KR100802434B1 - System and Method for Network Guard using Dynamic Telnet Port - Google Patents

Abstract

In the present invention, for the systematic and stable security management in the TCP / IP connection classification system, an external port allocated by the kernel using dynamic port allocation is used from the outside using the telnet port. Dynamic telnet port allocation that can effectively respond to system recovery in the shortest time in case of fatal problem caused by user's mistake or intentional attempt by using the logging function after the trusted server is blocked from the network. It provides a network intrusion prevention system and a method thereof.

Network, Dynamic Telnet Port, Intrusion Prevention, Hacking, Telnet, TCP / IP, Host, Security

Description

System intrusion prevention system using dynamic telnet port and method thereof {System and Method for Network Guard using Dynamic Telnet Port}             

1 is a configuration diagram of a general telnet service.

Figure 2 is an illustration of one embodiment of a telnet connection method for preventing network intrusion in accordance with the present invention.

Figure 3 is an illustration of one embodiment of a network intrusion prevention system according to the present invention.

4 is a diagram illustrating an embodiment of a method of changing a telnet port according to the present invention;

5 is a flowchart illustrating an embodiment of an NGS security authentication method according to the present invention;

Figure 6 is an embodiment overall configuration diagram of a network intrusion prevention system according to the present invention.

7 is an exemplary view of an initial screen of NGS according to the present invention;

8 is an exemplary view of a Telnet access user authentication screen according to the present invention.

9 is an exemplary view of a Telnet port inquiry screen according to the present invention.

Figure 10 is an exemplary view of a telnet port query screen in accordance with the present invention.

11 is an exemplary view of a master password screen according to the present invention.

12 is an exemplary view of a master password change screen according to the present invention.

Figure 13 is an exemplary view of a port reset screen according to the present invention.                 

14 is another exemplary view of a port reset screen according to the present invention.

15A and 15B are exemplary views of a log view screen according to the present invention.

* Explanation of symbols for the main parts of the drawings

310: Client 320: NGS Server 330: NGS Client

The present invention is a network intrusion prevention system that can limit the remote access by using a dynamic telnet port in the transmission control protocol / Internet (hereinafter referred to as "TCP / IP") network communication And a computer readable recording medium storing the method and a program for realizing the method.

TCP / IP's connection classification scheme has the following weaknesses in security.

First, as the authentication problem of the host, only the IP address and port of the connection request server are used for authentication of the host, and thus, the advantage is used when the IP address and service port of the target server are known. Hacking is possible enough. An example of such a hack is an IP Spoofing attack that exploits the weaknesses of TCP / IP communication. Spoofing means "to cheat", and in the traditional sense, an attacker authenticates other machines as a machine by forging packets from a trusted host. . In other words, it is a method of disguising the system used by the intruder to infiltrate the original host.

Next, as a problem of trusted users, users who are allowed to access the server internally and externally have difficulty in securing passwords, and intentionally or inadvertently delete important configuration files and parameters. (Parameter) Changes, process kills, and reboots can cause problems such as catastrophic damage to services and servers.

On the other hand, the security problem in the network is to build a firewall system most suitable for a given environment, but due to many considerations, it is not easy. To make this choice, you should carefully consider the cost of deployment, the technology you use, the information you need to protect, your security policies, and your organization's network policies, to choose the firewall system that is most appropriate for your network.

The problem with network security is that TCP / IP itself is vulnerable to security. In other words, the protocol was not designed with security in mind.

Another problem is that since the Internet is a collection of routers, data is transferred depending on the routers of other organizations that route data in addition to the sender and the receiver, and the control of each router is managed. It happens because you can't.

In addition, in access control, it is illegal to check whether access is allowed from the allowed system and whether the destination system to be communicated with is desired, determine whether to allow or not, and determine whether to access the network resource and then determine whether to access. The illegal access and destruction of resources to intruders should be prevented.

The present invention has been proposed to solve the above problems, and the temporary allocation to the kernel by using Dynamic Port Allocation for systematic and stable security management in the TCP / IP connection classification scheme Use the phenet port to block the Ephemeral Port from the outside of the network, and use the logging function after authenticating the trusted user to minimize the fatal problem caused by user's mistake or intentional attempt. It is an object of the present invention to provide a network intrusion prevention system using a dynamic telnet port assignment that can effectively cope with system recovery in time, and a method and a computer-readable recording medium recording a program for realizing the method.

