KR101150299B1 - Method for dynamic traversing of multiple firewalls based on simultaneous notarization of user and networking instance and apparatus thereof - Google Patents

Abstract

PURPOSE: A multiple firewalls dynamic pass method and apparatus thereof are provided to secure technology and to dynamically utilize the technology by securing computing resources which are located in inside firewalls. CONSTITUTION: After time information of VO(Virtual Organization) resources are mutually matched, an apparatus authenticates user information and TCP(Transmission Control Protocol) networks(S102,S104). The apparatus requests the notarization of a user in order to dynamically pass through a firewall(S106). A notarial certificate server manager transmits a notarial certificate to the user, an application server manager, and a firewall managers(S108). The user confirms the notarial certificate(S110).

Description

Method for dynamic traversing of multiple firewalls based on simultaneous notarization of user and networking instance and apparatus

The present invention relates to a method for dynamically passing through a firewall, and in particular, a multiple firewall capable of dynamically passing through multiple firewalls simultaneously in one attempt instead of user authentication and traffic authentication through simultaneous notarization of a user and a specific time of networking behavior. It is about a dynamic pass method.

Grid computing technology is a technology that integrates various kinds of networked computing resources to build a high performance infrastructure more efficiently. Grid computing environments built on these technologies differ from the current Internet environment.

In a grid environment, various kinds of computing resources can be shared in addition to the simple information sharing provided in the Internet environment. In a real grid environment, users should be able to use several resources at the same time.

In a grid / cloud computing environment, it is necessary to dynamically traverse local and other organization's firewalls when attempting to dynamically join computer resources belonging to other institutions and to participate in IDC / grid / cloud computing platforms for a short period of time. Internet Data Centers (IDCs) are data centers that rent computer resources.

Techniques for dynamically traversing firewalls have been developed. This prior art has allowed the firewall administrator to automate the manual process by software.

The conventional firewall dynamic pass technology can be summarized as shown in Table 1.

division case Dynamically Adding Firewall Filtering Rules Dynamically ? Dyna-Fire
? CODO
? DyNeF Intermediate cycle research group as if trying to connect inside a firewall ? GCB
? UDP Hole Punching
? Gateway / Proxy Relaying authentication of users and servers at the firewall TCP-AuthN

The development of this technology has greatly improved the firewall dynamic pass experience, but we can't say it's still satisfactory.

For example, as the importance of Internet security increases and the number of firewall installations increases, the firewall dynamic pass-through environment is getting worse because each firewall has to work and software may be different for each firewall. .

In particular, many researches have been conducted in the UDP (User Datagram Protocol) environment such as Internet telephone technology research, but in the case of TCP applications that are used by most of the Internet applications, it is not possible to simultaneously pass multiple firewalls at the same time.

For the dynamic passage of the firewall, user authentication and traffic authentication must be performed at each firewall. Here, traffic authentication refers to a so-called 3-way handshaking process.

Referring to Table 1, the approaches of technologies for dynamic traversal of firewalls are roughly divided into three approaches.

The first is to study how to dynamically generate firewall rules dynamically whenever there is a dynamic passthrough request.

Second, connection requests from inside the firewall to the outside use the features of the firewall that the firewall passes through by default.

Third, the firewall relays the authentication between the user and the server.

The first approach is inefficient in a multi-firewall environment. This is because, in order to dynamically traverse multiple firewalls, a pass request must be made for each firewall for each dynamic pass. In addition, when the firewall is changed, there is a problem in that the new method of using the changed firewall must be learned.

In the second method, each broker needs to be relayed from the outside to relay as if it is requested to connect from the inside to the outside. Therefore, as the number of firewalls to pass through increases, the number of agents to connect to is increased.

Recently, firewalls check the sequence number of the TCP and the 3-way handshaking status. Therefore, the firewall is limited to UDP applications such as Skype.

In the third method, authentication relaying at the firewall is further complicated by the increase in the number of firewalls in a multi-firewall environment.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problem, and is intended to dynamically and in a short period of time participate in IDC / grid / cloud computing platform computing resources belonging to other organizations in a grid / cloud computing environment. Its purpose is to provide a way to solve the problem of dynamically traversing other firewalls.

