KR101713909B1 - Method for defending network using white domain and apparatus therefor - Google Patents

Abstract

A method and apparatus for efficiently defending a network attack while maintaining existing equipment are disclosed. The method according to the present invention may compare a domain included in a packet with the main domain and the sub domain of a white domain list and determine whether a corresponding request is a white domain request. Also, the method according to the present invention may drop a corresponding packet if a corresponding request is not a white domain request.

Description

TECHNICAL FIELD [0001] The present invention relates to a network defense method using a white domain,

The present invention relates to a network defense method using a white domain and an apparatus therefor. In particular, the present invention relates to a method and apparatus for preventing overloading of a server using a white domain engine.

Attacks to overload network entities on the network have been widely used by attackers. Such an attack on the network is performed, for example, in order to overload the server to stop the operation of the server. When the operation of the server is stopped by such an attack, the server can not provide the service. In addition, there is a risk of leakage of security information of the server caused by a network attack.

For example, a Denial of Service (DoS) attack may be used. A DoS attack may imply temporarily or indefinitely blocking or stopping services for users of hosts connected to the Internet. Distributed Denial of Service (DDoS) attacks can also be denial of service attacks, which are one or more origins of attacks. DDoS attacks can usually be performed from more than a thousand unique IP addresses.

Examples of attacks aimed at overloading these servers are poisoning internet attack and DNS NX Domain Attack (Domain Name System Non-eXistent Domain attack). A DNS NX domain attack may be referred to as a non-existent internet domain names attack or an NX domain attack. A poisoning Internet attack means that when a user sends a connection request to a site in a specific firewall, it redirects the connection request by changing the destination IP address and restricts the user's access. can do. Also, the DNS NX domain attack may mean an attack that loads the server by requesting information from a domain in which domain information does not exist.

As the network attacks become more frequent, inconveniences caused by inability to provide services are increasing. In addition, the cost of recovering the service and the damage caused by server information leakage are increasing. Therefore, there is a need for a method that can more effectively block such network attacks.

Korean Patent Registration No. 10-1038673

It is a technical object of the present invention to provide a method for protecting a server from a network attack.

It is another object of the present invention to provide a method of preventing a network attack while preventing an overload of a server, at a low cost.

It is another object of the present invention to provide a method for classifying a normal connection request of a user using a white domain engine.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. ,

According to an aspect of the present invention, there is provided a network defense method using a white domain, comprising: reading a packet received from a user equipment; Matching a first domain of a first request included in the read packet with a main domain table; Matching the first domain with a sub domain table if the main domain of the first domain matches one of the main domains in the main domain table; Determining a first request as a white domain request if the sub domain of the first domain matches a sub domain of the sub domain table; And dropping the packet if the first domain does not match the main domain table or the subdomain table.

According to an aspect of the present invention, there is provided an apparatus for network defense using a white domain, comprising: a packet collecting unit for reading a packet; A white domain engine processing unit for matching a first domain of the first request included in the packet with a main domain table and a sub domain table; And a processor for controlling the packet collecting unit and the white domain engine processing unit, wherein the main domain of the first domain matches one main domain of the main domain table, and the sub domain of the second domain Domain sub-domain table matches a sub-domain of the sub-domain table, the first request is determined as a white domain request, and the main domain of the first domain requests the main domain table or the sub- If not, it may be configured to drop the packet.

According to embodiments of the present invention, an effective defense method against a network attack can be provided.

According to the embodiments of the present invention, an efficient processing method for an abnormal connection request can be provided.

According to the embodiments of the present invention, an overload of the server can be prevented by processing a connection request for a domain that exists on a white domain.

According to embodiments of the present invention, an efficient defense method against network attacks can be provided without replacing existing equipment.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description will be.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.
1A is a schematic diagram of a poisoning Internet attack.
1B is a flow chart of a poisoning Internet attack.
2A is a schematic diagram of an NX domain attack.
2B is a flow chart of the NX domain attack.
3 is a block diagram of a high-speed network security device engine according to an embodiment.
FIG. 4 illustrates a main domain table and a subdomain table according to an embodiment.
5 is a first flowchart of an attack defense method according to an embodiment.
6 is a second flowchart of an attack defense method according to an embodiment.
7 is a third flowchart of an attack defense method according to an embodiment.
8 is a fourth flowchart of an attack defense method according to an embodiment.