In the method of the present invention for achieving the above object, in a network intrusion prevention system, a user accessing a user connected through an ephemeral port through an authentication process, the user inputs a server name to which the user wants to access a registered port. Connecting means for connecting to the Telnet server by number; And an unused port number random generation function, a telnet daemon port modification function in a service file, a change port number notification function to the access means, and random generation of the unused port number upon receiving a port request from the access means. And a connection change means for changing the telnet port number through the function and informing the connection means of the changed telnet port number.

On the other hand, the method of the present invention, in the network intrusion prevention method using a network intrusion prevention system, when the user terminal is connected through the Ephemeral Port (Ephemeral Port), the first step of performing authentication; A second step of accessing a telnet server with a corresponding port number to a registered server when server information to be accessed is input from the user terminal; A third step of randomly generating an unused port number at the request of the telnet server and changing the telnet daemon port of the corresponding target host in a service file; A fourth step of notifying the telnet server of the changed telnet port number; And a fifth step of accessing a target host using the changed telnet port number and generating a log file.

On the other hand, the present invention, in the network intrusion prevention system having a processor, when the user terminal is connected through an ephemeral port, the first step of performing authentication; A second step of accessing a telnet server with a corresponding port number to a registered server when server information to be accessed is input from the user terminal; A third step of randomly generating an unused port number at the request of the telnet server and changing the telnet daemon port of the corresponding target host in a service file; A fourth step of notifying the telnet server of the changed telnet port number; And a computer-readable recording medium having recorded thereon a program for executing a fifth step of accessing a target host using the changed Telnet port number and generating a log file.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary configuration diagram of a general telnet service.                     

In the figure, "100" represents a client, "110" represents TCP / IP, and "120" represents a server, respectively.

The client 100 includes a user terminal 101, a telnet client 102, and an operating system 103.

In addition, the server 120 includes a telnet server 121 and an operating system 122.

In the client 100, the telnet client 102 reads the content that the user wants to send from the user terminal 101 and sends it to the server.

The server receives the content transmitted from the client 100 and sends the content to another terminal which is not determined.

The operating system 103 of the client 100 and the operating system 122 of the server 120 control the operation of the client 100 and the server 120, respectively.

On the other hand, the TCP / IP connection of telnet consists of five elements.

That is, the protocol related to Transmission Control Protocol (TCP), the local host IP address of the connecting client, the local port number of the temporary port of the connecting client, and the external host IP address of the target server. Host IP Address) and the Foreign Port Number of the Well-Known Port of the target server.

Here, the Well-Known Port Number is a reserved port registered in the "/ etc / services file" of the operating system (OS). The reserved port is shown in Table 1 below.

service Port number Remarks ftp 21 / tcp file transfer protocol telnet 23 / tcp smtp 25 / tcp Simple Mail Transfer Protocol time 37 / tcp timeserver snmp 161 / tcp Simple Network Management Protocol login 513 / tcp

The temporary port number is a port allocated by the kernel according to a user's process request, and is automatically returned to the system when the application program terminates.

2 is a diagram illustrating an embodiment of a telnet connection method for preventing network intrusion according to the present invention.

As shown in FIG. 2, a telnet connection is established when Host A 210 attempts to telnet 211 to Host B 220, and Host A 210 assigns an Ephemeral Port for telnet access. Receive. Here, it is assumed that the temporary port allocated by the host A 210 is "4000".

On the other hand, the host B 220 is always open "23" to the well-non-port to receive the telnet (211) request from the remote (Remote).

Host B 220 accepts the connection request from host A 210 and creates a child process 222 for continuous Telnet service.

That is, the Telnet service of Host A 210 and Host B 220 uses the TCP protocol, the local host IP address becomes "100.100.100.1", the local port number becomes "4000", and the external host IP address. Becomes "100.100.100.2" and the external port number becomes "23".

3 is a diagram illustrating an embodiment of a network intrusion prevention system according to the present invention.

In the figure, "310" represents a client, "320" represents an NGS server, and "330" represents an NGS client, respectively.

Network Intrusion Prevention System (hereinafter referred to as "NGS") is composed of GWS (?) And GWC (?), And GWC should be installed on each security management target server.

By changing the dynamic port for telnet connection, you can control telnet remote access regardless of external or internal network interworking, and for all commands executed by the authenticated accessor By supporting logging, hacking prevention and monitoring of external accessor can be prevented, and in case of a failure, the cause can be easily detected and the server can be recovered in the shortest time.

In addition, it is designed to be easily applied to general services such as FTP and SMTP in consideration of the scalability of TCP / IP security, and can be individually applied according to the severity of security in the future.

In addition, it is developed to be applied to the UNIX operating system (UNIX OS), which is an open system, and is applicable to extension.