Another object of the present invention is to provide a method for supporting simultaneous traversal of multiple and heterogeneous firewalls in one attempt even in the case of the TCP protocol used by most Internet applications.

It is yet another object of the present invention to provide a method for supporting dynamic traversal of multiple firewalls at any time without prior approval of the firewall administrators.

It is still another object of the present invention that the existing Internet transmission scheme operates as a series of operations in which the application layer and the network layer are linked to each other such as the start of data transmission of the application layer and the fine line setting of the network layer. It can be divided into three stages in the form of request confirmation, session setup confirmation of network layer, and start of data transmission of application layer so that the operation can be performed independently and in stages. And to provide a way to extend the scope of the invention irrespective of the type and number of firewalls.

One embodiment of the firewall dynamic passage method according to the present invention for achieving the above object

In the multiple firewall traversal method in a computing environment comprising a user-side communication server, an application-side communication server and a plurality of firewalls interposed between the two servers,

TCP for registering user information and networking behavior information, that is, an appointment start time between the user-side communication server and the application-side communication server previously agreed between the user-application server administrator and the information on the application-side communication server to a notary server. Notarization of networking and user information;

A user notarization application process for dynamically passing through a firewall requesting the notary server to allocate a notary for accessing the corresponding application-side communication server by the user-side communication server;

The notary server generates a notary containing a randomly generated IP address and port number within a range of IP addresses and port numbers registered in advance by a user and an application server administrator, and then a user-side communication server, an application-side communication server, and related firewalls. User notarization distribution process to send generated notaries to all;

The user side communication server and the application side communication server may establish a notarized certificate-based communication server for establishing a network connection environment such as setting an initial sequence number of TCP using information in the received notary certificate;

The user communication server transmits the TCP connection request packet having the IP address, port number, and initial sequence number registered in the notarization at the promised start time of use, and the application communication server transmits the corresponding TCP response packet to the TCP / IP. A timing control based TCP / IP connection process for establishing a connection; And

A TCP application connection process between the communication server for establishing a TCP application connection based on the established TCP / IP connection between the user side communication server and the application side communication server; Characterized in that it comprises a.

Here, in the timing control based TCP / IP connection process, the user side communication server transmits the TCP connection request packet twice consecutively in consideration of the initial packet loss, and the application side communication server correspondingly transmits the TCP response packet 2. It is preferable to transmit twice consecutively.

Multiple firewall traversal method according to the present invention to achieve the above object

An application layer that registers user information and networking behavior information, that is, an appointment start time between the user-side communication server and the application-side communication server previously agreed between the user-application server administrator and the information on the application-side communication server to a notary server. Data transmission request confirmation process;

The user side communication server requests a notary server to allocate a notary for accessing the application side communication server, and the notary server randomly generates a range of IP addresses and port numbers previously registered by the user and the application server administrator. After generating a notarization including an IP address and a port number, a notarized certificate is sent to all of the user side communication server, the application side communication server, and related firewalls, and the user side communication server and the application side communication server receive the received certificate. A session establishment process of a network layer for establishing a network connection environment such as setting an initial sequence number of TCP using information in a notary certificate;

The communication server of the user side transmits a TCP connection request packet having an IP address, a port number, and an initial sequence number registered in a notary certificate at a promised start time of use, and the application communication server transmits a TCP response packet corresponding thereto. TCP / IP connection process based on timing control for establishing IP / IP connection; And

A TCP application connection process between the communication server for establishing a TCP application connection based on the TCP / IP connection between the user side communication server and the application side communication server; Characterized in that it comprises a.

Here, in the timing control based TCP / IP connection process, the user side communication server transmits the TCP connection request packet twice consecutively in consideration of the initial packet loss, and the application side communication server correspondingly transmits the TCP response packet 2. It is preferable to transmit twice consecutively.