The following embodiments are a combination of elements and features of the present invention in a predetermined form. Each component or characteristic may be considered optional unless otherwise expressly stated. Each component or feature may be implemented in a form that is not combined with other components or features. In addition, some of the elements and / or features may be combined to form an embodiment of the present invention. The order of the operations described in the embodiments of the present invention may be changed. Some configurations or features of certain embodiments may be included in other embodiments, or may be replaced with corresponding configurations or features of other embodiments.

Unless defined otherwise, all terms used herein may be used in a sense that is commonly understood by one of ordinary skill in the art to which this invention belongs. In addition, commonly used predefined terms are not interpreted beyond or in excess of the meaning of the dictionary unless expressly defined otherwise. The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention.

Hereinafter, embodiments will be described with reference to the drawings.

1A is a schematic diagram of a poisoning Internet attack.

1A, an example of a network comprised of User Equipment (UE) 110, a firewall 130, a first server 121, a second server 125, and a high speed network security system 126, do. Although only one user device 110 is shown in FIG. 1A, it is apparent that a plurality of user devices can perform a poisoning Internet attack. The first server 121 may be, for example, a server for Site A, and the second server 125 may be a server for Site B.

1B is a flow chart of a poisoning Internet attack.

A user of the user device 110 may wish to access site A. In this case, a connection request may be transmitted (S110) from the user device 110 based on a user's input or the like.

Firewall 130 may include a blacklist of sites (e.g., a black list). For example, an attacker may include site A in the blocking site list of firewall 130. In this case, the firewall 130 that has received the user's access request blocks the connection to the requested site A and redirects the received access request to a predetermined site (e.g., site B) (S120). For example, the firewall 130 may redirect the connection request by resetting the destination IP address in the connection request to another predetermined IP address.

The redirected connection request is received at the second server 125 corresponding to the re-established IP address. If the second server 125 receives a connection request, rather than a connection request for itself, the second server 125 may send an error message to the user device 110 that transmitted the connection request. The second server 125 may read the destination IP address of the connection request and send an error message to the user device 110 regarding the erroneous request. This is because the destination IP address of the received connection request is a request to a site other than itself. For example, the error message may be a "404 NOT FOUND" error message. The operations described above with respect to the second server 125 may be performed by the high speed network security system 126 and the high speed network security system 126 may be part of the second server 125. [

In the poisoning Internet attack of FIGS. 1A and 1B, since the second server 125 repeatedly transmits an error message if such an attack is repeated, the second server 125 is overloaded due to the repeated error message response It is possible. In particular, since the redirected access request from the poisoning Internet attack is a normal access request query modulated only by the destination IP address, it is difficult for the high-speed network security system 130 to determine whether the access request is an abnormal access request .

2A is a schematic diagram of an NX domain attack.

In FIG. 2A, the user device 210 may be one or more user device groups. Server 220 is a server for site A and high-speed network security system 226 may be a separate device or part of server 220. [ Operations described below in connection with the server 220 may be performed by the high speed network security system 226.

2B is a flow chart of the NX domain attack.

The user device 210 transmits a connection request made in the main domain of the site A to the server 220 (S210) with the subdomain "abc". For example, the main domain of site A may be "A.com ". In this case, the connection request of the user device 210 may be a connection request to "abc.A.com ". In the following embodiments, the domain name A may mean a series of strings rather than a letter A, and the string may include numbers and / or special symbols.

The server 220 is configured to return an IP address in response to a normal DNS (Domain Name System) request (e.g., www.A.com). However, if the subdomain is not supported with respect to the main domain as shown in FIG. 2B, the server 220 returns an error code indicating that the corresponding DNS IP does not exist.

In FIG. 2B, the server 220 transmits an error message to the request including the sub-domain that it does not support (S220). The NX domain attack is intended to cause an overload on the server 220 by iteratively performing a request including unsupported subdomains. That is, as shown in FIG. 2B, connection requests including unsupported sub-domains may be repeatedly transmitted to the server 220 (S230, S250). In addition, the server 220 repeatedly transmits an error message (S240, S260).

The NX domain attack attacks (DNS) server 220 using a subdomain of a list of normal serving domains. It is difficult for the high-speed network security system 226 to block such an attack because it is difficult to determine whether the DNS is in the normal domain by the high-speed network security system 226. [

Thus, as described above in connection with FIGS. 1A-2B, a method is needed that is capable of blocking the connection request in advance for various types of network attacks by the network security system.

3 is a block diagram of a high-speed network security device engine according to an embodiment.

