KR101473607B1 - Apparatus and Method for Access Control in a Virtual Private Network - Google Patents

Abstract

The present invention relates to an apparatus and a method for controlling a virtual private network access. According to the present invention, a gateway server which is positioned in a neutral zone to control a client terminal of an external network device includes: a policy storage unit to store an access policy of an internal network; a command receiving unit to receive a command word from the client terminal, which accesses from the external network; a policy identifying unit to identify the stored policy with respect to the received command word; and an access controller to control an access to the internal network according to the identified policy. According to the present invention, even when an ID and a password are hacked and stealing of internal enterprise information is attempted, an access to the internal enterprise information having a possibility of being leaked can be prevented, an efficient extension of work is always guaranteed based on SSL VPN, and the internal enterprise information can be safely protected.

Description

Technical Field [0001] The present invention relates to a virtual private network access control apparatus and a virtual private network access control apparatus,

The present invention relates to a virtual private network access control apparatus and method, and more particularly, to an access control apparatus and method for enhancing security of a virtual private network service in a virtualized environment.

The contents described in this section merely provide background information on the embodiment of the present invention and do not constitute the prior art.

Virtualization refers to a technology that physically integrates other systems logically, or conversely, one system is logically divided to make efficient use of resources. In recent years, such functions are absolutely required in servers and PCs.

Types of virtualization can be divided into application virtualization, desktop virtualization, server virtualization, storage virtualization, and network virtualization.

Application virtualization is a technology that virtualization provides without the need to install the applications required for users' local PCs. Desktop virtualization creates virtual machines with the performance of the existing desktop level on a central server and assigns them to users by the administrator. Users authenticate with their assigned accounts using the desktop or various mobile devices, Virtualization A technology that allows you to use your PC or business virtualization PC as your own virtual desktop.

Examples of network virtualization are virtual private network (VPN) services. The virtual private network service is a service that provides a special communication system and encryption method to use the internet network as a private line, and it has the same effect as installing a private network between the corporate headquarters and branch offices or branch offices. It solves the high cost burden of the existing private network For use. Since it is only necessary to connect with the enterprise communication network and the Internet service provider, it is not necessary to purchase and manage expensive equipment or software separately, and it is possible to reduce the cost compared to the existing private line. In addition, it has advantages such as user's mobility guarantee and convenient network configuration.

However, since the virtual private network service is constructed and operated by the private network in the public network, security technology that can compensate the security weakness in the public network must be supported. An example of a technique for securing virtual private network services is IPsec (IP Security) VPN, which is traditionally configured on an IP basis. However, in order to configure IPsec VPN, it is necessary to configure VPN equipment for security communication, and there are difficulties due to restriction on NAT (Network Access Translation) and difference in configuration method between devices.

SSL VPN (Secure Sockets Layer Virtual Private Network), which is complemented by these disadvantages, is a server that allows multiple clients (PCs, smart phones, thin client PCs, tablet PCs and notebooks) If you pass it, the private network is constructed. If the existing IPsec was a VPN at the network layer, SSL is a VPN configuration at the transport layer and the application layer. Therefore, VPN communication is possible on the move if Internet communication is possible with a web browser at any time, without the need for IPsec equipment.

With the introduction of SSL VPN, it has been possible to guarantee the extensibility of business efficiently anytime and anywhere. However, security threats such as leakage of internal information are becoming a problem. Recently, information stealing techniques have been developed. Especially, in the case of financial business, leakage of personal information of customers inside the company has a serious impact on the corporate image.

Accordingly, the present invention proposes a virtual private network access control apparatus and method for enhancing security in a virtualized environment that can overcome the above-described technical constraints.

Korean Published Patent No. 10-2010-0033698, published on March 31, 2010 (name: virtual private network service method and system thereof)

According to an aspect of the present invention, there is provided a virtual private network service in a virtualized environment. The virtual private network service includes: Thereby enhancing security.