The present invention is expected to increase the mobility of the Internet users in the future, the application platform is expected to gradually evolve into a grid / cloud environment, in which case, if you want to dynamically expand the grid computing or science cloud platform to IT resources of external institutions, As a matter of protection, it can be expected to secure a technology that can dynamically utilize even computing resources installed deep inside each firewall of two or three of each institution.

1 illustrates a conventional TCP / IP 3-way handshaking process.
2 is a flowchart illustrating a firewall traversal method according to the present invention.
FIG. 3 is for explaining the operation in the timing control based TCP / IP connection process s114 shown in FIG. 2 in more detail.
4 shows a timing diagram for performing the method shown in FIG. 3.
5 shows an example of a configuration form of a notary used in the method according to the present invention.
6 shows a configuration of a system for performing a method according to the invention.

Hereinafter, the configuration and operation of the present invention will be described in detail with reference to the accompanying drawings.

The present invention supports three handshaking for reliable connection of TCP / IP.

1 illustrates a conventional TCP / IP 3-way handshaking process. The TCP protocol precedes the 3-way handshaking process for establishing a connection for reliable communication.

This 3-way handshaking of TCP / IP

1) The client terminal starts by transmitting a SYN flag packet in which the SYN bit is on among the TCP header code bits (6 bits) (SYN_SENT state),

2) Upon receiving it, the server stores this information in a backlog that exists in kernel memory and sends a SYN / ACK flag packet to the 32-bit source address specified in the IP header (SYN_RECEIVED state).

3) Finally, when the ACK flag packet is transmitted to the client, both terminals become Established, and thus, one TCP session is established and application communication is performed.

In this process, the first time the client sends seq number x, the server adds 1 to this x and sends it to ACK. Send your own seq number y. Then, the client checks whether the ACK of the packet from the server matches its seq number, and if confirmed, adds 1 to the server's seq number y and sends it to the ACK.

On the server, if the ACK number sent by the client matches its seq number, the server authenticates that the connection is established and enters data communication.

The present invention allows the user server and the application server to simulate the second step of the 3-wqy handshaking process of TCP / IP by the promised procedure, and allow the third step to be performed at a given time. The promised procedure is based on the notarization issued by the notary server.

In other words, the firewall dynamic traversal method according to the present invention replaces user authentication and traffic authentication at the same time through simultaneous notarization of networking behavior between a user and an application server manager, and can dynamically pass through multiple firewalls simultaneously with one attempt. To be.

2 is a flowchart illustrating a firewall traversal method according to the present invention. 2 illustrates a multi-firewall dynamic pass technology that can simultaneously traverse multiple firewalls simultaneously in a single attempt instead of user authentication and traffic authentication through simultaneous notarization of the user and a specific time of networking behavior.

Referring to FIG. 2, the firewall dynamic authentication method according to the present invention includes a process of matching time information of VO resources with each other (s102), a notarization process with TCP networking and user information (s104), and a user notary for dynamically passing through a firewall. Application process (s106), user notarization distribution process (s108), user notary certificate confirmation process (s110), notarization based communication server setting process (s112), timing control based TCP connection process (s114), and TCP application connection process between communication servers (s116).

In the process of matching time information of VO resources with each other (s102), the user and the application server manager agree to access the application-side communication server at any time.

Here, VO (Virtual Organization) is a term that collectively refers to a group of computers, applications, users and networks included in the same management (or service) environment in grid computing or cloud computing.

In the process of notarizing TCP networking and user information (s104), user information and networking behavior information, that is, a start time of use agreed between a user and an application server administrator and information about an application server are registered in a notary server.

The notary manager requests that a notary for accessing the corresponding application server is allocated in the user notary application process s106 for dynamically passing through the firewall.

In the distribution process of user notarization (s108), the notary server administrator generates a notarized certificate including a randomly generated IP address and port number within a range of IP addresses and port numbers previously registered by the user and application server administrator. The created notary is sent to both the administrator and the relevant firewall administrators.

In the user notarization check process (s110), the user verifies the notary.