The high speed network security device 300 includes a packet collecting unit 310, a protocol analyzing unit 320, a Hyper Text Transfer Protocol (HTTP) processing unit 330, a DNS (Domain Name System) processing unit 340, 350, and a domain Quality of Service (QoS) engine 360.

The packet collecting unit 310 can read a packet of a network interface card (NIC). The packet may be a request query received from the user device. The protocol analyzer 320 analyzes the received packet and classifies the received packet into an HTTP protocol or a DNS protocol.

In the case of a packet of the HTTP protocol, the HTTP processing unit 330 processes the packet according to the HTTP protocol and transmits it to the white domain engine processing unit 350. In the case of a DNS protocol packet, the DNS processing unit 340 processes the packet according to the DNS protocol and transmits it to the white domain engine processing unit 350.

The white domain engine processing unit 350 may include a main domain table and a sub domain table. FIG. 4 illustrates a main domain table 410 and a subdomain table 420 according to an embodiment. The white domain may be a domain that is not blocked by the high-speed network security device (300 in FIG. 3), and may be a list of domains that are secured by predetermined criteria or an administrator. A white domain list may mean a concept opposite to a blocking domain list (i.e., blacklist). The main domain table 410 may include main domains of a secure domain set based on preset conditions or an administrator's input. In addition, the subdomains associated with each main domain may be stored in the subdomain table 420. 4, "mail1.A.com", "mail2.A.com", "map.A.com", and "www.A.com" are stored in the main domain table 410 and the subdomain table (420). ≪ / RTI > The main domain table 410 and the subdomain table 420 of FIG. 4 may be referred to as a white domain table.

Referring back to FIG. 3, for example, in the case of a packet according to the HTTP (i.e., WEB) protocol, the request query may be a GET or POST request. This Web service request may also be a request to a service port having a Transmission Control Protocol (TCP) port number 80, 8080, or 443. In this case, the packet may contain a "Host" string and a host name. Accordingly, the white domain engine processing unit 350 determines whether the host name matches the main domain table (410 in FIG. 4) described above with reference to FIG. When matching with the main domain table, the white domain engine processing unit 350 judges whether or not it matches the host name and the subdomain table (420 in FIG. 4) described above with reference to FIG. If the host name matches both the main domain table and the sub domain, the white domain engine processing unit 350 determines a normal white domain request. On the other hand, when the main domain table or the sub domain table and the host name do not match, the white domain engine processing unit 350 can prevent the server from being overloaded by dropping the corresponding packet.

For example, the request query may be a packet according to the DNS protocol. In this case, the request query may be a request to a DNS service port having a User Datagram Protocol (UDP) port number 53 or a TCP port number 53. The white domain engine processing unit 350 may determine whether the corresponding domain is a normal white DNS domain request by matching the packet with the main domain and the sub domain table. The determination and processing method is the same as described above with respect to the packet according to the HTTP protocol, and is omitted for convenience of explanation.

If the request query (HTTP or DNS) is determined as a normal white domain (DNS) request, the same request may be restricted. Even if a normal white domain request is repeated in a duplicate, a response to the request may cause an overload in the server. Therefore, it is possible to prevent the same access DoS attack through the domain QoS. For example, the domain QoS engine 360 may be configured to limit the same request as a request determined with a normal white domain request. For example, if the same request is received again within a predetermined time, the request may be dropped (or discarded). The same request may refer to the same request, such as a source address, a host name, and / or a destination request. The domain QoS engine 360 may drop (or discard) the same request based on a predetermined condition. For example, the domain QoS engine 360 may drop the packet if the same request is received more than a predetermined number of times in a predetermined time. In addition, the domain QoS engine 360 may drop packets of the same request by a predetermined time when the predetermined condition is satisfied. For example, a timer may be set to drop packets of the same request to the domain QoS engine 360.

The high-speed network security device 300 described above may be implemented as an independent device or as a part of a server. The high-speed network security device 300 may further include other configurations besides the configuration shown in FIG. For example, high speed network security device 300 may further include a processor. In addition, the processor may be configured to control each of the high-speed network security device 300 configurations. 3 may be implemented on one or a plurality of chips. The configurations shown in FIG. 3 are logically divided centering on the functions of the high-speed network device 300, and each configuration may be a physical individual configuration, but may also be a software implemented function.

Hereinafter, an attack defense method according to an embodiment will be described with reference to FIGS. 5 to 8. FIG. The following embodiments can be performed by the above-described high-speed network security device and / or its configuration.

