KR101141919B1 - High performance network equipment with a fuction of multi-decryption in ssl/tls sessions' traffic and data processing method of the same - Google Patents

Abstract

PURPOSE: A high performance network apparatus with a multi dencoding configuration in SSL(Secure Sockets Layer)/TLS(Transport Layer Security) traffic and a method for processing data in a high performance network are provided to process high performance and high capacity network data by performing the multi encoding of decoded traffic in the SSL session. CONSTITUTION: A decoded data management unit(50) processes data transmitted from a decoder(40). A packet detection unit(60) inspects a packet for decoded packet data in the decoded data management unit. The packet detection unit transmits a signal of a normal packet to a detected packet processing unit. The packet detection unit transmits a packet drop signal, which drops a corresponding packet determined as a packet in hacking traffic or attack traffic, to the detected packet processing unit. The detected packet processing unit receives a normal packet signal or a packet drop signal transmitted from the packet detection unit. A writer(14) processes a corresponding normal packet in the detected packet processing unit. The detected packet processing unit drops the corresponding packet when the packet drop signal drop is received.

Description

TECHNICAL FIELD [0001] The present invention relates to a high-performance network equipment and a high-performance network data processing method using a multi-decryption configuration of a DSL /

The present invention relates to a session management technique and a decryption technique for an SSL / TLS session for analyzing traffic flowing in a network device operating in a transparent mode and for decrypting an SSL / TLS session between a server and a client.

The existing SSL / TLS decryption method is applied to the middle of the network as a Proxy method, and the session is restricted by the Proxy method in the encrypted communication between the user and the server. In the Proxy server, the server has the private key of the server, <-> Proxy uses a method of decrypting and re-encrypting between Proxy <-> servers, and it is used in network technology as a method of determining whether the session is normal.

In other words, with the description of the conventional SSL / TLS decoding method, as shown in FIG. 9, the entire packet information is decoded into a single configuration, and then a process of checking the stability of the packet is performed. And, by dropping bad data such as hacking, the security between the server and the client is secured.

However, in using the conventional Proxy method, since the network packets for all the transmitted and received sessions are subjected to the encryption / decryption process, in the process of processing all the high-capacity network information, the network speed becomes remarkable due to the high- There is a possibility that the transmission / reception of data may be slowed down. In addition, there is a disadvantage that overload occurs due to high capacity even in such a network system. If a trouble occurs in the transmission and reception of the network data due to the overload of the network system, the network communication is not smooth.

In order to solve the above-described problems, the present invention provides a method of decrypting traffic for an encrypted SSL / TLS session in a multiplexed manner, so that data transmission and reception can be performed smoothly even in high- , SSL / TLS session analysis and management, and encryption techniques.

That is, in the high-performance network equipment according to the present invention, a multi-decryption processing job is performed for processing the packet data. In this way, the multi-decryption process can stably process high-capacity and high-performance network data without a significant load.

In addition, in the high-performance network equipment according to the present invention, the session analysis process and the multiple decoding process are separated so as to reduce the load until the read and write operations of the packet are performed, thereby ensuring the performance of the high- To be able to perform the analysis work of the present invention smoothly.

According to an aspect of the present invention, there is provided a network device connected between a client (11) and a server (12) to which an SSL / TLS protocol is applied, And a packet processing unit for extracting information for decrypting the T / L traffic and distributing the decoded information to a plurality of session decryption processing units, and for performing a decryption process on the decrypted packets and for checking the decrypted packets. High-performance network equipment is provided according to the multiple decoding configuration of LS traffic.

The present invention also provides a network device connected between a client 11 and a server 12 to which an SSL / TLS protocol is applied. The network device includes a reader 13 and a writer 14, And a session management unit for receiving the data from the decryption / extraction unit 20 and managing the session information of the ESL / TLS traffic from the decryption / And a session decryption processing unit 41 for receiving data from the session management unit 30 and decrypting the received data using the session information. The decryption unit 40 And a packet detector 60 for receiving the packet information decoded from the decoded data manager 50 and performing packet inspection. The packet detector 60 receives the decoded data from the decoded data manager 50, The high-performance network equipment according to the multiple decoding configuration of the ESL / TS traffic is provided.

