KR101346810B1 - Unitive Service Controlling Device and Method - Google Patents

Abstract

The integrated service control apparatus and method applies a service provider, a service function, and a service protocol, which are used as criteria of network service classification, to a signature to group signatures having the same ID tag for the service provider, service function, or service protocol. By applying policies, network services can be integrated and controlled.

Description

Unity Service Controlling Device and Method

The present invention relates to a service control apparatus and method, and more particularly, to an integrated service control apparatus and method.

As the network environment is diversified and complicated, information leakage through various services increases. In order to prevent such information leakage, a firewall or an intrusion prevention system (IPS) is used. The firewall or intrusion prevention system pattern-matches the pre-signed signature and the incoming data packet to allow or block the inflow of the packet.

When a plurality of signatures are created in a firewall or an intrusion prevention system to perform pattern matching of input packets and signatures, the signatures and input data packets are matched one-to-one.

As a result, it takes a lot of time to manually match each of the multiple signatures when there are a large number of signatures created. In addition, there is a problem that a matching operation and a policy for signatures having the same property cannot be simultaneously performed.

An object of the present invention is to provide a service control apparatus and method that can collectively control a service by applying a policy by grouping signatures having the same attribute value.

The integrated service control method classifies signatures based on two or more attributes according to attribute information, and adds an ID tag for each attribute to each signature, and applies the first attribute of the two or more attributes according to the policy information to be applied. Selecting a signature of the first group including a first ID tag, and matching or matching the signature of the selected first group with the input packet to allow or block the inflow of the input packet; When at least one signature of the signature and the input packet match, the inflow of the input packet is blocked.

The integrated service control device classifies the signatures based on two or more attributes according to the attribute information and adds an ID tag for each attribute to each signature, and the first one of the processed signatures according to the policy information to be applied. A signature selector which selects a signature of a first group including a first ID tag for an attribute, and a signature matcher which permits or blocks the inflow of the input packet by matching an input packet with a signature of the selected first group; The signature matching unit may block inflow of the input packet when at least one signature of the first group of signatures matches the input packet.

According to the integrated service control apparatus and method of the present invention, a service provider, a service function, and a service protocol, which are used as criteria of network service classification, are applied to a signature to have the same ID tag for the service provider, service function, or service protocol. By grouping signatures and applying policies, network services can be integrated and controlled.

1 is a block diagram illustrating an integrated service control apparatus according to an embodiment of the present invention.
2 is a conceptual diagram for describing classifying network services based on attributes.
3 is a schematic diagram illustrating signatures processed by the signature processing unit of FIG. 1.
4 is a schematic diagram illustrating an example of the processed signatures of FIG. 3.
FIG. 5 is a schematic diagram illustrating that a signature group having a specific ID tag value is selected for a specific attribute in the processed signatures of FIG. 4.
6 is a flowchart illustrating an integrated service control method according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between .

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 is a block diagram illustrating an integrated service control apparatus according to an embodiment of the present invention.

Referring to FIG. 1, an integrated service control apparatus 100 according to an embodiment of the present invention includes a signature processing unit 110, a signature selecting unit 120, and a signature matching unit 130.

The signature processing unit 110 classifies the signatures based on two or more attributes according to the attribute information, and adds an ID tag for each attribute to each signature. The present invention describes service providers, service functions, and service protocols as examples of attributes that classify signatures. But the attributes that classify signatures are not limited to these.

The signature processing unit 110 may include pre-processed signatures such as signatures stored in the signature database (not shown) or signatures generated by the signature generation unit (not shown). Classify by criteria. Then, the processed signatures are generated by adding the service provider ID tag, the service function ID tag, and the service protocol ID tag of the signature to each signature. The service provider, service function, and service protocol will be described later.

The signature selector 120 selects a signature of the first group including the first ID tag for the first attribute among the processed signatures according to the policy information to be applied.