The problems to be solved by the present invention are not limited to those mentioned above, and another problem to be solved can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a gateway server apparatus for controlling access to a client terminal of an external network, the gateway server apparatus being located in a neutral zone, the gateway server apparatus comprising: a policy storage unit for storing an access policy to an internal network; An instruction receiver for receiving an instruction from a client terminal connected to the external network; A policy verifying unit for verifying the stored policy with respect to the received command word; and an access control unit for controlling access to the internal network according to the verified policy.

According to another aspect of the present invention, there is provided a method of controlling a virtual private network access of a client terminal of an external network in a gateway server apparatus located in a neutral zone, the method comprising: storing an access policy to an internal network; Receiving an instruction from a client terminal connected in an external network; A policy checking step of confirming the stored policy with respect to the received command word; and an access control step of controlling access to the internal network according to the checked policy.

Another aspect of the present invention provides a computer readable recording medium on which a program for executing a virtual private network access control method is recorded.

According to the virtual private network access control apparatus and method of the virtualized environment of the present invention, even if an attempt is made to steal company internal information by hacking an ID and a password, the access with possibility of leak of internal company information can be effectively prevented.

In addition, it is effective to safely protect the information inside the company, while ensuring the extensibility of the business efficiently and at anytime and anywhere with the SSL VPN.

The effects obtained in the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description .

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the technical features of the invention.
1 is a diagram illustrating a schematic configuration of a virtual private network access control apparatus according to an embodiment of the present invention.
2 is a diagram illustrating a schematic configuration of a gateway server according to an embodiment of the present invention.
3 is a diagram illustrating a virtual private network access control method according to an embodiment of the present invention.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following detailed description, together with the accompanying drawings, is intended to illustrate exemplary embodiments of the invention and is not intended to represent the only embodiments in which the invention may be practiced. The following detailed description includes specific details in order to provide a thorough understanding of the present invention. However, those skilled in the art will appreciate that the present invention may be practiced without these specific details.

In some instances, well-known structures and devices may be omitted or may be shown in block diagram form, centering on the core functionality of each structure and device, to avoid obscuring the concepts of the present invention.

Throughout the specification, when an element is referred to as "comprising" or " including ", it is meant that the element does not exclude other elements, do. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have. Also, the terms " a or ", "one "," the ", and the like are synonyms in the context of describing the invention (particularly in the context of the following claims) May be used in a sense including both singular and plural, unless the context clearly dictates otherwise.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram illustrating a schematic configuration of a virtual private network access control apparatus according to an embodiment of the present invention.

Here, virtual private network service is explained based on SSL VPN technology. The client terminal 100 refers to an external user access terminal located in an unspecified number of external networks. Examples of the client terminal 100 are an Internet access device such as a personal computer, a laptop computer, a personal digital assistant (PDA), a cellular telephone, a mainframe computer, a mini computer and a Web TV.

Further, the client terminal 100 preferably is equipped with web browser software such as MICROSOFT INTERNET EXPLORER, MOZILLAFIREFOX, etc. and is connected to the network 300 using any known data communication networking technology.

The host computer 200 is a server existing in the internal network 202 such as a company that establishes a virtual environment and provides the virtual environment to the client terminal 100. Physically, it is possible to efficiently operate various applications of different operating systems (OS) such as Windows and Linux on one system.

The host computer 200 may be in the form of a server farm as well as a single server. A server farm is a group of servers that are housed and operated as a group, which is also called a server cluster, and is managed separately from the client network. Each server can be used to stabilize the server because it can be immediately replaced by any other server to prevent service interruption.

A guest virtual machine 210 is mounted on the host computer 200. The virtual machine 210 refers to a computer logically created by software on a real computer. Such as a central processing unit (CPU) and an input / output device (I / O), and it is possible to operate a plurality of systems by connecting client terminals 100 of a plurality of users on one computer.

A virtual guest OS can run as an operating system on the guest virtual machine 210 and the operating system can be any form such as CP / M, MS-DOS, Windows, Unix, Linux, VMS, OS /

Tunneling (320) for maintaining a stable communication base between the client terminal (100) and the host computer (200).

