KR102362320B1 - System and method for communicating of network address mutation on dynamic network security - Google Patents

Abstract

The present invention relates to an address mutation connection system for dynamic network security and a method thereof. The address mutation connection system includes: a database server storing a dynamic Internet address of a target server to be protected, and address mutation data and a mutation policy of the target server for a port change; an authentication server managing an ID and a password of a connection user to authenticate the user and searching a data server to provide a changed Internet address and port to an authenticated client part; the client part registering an OTP in the authentication server to join membership and requesting authentication with the registered OTP to receive the address-mutated Internet address and port to connect the target server; and the target server self-mutating an IP address and PORT for connection in a predetermined cycle by using IP addresses located in an Internet address pool, and including an address mutation server agent storing the changed IP address and PORT in the data server and transmitting the same to the authentication server. Therefore, the present invention is capable of preventing inappropriate access to a server.

Description

Address mutation access system and method for active network security {System and method for communicating of network address mutation on dynamic network security}

The present invention relates to an address variation access system and method for active network security, and more particularly, actively protects it by applying it to SSH, which connects to a host server through IP and port using network-based MTD (NMTD). and to an address variation access system and method for active network security that enhances security for insider access to SSH through user identification using OTP.

In the era of the 4th industrial revolution, the use of the Internet of Things (IoT), in which various networks and 5G-based objects are connected to the Internet based on the Internet, is rapidly increasing. In addition, in order to control and maintain these objects, a large amount of cost is required to establish and monitor a security control system on the equipment, and it is difficult to manage individual equipment. On the other hand, in the case of spatially separated wireless CCTV and webcam, it is almost impossible to construct an individual firewall, so security accidents are frequent.

In order to prevent such a security incident, devices connected to the Internet must be designed so that they can actively defend themselves. A system designed in this way can not only perform appropriate defense functions without a firewall, but also prevent hacking of the Internet of Things and servers and block DDoS attacks in advance. For such active security, MTD (Moving Target Defense) techniques that dynamically change various characteristics of a system to be protected according to time change are being developed.

The goal of the MTD (Moving Target Defense) technology is to make the various attributes of the protected object less static, less homogeneous, and less deterministic, thereby increasing the attacker's reconnaissance action workload. will be. As a result, it reduces the similarity of one successful attack and adds dynamism to the system, thereby reducing the lifetime of the attack and limiting the damage of a large-scale attack.

Existing studies related to network address variation use a NAT (network address translation) type address translation method and an address generation method using a cryptographic algorithm to generate and mutate network addresses.

However, in the case of NAT-type address mutation, since the address mutation is performed on a network device such as a gateway, there is a possibility that the real address of the protected server may be exposed to an internal attacker located in the same subnetwork as the protected server.

In addition, when a network address is generated using a cryptographic algorithm, there is a problem that an address conflict in which the same output value for different inputs is generated may occur.

Domestic Patent Publication No. 2020-0002599

The present invention has been devised to solve the conventional problems as described above, and its purpose is to access a host server using cyber self-defense technology and Internet address variation technology to neutralize the reconnaissance behavior of the server's IP and PORT. By applying to SSH using Internet IP and PORT, intrusion is prevented by neutralizing the detection of hackers, and furthermore, it identifies insider access using public access accounts and implements and applies SSH access permission using OTP of authenticated users. And to provide an address variation access system and method for active network security for fundamentally preventing unauthorized access by insiders.

An address variation access system for active network security according to the present invention includes: a database server storing address variation data for active Internet address and port change of a target server to be protected and a variation policy of the target server; an authentication server that manages the ID and password of the access user to authenticate the user, searches a data server, and provides the changed Internet address and port to the authenticated client unit; a client unit capable of accessing a target server by registering OTP in the authentication server, joining as a member, requesting authentication with the registered OTP, receiving an address-mutated Internet address and port; and a target server including an address variation server agent that uses the IP address in the Internet address pool to self-mutate the access IP address and PORT at regular intervals, and stores the changed IP address and PORT in the data server and transmits it to the authentication server. will include

In addition, in the address variation access system for active network security according to the present invention, the target server is characterized in that it includes a virtual interface card.

In addition, in the address variation access system for active network security according to the present invention, the address variation server agent modifies and adds a network address translation unit (NAT) so that a packet transmitted from the client unit can be transmitted to a virtual IP and port , or to be deleted.