In the notation-based communication server setting process (s112), the user and the application server manager establish a network connection environment by setting an initial sequence number of the TCP by using the information in the notarized certificate.

In the timing control-based TCP / IP connection process (s114), the user side communication server transmits a TCP connection request packet having a promised IP address, a port number, and an initial sequence number at an appointed time, and the application side communication server corresponds to the corresponding TCP. Send a response packet to establish a TCP / IP connection.

In the TCP application connection process (s116) between communication servers, the user side communication server and the application side communication server establish a TCP application connection based on the established TCP / IP connection.

Specifically, the user-side communication server sends the first TCP connection request packet with the SYN flag set to the IP address and port number of the application server known in advance.

In the case of TCP, if the SYN flag is set, the local firewall can pass through because it is traffic from inside to outside. However, when it arrives at the other firewall, it is dropped because there is no pre-work on the other firewall. This is because the user communication server to communicate with is not registered in the firewall iptable of the application communication server.

The TCP connection request packet sent by the user side communication server makes the local firewalls wait for the response packet of the application side communication server corresponding to the connection request packet sent by the user side communication server to arrive through the local firewalls.

Since the application side communication server already knows the IP address, port number, TCP sequence number, and sent time of the connection packet sent by the client, it performs simulation operation as if the user side communication server did not receive the packet. That is, the local firewalls of the user communication server generate and send the first response packet.

That is, a packet having an ACK number corresponding to a sequence number of a packet in which SYN and ACK flags are set and reception is scheduled is generated and sent.

Therefore, the normal TCP / IP connection is established because the firewall between the sender and receiver can satisfy the value of the waiting connection state due to the first connection request packet and the first response packet.

Firewall administrators verify whether or not they are using notary-based networking with the user or application server administrator as part of the firewall traversal traffic analysis or security monitoring process. In response, the user (or server administrator) confirms to the firewall administrator that he or she is using (or doing) public-based firewall dynamic passthrough networking.

The dynamic traversal method of the multiple firewalls according to the present invention shown and described with reference to FIG. 2 does not need to work individually for each firewall when trying to traverse multiple firewalls simultaneously and simultaneously. All can be traversed at once, the same can be applied to different types of firewalls, and with the post-approval of the firewall administrator, it can support dynamic traversal of multiple firewalls at the time you want.

Referring to FIG. 2, it can be seen that the application layer and the network (TCP) layer are performed independently and in stages.

In the conventional Internet transmission scheme, the application layer and the network instrumentation operate in a series of tasks such as the start of data transmission of the application layer and the session establishment of the network layer therefor. On the contrary, the present invention divides the data transmission request of the application layer, the session setup of the network layer, and the data transmission start of the application layer into three stages so that the operation can be performed independently and stepwise.

That is, in the flowchart shown in FIG.

Processes s102 and s104 correspond to the process of identifying data transfer requests at the application layer,

Steps s106 to s113 correspond to the session establishment process at the network layer, and

Processes s114 to s116 correspond to data transmission processes in the application layer.

These processes are not continuous in time but are performed independently and in stages.

Accordingly, the multi-firewall dynamic pass through process of the present invention can extend the scope of application of the present invention regardless of the type of application and the type and number of firewalls while maintaining compatibility with the existing Internet transmission scheme.

In addition, this independent step-by-step control process in the present invention separates the data transfer service and the TCP service in the application to enable the TCP connection control not only the existing TCP application but also TCP connection control.

While the conventional firewall traversal technique is based on authentication of a user (or traffic) attempting to pass through each firewall, the present invention is based on a single-use notarized by a multilateral notary such as a firewall administrator, an application server provider, and a notary system. Multiple firewall technology.

Therefore, although the firewall administrator had to work for the conventional firewall, the firewall manager merely monitors whether the traffic is notarized and simulates the traffic notation procedure and TCP protocol, which are the core functions for dynamic passage, only for users who want to pass through the firewall. Perform the function.

In other words, by enabling the firewall administrator to switch from the existing active central role to the passive third party in the work related to the firewall dynamic traversal, the present invention proposes a method of dynamically traversing the firewalls only by end-to-end user agreement. .

