KR102585404B1 - Data security apparatus - Google Patents

Abstract

A data security device is disclosed. The data security device of the present invention includes a local server that moves bits of data transmitted from a DCU (Date Concentration Unit); a Front End Processor (FEP) server that resets files that have been bit-shifted by the local server; a detoxification system that detoxifies files placed by the FEP server; an MDMS (Meter Data Management System) server that receives files returned by the FEP server from the FEP server and delivers them to the decryption system; An obfuscation system that obfuscates files delivered from the MDMS server; and an integrated server that receives and stores files decrypted by the deobfuscation system from the MDMS server, and transmits the files delivered from the MDMS server to the obfuscation system to be obfuscated.

Description

DATA SECURITY APPARATUS}

The present invention relates to a data security device, and more specifically, to a data security device that protects data and development source code generated in an MDMS system (Meter Data Management System) environment and improves data reliability.

MDMS (Meter Data Management System) currently collects, verifies, aggregates and manages metering data from AMI (Advanced Metering Infrastructure) customers. MDMS provides data through the AOS (AMI Operating System) site or services such as Power Planner (placebo/challenge detection, GIS information, and services for the elderly living alone). However, there is a possibility of hacking incidents in these systems, and AMI, a core technology of smart grid, must safely protect the data and source code transmitted from the consumer's smart meter (100) to the MDMS from external cyber attacks.

Because reliability and security are important for AMI measurement data and source code, it is necessary to develop technology, system, and provide security services (confidentiality, authentication, packing, and non-repudiation, etc.) for data and source code. In other words, it is a very important technology that determines the reliability and security of data (electricity usage, personal information, address, card number, source code, etc.) and customers, and a data security system for this is absolutely necessary.

Conventional MDMS systems do not take security measures for data and code when storing data, uploading JavaScript to a web server, or managing source code, so information is easily opened when stolen from outside or inside. If such data, such as key information of individuals or national organizations, is passed over to a malicious attacker, there is a high possibility that enormous financial damage will occur due to data containing personal information, development source code, etc. Because of these shortcomings, a data security system that can block in advance if stolen by external or internal attacks is needed.

In addition, because the conventional MDMS system transmits data in plain text and does not perform packing processes such as obfuscation and deobfuscation of data and source code, data and source code can be easily exposed to external attackers or communicate with unauthorized devices. It has the disadvantage of leaking data containing important information such as power usage or personal information, making it very unreliable.

The background technology of the present invention is disclosed in ‘Application code obfuscation device and method’ in Korean Patent Publication No. 10-1328012.

The present invention was created to improve the above-mentioned problems, and the purpose of one aspect of the present invention is to provide a data security device that safely protects data and source code transmitted from the consumer's smart meter to the MDMS from external cyber attacks. There is.

A data security device according to one aspect of the present invention includes a local server that moves bits of data transmitted from a Date Concentration Unit (DCU); a Front End Processor (FEP) server that resets files bit-shifted by the local server; a decryption system that decrypts files relocated by the FEP server; an MDMS (Meter Data Management System) server that receives a file returned by the FEP server from the FEP server and delivers it to the decryption system; An obfuscation system that obfuscates files delivered from the MDMS server; and an integrated server that receives and stores files decrypted by the deobfuscation system from the MDMS server and transmits the files delivered from the MDMS server to the obfuscation system to obfuscate them, and the local server. The data transferred from the DCU is moved bit by file using a random number, and the decryption system inserts a sequence number into the file before detoxification and uploads it to the detoxification module in the order of the sequence number to pass authentication. It is characterized by allowing data to be viewed only in .

The data security device according to one aspect of the present invention safely protects data and source code transmitted from the consumer's smart meter to the MDMS from external cyber attacks. In particular, the data security device according to one aspect of the present invention can respond to sniffing attacks by moving bits about data, and improves the readability of the source code through source code obfuscation to convert it into a code that is difficult to see from the outside, providing advanced technology. Leakage can be prevented and the security of the MDMS system can be improved by allowing only authorized devices to read the data.

1 is a block diagram of a data security device according to an embodiment of the present invention.
Figure 2 is a diagram showing an example of conventional JavaScript obfuscation.
Figure 3 is a diagram showing an example of string value obfuscation conversion according to an embodiment of the present invention.
Figure 4 is a diagram showing a conventional Power Planner web obfuscation code.
Figure 5 is a diagram showing the Power Planner web obfuscation code according to an embodiment of the present invention.
Figure 6 is a diagram showing an example of a binary deobfuscation process according to an embodiment of the present invention.
Figure 7 is a diagram showing the process of the detoxification module according to an embodiment of the present invention.

