confirm the type of access control policy according to the type of service requested by the client and the type of the identified access control policy based on the service request and access authority certificate of the client received through the home gateway or directly to the home device. Including an access control processing unit for performing the access control processing according to,
The access control processing unit,
When the type of service requested by the client corresponds to the first access control policy, the home device directly performs service processing for the client, and when the type of the requested service corresponds to the second access control policy. The home device receives and processes a service control message for service processing of the client from the home gateway,
The access right certificate issuing unit,
If a security credential of the client requesting access corresponds to the first access control policy, issue a first access right certificate for authorizing an access right according to the first access control policy,
Delegating to the home gateway to issue a second access right certificate for authorizing the access right according to the second access control policy to the client when the security entitlement of the client requesting access corresponds to the second access control policy. 3 Issue a certificate of access rights,
And the third access right certificate includes authority delegation information for authorizing a part or all of the access rights of the second access control policy. delete 13. The method of claim 12,
The access control policy setting unit,
And an access control policy for setting the access control policy for the client according to security level information for each service inputted from an administrator authorized to access the home device.

Images