KR20020055211A - apparatus and method for user access control by using HTTP proxy - Google Patents

Abstract

PURPOSE: A device and a method for controlling a user access using an HTTP proxy are provided to cut off an access from a specific host to a specific site at a specific time, date, and day of the week using an HTTP(Hyper Text Transfer Protocol) proxy and prevent an unnecessary network traffic using a web cache. CONSTITUTION: An HTTP client(30) requests resources for outputting to a web browser. An HTTP proxy(20) performs an access control, performs a cut-off with respect to an access violated to a rule, and transmits cut-off information when the resources of the HTTP client(30) are requested. A file system(60) receives a resources request information confirmation message from the HTTP proxy(20) and checks whether corresponding information is existed. A monitor(50) receives cut-off information from the HTTP proxy(20) and outputs the information on a screen. If corresponding information is not existed in the file system(60), a web server(40) transmits corresponding information to the HTTP proxy(20).

Description

Apparatus and method for user access control by using HTTP proxy}

The present invention relates to an HTTP service in a communication network environment in which a firewall is constructed. In particular, the present invention relates to a user access control apparatus and method for blocking access to a specific site from a specific host at a specific time, date, and day using an HTTP proxy. It is about.

In general, in case of a HTTP (Hyper Text Transfer Protocol) proxy in a communication network environment where a firewall is constructed, an HTTP proxy as a gateway that controls external users from accessing internally and a web cache function by an internal user There is an HTTP proxy as a cache proxy to use.

As the latter, the HTTP proxy as a cache proxy stores resources of a site accessed by the user, and when there is a request for the same resource from another user, transmits the resource stored in the proxy to the user. It is used to reduce the transmission load on the image. In other words, the cache function is the main HTTP proxy.

An HTTP proxy as a cache proxy logically has one connection, but physically forms two connections as a subject and an HTTP proxy, an HTTP proxy and an object, and the user can use the proxy in the web browser's options to use the HTTP service. After setting, if you input URL (Universal Resource Location) to connect, request the resource with the HTTP proxy that is set first.If there is no resource in the cache memory of the proxy, connect directly to the server and bring the resource to the user. If there is a user who requests the same resource after storing it in the cache memory at the same time, it transmits the information to the user using the information in the cache memory.

As such, the commonly used HTTP proxy stores the requested resource in the cache memory. When the same request is made, the HTTP proxy provides a cache function that transmits the information to the user by using the information in the cache memory. It is vulnerable to security related functions such as access control.

In addition, even if the utilization rate of the network service is more than 80% of the total, it is no exaggeration to require a proxy with an access control function that can control unnecessary information transmission for the HTTP service used by many users.

Therefore, the present invention was devised to solve the above-mentioned conventional problems, and blocks access to a specific site from a specific host at a specific time, date and day by using an HTTP proxy, and uses an unnecessary network by using a web cache. The purpose is to prevent traffic.

1 is a schematic diagram of a user access control apparatus applied to the present invention.

2 is a detailed configuration diagram of a user access control apparatus applied to the present invention.

3 is a flowchart of a method of implementing an HTTP proxy applied to the present invention.

4 is a flowchart of a user access control method applied to the present invention.

5 is a message format diagram for blocking information applied to the present invention.

<Explanation of symbols for the main parts of the drawings>

10: firewall 20: HTTP proxy

30: HTTP Client 40: Web Server

50: monitor 60: file system

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment according to the present invention.

An embodiment of a user access control device according to the present invention,

An HTTP client requesting resources for output to a web browser,

An HTTP proxy for performing access control when requesting the resource of the HTTP client to block access to the violation of rules and at the same time transmitting the blocking information;

A file system that receives the resource request information confirmation message from the HTTP proxy and checks whether the information exists;

A monitor that receives the blocking information from the HTTP proxy and outputs it to the screen;

Preferably, the web server transmits the information to the HTTP proxy when the information is not present in the file system.

The HTTP proxy is

A web cache unit for temporarily storing data transmitted from the web server;

An access control unit that restricts the use of the service by using an IP address, time, day of the week, and date;

It is preferable to configure the alarm unit to notify the administrator in real time the blocking information in case of violation.

An embodiment of the HTTP proxy implementation method according to the present invention,

After the user makes a resource request with an HTTP proxy, the HTTP proxy collects information to determine which network group the user belongs to or where to try to connect.

Performing access control using the collected information to transmit blocking information to the administrator in violation of the rule;

A process of comparing cache information about whether the requested resource exists in the file system of the HTTP proxy when the access control passes, and transmitting the information to the HTTP client if the information exists;

If the cache information is not found when comparing the cache information, the HTTP proxy attempts to access the web server, requests the resource, and stores the resource in its file system.