Hereinafter, a data security device according to an embodiment of the present invention will be described in detail with reference to the attached drawings. In this process, the thickness of lines or sizes of components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are terms defined in consideration of functions in the present invention, and may vary depending on the intention or custom of the user or operator. Therefore, definitions of these terms should be made based on the content throughout this specification.

Implementations described herein may be implemented, for example, as a method or process, device, software program, data stream, or signal. Although discussed only in the context of a single form of implementation (eg, only as a method), implementations of the features discussed may also be implemented in other forms (eg, devices or programs). The device may be implemented with appropriate hardware, software, firmware, etc. The method may be implemented in a device such as a processor, which generally refers to a processing device that includes a computer, microprocessor, integrated circuit, or programmable logic device. Processors also include communication devices such as computers, cell phones, portable/personal digital assistants (“PDAs”) and other devices that facilitate communication of information between end-users.

Figure 1 is a block diagram of a data security device according to an embodiment of the present invention, Figure 2 is a diagram showing a conventional JavaScript obfuscation example, and Figure 3 is a string value obfuscation according to an embodiment of the present invention. This is a diagram showing an example of conversion, Figure 4 is a diagram showing a conventional Power Planner web obfuscation code, Figure 5 is a diagram showing a Power Planner web obfuscation code according to an embodiment of the present invention, and Figure 6 is a diagram showing the present invention. This is a diagram showing an example of a binary deobfuscation process according to an embodiment of the present invention, and FIG. 7 is a diagram showing a process of a deobfuscation module according to an embodiment of the present invention.

Referring to Figure 1, the data security device according to an embodiment of the present invention includes a smart meter 100, a Date Concentration Unit (DCU) 200, a local server 300, an integrated server 400, and an obfuscation system ( 410), a FEP server 500, an MDMS server 600, and a decryption system 610.

The smart meter 100 is installed at each customer and periodically reads data such as electricity usage LP (hourly usage) data, active power, reactive power, power factor, ID, and meter reading time.

The DCU (200) collects the data measured by each smart meter (100), divides the collected data into low-pressure data and high-pressure data, and then sends the low-pressure data to the local server (300). and transmits the high-pressure data to the integrated server 400.

When installing an existing system, the local server 300 applies the data transmitted from the DCU 200 to the bit movement module with a random number (nonce) based on the policy by the security officer to move the bits for each file unit, and then moves the bits by FEP ( It is delivered to the Front End Processor server (500).

The FEP server 500 returns the bit-shifted files received to their original positions and delivers them to the MDMS server 600.

The MDMS server 600 inputs the collected files into the decryption system 610 and attaches a special code to the file format. In files with these special codes attached, customer data is classified (low/high pressure, contract type, etc.) through a business process and stored in the integrated server 400.

The AOS (AMI Operating System) management page and Power Planner website provide data stored in the integrated server 400 to managers or customers, and for this, an obfuscation function is required.

The integration server 400 obfuscates the corresponding source codes through the obfuscation system 410 and uploads the output code to the web server.

Referring to Figure 2, the results are shown when conventional HTML, CSS, and JavaScript codes are obfuscated with public tools. As shown in FIG. 2, in the related art, unnecessary source code is added to reduce the readability of the existing code, so some source code may be visible when unpacked using another public tool and de-extracted again. Therefore, it may not be suitable for MDMS source code (HTML, CSS, JavaScript, etc.).

However, the obfuscation system 410 according to an embodiment of the present invention reduces the readability of the code by converting the string value into an octal or hexadecimal number in the process of obfuscating the script source code. .

In other words, as shown in FIG. 3, the obfuscation system 410 converts the string value into octal, hexadecimal, etc., thereby losing the sentence power that can be known from the existing alphabet, thereby improving the readability of the code. It degrades. Here, in order to improve readability, readability can be improved again by further upgrading with a public SW (Software Tool) tool, thereby increasing the safety of code protection when externally distributing the source code.

Figure 4 shows the results of obfuscating some codes on the existing Power Planner website. Here, hexadecimal conversion was performed and a test.jsp file for the corresponding code was created. There is an advantage in being able to safely distribute data through an obfuscation module when using the jsp file by uploading it to a web server or transferring the source code to an external source.

