KR19990069355A - How to block site access - Google Patents

Abstract

The present invention relates to a method for blocking access to a site, and more particularly, to a method for blocking access to a site having harmful information in a communication. The present invention relates to a network management method for managing a plurality of computers connected by a communication network. If the first computer connected to the communication network wants to connect to a second computer connected to another communication network that is not allowed to connect, the third computer managing the communication network sends a signal as if the third computer managing the communication network is to terminate the communication from the second computer to the first computer. It is made by blocking the connection between the first computer and the second computer, so that the network can be monitored by using lower specification hardware, reducing the burden on the network administrator to a minimum, and eliminating the system obstacles caused by the connection blocking. To provide.

Description

How to block site access

The present invention relates to a site access blocking method, and more particularly, to a method for blocking access to a site having harmful information in communication.

Today, the Internet is the product of most noticeable information and communication, as the definition of a network is a huge collection of networks. The Internet, developed by the US Department of Defense (ARPAnet) in 1969, has developed into a global network. The Internet has moved away from automating simple functions such as e-mail and file transfer. It is evolving with the advent of browsers with interfaces.

In the early days, the purpose of the Internet was to be used as a means of academic research. At the same time, the use of the Internet began to expand to various fields of society such as academic, economic, and cultural.

One of the biggest dysfunctions in this development is the rapid increase in the number of hosts that provide harmful information such as life-threatening, human rights violations, pornographic information, and unhealthy entertainment.

The rapid increase in harmful information has an extremely bad effect on Internet users, and measures are needed to protect youth from flooding harmful information, especially in the educational field of educational institutions that are being rapidly promoted by the high-speed information society. Is necessary.

The most important feature of the Internet is its open network. In other words, if you have only the elements you need, you can connect to anyone who wants to.

The Internet is a network designed to maintain communication between two computers that are separated from each other at any time since its inception. ARPAnet, the parent of the Internet, was established based on packet communication.In 1973, ARPAnet was established based on packet communication. The first international connections to Norway were initiated, and in 1974, the design of the Transmission Control Protocol (TCP), a packet-switched network protocol, began.

After that, ARPAnet, which continued to expand, was established in 1982 using Transmission Control Protocol / Internet Protocol (TCP / IP), which is the core technology of the Internet. The e-mail service was launched. In 1988, the Korean domain was defined as (.kr) and applied to various Internet services.

The Internet has made rapid progress with the development of WWW services based on hypertext.

The WWW was developed by Tim Berners-Lee of The European Laboratory for Particle Physics (CERN) in 1989 for efficient organization and retrieval of documents scattered in CERN based on a client / server model. Developed.

And, hypertext refers to a document of a network structure that allows direct connection with designated data beyond a menu format such as a conventional gopher method (WAIS). When WWW is first developed, text is a text. It was operated on a browser (text brouser) basis and did not receive much acknowledgment. However, in 1993, the development of a mosaic brouser at the National Center for Supercomputer Applications (NCSA) in the United States included text, video, video and audio information. It started running under the GUI (Graphic User Interface) environment, and received great response from all over the world.

As shown in FIG. 1, the structure of TCP / IP is composed of IP belonging to the Internet layer and TCP belonging to the transport layer.

As shown in FIG. 2, the TCP cuts the data transmitted from the upper application program into a predetermined size and transmits the data to the IP in a predetermined order in one data unit called a packet.

TCP consists of 40 ~ 44 (Octet) header information and the data part to be used in the actual higher level application program, and it is transmitted in the order determined by sequence number and acknowledgment number. do.

The main function of TCP is to provide a virtual circuit between upper layers.

That is, it provides three services such as establishment, maintenance, and disconnection of virtual circuits, which are set in a 3-WAY-HANDSHAKE method, and are determined by a code bit value in a transmitted packet.

The cutting of the virtual circuit is made as shown in FIG. That is, after data to be transmitted from Site 1 is transmitted, the FIN bit, which is a flag indicating termination, is set and transmitted to Site 2, and Site 2 transmits the FIN bit indicating the termination at the same time as the response (ACK). The TCP connection is terminated between two.