FIG. 3 is for explaining the operation in the timing control based TCP / IP connection process s114 shown in FIG. 2 in more detail.

Referring to FIG. 3, a TCP connection request for transmitting data having a data size of zero is initiated (s302).

The client transmits a TCP connection request packet in which a sequence number and SYN bit set to the client are set (s304). In consideration of the initial packet loss, the TCP connection request packet is transmitted twice in succession.

The server transmits a server response TCP packet in which the sequence number and acknowldgement number and the SYN and ACK bits set to the server are set (s306).

The client transmits a client response TCP packet having a sequence number, an acknowledgement number, an ACK, and a bit set thereto.

Check the TCP connection between the server and the client. (S310)

4 shows a timing diagram for performing the method shown in FIG. 3.

At the connection start appointment time t, the client sends a TCP connection request packet with the sequence number and SYN bit set to it. In consideration of the initial packet loss, the TCP connection request packet is transmitted twice in succession.

At the time elapsed by 1 / 4RTT from the connection start appointment time (t + 1 / 4RTT), the server transmits a server response TCP packet in which the sequence number and acknowledgement number assigned to it and the SYN and ACK bits are set. The server also sends two consecutive server response TCP packets in consideration of the initial packet loss. Here, the round trip time (RTT) represents the time taken for the signal sent from the receiver to confirm the reception after the data is transmitted to the sender, that is, the time taken for the data to travel between the transmitter and the receiver.

5 shows an example of a configuration form of a notary used in the method according to the present invention.

Referring to FIG. 5, the notary has a source IP address, a destination IP address, a source port number, a destination port number, a source sequence number, a destination sequence number, a source transmission time, a destination transmission time, and a plurality of user IDs.

The user server, the application server, and the like refer to a notary having a content as shown in FIG. 5 and transmit a TCP packet having a promised sequence number at an appointed time. The firewall checks whether or not the user or server administrator is using or using notary-based networking after the scheduled time.

6 shows a configuration of a system for performing a method according to the invention. Referring to Fig. 6, reference numeral 602 denotes a user side communication server, 604 denotes an application side communication server, 606 denotes a notary server and 608 denotes a firewall. There may be a plurality of firewalls. In the system shown in FIG. 6, multiple firewall dynamic traversal is performed as follows.

At any time, the user and the application server administrator agree that the user side communication server 602 accesses the application side communication server 604.

(2) A notarized certificate for allocating user information and networking behavior, that is, the start time of use agreed between the user and the application server administrator, and information about the communication server of the application side to the notary server, and then assigning a notary for accessing the application server. Ask server 606

③ The notarization server 606 generates a notarization including a randomly generated IP address and port number within a range of IP addresses and port numbers registered in advance by a user and an application server administrator, and then a user side communication server 602 and an application side. The created notation is sent to both the communication server 604 and the associated firewalls 608.

(4) The user side communication server 602 and the application side communication server 604 establish a network connection environment by setting an initial sequence number of TCP using the information in the received notarization. The user side communication server 602 then sends the first TCP connection request packet with the SYN flag set to the IP address and port number of the application side communication server 604, which is known in advance. In the case of TCP, if the SYN flag is set, the local firewall can pass through because it is traffic from inside to outside. However, when it arrives at the other firewall, it is dropped because there is no pre-work on the other firewall. This is because the application server side firewall is not registered in iptable. The TCP connection request packet sent by the user passes through the local firewalls and causes the local firewalls to wait for a response packet on the application server side corresponding to the connection request packet sent by the user to arrive.

⑤ Since the application-side communication server 604 already knows the IP address, port number, TCP sequence number, and time of the connection packet sent by the user-side communication server 602, the user-side communication server 604 may receive the packet as if the user did not receive the packet. It performs the simulation operation and generates and sends the first response packet waiting for the local firewalls on the user side communication server 602. That is, the ACK number corresponding to the sequence number of the packet for which the SYN and ACK flags are set and the reception is scheduled is received. Create and send a packet with Therefore, the normal connection is established because the firewall between the sender and receiver with the first connection request packet and the first response packet can satisfy the value of the waiting connection state.