The decryption unit 40 receives the data from the session management unit 30 and distributes data for decryption processing to a plurality of session decryption processing units 41 that are configured in a multiplex manner so as to transmit the decrypted data to the decryption / A plurality of session decryption processing units 41 for decrypting the data distributed separately from the decryption and distribution unit 42 and a plurality of session decryption processing units 41 for receiving the decrypted information data And a decryption unit 43 for decrypting the decrypted data to the decrypted data management unit 50.

The present invention also provides a method for processing in a network equipment connected between a client and a server and to which an SSL / TLS protocol is applied, the method comprising the steps of: receiving information for decoding an AS / And decodes the decoded packet so that the decoded data is distributed to a plurality of the session decode processing units, and performs the decoding of the decoded packet. The high-performance network data processing according to the multiple decoding configuration of the ESL / Method is provided.

The present invention also provides a method of processing in a network device connected between a client 11 and a server 12 and to which an SSL / TLS protocol is applied, wherein the reader 13 and the writer 14 A decoding information extracting step (S01) of extracting information for decoding the ASL / TLS from the decoding extracting unit (20) with respect to the packet transmitted / received by the decoding / extracting unit (20); A session management step (S02) of judging and managing whether or not the session information of the ESL / TLS is correct in the session management unit (30) having received the data from the decryption / extraction unit (20); A session decoding step (S03) of distributing and decoding data to a session decryption processing unit (41) multiplexed by a decryption unit (40) which has received data from the session management unit (30); A decoded data management step (S04) for discriminating normal decoded data from the data received from the decoded data management unit (50) having received the data from the decryption unit (40) and transmitting the decoded data to the packet detection unit (60); (S05) for performing a packet check on the data in the packet detector (60) which has received the decoded packet information from the decoded data manager (50) A high-performance network data processing method according to a multiple decoding configuration of LS traffic is provided.

In addition, the present invention includes a network device connected between the client 11 and the server 12 to which the SSL / TLS protocol is applied, and the reader 13 and the lighter 14 A decryption / extraction unit 20 for extracting information for decrypting the ESL / TLS traffic from packets to be transmitted and received, and a decryption unit 20 for receiving data from the decryption and extraction unit 20 and managing session information of the ESL / And a session decryption processing unit 41 for receiving data from the session management unit 30 and decrypting the received data using the session information are included in the decryption unit 40 (50) for receiving data from the decryption unit (40) and for processing normal decryption data, a decryption unit for decrypting the decrypted data from the decrypted data management unit And transmits a signal of a normal packet to the detection packet processing unit 17 in the case of a normal packet or a packet drop to drop the packet when it is determined that the packet is a hacking traffic or an attack traffic packet (60) for receiving a signal or a packet drop signal of a normal packet transmitted from the packet detector (60) and receiving a signal of a normal packet transmitted from the packet detector The detection packet processing unit 17 is provided to process the corresponding normal packet in the rewriter 14 and to drop the packet when receiving the packet drop signal, And extracts information for decoding of the ESL / TFL traffic from a plurality of session decryption processing units, And decrypts the decrypted packet. When it is determined that the packet is hacking traffic or attack traffic, the packet is dropped, and the high performance network equipment according to the multiple decoding configuration of the ESL / TLS traffic is provided .

The present invention is characterized in that the decryption unit 40 receives data from the session management unit 30 and distributes data for decryption processing to a plurality of session decryption processing units 41 constituted in multiple, A plurality of session decryption processing units 41 for decrypting the data distributed separately from the decryption and distribution unit 42 and a plurality of session decryption processing units 41 for decrypting the data decrypted from the plurality of session decryption processing units 41, And a decryption unit 43 for receiving the data and transmitting the decrypted data to the decryption data management unit 50. The high-performance network equipment according to the multi-decryption configuration of the ESL / TLS traffic is provided.