Virtual private networking services have the same effect as connecting directly to a virtual circuit in a virtual network through a connection through an unknown public network. Here, the virtual private network service method is classified according to a method of implementing a virtual circuit, and a tunneling technique is commonly used. Tunneling is a technology that encapsulates a specific protocol that is desired to be used for actual communication in a network protocol that does not support it or an unreliable network (public network).

Preferably, the tunneling 320 according to an embodiment of the present invention utilizes an SSL session tunneling method in a VPN SSL environment.

The communication network 300 refers to a connection means capable of providing a connection between the client terminal 100 and the host computer 200. A wide area network (WAN), a local area network (LAN), an intranet, a Code Division Multiple Access (CDMA), a Wideband Code Division Multiple Access (WCDMA) , Global System for Mobile Communications (GSM), and Long Term Evolution (LTE), or any type of network to be implemented in the future, regardless of its name.

In one embodiment of the present invention, the gateway server 400 is separately constructed in a demilitarized zone 420. The gateway server 400, which performs a core function in one embodiment of the present invention, will be described in detail in the following description of FIG.

The neutral zone 420 is a kind of host or network that is a space for preventing the external network 102 and the internal network 202 from being connected to each other. It is possible to prevent an external user from directly accessing an internal server 202 of the internal network 202 containing the information of the enterprise, and even if an external user breaks the security of the neutral host, information inside the enterprise is not leaked.

The neutral zone 420 may provide some sort of separation service between the external network 102 and the internal network 202.

In the embodiment of the present invention, the neutral zone 420 is the destination of all the external networks 102, and the internal network 202 does not directly communicate with the external network 102.

Information is exchanged between the external network 102 and the gateway server 400 through the tunneling 320 in order to enhance security between the gateway server 400 and the virtual machine 210. Preferably, the tunneling scheme encapsulates and encrypts the packet through SSL session tunneling.

The screen value executed in the virtual machine 210 of the internal network 202 is transmitted to the gateway server 400 through the tunneling 320 and the client terminal 100 sees the screen value transmitted to the gateway server 400 do.

A firewall (not shown) may be installed between the external network 102 and the gateway server 400 and between the gateway server 400 and the virtual machine 210 to further enhance security.

Hereinafter, the components of the gateway server 400, which is a core component of the present invention, will be described in detail with reference to FIG.

2 is a diagram illustrating a schematic configuration of a gateway server according to an embodiment of the present invention.

The gateway server 400 plays a role of preventing the command input from the client terminal 100 in advance when there is a risk that information of the internal network 202 can be leaked.

In order to do this, pre-stored risky commands are stored in the policy storage unit 401. Examples of these are CMD, COPY, FTP, Delete, and MTSC. Commands can also be saved.

The stored policy can usually be configured to store commands to be blocked, or vice versa.

The command is preferably in the form of a character command but is not limited to any type of command that can cause an execution command to be executed by the virtual machine 210 of the internal network 202, such as text, voice, sound, It is a concept that includes formats.

The policy stored in the policy storage unit 401 can be modified, added or deleted at any time according to the policy change of the user.

Client terminal 100) accesses the virtual private network and inputs a command, the command receiving unit 403 receives all commands and extracts the keyword.

In the policy checking unit 405, the command receiving unit 403 receives the extracted command keywords and performs filtering. In order to filter the risk of each instruction, the policy verifying unit 405 inquires the previously stored policy storage unit 401 to check whether it is a command to block or execute.

The policy verification unit 405 transfers the confirmed result value to the access control unit 407. [

The access control unit 407 processes the inputted commands according to the user policy. If the command is the block target command, the client terminal 100 notifies the client terminal 100 of the blocking message without performing the command. When the client terminal 100 receives the command blocking message, it displays whether or not the message is blocked in a predetermined format, for example, a popup message format.

If the command is an executable command, the access control unit 407 forwards the command to the virtual machine 210.

The screen value of the result executed in the virtual machine 210 of the internal network 202 according to the forwarded command is transmitted to the gateway server 400 through the tunneling 320. The client terminal 100 transmits the screen value to the gateway server 400, The user can see the screen value received from the user.