As shown in FIG. 4, IP is composed of an IP header portion and an IP data portion of 40 (Octet) or more, and the IP data includes an actual TCP header, a TCP data portion, a User Datagram Protocol (UDP) header, and a UDP data portion. have.

IP transmits the packet received from TCP to the host of destination, including source IP address and destination IP address, and decides whether to fragment the packet. The destination host enables recombination of the data.

Meanwhile, as the Internet users are diversified, management of websites that deal with unhealthy information such as pornography, drugs, and violence is required.

However, since the Internet is an open network, it is practically difficult to block a specific user from a specific website.

For this reason, it is often the case that a program using a network technology is used to block the connection itself at the client level or to control each client's website access at the server.

In addition, companies with firewalls may use some features of the firewall to restrict site access.

Internet service providers also offer separate services for specific age groups, such as teens and children, or even close some sites using routers' access lists.

There are many ways to block harmful sites that provide such information. Among them, the black list filtering technique lists the sites that contain the information and accesses the blacklisted sites. If you want to, say how to block.

White list filtering is a method of creating a list of sites that users can connect to, and making them inaccessible to other sites.

Neutral label filtering is a method of classifying Internet sites by rating and connecting only sites that are appropriate for each user.

Filtering software used for the purpose of blocking harmful information or network on the Internet is divided into personal and administrator use, and personal use installs and uses filtering software in a personal Internet access system. Compared with the advantages that can be achieved, the filtering safety device can be deleted and modified, so the stability is inferior. There are the following types.

NCA patrol is developed by Korea Computer Center and performs blocking function according to the default blocked address list and the user's added blocked address list or blocked word list.

Cyber patrol, developed by Microsoft Software, is a filtering software using proxy servers that can block Internet access during the day, as well as block lists.

Net shepherd, developed by Net Shepherd, is a way of issuing accounts and granting permissions to individual users in consideration of the user interface.

Netnanny is a blocking feature that can be applied to specific browsers. The list is retrieved through a proxy server to control access to Internet sites and to search for words or sentences to control access. Administrators can identify the Internet addresses that individual users want to access.

Cybercity is a program that provides a simple user experience with a simple and clean interface to control site access through words.

Netfilter is set to work only if the proxy function of the web browser is set to the netfilter site, and netfilter can only use the block list provided by netfilter.

For administrators, the filtering software must pass through gateways or proxy servers installed, making it unsuitable for small to medium sized networks by requiring expensive and high-efficiency equipment at the time of installation. There is a problem to reconfigure the network.

In addition, the method of adjusting through the access list of the router for the administrator can be filtered only by the site address list, the elastic filtering using the content rating is impossible, and the system bottleneck is caused to cause the bottleneck of the network. There are the following kinds of things.

The Cyber Patrol Proxy version uses a proxy approach, installs and runs on Microsoft or Netscape Proxy Server, and periodically updates and receives filtering lists from Cyber Patrol.

SmartFilter-WebTrack is installed using the Netscape Proxy plug-in used by Windows NT. You need to download and install the control list using FTP.

On the other hand, the method of blocking harmful information on the Internet can be divided into a client method and a server method. The client method is a method of installing a program and installing a DB on all PCs in the network, and the server method is a network method. Blocking harmful information risks erasing the program if you are a computer expert.

In addition, the server method uses a proxy method, and since all users in the network are connected to the Internet through a proxy server or gateway, there is a disadvantage of reconfiguring a lower network, and by user group (for example, In order to manage by age restriction, it is necessary to configure terminal servers for each group.

An object of the present invention is to solve the problems of the conventional unhealthy site blocking program as described above, when a user accesses or attempts to access a unhealthy site, a monitor that monitors the network transmits a signal to inform the user of the termination of the connection. It is to provide a site access blocking method that blocks access to unhealthy sites.