Further, the present invention provides a method of processing in a network device connected between a client 11 and a server 12 to which an SSL / TLS protocol is applied, wherein the reader 13 and the writer 14 A decoding information extracting step (S01) of extracting information for decoding the ASL / TLS from the decoding extracting unit (20) with respect to the packet transmitted / received by the decoding / extracting unit (20); A session management step (S02) of judging and managing whether or not the session information of the ESL / TLS is correct in the session management unit (30) having received the data from the decryption / extraction unit (20); A session decoding step (S03) of distributing and decoding data to a session decryption processing unit (41) multiplexed by a decryption unit (40) which has received data from the session management unit (30); A decoded data management step (S04) for discriminating normal decoded data from the data received from the decoded data management unit (50) having received the data from the decryption unit (40) and transmitting the decoded data to the packet detection unit (60); (S05) for performing a packet inspection of the data by the packet detector (60), which has received the decoded packet information from the decoded data management unit (50), and the step (S05) The packet detector 60 receiving the packet information decoded from the decoded data management unit 50 performs packet inspection to transmit a signal of a normal packet to the detection packet processor 17 in the case of a normal packet, A packet drop signal for dropping the packet when it is determined that the packet is a packet of hacking traffic or attack traffic, to the detection packet processing unit 17, and a signal or packet of a normal packet transmitted from the packet detection unit 60 Upon receiving the signal of the normal packet, the detection packet processing unit 17 receiving the drop signal processes the corresponding normal packet in the rewriter 14, And extracts the information for decoding the ESL / TLS traffic from the packet data to be transmitted and received. The packet data is distributed and multiplexed into a plurality of session decryption processing units And the packet is dropped when it is determined that the packet is a hacking traffic or an attack traffic. The high-performance network data processing method according to the multi-decoding configuration of the ESL / / RTI &gt;

The present invention configured as described above has an excellent effect of processing high-capacity, high-performance network data by multiplexing traffic decryption processes for an encrypted SSL / TLS session.

In the high-performance network equipment according to the present invention, the packet data is multiplexed and processed for decoding, so that the high-capacity and high-performance network data can be stably handled without a heavy load in the multi-decoding process.

Further, in the high-performance network equipment according to the present invention, the session analysis process and the multiple decoding process are separated, and the load from the time of read and write of the packet is reduced, thereby ensuring the performance of the high-performance network equipment, And the analysis work of the system can be performed stably.

1 is a schematic diagram of a network to which a high-performance network equipment according to the present invention is applied;
2 is a block diagram of a network to which high-performance network equipment according to the present invention is applied.
3 is a simplified flow diagram of a high performance network equipment in accordance with the present invention;
Figure 4 is an illustration of packet flow in high performance network equipment in accordance with the present invention;
FIG. 5 is an overall flow configuration diagram of a high performance network equipment according to the present invention; FIG.
FIG. 6 is an exemplary packet flow diagram in a high performance network device according to the present invention; FIG.
7 is a block diagram of a network of high performance network equipment according to the present invention.
Figure 8 is a flow chart of a process for a network of high performance network equipment in accordance with the present invention;
9 is a packet flow diagram according to the prior art;

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

That is, the high performance network equipment (10, HIGH PERFORMANCE NETWORK EQUIPMENT) according to the multiple decoding configuration of the ESL / TLS according to the present invention (SSL / TLS, HTTPS technology application) CLIENT) and a server (SERVER) to which the SSL / TLS protocol is applied.

In particular, the high-performance network equipment 10 according to the present invention is configured to extract information for decoding the SSL / TLS traffic from the packet data transmitted and received, and provides a plurality of session decryption processing units (A SESSION DECRYPT (SSL / TLS) traffic, which is distributed to a plurality of networks and distributed to a plurality of networks and decrypted by a network, and which performs a check of decrypted packets, according to an A FUCTION OF MULTI-DECRYPTION scheme. A data processing method (high performance network data processing method) is provided.

To this end, information for decoding the SSL / TLS traffic is extracted from the packet data transmitted and received, and decoded by a plurality of session decryption processing units (A SESSION DECRYPT WORKER) (HIGH PERFORMANCE NETWORK EQUIPMENT) according to A FUCTION OF MULTI-DECRYPTION of the SSL / TLS traffic having a packet processing unit (PACKET DISSECT) for performing inspection of decoded packets. Is provided.

In particular, the high performance network equipment and data processing method according to the present invention is a high performance network equipment and a data processing method (High Performance Network Equipment and Data Processing Method) according to the present invention. In a high performance network equipment operating in a transparent mode, In order to guarantee the minimum level of reliability.