The policy storage unit 401, the command receiving unit 403, the policy checking unit 405, and the access control unit 407 refer to a unit for processing a single function or operation. The unit may be hardware, software, , And any one or more of the configurations may be physically separated or integrated.

Hereinafter, a virtual private network access control method according to an embodiment of the present invention will be described.

3 is a diagram illustrating a virtual private network access control method according to an embodiment of the present invention.

In the policy storage unit 401, a policy for blocking or execution commands according to the policy is stored (S310).

When a client terminal 100 accessing a virtual private network requests a service using a web browser address bar, a hyperlink, or a submit button, the packet is encapsulated, encrypted, and transmitted to the gateway server 400 through tunneling S320).

After the keywords of the received command are extracted, a policy for blocking the command is compared with a previously stored policy (S330).

If the command is a blocking target command, the command blocking message is transmitted to the client terminal 100 in a predetermined manner (S340), and the client terminal 100 displays the blocking message in a pop-up form or the like (S350) .

If the command is not a block target instruction and execution is possible, the command is forwarded to the virtual machine 210 (S360).

The virtual machine 210 of the internal network 202 executes the corresponding command according to the forwarded command in step S370 and transmits the executed screen value to the gateway server 400 through the tunneling 320 in step S380.

The gateway server 400 transmits the screen value again to the client terminal 100 (S390).

3, it is described that steps S310 to S390 are sequentially executed. However, this is merely an exemplary description of the technical idea of the present embodiment, and it is obvious to those skilled in the art that the present embodiment It will be understood that various modifications and changes may be made to the method of the present invention without departing from the essential characteristics and by implementing one or more of the steps S310 to S390 in parallel, But is not limited thereto.

Each block of the block diagrams attached hereto and combinations of steps of the flowchart diagrams may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The foregoing description is merely illustrative of the technical idea of the present invention and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

100: a client terminal
102: External network
200: Host computer
210: Virtual Machine
202: Nebu Network
300: Network
320: Tunneling
400: gateway server
420: Neutral Zone
401: Policy storage unit
403:
405:
407:

Claims (13)

1. A gateway server apparatus for controlling access to a client terminal of an external network in a neutral zone,
A policy storage unit for storing an access policy to the internal network;
An instruction receiving unit for receiving an instruction in a form of one or more of a character, voice, sound, or code from a client terminal connected in an external network;
A policy verifying unit for verifying the stored policy with respect to the received command; And
An access control unit for controlling access to the internal network according to the identified policy;
The access policy comprising:
And the other commands are forwarded to the virtual machine of the internal network through forwarding,
Wherein when the transmission of the command is interrupted, a message indicating that the command is blocked is transmitted to the client terminal, and the command is not executed. delete The method according to claim 1,
The predetermined command to which the transmission is blocked,
CMD, COPY, FTP, Delete, and MSTSC. delete delete The method according to claim 1,
When a command is transferred to the virtual machine,
Wherein the gateway server receives the screen value from which the command is executed in the virtual machine and transfers the received screen value to the client terminal. A method for controlling a virtual private network access of a client terminal of an external network in a gateway server device located in a neutral zone,
Storing an access policy to an internal network;
Receiving an instruction from a client terminal connected to the external network in a form of one or more of a character, a voice, a sound, and a code;
Checking the stored policy for the received command; and
And an access control step of controlling access to the internal network according to the identified policy,
Wherein the access policy blocks transmission of a predefined command and transfers the other command to the virtual machine of the internal network through forwarding,
And transmitting a message informing that the command is blocked to the client terminal when blocking the transmission of the command. delete 8. The method of claim 7,
The predetermined command to which the transmission is blocked,
CMD, COPY, FTP, Delete, and MSTSC. delete 8. The method of claim 7,
When a command is transferred to the virtual machine,
Wherein the virtual machine receives the screen value from which the command is executed in the virtual machine and transfers the received screen value to the client terminal.

delete delete

Images