In addition, in the address variation access system for active network security according to the present invention, the authentication server comprises: a variation storage processing module for storing and processing the mutated address and port transmitted from the address variation server agent in a database server; a user registration module for registering and managing user information registered as a member in the client unit; OTP authentication module that registers the OTP of the registered user and performs OTP authentication; and an address variation search module that searches the database server for address variation information in response to an OTP-authenticated user's access request, and transmits an IP address and port currently accessible to the target server to the client unit.

In addition, in the address variation access system for active network security according to the present invention, the client unit generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and the QR code It is characterized in that the code is registered in the OTP.

In addition, in the address variation access system for active network security according to the present invention, the OTP is characterized in that it uses an open app OTP including Google OTP.

In addition, in the address variation access system for active network security according to the present invention, the client unit drives the user authentication client to input the authenticated user's smartphone phone number and the registered OTP authentication number, and OTP authentication is performed in the authentication server. It is characterized in that the user's access log is left by authenticating the number.

On the other hand, the address change method for active network security according to the present invention comprises the steps of: self-mutating, by a server agent of a target server, an IP address for access and a PORT at a regular cycle; In the authentication server, the server agent transmits the self-mutated Internet address and port to the database server; The client unit registers an OTP in the authentication server, joins the membership, and requests authentication with the registered OTP; The authentication server authenticates the client unit by verifying the user's smartphone number and OTP authentication number; transmitting, by the authentication server, an IP address and port currently accessible to the target server to the client unit by searching for address variation information with a database server; and accessing the target server by connecting the client unit with the changed IP address and port.

In addition, in the address variation method for active network security according to the present invention, the address variation server agent modifies and adds a network address translation unit (NAT) so that the packet transmitted from the client unit can be transmitted to the virtual IP and port for SSH , or is characterized in that it comprises the step of deleting.

In addition, in the address change method for active network security according to the present invention, the client unit generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and generates the QR code It is characterized in that it includes the step of registering for OTP.

The present invention blocks hacking by neutralizing the detection of hackers by using the Internet address self-variation daemon in response to reconnaissance on the IP and port of the server, and applying to SSH using the Internet IP and port connected to the host server, As a security measure against unauthorized insider access, it is effective to prevent unauthorized access by leaving an access log of the end user who inquires the IP and port using the Google account and phone number of the authenticated user's smartphone and a separate OTP. have.

In addition, according to the present invention, since IP change is made at a specific interval, there is a blocking effect according to a long time connection, so that another intrusion can be prevented while the user is away.

In addition, as the features and effects of the implementation system according to the present invention, it is possible to identify and prevent internal accessors, which cannot be done by hacking prevention through a firewall.

1 is a block diagram of an address variation access system for active network security according to the present invention.
2 is a detailed configuration diagram of a target server in an address variation access system for active network security according to the present invention.
3 is a state diagram for transmitting mutated address and port information in the target server of the present invention.
4 is a diagram illustrating a state in which a client accesses a target server according to changed address and port information in the system according to the present invention.
5 is a diagram illustrating a state in which a target server accesses a client in the system according to the present invention.
6 is a user registration interface screen of the client unit in the system according to the present invention.
7 is a user authentication interface screen of the client unit in the system according to the present invention.
8 shows information stored in the database server of the system according to the present invention.
9 shows an address variation access process for active network security according to the present invention.

Hereinafter, an address variation access system and method for active network security according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an address variation access system for active network security according to the present invention, FIG. 2 is a detailed configuration diagram of a target server in an address variation access system for active network security according to the present invention, and FIG. This is a state diagram of the target server transmitting the mutated address and port information.

1 and 2, an address variation access system for active network security according to an embodiment of the present invention includes a client unit 100, an authentication server 200, a database server 300, and a target server 400. include

In order to actively change the Internet address and port of the target server to be protected, the IP address and port for access are self-mutated at regular intervals by using the IP address in the Internet address pool, and the changed IP address and port are changed as shown in FIG. It includes an address variation server agent 410 that stores the IP address and PORT in the data server and transmits it to the authentication server.

The database server 300 stores address variation data and a variation policy of the target server 400 for actively changing the Internet address and port of the target server 400 to be protected.

The authentication server 200 manages the ID and password of the user accessing the target server 400 to authenticate the user, searches the data server 300 and provides the changed Internet address and port to the authenticated client unit 100 . .

The client unit 100 registers an OTP in the authentication server 200 to register as a member, requests authentication with the registered OTP, receives an address-mutated Internet address and port, and can connect to the target server 400 .

1 and 2, the target server 400 includes a network address translation (NAT, 420) and a virtual network interface card (430).

The address change server agent 410 modifies, adds, or deletes the network address conversion unit 420 so that the packet transmitted from the client unit 100 can be transmitted to the virtual IP and port.