The NGS is largely composed of the NGS server 320 and the NGS client 330.                     

First, when the user enters the telnet port "23", the NGS server 320 outputs an authentication prompt and performs an authentication process. The NGS server 320 receives an NGS client ( 330) After accessing the telnet server with the corresponding port number to the server registered in the list, all input / output data is managed as a daily log file. Here, the daily log file can be monitored in real time and stored in the NGS client 330 change port number list.

The NGS server 320 performs a port "23" telnet connection daemon function, an NGS client 330 telnet server connection function, an I / O data log file writing function, and an I / O data log file real-time inquiry function.

For example, the log format is as follows:

"Log Format: [Host] [Port] [HHMMSS]". For example, write "wdsnms: 6969 112534 rm * .log".

On the other hand, the process of the NGS server is composed of "tgstel" 323, "gwsd" 324, "gwss", "gwst", "gwsp", and "inet".

"tgstel" is NGS's telnet process, and "gwsd" is the GWS daemon, which handles all aspects of the NGS server daemon, including telnet authentication password generation and log generation.

"gwss" is the process of updating the telnet port number of the changed client to the "/etc/gwsd.conf" file.

"gwst" is a shell script that allows you to process "gwld" and "gwss" at once.                     

"gwsp" is a shell script that generates and inquires a master password or telnet authentication key, and generates passwords, view shell scripts, and hostnames.

"inet" is a shell script that marks the beginning and end of the "inetd" daemon.

Table 1 shows the initialization files of the NGS server.

file function /etc/gwsd.conf Internet Protocol Telnet Port Number Management File etc / gwsd.passwd.root Root password file /etc/gwsd.passwd Temporary user password file, valid only once, delete file if user uses telnet /etc/gwsd.host.temp Automatically connects to registered host, only valid once, deletes file if user uses telnet etc / gwsd.pass.conf Registered host connects automatically without inputting password /gw/log/gws.YYYYMMDD.owner.log Log files

Meanwhile, the NGS client will be described as follows.

Change the target host's telnet port by the NGS server, inform the NGS server of the change, and restart the "Inetd Daemon".

In addition, the client process runs only for NGS requests and terminates after passing port information to the NGS.

The NGS client randomly generates unused port numbers, modifies the Telnet daemon port in the service file, restarts "Inetd Daemon", and informs the NGS server of the changed port number.

The NGS client process consists of the following:

First, when it receives a request from the server side as Ngw client daemon as "gwld", it changes the telnet port number, announces the changed telnet port number on the NGS server, and restarts "Inetd Daemon".

The following is a shell script that starts and stops "Inetd Daemon" as "inet".

Table 2 shows the NGS client initialization list.

file function /tmp/inet.log Log file indicating inet exit and start /tmp/YYYYMMDD.err System error file

NGS's features include Telnet Authentication Service, Telnet Port Change, Logging / Log View, Master Authentication, Port Reset, and Current Connection View.

First of all, as a telnet authentication service function, access restriction to external network should be connected to NGS when accessing internet service system through public network by implementing connection unification. In addition, since the telnet port of each Internet service server is changed dynamically for the connection through the internal network, it must also be connected through NGS.

In addition, the authentication number is valid only once and must be given a new authentication number when requesting Telnet for the same server again.

The telnet port change feature is typically reserved for port 23 for telnet services in TCP / IP communications. This can be used to gain root damage through various methods, such as password scanning, which can cause catastrophic damage to the server.

In addition, it has a problem that it is difficult to determine the exact cause of the problem caused by the error of the person allowed to access from the outside through the authentication of the internal manager.

To prevent this hacking problem, the telnet service port can be changed dynamically as needed to prevent telnet access from the outside.

Next, as a logging function / log view function, it supports logging function for all actions that occur after the authentication process, and automatically records the history management and access history after accessing the Internet service system accessor. This enables immediate response and recovery in case of problems.

In addition, by supporting various management functions and log views for history management, administrators can easily access the access / job history.

Next, the master authentication function does not require authentication by providing a master password for accessors (eg, internal administrators) with low security severity that security officers are fully aware of when quick access to the server is required. It is a function that can be connected.

Next, the port reset function requires an external connection for server administrators and application developers to quickly solve a problem when a fatal error occurs in the application of the Internet service server. Function to restore the Telnet service port of the target server to 23 for the importance of service recovery.

Next, the Current Connections View function displays and displays the currently connected Telnet session.

4 is a diagram illustrating an embodiment of a method of changing a telnet port according to the present invention.