The present invention provides a network management method for managing a plurality of computers connected by a communication network, in order to achieve the above object, if the first computer connected to the communication network to connect to a second computer connected to another communication network is not allowed And disconnecting the connection between the first computer and the second computer by transmitting a signal as if the third computer managing the communication network intends to terminate the communication from the second computer to the first computer. To provide.

1 is a configuration diagram showing a configuration of TCP / IP;

2 is a configuration diagram of TCP,

3 is a flowchart of a virtual circuit,

4 is a configuration diagram of an IP,

5 is a configuration diagram showing the configuration of a LAN.

The configuration and operation of the site access blocking method according to the present invention will be described in detail through one embodiment.

5 is a diagram illustrating the configuration of a LAN.

The configuration of the site access blocking method according to the present invention will be described in detail with reference to FIG.

In FIG. 5, computer A is a management computer for managing a local area network (LAN), and computer B is one of a plurality of general users connected by a LAN. Computer C is a counterpart computer connected via the Internet via a router.

Computer A, which is a management computer, is provided with filtering software based on the site access blocking method according to the present invention and a database for preventing access to a computer address, and in the embodiment of the present invention, information that is unhealthy in the computer C is constructed. Assume

Computers A and B are each composed of an application program, an operating system, and a driver and an adapter that connect a computer to a LAN, and a database may be constructed. .

In general, a local area network (LAN) is a communication method in which multiple computers transmit packets over a common communication medium in time according to a standard set by the IEEE.

Each computer receives and processes only the information that is transmitted by default through hardware called LAN adapters and software called LAN drivers.

In these packets, the address of each transmitting adapter, the address of the receiving adapter, the contents (DATA), and the like are coded according to a format defined by the standard.

In addition, using PROMISCOUS MODE defined in the LAN protocol, all packets on the LAN can be received, and when the packets are decoded, computer A on the LAN can be used by another computer B and another computer C on the LAN or the Internet. You can see if the content is communicating.

Using this principle, computer A, which is monitoring the LAN, determines that computer B is attempting or communicating with computer C on the LAN or the Internet, which needs to block communication, and then computer A sends a FAKE PACKET. Create and send to computer B.

This fake packet consists of a computer B for the receiving side address and a computer C for the transmitting address, and the end of communication.

In other words, computer A constructs and transmits a packet for termination by disguising itself as computer C.

Computer B actually received a fake packet sent from Computer A, but because it is incapable of distinguishing it from the normal packet sent by Computer C, it understands that Computer C wants to end the communication and terminates the communication.

This technology can be used by LAN administrators and others to restrict the inappropriate use of the Internet. In particular, when the school network is operated, students are prevented from interfering with the system by effectively blocking access to non-educated sites.

Software technology for this purpose is commonly referred to as information filtering technology. Conventional connection blocking technology uses a proxy server to configure all computers on the LAN to communicate through the proxy server when they want to communicate over the Internet. This proxy server blocks the connection.

On the other hand, the site access blocking method according to the present invention has been described based on the embodiment of the LAN, it can be applied to the principle applied to other communication networks.

The site access blocking method according to the present invention configured as described above can monitor the network using hardware of lower specification, reduce the burden on the network administrator to the minimum, and eliminate the system obstacles caused by the connection blocking. to provide.

Claims (4)

In the network management method for managing a plurality of computers connected by a communication network, If the first computer connected to the communication network wants to connect to a second computer connected to another communication network that is not allowed to connect, the third computer managing the communication network sends a signal as if the third computer managing the communication network is to terminate the communication from the second computer to the first computer. A method of blocking access to a site, the method comprising: disconnecting a connection between a first computer and a second computer. The method of claim 1, wherein the data transmitted / received on the communication network is in the form of a packet including a sender address, a receiver address, and data to be transmitted. The method of claim 1, wherein the third computer checks the address of the second computer to which the first computer is to be connected by monitoring data transmitted and received between a plurality of computers connected to the communication network. The connection termination signal sent from the third computer to the first computer includes an address of the second computer, which is a sender address, an address of the first computer, which is a receiver address, and data indicating an end of the connection. Site access blocking method characterized in that the packet made.