In the present invention, the policy information is information related to a service object that a user or an administrator wants to control. That is, the policy information may vary according to a case in which a service provided by a specific service provider is desired, a service including a specific function is desired, or a service using a specific protocol is desired. The policy information may be stored in advance in a policy setting database (not shown). Accordingly, the signature selector 120 may select a signature group having a specific ID tag for a service provider attribute when a command for controlling a service provided by a specific service provider is input.

The signature matching unit 130 allows or blocks the inflow of the input packet by matching an input packet with a signature of the selected first group. The signature matching unit 130 matches the signatures of the first group with the input packets, respectively, and blocks the inflow of the input packets when the matching of the at least one signature and the input packets matches as a result of the matching. . On the contrary, if the matching of all signatures and the input packet does not match, the access of the service having a specific attribute is allowed by allowing the inflow of the input packet.

Therefore, it is possible to allow or block the access of a service having a specific property.

2 is a conceptual diagram for describing classifying network services based on attributes. In the present invention, the classification criteria of network services are utilized for signature.

Referring to FIG. 2, network services may be classified based on a service provider, a service function, and a service protocol.

Service Provider means a company or organization that provides services. For example, service providers such as NHN, DAUM, and Microsoft. One service provider may provide various services such as a mail service, a social network service (SNS), a file sharing, and the like. You can use the HOST field value in the RFC 2410 HTTP standard to classify these service providers. That is, the service provider can be identified by checking the value of the HOST field in the RFC 2410 HTTP standard.

The service function refers to a type of service provided by a service provider to a user. Although the types of services may vary, examples of the types of services exposed to the user include a message, a file, a file size, and a login. A message refers to the act of sending a message. That is, it may include actions such as writing a mail, registering a post on a homepage, commenting, and writing a note. A file refers to an act of attaching and transmitting a file stored in a storage device. That is, the mail writing may include attaching and sending an attachment, registering a photo, or adding an attachment when registering a post. The file size refers to the size of a file attached to the file function (for example, byte). Login refers to the act of accessing a service using an ID and password of an account issued for the purpose of using the service provider's functions.

The service protocol means an appointment for communication between a service provider and a service user. When using web services, follow the HTTP standard (RFC 2410) described above. Certain network services (or applications) use proprietary protocols to communicate with each other. For example, in the case of BitTorrent applications, also known as peer to peer (P2P) applications, the applications communicate with each other using the Bittorrent protocol. MSN, also known as Messenger) service, uses its own protocol called MSNP.

3 is a schematic diagram illustrating signatures processed by the signature processing unit of FIG. 1, and FIG. 4 is a schematic diagram illustrating an example of the processed signatures of FIG. 3.

Referring to FIG. 3, each signature is processed in the signature processing unit to add a service provider ID tag, a service function ID tag, and a service protocol ID tag of the signature.

The service provider ID tag, the service function ID tag, and the service protocol ID tag are added to the signature using the result of collecting and analyzing the traffic of webmail, SNS, and web hard.

Referring to FIG. 4, the first NAVER webmail signature includes NHN as a service provider ID tag, a message as a service function ID tag, and http as a service protocol ID tag. This means that the first NAVER webmail signature has an NHN based on the service provider, a message based on the service function, and an http value based on the service protocol. The first NAVER webmail signature may block access to a network service having such an attribute value.

The second NAVER webmail signature includes NHN as the service provider ID tag, file as the service function ID tag, and ftp as the service protocol ID tag. This means that the second NAVER webmail signature has an attribute value of NHN based on the service provider, file based on the service function, and ftp based on the service protocol. The second NAVER webmail signature may block access to a network service having such an attribute value.

The first MSN IM signature includes Microsoft as the service provider ID tag, a message as the service function ID tag, and MSNP as the service protocol ID tag. This means that the first MSN IM signature has an attribute value of Microsoft based on the service provider, message based on the service function, and MSNP based on the service protocol. The first MSN IM signature may block access to a network service having such an attribute value.