Accordingly, the address change server agent 410 uses the IP in the IP pool to self-variate the connection IP and port, and transmits the changed IP and port to the database server 300 using SSL communication, and the client The NAT 420 is modified so that the packets transmitted from the unit 100 can be transmitted to the virtual IP and port through the virtual network interface card 430 so that the SSH daemon processes the packets received from the private IP and port. make it

4 is a state diagram in which a client accesses a target server according to changed address and port information in the system according to the present invention, and FIG. 5 is a state diagram in which the target server accesses the client in the system according to the present invention.

4 and 5, when transmitting a packet from the target server 400 to the client unit 100, the internal interface and the destination NAT module are not involved, so if there is an accurate connection IP and port, normal communication is performed. However, if the access IP and port are changed periodically, the corresponding communication is cut off and the connection is not reconnected.

According to an embodiment of the present invention, the address variation server agent 410 changes the IP address and the service port every 30 minutes.

Referring to FIG. 1 , the authentication server 200 stores the mutated address and PORT transmitted by SSL from the address variation server agent 410 in the database server 300 and is connected to the client unit 100 for user registration, OTP It handles registration and OTP authentication.

The authentication server 200 notifies the current IP and port of the target server to which the access right is allowed when the client unit 100 connects through the Android app or the web and completes 2-pass authentication with a phone number and OTP.

In FIG. 1 , the authentication server 200 includes a variation storage processing module 210 , a user registration module 220 , an OTP authentication module 230 , and an address variation search module 240 .

The mutation storage processing module 210 stores the mutated address and port transmitted from the address mutation server agent 410 in the database server 300 .

The user registration module 220 registers and manages user information registered as a member in the client unit 100 .

The OTP authentication module 230 registers the OTP of the registered user and processes authentication using the registered OTP number.

The address variation search module 240 searches the database server 300 for address variation information in response to an OTP-authenticated user's access request, and sends an IP address and port currently accessible to the target server 400 to the client unit 100 . send it

The client unit 100 generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and registers the QR code in the OTP.

6 is a user registration interface screen of the client unit in the system according to the present invention.

The user authentication client is implemented as an app as shown in FIG.

A QR code is generated using the Google Account account email and smartphone number of the smartphone read through the authentication app installed in the client unit 100 .

By using the generated QR code, it is possible to register the app OTP (eg, Google OTP), etc. and use the open app OTP, and user authentication is possible without the need to use a separate hardware OTP.

7 is a user authentication interface screen of the client unit in the system according to the present invention.

Referring to FIG. 7 , when an OTP authentication request is made by inputting the smartphone number of the user to be authenticated and the registered OTP authentication number, the authentication server 200 verifies the OTP verification and OTP authentication number in the authentication module to authenticate the user. to process

Accordingly, the identity of the public account is distinguished by leaving an access log of the end user who inquires the IP and PORT.

8 shows information stored in the database server of the system according to the present invention.

Referring to FIG. 8 , the server name, IP, service name, service port, and change history are stored in the database server 300 as address-changed target server information.

According to the embodiment of Fig. 8, the servers with server IDs 719 and 720, respectively, initially have IPs of 124. 111. 52. 67. and port numbers of 22 and 21. According to the changed address after 30 minutes, IP is 124 .111. 52. 20. has been changed.

In addition, the generated and updated access log history according to the e-mail and smartphone number of the server accessing user is stored.

9 shows an address variation access process for active network security according to the present invention.

Referring to FIG. 9 , an address variation access process for active network security proceeds as follows.

First, the server agent 410 of the target server 400 mutates the IP address and port for access at a regular cycle at a regular cycle (S10).

Referring to FIG. 9 , the address change server agent 410 changes the IP address and the service port every 30 minutes.

When the IP accessible to the target server 400 and the service port are changed, the server agent 410 transmits the self-mutated Internet address and port to the database server 300 (S20).

Next, the client unit 100 registers an OTP in the authentication server 200 for a user accessing the server, joins the member, and requests authentication using the registered OTP (S30, S40).

Thereafter, the authentication server 200 authenticates the client unit 100 by confirming the user's smartphone number and OTP authentication number (S50).

The authentication server 200 retrieves the address variation information to the database server 300, the database server 300 transmits the raw address variation information to the authentication server 200, and the authentication server 200 currently accesses the target server. A possible IP address and port are transmitted to the client unit 100 (S60, S70).

The client unit 100 accesses the target server 400 by accessing the changed IP address and port (S80).

