CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority under 35 U.S.C. § 119 to Korean Patent Application No. 10-2019-0147924, filed in the Korean Intellectual Property Office on Nov. 18, 2019, and Korean Patent Application No. 10-2019-0171024, filed in the Korean Intellectual Property Office on Dec. 19, 2019, the entire contents of which are hereby incorporated by reference.

TECHNICAL FIELD

The present disclosure relates to a device authentication system and method in an Internet of Things (IoT) cloud and more particularly, to a system and method for generating a pair of device public and private keys for IoT device authentication by using a hardware security module (HSM) and authenticating a device by generating a device certificate with the generated public key and a device identifier (ID) through a cloud.

BACKGROUND

In general, Internet of Things (IoT) refers to a technology or an environment for collecting data of objects or the surroundings thereof by using a device with limited resources, such as a sensor, and transmitting and receiving the collected data through a wireless network. IoT is being applied to and used in various fields. For example, IoT provides a method for managing and monitoring various pieces of data of manufacturing facilities, such as a smart factory, medical equipment for real-time diagnosis and healthcare data collection, traffic facilities, such as a smart vehicle, financial payments employing smart phones or wearable devices, and the like, in real time at a remote place.

However, most of the IoT is based on a public Internet network and wireless communication, and thus an IoT device connected to a network may be the target of a malicious attacker or may be the target of a secondary attack against a legacy system such as a cloud. Consequently, it is necessary to check security problems of devices connected to the IoT or understand security states of the devices and authenticate each of the devices.

SUMMARY

The present disclosure is directed to providing a system for authenticating a device through a hardware security module (HSM) which generates a pair of public and private keys for device authentication in an Internet of Things (IoT) security cloud.

According to an aspect of the present disclosure, there is provided a system for authenticating a device through an IoT cloud by using an HSM, the system including an IoT device connectable to a cloud which provides an IoT service, and a security module connected to the IoT device and configured to generate a pair of public and private keys for authenticating the IoT device. The IoT device transmits a certificate generation request including the public key and a device identifier (ID) to an authentication server through the cloud in order to generate a device certificate.

The IoT device may receive a device certificate generated by the authentication server according to the certificate generation request, and the security module may store the private key and the device certificate.

The security module may include a security storage configured to store the private key and the device certificate.

The IoT device may encrypt the certificate generation request and transmit the encrypted certificate generation request to the authentication server, and the authentication server may decrypt the encrypted certificate generation request and generate the device certificate according to the certificate generation request.

According to another aspect of the present disclosure, there is provided an HSM for supporting device authentication through an IoT cloud, the HSM including a microcontroller unit (MCU) including an input and output module connected to an IoT device connectable to a cloud, and a security element configured to generate a pair of public and private keys for authenticating the IoT device. The security element is configured to transmit the public key to the IoT device through the input and output module so that the IoT device may transmit a certificate generation request including the public key to an authentication server through the cloud in order to generate a device certificate.

The IoT device may receive a device certificate generated by the authentication server according to the certificate generation request, and the HSM may store the private key and the device certificate.

The HSM may further include a security storage configured to store the private key and the device certificate.

According to another aspect of the present disclosure, there is provided a method of authenticating a device through a cloud by using an HSM, the method including: providing an IoT device connectable to a cloud which provides an IoT service; generating, by a security module connected to the IoT device, a pair of public and private keys for authenticating the IoT device; and transmitting, by the IoT device, a certificate generation request including the public key and a device ID to an authentication server through the cloud in order to generate a device certificate.

The method may further include: receiving, by the IoT device, a device certificate generated by the authentication server according to the certificate generation request; and storing, by the HSM, the private key and the device certificate.