5 is a first flowchart of an attack defense method according to an embodiment.

When the packet is received, the received packet is read (S510). The reading of the packet may be performed in the packet collecting unit. After reading the packet, the protocol of the packet is analyzed (S520), and it is determined whether the packet is web (i.e., HTTP) traffic (S530) or DNS traffic (S540). The protocol of the packet may be performed by a protocol analysis engine. If the packet is neither a Web protocol nor a DNS protocol, the packet may be processed by another security engine (S550).

6 is a second flowchart of an attack defense method according to an embodiment.

In FIG. 5, when the corresponding packet is determined to be web traffic (A in FIG. 5), the high speed network security device checks in step S610 whether the protocol and port of the corresponding packet are mapped. For example, the packet may be a request to a service port having a Transmission Control Protocol (TCP) port number 80, 8080, or 443. If the packet corresponds to a predetermined port number of the predetermined protocol, the high speed network security device determines whether the packet is a GET or POST request (S620). If the packet is a GET or post request, the high speed network security device checks whether the "Host" string exists in the packet (S640). If the "Host" string is detected in the packet, the white domain processing engine may determine (S640) if the host name in the packet matches the (pre-established) main domain table. Also, if the domain name matches the main domain table (if the domain name matches one of the main domains in the main domain table), the white domain processing engine determines whether the host name in the packet matches the (predefined) (S650). That is, it can be determined whether the domain name matches with one subdomain in the subdomain table. If the host name of the packet does not match the main domain table or the sub domain table, the corresponding packet is dropped (S660). Also, in this case, the packet may be discarded.

7 is a third flowchart of an attack defense method according to an embodiment.

In FIG. 5, when the corresponding packet is judged as DNS traffic (B in FIG. 5), the high speed network security device checks in step S710 whether the protocol and port of the corresponding packet are mapped to the predetermined protocol and port. For example, the packet may be mapped to a UDP (User Datagram Protocol) port number 53 or a TCP port number 53. When the DNS service port (for example, UDP 53, TCP 53) and the packet's protocol and port are mapped, the white domain processing engine determines whether the DNS query in the packet matches the main domain table and the subdomain table (S720, S730) . That is, it can be determined whether the domain name matches one main domain in the main domain table and one subdomain in the subdomain table. If the DNS query of the packet does not match the main domain table or the sub-domain table, the corresponding packet is dropped (S740). Also, in this case, the packet may be discarded.

8 is a fourth flowchart of an attack defense method according to an embodiment.

If the packet matches the main domain table and the subdomain table (FIGS. 6 and 7C), the packet is forwarded to the domain QoS engine. If the packet is a packet of the TCP protocol (S810), IP and domain inspection (S820) may be performed. If the packet is a UDP protocol packet (S830), a domain check (S840) may be performed. As described above, if the packet matches the main domain table and the sub domain table, the corresponding packet can be determined as a request for the white domain. However, as described above, the corresponding packet may be dropped or discarded in steps S820 and S840 in order to prevent network overload due to the same address repeated access. For example, if the same request is received again within a predetermined time, the request may be dropped (or discarded). The same request may refer to the same request, such as a source address, a host name, and / or a destination request. The domain QoS engine may drop (or discard) the same request based on predetermined conditions.

In the embodiments described above, some steps may be omitted or reduced to one step. For example, the present invention may be represented in an abbreviated form as comparing the requested domain with the predetermined white domain list (white main domain list and white domain list) by reading the packet and the read packet.

According to the embodiments described above, in case of a poisoning Internet attack in which the destination IP address is changed, the high speed network security system can drop the redirected request. This is because the redirected destination IP address does not match the white domain list of the high-speed network security system. Thus, a server overload due to a response to an unnecessary request (transmission of an error message) can be prevented.

According to the above-described embodiments, an NX domain attack with a non-existent subdomain can be prevented. In this case, the high-speed network security system may drop the packet because the sub-domain does not match the white domain list of the high-speed network security system. Thus, a server overload due to a response to an unnecessary request can be prevented.

According to the above-described embodiments, an attack by the same connection request can be prevented. Even if the request is for a domain in the white domain list, the high speed network security system may drop the packet for the same repeated access request. Thus, a server overload due to a response to an unnecessary request can be prevented.