In the configuration of the present invention, members named '~', 'engine', 'engine', '~ module', '~ worker', etc. constitute physical parts for data processing, Means a unit for processing a specific function or operation, such as a configuration, a logical processing configuration, a processor configuration, and a control flow configuration, and a hardware configuration, a software configuration, or a hardware configuration and a software configuration are combined The present invention is not limited to any particular form and can be applied and operated within the general technical information field of a general electronic information communication field. Able to know.

The high-performance network equipment 10 and the configuration of the processing according to the present invention will now be described in detail.

The multi-decryption processing configuration of the SSL / TLS traffic with the high performance network equipment 10 according to the present invention is connected between the client 11 and the server 12 so that the AS / It can be provided as network equipment such as NIC as a network equipment to which the SSL / TLS protocol is applied.

And receives data from the client 11 or CLIENT of the network or the server 12 or SERVER so as to receive data from the packet transmitted and received by the reader 13 and the writer 14 WRITER, (SSL / TLS SESSION ANALYSIS & SEED ABSTRACT) for extracting information for decoding the SSL / TLS traffic.

The decryption information extraction step S01 for extracting the information for decoding the ESL / TLS from the decryption and extraction unit 20 will be performed on the packets transmitted and received by the reader 13 and the writer 14. [

That is, the decryption / extraction unit 20 determines the SSL / TLS handshake flow and the application data flow to perform the handshake flow. After the handshake flow is performed, the decryption / extraction unit 20 extracts and stores Seed values used for decryption of the session, Upon reaching the flow ending step, the message is sent to the session management unit 30. In addition, the application data may be directly provided to the session management unit 30.

Next, a session management unit 30 for receiving data from the decryption / extraction unit 20 and managing session information of the SSL / TLS, and an SSL / TLS session manager Will be provided.

A session management step S02 for judging whether the session information of the MS / TS is correct and managing the session information is performed in the session management unit 30 that has received the data from the decryption /

In other words, it may be configured to perform an integrity check and a key generation on a decryption key generation message transmitted from the decryption / extraction unit 20. In case of transmitting application data in the decryption / extraction unit 20, a decryption message and a decryption key may be transmitted to the decryption unit 40 Session information. &Lt; / RTI &gt;

And a session decryption processing unit 41 for receiving data from the session management unit 30 and decrypting the received data using the session information, , SESSION DECRYPT ENGINE) can be constructed. Particularly, the decoding unit 40 has an excellent merit that a plurality of detailed decoding processing members are provided so that decoding can be performed in multiple, and decoding processing can be performed for a large number of data at the same time, and processing of the entire packet data is performed .

The decryption unit 40 receives the data from the session management unit 30 and distributes data for decryption processing to a plurality of session decryption processing units 41 that are configured in a multiplex manner. A plurality of session decryption processing units 41 for decrypting data distributed separately from the decryption policing unit 42 and a plurality of session decryption processing units 41 for decrypting the decrypted data, And transmits the decoded data to the decoded data management unit 50. [

Accordingly, a session decryption step (S03) for decrypting data by distributing data to the session decryption processing unit 41 configured in the decryption unit 40, which has received the data from the session management unit 30, will be performed.

The decryption multiplex distributing unit 42 can be provided to distribute and process the data corresponding to the plurality of session decryption processing units 41 so that data can be efficiently processed and a plurality of session decryption processing units 41 ) Are collected by the decryption and collection unit 43 and are then processed, thereby ensuring the stability of the data.

In the decryption unit 40, the session decryption processing unit 41 performs decryption by using the allocated session information (decryption key and application data) by performing multi-decryption processing. Then, the decryption unit 40 decrypts the decrypted data, And transmit the resultant data to the packet detector 50 and the packet detector 60, respectively.

Also, a decoded data manager 50 (DECRYPTED PACKET MANAGER) for receiving data from the decoding unit 40 (SESSION DECRYPT ENGINE) and processing normal decoded data may be provided.

A decoded data management step S04 is performed to discriminate the normal decoded data from the data received from the decoded data management unit 50 that has received the data from the decryption unit 40 and to transmit the decoded data to the packet detection unit 60 .