FIG. 5 is a schematic diagram illustrating that a signature group having a specific ID tag value is selected for a specific attribute in the processed signatures of FIG. 4.

Referring to FIG. 5, the signatures are grouped into a signature group having the same attribute value, that is, the same ID tag values, in the signature selector according to a policy to be applied.

For example, if the policy to be applied is to block all network services whose service provider is 'NHN', signatures having a service provider ID tag of 'NHN' are selected and grouped. That is, the first neighbor webmail signature, the second neighbor webmail signature, the first me2day SNS signature, and the second me2day SNS signature are grouped and selected as the first signature group.

Therefore, signatures having a service provider attribute of 'NHN' among signatures are selected at the same time, and thus, all network services having a service provider of 'NHN' can be blocked regardless of other attributes (service function and service protocol).

As another example, if the policy to be applied is to block all network services whose service function is 'message', the signatures whose service function ID tag is 'message' are selected and grouped. That is, the first neighbor webmail signature, the first metoday SNS signature, the first MSN IM signature, and the first next webmail signature are grouped and selected as the second signature group.

Accordingly, since signatures having a service function attribute of 'message' among signatures are selected at the same time, all network services having a service function of 'message' can be blocked regardless of other attributes (service provider, service protocol).

As described above, the present invention applies a service provider, a service function, and a service protocol used as a criterion of network service classification to a signature. Grouping signatures with the same ID tag for a service provider, service function, or service protocol can be used to collectively control and manage network services by applying policies.

6 is a flowchart illustrating an integrated service control method according to an embodiment of the present invention.

Referring to FIG. 6, in the integrated service control method according to an embodiment of the present invention, signatures are first classified based on two or more attributes according to attribute information. Specifically, they are classified based on service provider, service function, and service protocol. Then, the service provider ID tag, the service function ID tag, and the service protocol ID tag of the signature are added to each signature (step 610).

Next, a first signature group including a first ID tag (eg, NHN) is selected for the first attribute (eg, service provider property) according to the policy information to be applied (step 620).

Next, each signature included in the first signature group is matched with the input packet to allow or block the inflow of the input packet (step 630).

If at least one signature among the signatures included in the first signature group matches the pattern of the input packet as a result of the matching, access of the service is blocked by blocking the inflow of the input packet (step 640).

If all of the signatures included in the first signature group and the pattern of the input packet do not match as a result of the matching, the flow of the input packet is allowed to allow access of the service (step 650).

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

100: integrated service control unit
110: signature processing part
120: signature selection unit
130: signature matching unit

Claims (8)

Classifying the signatures based on two or more attributes according to the attribute information, and adding an ID tag for each attribute to each signature;
Selecting a signature of a first group including a first ID tag for a first attribute of the two or more attributes according to the policy information to be applied; And
Allowing an incoming packet to be allowed or blocked by matching the input packet with a signature of the selected first group;
And inflow of the input packet when at least one signature of the first group of signatures matches the input packet.
The method of claim 1, wherein the attribute comprises at least one of a service provider, a service function, or a service protocol.
The method of claim 2, wherein the service function
Integrated service control method that includes message transfer or file attachment transfer.
delete A signature processing unit for classifying signatures based on two or more attributes according to attribute information and adding an ID tag for each attribute to each signature;
A signature selecting unit that selects a signature of a first group including a first ID tag with respect to a first attribute among the processed signatures according to the policy information to be applied; And
A signature matching unit configured to allow or block the inflow of the input packet by matching an input packet with a signature of the selected first group,
The signature matching unit
And at least one signature of the first group of signatures matches the input packet to block the inflow of the input packet.
6. The integrated service control device of claim 5, wherein the attribute comprises at least one of a service provider, a service function, or a service protocol.
The method of claim 6, wherein the service function
Integrated service control device including message transfer or file attachment transfer.
delete

Images