The high speed network security system described above with respect to Figures 1A-8 may be implemented as one independent network security device or network security module. The network security system may be implemented as part of a server. The server described above in connection with Figs. 1A to 8 may be referred to as a receiving side, a receiving device, a decoding device, and the like, and may include a node, an eNodeB, a base station, a workstation, The server and / or network security system may include a network interface for transmitting and receiving data. The server and / or network security system may also include a processor for controlling network interfaces and other server configurations. In addition, the server may further include other configurations such as memory and power sources.

The server and / or network security system may further include other configurations in addition to those described above. A processor of a server or network security system (or device) may be referred to as a controller, a microcontroller, a microprocessor, a microcomputer, or the like. A processor may be implemented by hardware or firmware, software, or a combination thereof.

(DSP), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), and the like, when implementing the embodiments of the present invention using hardware. arrays) may be provided in the processor.

On the other hand, when implementing embodiments of the present disclosure using firmware or software, firmware or software may be configured to include modules, procedures, or functions that perform the functions or acts herein, May be contained within the processor or may be stored in memory and driven by the processor. Although not particularly mentioned in the above embodiments, a series of operations such as data processing of the above-described embodiments can be performed by the processor.

The embodiments described above are those in which the elements and features of the present invention are combined in a predetermined form. Each component or feature shall be considered optional unless otherwise expressly stated. Each component or feature may be implemented in a form that is not combined with other components or features. It is also possible to construct embodiments of the present invention by combining some of the elements and / or features. The order of the operations described in the embodiments of the present invention may be changed. Some configurations or features of certain embodiments may be included in other embodiments, or may be replaced with corresponding configurations or features of other embodiments. It is clear that the claims that are not expressly cited in the claims may be combined to form an embodiment or be included in a new claim by an amendment after the application.

It will be apparent to those skilled in the art that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

Claims (14)

A network defense method using a white domain,
Reading a packet received from the user equipment;
Matching a first domain of a first request included in the read packet with a main domain table;
Matching the first domain with a sub domain table if the main domain of the first domain matches one of the main domains in the main domain table;
Determining a first request as a white domain request if the sub domain of the first domain matches a sub domain of the sub domain table; And
And dropping the packet if the first domain does not match the main domain table or the subdomain table,
Further comprising dropping a packet for the second request if a second request identical to the determined white domain request is received within a predetermined time from the time the first request was received. . The method according to claim 1,
And sending the determined white domain request to a server corresponding to the first domain. The method according to claim 1,
Wherein matching the first domain with the main domain table is performed only when a service port of the first request matches a predetermined protocol and port. The method of claim 3,
Wherein the predetermined protocol and port are TCP (Transfer Control Protocol) port 80, 8030 or 433 when the first request is a web request. The method of claim 3,
Wherein the service port of the DNS request is a TCP port 53 or a UDP (User Datagram Protocol) port 53 when the first request is a Domain System Name (DNS) request. The method according to claim 1,
Wherein matching the first domain with the main domain table is performed only if the first request is a GET or POST request. The method according to claim 1,
Wherein matching the first domain with the main domain table is performed only if the first request includes a string "Host ". delete An apparatus for network defense using a white domain,
A packet collecting unit for reading a packet;
A white domain engine processing unit for matching a first domain of the first request included in the packet with a main domain table and a sub domain table; And
A processor for controlling the packet collection unit and the white domain engine processing unit,
The processor comprising:
If the main domain of the first domain matches one main domain of the main domain table and the sub domain of the first domain matches one sub domain of the sub domain table, as a white domain request,
And drop the packet if the first domain does not match the main domain table or the subdomain table,
A domain QoS (Quality of Service) engine that drops a packet for the second request if a second request identical to the determined white domain request is received within a predetermined time from the time the first request is received Further comprising: a device for network defense. 10. The method of claim 9,
Wherein the processor is further configured to cause the white domain engine processing unit to match the first domain with the main domain table only if the service port of the first request matches a predetermined protocol and port, Lt; / RTI > 11. The method of claim 10,
Further comprising a protocol analyzing unit for classifying the read packet as a web request or a DNS (Domain Name System) request,
If the first request is a web request, the predetermined protocol and port are a Transfer Control Protocol (TCP) port 80, 8030 or 433,
Wherein the service port of the DNS request is a TCP port 53 or a User Datagram Protocol (UDP) port 53 if the first request is a DNS request. 12. The method of claim 11,
Wherein if the first request is a web request, the first request is a GET or POST request. 12. The method of claim 11,
Wherein if the first request is a web request, the first request includes a string "Host ". delete

Images