That is, the decryption unit 40 may be provided to transmit the decrypted data to the packet detection unit 60.

Next, a packet detector (PACKET DISSECT) 60 for receiving the packet information decoded from the decoded data manager (DECRYPTED PACKET MANAGER) 50 and performing packet inspection will be provided.

In step S05, the packet detector 60, which receives the decoded packet information from the decoded data manager 50, performs a packet check on the corresponding data.

That is, the packet detection unit 60 of the network equipment performs packet analysis on the packet data subjected to the multiple decoding processing through the plurality of session decryption processing units 41 of the decoding unit 40.

As described above, the performance of the decoding is improved through the high-performance network equipment according to the multiple decoding configuration of the SSL / TLS according to the present invention and the multi-decryption data processing method using the same. The plurality of session decryption processors 41 (Session Decrypt Worker) of the plurality of session decryption processors 41 may be generated and allocated to be multiplexed and decoded, thereby facilitating network packet processing performance.
That is, in this packet execution step S05, the packet detector 60, which has received the decoded packet information from the decoded data management unit 50, performs packet inspection and detects a signal of a normal packet in the case of a normal packet To the packet processing unit 17 or to send a packet drop signal for dropping the packet to the detection packet processing unit 17 when the packet is determined as a packet of hacking traffic or attack traffic, When receiving a signal of a normal packet in the detection packet processing unit 17 which has received a signal of a normal packet or a packet drop signal transmitted from the receiver 14, the normal packet is processed by the rewriter 14, The packet is dropped.
Therefore, according to the present invention, it is possible to extract information for decoding the ASL / TLS traffic from packet data to be transmitted and received (applying a technique such as mirroring), and distribute and multiplex the data in a plurality of session decoding processing sections, When the packet is determined to be hacking traffic or attack traffic, the packet is dropped.

The high-performance network equipment 10 according to the multiple decoding configuration of the SSL / TLS according to the present invention and the high-performance network data processing using the same will be described in detail.

6 and the like, data is transmitted and received from the client 11 or the server 12, and data to be transmitted and received is subjected to READ and WRITE processing by the reader 13, the reader 14, and the writer 14 (WRITER) . The data of the SSL / TLS to be transmitted and received will be processed and decoded through the high-performance network equipment 10 according to the present invention, and then an inspection process for the corresponding packet will be performed.

Therefore, it will perform a process of verifying whether the packet read from the first NIC is an HTTPS (SSL / TLS) packet. For these HTTPS (SSL / TLS) packets, the packets will be stored in the HTTPS buffer.

Then, the HTTPS decryption engine performs a verification process to determine whether the session is a previously existing session. If the session exists, but the session time has expired, the session will be initialized (part (4-1) of FIG. 6).

In the absence of a session (part (8-1) of FIG. 6), a new session key is generated and a session key decoding (initial session decryption) process is performed. The session decryption processing unit 41 will be subjected to the multiple decryption processing.

If a session exists ((8-2) portion of FIG. 6), the data decoding process will be performed through the data decoding engine.

If there is a session but the packet is not normal in the decoding process, the session will be terminated (part (9-2) of FIG. 6).

Next, integrity check and key generation are performed on the decryption key generation message transmitted to the decryption engine (part (11) of FIG. 6), i.e., the decryption unit 40, and the decryption unit 40 decrypts The session decryption processing unit 41 of the decryption unit 40. The session information (decryption key and application data) allocated in the decrypted packet ((12) portion of FIG. 6).

In particular, in the decryption unit 40, which is a decryption engine, a plurality of session decryption processing units 41 are provided as a multi-engine in order to perform fast session processing, To be able to do so.

When the session data is dumped and confirmed (part (13) of FIG. 6), the data dump process may be performed by connecting the decrypted packet to the session buffer as shown in FIG.

The decrypted packet is used to determine whether the packet is a hacking traffic or an attack traffic through the packet detection unit 60, which is a detection engine. When it is determined that the packet is a hacking traffic or an attacking traffic, The packet detection unit 60 transmits a processing signal of dropping a packet to the detection packet processing unit 17 and the detection packet processing unit 17 will drop the corresponding packet of the buffer 6, part (16)).