In the figure, "410" represents GWS and "420" represents GWC, respectively.

The GWS 410 has a "gwst" process 411 and an initialization file 412, and the GWC 420 has a "gwld" process 421, a service file 422, and an "inet" process 423. .

Meanwhile, the GWS 410 and the GWC 420 exchange data with each other using a reserved port.

5 is a flowchart illustrating an embodiment of an NGS security authentication method according to the present invention.

As shown in FIG. 5, the NGS security authentication method first receives a connection request from an external terminal (501) and determines whether to allow (502).

As a result of the determination, if not allowed, the process proceeds to the process of rejecting the connection and requesting an external terminal connection (501). At this time, logging starts (509).

Next, log in to the target host (506) and complete the task (507).

Then, the connection is closed (508). At this time, logging is terminated (510).

Figure 6 is an overall configuration diagram of an embodiment of a network intrusion prevention system according to the present invention.

As shown in FIG. 6, by applying a firewall policy, external telnets except for the NGS server are blocked by using "601" and "602" firewalls, and when the telnet is connected to the NGS server 601, the network is NGS. The server 601 is connected.

7 is an exemplary view of an NGS initial screen according to the present invention.

This is the NGS GUI that appears initially when you run NGS.

At this time, click "User authentication procedure" to start authentication.

8 is an exemplary view of a Telnet access user authentication screen according to the present invention.

After basically recording the authentication for the access requester, click on the "authentication number" to generate a random 6-digit authentication number.

9 is an exemplary view of a Telnet port inquiry screen according to the present invention.

Click Telnet Port Inquiry on the Telnet Port Inquiry screen to inquire the port.

10 is an exemplary view of a telnet port query screen according to the present invention.

It is in the form of a dialog box for querying the telnet port number. It displays the port number for the server name.

11 is an exemplary view of a master password screen according to the present invention.

By assigning a specific authentication number to a specific user, it has a function to simplify the repeated authentication process when connecting to Telnet.

Click Change master password to change the master's password.                     

12 is an exemplary view of a master password change screen according to the present invention.

Only one master password can exist and can be changed.

Therefore, the password is changed by inputting a new password from the existing password in the screen as shown in FIG.

13 is an exemplary view of a port reset screen according to the present invention.

Supports port reset for fast failover in the event of a critical system problem on a client server.

As shown in FIG. 13, when a port reset is clicked, a port may be reset.

14 is another exemplary view of a port reset screen according to the present invention.

In FIG. 13, when the port reset is clicked, the screen of FIG. 14 is displayed and the port reset is performed for the host to be reset.

15A and 15B are exemplary views illustrating a log view screen according to the present invention.

Various log queries are possible by time, vendor and user, and log view function is supported.

15B is a screen used when querying by time interval.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention has an effect of effectively controlling internal / external system access through Telnet service authentication and actively responding to hacking in network security.

Claims (5)

In the network intrusion prevention system, Access means for accessing a user who is connected through an ephemeral port via the authentication procedure, to the telnet server by inputting a server name to which the user wants to access by using the registered port number; And Random port number generation function that is not in use, Telnet daemon port modification function in the service file, and change port number notification function to the access means, and random port function generation function when the port request is received from the access means. A connection change means for changing the telnet port number through the terminal and informing the access means of the changed telnet port number; Network intrusion prevention system comprising a. The method of claim 1, The connecting means, A network intrusion prevention system comprising a telnet authentication function, a telnet port change function, a logging function, a log view function, a master authentication function, a port reset function, and a current connection view function. delete In the network intrusion prevention method using a network intrusion prevention system, A first step of performing authentication when a user terminal is connected through an ephemeral port; A second step of accessing a telnet server with a corresponding port number to a registered server when server information to be accessed is input from the user terminal; A third step of randomly generating an unused port number at the request of the telnet server and changing the telnet daemon port of the corresponding target host in a service file; A fourth step of notifying the telnet server of the changed telnet port number; And A fifth step of accessing a target host using the changed telnet port number and generating a log file Network intrusion prevention method comprising a. In a network intrusion prevention system with a processor, A first step of performing authentication when a user terminal is connected through an ephemeral port; A second step of accessing a telnet server with a corresponding port number to a registered server when server information to be accessed is input from the user terminal; A third step of randomly generating an unused port number at the request of the telnet server and changing the telnet daemon port of the corresponding target host in a service file; A fourth step of notifying the telnet server of the changed telnet port number; And A fifth step of accessing a target host using the changed telnet port number and generating a log file A computer-readable recording medium having recorded thereon a program for executing the program.

Images