Meanwhile, the address change server agent 410 modifies, adds, or deletes the network address conversion unit 420 so that the packet transmitted from the client unit 100 can be transmitted to the virtual IP and port.

In addition, the client unit 100 generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and registers the QR code in the OTP to process the user membership registration .

According to the present invention, since IP change is made at specific intervals, there is a blocking effect according to long-time access, so another intrusion can be prevented while the user is away, and identification and prevention of internal users becomes possible.

Although the present invention has been described in detail only with respect to the specific embodiments described above, it is apparent to those skilled in the art that various modifications and variations are possible within the scope of the technical spirit of the present invention, and it is natural that such variations and modifications belong to the appended claims. .

100: client unit 200: authentication server
210: mutation storage processing module 220: user registration module
230: OTP authentication module 240: address variation search module
300: DB server 400: target server
410: address variation server agent 420: network address translation unit
430: virtual network interface card

Claims (10)

a database server that stores address variation data for active Internet address and port change of a target server to be protected and a variation policy of the target server;
an authentication server that manages the ID and password of the user accessing the target server to authenticate the user, searches the data server, and provides the changed Internet address and port to the authenticated client unit;
a client unit that registers OTP in the authentication server to register as a member, requests 2-pass authentication with the user's phone number and OTP, receives the address-mutated Internet address and port, and accesses the target server; and
Including a target server with an address variation server agent that uses the IP address in the Internet address pool to self-mutate the IP address and port for access at regular intervals, and stores the changed IP address and PORT in the data server and transmits it to the authentication server and
The address change server agent uses the IP in the IP pool to change the connection IP and port, and transmits the changed IP and port to the database server using SSL communication, and sends the packet transmitted from the client to the virtual network interface card. The SSH daemon processes the packets received from the private IP and port by modifying the NAT so that it can be transmitted to the virtual IP and port through
a mutation storage processing module for storing and processing the mutated address and port transmitted from the address mutation server agent in a database server;
a user registration module for registering and managing user information registered as a member in the client unit;
OTP authentication module that registers the OTP of the registered user and performs OTP authentication; and
Address variation for active network security, characterized in that it includes an address variation search module that retrieves address variation information from a database server in response to an OTP-authenticated user's access request, and transmits an IP address and port currently accessible to the target server to the client unit connection system. delete The method of claim 1,
The address variation server agent modifies, adds, or deletes a network address translation unit (NAT) so that a packet transmitted from the client unit can be transmitted to a virtual IP and port. delete The method of claim 1,
Active network security address variation access, characterized in that the client unit generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and registers the QR code in the OTP system. 6. The method of claim 5,
The OTP is an active network security address change access system, characterized in that using the open app OTP including Google OTP. The method of claim 1,
Active type, characterized in that by driving a user authentication client, inputting the authenticated user's smartphone phone number and registered OTP authentication number in the client unit, and authenticating the OTP authentication number in the authentication server, the user's access log is left. Address variation access system for network security. self-variating, by a server agent of a target server, an IP address and port for connection at a regular cycle;
The server agent transmitting the self-mutated Internet address and port to the database server;
The client unit registers an OTP in the authentication server, joins the membership, and requests authentication with the registered OTP;
The authentication server authenticates the client unit by verifying the user's smartphone number and OTP authentication number;
transmitting, by the authentication server, an IP address and port currently accessible to the target server to the client unit by searching for address variation information with a database server; and
The client unit includes a step of accessing the target server by accessing the changed IP address and port,
The address change server agent uses the IP in the IP pool to change the connection IP and port by itself, and transmits the changed IP and port to the database server using SSL communication. The SSH daemon processes the packets received from the private IP and port by modifying the NAT so that it can be transmitted to the virtual IP and port through the
a mutation storage processing module for storing and processing the mutated address and port transmitted from the address mutation server agent in a database server;
a user registration module for registering and managing user information registered as a member in the client unit;
OTP authentication module that registers the OTP of the registered user and performs OTP authentication; and
Address variation for active network security, characterized in that it includes an address variation search module that searches the database server for address variation information in response to an OTP-authenticated user's access request, and transmits an IP address and port currently accessible to the target server to the client unit How to connect. 9. The method of claim 8,
Address variation server agent for active network security, characterized in that it includes the step of modifying, adding, or deleting a network address translation unit (NAT) so that the packet transmitted from the client unit can be transmitted to the virtual IP and port. How to connect. 9. The method of claim 8,
The client unit generates a QR code using the account email and smartphone number of the user's smartphone read by driving the user authentication client, and registering the QR code in the OTP for active network security Address variation access method.

Images