Method and apparatus for access control on ship network
A ship network access control method may comprise: receiving, from an agent installed in a specific sub-network among sub-networks of the ship network, a registration request message requesting registration based on an agent certificate, and verifying the agent certificate; in response to determining that the agent certificate is valid, transmitting, to the agent, agent registration information for the agent; receiving, from the agent, a connection request message generated based on the agent registration information, and verifying the agent registration information; in response to determining that the agent registration information is successfully verified, performing a mutual authentication protocol with the agent; and determining whether to allow a connection between the first terminal and a second terminal located in another sub-network of the ship network or an external network according to an authority of the agent.
1. A ship network access control method performed by an access control apparatus connected to a ship network, the ship network access control method comprising:
receiving, from a first authentication controller agent installed in a first sub-network among sub-networks of the ship network, a registration request message requesting registration based on a first certificate, and verifying validity of the first certificate;
in response to determining that the first certificate is valid, transmitting, to the first authentication controller agent, registration information for the first authentication controller agent;
receiving, from a second authentication controller agent installed in a second sub-network among sub-networks of the ship network, a registration request message requesting registration based on a second certificate, and verifying validity of the second certificate;
in response to determining that the second certificate is valid, transmitting, to the second authentication controller agent, registration information for the second authentication controller agent;
receiving, from the first authentication controller agent or the second authentication controller agent, a connection request message generated based on the registration information, and verifying an authority of the first or the second authentication controller agent according to the reception of the connection request message;
in response to determining that the authority of the first or the second authentication controller agent is verified, for performing a mutual authentication protocol with the first or the second authentication controller agent, transmitting a list or information on a service provided by the second authentication controller agent and the registration confirmation information to be used in a connection procedure to the first authentication controller agent, or a list or information on a service provided by the first authentication controller agent and registration confirmation information to be used in a connection procedure to the second authentication controller agent; and
determining whether to allow a connection between a first terminal in the first sub-network and a second terminal located in the second sub-network of the ship network or between the first terminal or the second terminal and a terminal in an external network according to the authority of the first or the second authentication controller agent,
wherein the registration confirmation information is used to verify information required for connection between the first authentication controller agent and the second authentication controller agent, and information required for connection between the first authentication controller agent or the second authentication controller agent and the terminal in the external network, before performing the mutual authentication protocol.
2. The ship network access control method according to claim 1 , wherein the registration information of the first authentication controller agent includes a public key of the first terminal, a unique identification value capable of identifying the first terminal, and an access token.
3. The ship network access control method according to claim 2 , wherein the access token includes a value for verifying whether the first terminal is authorized to access resources within the ship network.
4. The ship network access control method according to claim 1 , further comprising, in response to identifying the authority of the first authentication controller agent, transmitting, to the first terminal, the registration confirmation information for the second terminal or the second authentication controller agent,
wherein the registration confirmation information includes authentication information of an existing registration confirmation information used in a registration procedure of the first or the second authentication controller agent.
5. The ship network access control method according to claim 4 , further comprising, when the first terminal performs a connection procedure to the second terminal based on the registration confirmation information for the second terminal or the second authentication controller agent, allowing or blocking data traffic between sub-networks or access between the sub-networks and an external network based on authentication through the access control apparatus installed at an upper end of the sub-networks.
6. The ship network access control method according to claim 1 , wherein in the performing of the mutual authentication protocol, information on a service provided by the first authentication controller agent is received, and the information on the service includes an Internet protocol (IP) address, a port, and an identifier of the service.
7. The ship network access control method according to claim 1 , wherein the sub-networks are connected to an authentication-based network access control channel of the ship network access control apparatus through gateways respectively installed in the sub-networks.
8. The ship network access control method according to claim 1 , wherein the first or the second authentication controller agent includes a first agent of a host agent type that is installed in a specific terminal within the ship network or a second agent of a gateway type that is coupled with a switch of a sub-network to which another specific terminal in which the first agent is not installed belongs.