Figure 5 shows the improved code in the proposed obfuscation module.

However, the obfuscation system 410 in this embodiment can optimize the code by selecting the code conversion base, converting the data of the source code, and then improving readability and compressing it through a preset obfuscation SW tool. This obfuscation system 410 has the advantage of improving source code protection and download performance because it uses code readability using the above code conversion and already verified public tools.

Referring to FIG. 6, the deobfuscation system 610 performs a deobfuscation process to prevent external leakage of not only the obfuscated source code but also data files created in the MDMS.

As shown in FIG. 6, the deobfuscation system 610 inserts a sequence number into the file before deobfuscation and uploads it to the deobfuscation module in order of the sequence number, allowing the corresponding data to be viewed only on servers that have passed authentication.

Referring to Figure 6, when the file is read or written on an unauthenticated server, the contents are automatically deleted through an internally inserted code so that the actual data cannot be viewed.

To this end, the decryption system 610 inserts the authentication value into the .data area of the data format as shown in FIG. 7.

First, the decryption system 610 sends the MAC address of the local server 300 (48-bit identification code such as A6:C7), data of the generated file to be transmitted, file creation time, and file creation sequence to the deobfuscation module. Enter.

In this embodiment, where the deobfuscating system 610 merges four ordered lists into an authentication value, the authentication value is indicated as SH_A6_TEAF13001. For example, if the regional headquarters is Seoul Headquarters, SH (Seoul Headquarters), A6 may be the MAC address of the server LAN card, and TEAF may be the first letters of Two Thousand August Friday. 13 represents the creation time, and 001 is the file creation sequence.

These authentication values can be modified and used in various forms through administrator policies.

Next, the decryption system 610 inserts the authentication value into the .data area of the ELF file format, and transmits it in the form of a network packet such as IPv4 or IPv6 when transmitting data. At this time, the authentication value is inserted into the Header Checksum area. . Here, the area where the authentication value is stored can be changed. In this embodiment, the authentication value is inserted into the header checksum.

When sending the authentication value to another server, the decryption system 610 encrypts the authentication value and sends it, and the server (not shown) that receives it must decrypt it, enter it into the decryption module system (not shown), and then unlock it to use it. possible. When the decryption module system of the received server releases the lock, the previously described MAC address is omitted, and the lock must be released by modifying it to the value inserted into the existing security manager and internal server CPU processor at the time of initial installation.

If the server's decryption module system fails the process of releasing the lock N times, the data is transformed into an unreadable form as shown in Step 3 of FIG. 6. Also, if an insider leaks data to the outside, not only is there no module to unlock the code, but even if a separate program is written, if the internal work process (only the top administrator) is not known, the stolen data cannot be easily unlocked. The contents become unreadable.

In this way, the data security device according to an embodiment of the present invention safely protects data and source code transmitted from the consumer's smart meter to the MDMS from external cyber attacks. In particular, the data security device according to an embodiment of the present invention can respond to sniffing attacks by moving bits about data, and improves the readability of the source code through source code obfuscation and converts it into code that is difficult to see from the outside, thereby providing advanced technology. Leakage of data can be prevented, and the security of the MDMS system can be improved by allowing only authorized devices to read the data.

The present invention has been described with reference to the embodiments shown in the drawings, but these are merely illustrative, and those skilled in the art will recognize that various modifications and other equivalent embodiments can be made therefrom. You will understand. Therefore, the true technical protection scope of the present invention should be determined by the scope of the patent claims below.

100: Smart Meter 200: DCU
300: Local server 400: Integrated server
410: Obfuscation system 500: FEP server
600: MDMS server 610: Bulldog system

Claims (1)

a local server that bit-shifts data delivered from a Date Concentration Unit (DCU);
a Front End Processor (FEP) server that resets files bit-shifted by the local server;
a decryption system that decrypts files relocated by the FEP server;
an MDMS (Meter Data Management System) server that receives a file returned by the FEP server from the FEP server and delivers it to the decryption system;
An obfuscation system that obfuscates files delivered from the MDMS server; and
An integrated server that receives and stores files decrypted by the deobfuscation system from the MDMS server and transmits the files received from the MDMS server to the obfuscation system to obfuscate them,
The local server moves the data transmitted from the DCU bit by file unit using a random number,
The decryption system is a data security device characterized in that it inserts a sequence number into the file before decryption and uploads it to the deobfuscation module in the order of the sequence number, allowing the data to be viewed only on a server that has passed authentication.