⑥ Firewall administrators verify whether or not they are using notary-based networking with the user or application server administrator as part of the firewall traversal traffic analysis or security monitoring process.

The user (or application server administrator) can confirm to the firewall administrator that he or she is using (or doing) public-based firewall dynamic passthrough networking.

The present invention is expected to increase the mobility of the Internet users in the future, the application platform is expected to gradually evolve into a grid / cloud environment, in which case, if you want to dynamically expand the grid computing or science cloud platform to IT resources of external institutions, As a matter of protection, it can be expected to secure a technology that can dynamically utilize even computing resources installed deep inside each firewall of two or three of each institution.

602 ... user-side communication server 604 ... application-side communication server
606 Notary Server 608 Firewall

Claims (4)

In the multiple firewall traversal method in a computing environment comprising a user-side communication server, an application-side communication server and a plurality of firewalls interposed between the two servers,
TCP for registering user information and networking behavior information, that is, an appointment start time between the user-side communication server and the application-side communication server previously agreed between the user-application server administrator and the information on the application-side communication server to a notary server. Notarization of networking and user information;
A user notarization application process for dynamically passing through a firewall requesting the notary server to allocate a notary for accessing the corresponding application-side communication server by the user-side communication server;
The notary server generates a notary containing a randomly generated IP address and port number within a range of IP addresses and port numbers registered in advance by a user and an application server administrator, and then a user-side communication server, an application-side communication server, and related firewalls. User notarization distribution process to send generated notaries to all;
The user side communication server and the application side communication server may establish a notarized certificate-based communication server for establishing a network connection environment such as setting an initial sequence number of TCP using information in the received notary certificate;
The user communication server transmits the TCP connection request packet having the IP address, port number, and initial sequence number registered in the notarization at the promised start time of use, and the application communication server transmits the corresponding TCP response packet to the TCP / IP. A timing control based TCP / IP connection process for establishing a connection; And
A TCP application connection process between the communication server for establishing a TCP application connection based on the established TCP / IP connection between the user side communication server and the application side communication server; Multiple firewall dynamic pass-through method comprising a. The method of claim 1, wherein in the timing control based TCP / IP connection process, the user side communication server transmits a TCP connection request packet twice in succession in consideration of initial packet loss, and the application side communication server correspondingly responds to TCP. Multiple firewall traversal method characterized in that the transmission of the response packet twice in succession. An application layer that registers user information and networking behavior information, that is, an appointment start time between the user-side communication server and the application-side communication server previously agreed between the user-application server administrator and the information on the application-side communication server to a notary server. Data transmission request confirmation process;
The user side communication server requests a notary server to allocate a notary for accessing the application side communication server, and the notary server randomly generates a range of IP addresses and port numbers previously registered by the user and the application server administrator. After generating a notarization including an IP address and a port number, a notarized certificate is sent to all of the user side communication server, the application side communication server, and related firewalls, and the user side communication server and the application side communication server receive the received certificate. A session establishment process of a network layer for establishing a network connection environment such as setting an initial sequence number of TCP using information in a notary certificate;
The communication server of the user side transmits a TCP connection request packet having an IP address, a port number, and an initial sequence number registered in a notary certificate at a promised start time of use, and the application communication server transmits a TCP response packet corresponding thereto. TCP / IP connection process based on timing control for establishing IP / IP connection; And
A TCP application connection process between the communication server for establishing a TCP application connection based on the TCP / IP connection between the user side communication server and the application side communication server; Multiple firewall dynamic pass-through method comprising a. 4. The method of claim 3, wherein in the timing control based TCP / IP connection process, the user side communication server transmits a TCP connection request packet twice in succession in consideration of initial packet loss, and the application side communication server correspondingly performs the TCP. Multiple firewall traversal method characterized in that the transmission of the response packet twice in succession.

Images