9. The ship network access control method according to claim 1 , further comprising controlling access to the first terminal so that data traffic of the second terminal from the second sub-network or data traffic from the terminal of the external network is denied, wherein the data traffic is data traffic that is not permitted to access to the first sub-network.
10. A ship network access control apparatus for a ship network, comprising:
a transceiver connected to the ship network;
a memory storing at least one command; and
at least one processor connected with the transceiver and the memory, wherein the at least one command causes the at least one processor to:
receive, from a first authentication controller agent installed in a first sub-network among sub-networks of the ship network, a registration request message requesting registration based on a first certificate, and verify validity of the first certificate;
in response to determining that the first certificate is valid, transmit, to the first authentication controller agent, registration information for the first authentication controller agent;
receive, from a second authentication controller agent installed in a second sub-network among sub-networks of the ship network, a registration request message requesting registration based on a second certificate, and verifying validity of the second certificate;
in response to determining that the second certificate is valid, transmit, to the second authentication controller agent, registration information for the second authentication controller agent;
receive, from the first authentication controller agent or the second authentication controller agent, a connection request message generated based on the registration information, and verify an authority of the first or the second authentication controller agent according to the reception of the connection request message;
in response to determining that the authority of the first or the second authentication controller agent is verified, for performing a mutual authentication protocol with the first or the second authentication controller agent, transmitting a list or information on a service provided by the second authentication controller agent and registration confirmation information to be used in a connection procedure to the first authentication controller agent, or a list or information on a service provided by the first authentication controller agent and the registration confirmation information to be used in a connection procedure to the second authentication controller agent; and
determine whether to allow a connection between a first terminal in the first sub-network and a second terminal located in the second sub-network of the ship network or between the first terminal or the second terminal and a terminal in an external network according to the authority of the first or the second authentication controller agent,
wherein the registration confirmation information is used to verify information required for connection between the first authentication controller agent and the second authentication controller agent, and information required for connection between the first authentication controller agent or the second authentication controller agent and the terminal in the external network, before performing the mutual authentication protocol.
11. The ship network access control apparatus according to claim 10 , wherein the registration information of the first authentication controller agent includes a public key of the first terminal, a unique identification value capable of identifying the first terminal, and an access token.
12. The ship network access control apparatus according to claim 11 , wherein the access token includes a value for verifying whether the first terminal is authorized to access resources within the ship network.
13. The ship network access control apparatus according to claim 10 , wherein the at least one command further causes the at least one processor to:
in response to identifying the authority of the first authentication controller agent, transmit, to the first terminal, the registration confirmation information for the second terminal or the second authentication controller agent,
wherein the registration confirmation information includes authentication information of an existing registration confirmation information used in a registration procedure of the first or the second authentication controller agent.
14. The ship network access control apparatus according to claim 13 , wherein the at least one command further causes the at least one processor to: when the first terminal performs a connection procedure to the second terminal based on the registration information or the registration confirmation information for the second terminal or the second authentication controller agent, allow or block data traffic between sub-networks or access between the sub-networks and an external network based on authentication through the access control apparatus installed at an upper end of the sub-networks.
15. The ship network access control apparatus according to claim 10 , wherein the at least one command further causes the at least one processor to receive, from the first authentication controller agent, information on a service provided by the first authentication controller agent for performing the mutual authentication protocol, wherein the information on the service includes an Internet protocol (IP) address, a port, and an identifier of the service.
16. The ship network access control apparatus according to claim 10 , wherein the sub-networks are connected to an authentication-based network access control channel of the ship network access control apparatus through gateways respectively installed in the sub-networks.
17. The ship network access control apparatus according to claim 10 , wherein the first or the second authentication controller agent includes a first agent of a host agent type that is installed in a specific terminal within the ship network or a second agent of a gateway type that is coupled with a switch of a sub-network to which another specific terminal in which the first agent is not installed belongs.
18. The ship network access control apparatus according to claim 10 , wherein the at least one command further causes the at least one processor to control access to the first terminal so that data traffic of the second terminal from the second sub-network or data traffic from the terminal of the external network is denied, wherein the data traffic is data traffic that is not permitted to access to the first sub-network.