When the packet is determined to be normal traffic, the packet detector 60 transmits a signal of the normal packet to the detection packet processor 17, and the detection packet processor 17 performs the packet in the next process So that it will be processed.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The technical idea of the present invention should not be construed as being limited.

10: High Performance Network Equipment
11: Client 12: Server
13: Reader 14: Lighter
20: Decryption extraction unit 30: Session management unit
40: Decryption unit 41: Session decryption processing unit
42: Decoding Multiplex Distributor 43: Decoding Collector
50: decoded data management unit
60: packet detection unit

Claims (5)

A network device connected between the client 11 and the server 12 and adapted to the SSL / TLS protocol is provided,
A decoding and extracting unit 20 for extracting information for decoding the ASL / TLS traffic from the packet transmitted and received by the reader 13 and the writer 14,
A session management unit 30 for receiving data from the decryption / extraction unit 20 and managing session information of the MS / TS,
A session decryption processing unit 41 that receives data from the session management unit 30 and decrypts the received data using the session information of the ESL / In equipment,
A decoded data management unit 50 that receives data from the decryption unit 40 and processes normal decoded data,
Receives the decoded packet information from the decoded data management unit 50 and performs packet inspection. In the case of a normal packet, it transmits a normal packet signal to the detection packet processing unit 17 or discriminates it as a packet of a hacking traffic or an attack traffic A packet detector 60 for detecting a packet drop signal to drop a packet to the detection packet processor 17,
Upon receipt of a normal packet signal or a packet drop signal transmitted from the packet detector 60 and receiving a normal packet signal, the normal packet is processed by the rewriter 14, A detection packet processing unit 17 provided to drop the packet,
Extracts information for decoding the ESL / TLS traffic from the packet data to be transmitted and received, inspects the decoded packet so as to be distributed and multiplexed into a plurality of session decryption processing units, performs hacking traffic or attack traffic And the packet is dropped when it is determined that the packet has been received. The high-performance network equipment according to the multiple decoding configuration of the ESL / TLS traffic.
delete The method according to claim 1,
The decoding unit (40)
A decryption multiplexing distribution unit 42 for receiving data from the session management unit 30 and distributing data for decryption processing to a plurality of session decryption processing units 41 configured in multiple,
A plurality of session decryption processing units 41 for decrypting the data distributed and distributed separately from the decryption and distribution unit 42,
And a decryption unit (43) for receiving the decrypted information data from the plurality of session decryption processing units (41) and transmitting the decrypted information data to the decryption data management unit (50) High-performance network equipment according to.
delete A method for processing in a network equipment connected between a client (11) and a server (12) to which an SSL / TLS protocol is applied,
A decoding information extracting step (S01) for extracting information for decoding of the S / L / TS from the decoding extraction unit (20) with respect to the packets transmitted and received by the reader (13) and the writer (14);
A session management step (S02) of judging and managing whether or not the session information of the ESL / TLS is correct in the session management unit (30) having received the data from the decryption / extraction unit (20);
A session decoding step (S03) of distributing and decoding data to a session decryption processing unit (41) multiplexed by a decryption unit (40) which has received data from the session management unit (30);
A decoded data management step (S04) for discriminating normal decoded data from the data received from the decoded data management unit (50) having received the data from the decryption unit (40) and transmitting the decoded data to the packet detection unit (60);
(S05) for performing packet inspection on the data by the packet detector (60), which has received the decoded packet information from the decoded data management unit (50)
In the packet execution step S05, the packet detector 60, which has received the decoded packet information from the decoded data management unit 50, performs packet inspection, and in the case of a normal packet, To the detection packet processing unit 17 when the packet is determined to be a packet of a hacking traffic or attack traffic, and to drop the packet drop signal to the detection packet processing unit 17,
Upon receipt of the normal packet signal or the packet drop signal transmitted from the packet detector 60, the detection packet processor 17 processes the corresponding normal packet in the rewriter 14 , And drops the packet if the packet drop signal is received,
Extracts information for decoding the ESL / TLS traffic from the packet data to be transmitted and received, inspects the decoded packet so as to be distributed and multiplexed into a plurality of session decryption processing units, performs hacking traffic or attack traffic And the packet is dropped when it is determined that the packet is a packet.

Images