Preferably, the resource is stored and transmitted to the HTTP client.

It is preferable to set the rules of the access control by grouping users and categorizing URLs to perform access control according to a specific date, time, and day of the week.

When the access control violations, it is preferable that the HTTP proxy transmits blocking information in real time using a packet of UDP type to the monitor.

It is preferable not to use the web cache function without the access control.

The access control is,

Checks the network group of the HTTP client with the user IP address and allows access control when the network group does not exist;

Obtaining a network group in the above process and checking the category to which the URL information requested by the HTTP client belongs to allow access control when the category does not exist,

Allowing access control when the rule does not exist by checking whether the corresponding rule exists based on the network group and URL category information;

If the rule exists, access control is denied if it falls within the range compared to the date, time, day of the week information applied to the rule and the current date, time, and day of the day when the service is requested. It is preferable that the process is made.

1 is a schematic diagram of a user access control apparatus applied to the present invention, FIG. 2 is a detailed configuration diagram of a user access control apparatus applied to the present invention, FIG. 3 is a flowchart of an HTTP proxy implementation method applied to the present invention. 4 is a flowchart illustrating a user access control method applied to the present invention, and FIG. 5 is a message format diagram for blocking information applied to the present invention.

In order to efficiently use limited network resources, the HTTP proxy 20 that restricts the use of internal users' services uses the basic web cache function 21, IP (Internet Protocol) address, time of day, day of the week, and date. Access control function for limiting the use and 22, and alarm function 23 for informing the administrator of the blocking information in the event of a rule violation in real time.

As shown in FIG. 1, the HTTP proxy 20 may limit the use of the internal user's HTTP service, and the administrator may monitor the user's violation of rules in real time.

In order to provide the HTTP service in the above manner, the access control is clearly made by paying attention to the rule setting of packet filtering of the firewall 10 located in front of the HTTP proxy 20.

In addition, as shown in Figure 1, the firewall 10 is located between the internal network and the external network in order to protect the internal resources from external chip particles, the HTTP proxy 20 targets the internal users for security internal network Will be present in.

The HTTP clients 30 may access the external web server 40 only through the HTTP proxy 20, and the proxy monitor 50 may block the HTTP proxy (blocking information) when the HTTP client 30 attempts to access the rule. Received at 20) and displayed on the screen, the administrator can check in real time.

As shown in FIG. 2, the HTTP client 30 makes a resource request for output to a web browser to the HTTP proxy 20, and upon request, the HTTP proxy 20 performs access control and accesses that violate the rules. Blocking is performed at the same time and the blocking information is transmitted to the proxy monitor 50 in the form of UDP (User Datagram Protocol).

When the request is received from the HTTP client 30, the HTTP proxy 20 checks whether there is the corresponding information from its file system 60, and transmits the corresponding information that it had to the HTTP client 30 when it exists. And, in the absence of access to the web server 40 retrieves the information and stores in its own file system 60 and transmits the resource to the HTTP client (30).

As shown in FIG. 3, the user accesses and performs a resource request to the HTTP proxy 20 (S10). At this time, the HTTP proxy 20 collects information in order to determine which network group the user belongs to or which connection attempt is attempted (s11).

Access control is performed using this information (s12), and when the rule is violated, blocking information is transmitted to the administrator (s19).

If the access control passes, the cache information is compared whether the requested resource exists in the file system 60 of the HTTP proxy 20 (s13). If the information exists, the information transmission is transmitted to the HTTP client 30. (S14).

In the cache information comparison (s13), if the corresponding information is not found, the HTTP proxy 20 attempts to access the web server 40, requests the corresponding resource (s16), and stores the information in its file system 60. After that, the process of transmitting the resource to the HTTP client 30 is executed (s18).

As shown in FIG. 4, the network group of the HTTP client 30 is checked by the user IP (Internet Protocol) address (s20), and access control is allowed if the network group does not exist.

If the network group is obtained in the above process, the HTTP client 30 checks the category to which the requested URL information belongs (s21). If the category does not exist, access control is allowed.

The network group and the URL category information obtained in the process (s20, s21) is checked whether the rule exists in the process (s22), and if the rule does not exist, access control is allowed.

If the rule exists in the range compared to the date, time, day of the week information applied to the rule and the current date, time, day of the week for which the service is requested, access control is denied. If not within the range, access control is denied. Is allowed.

5 is a block information message format transmitted to an administrator after an access is blocked by an access control rule. The first item is information related to a date and time of requesting a service, and the second item is an HTTP client 30 requesting a service. The third item is the destination IP address or URL information for which the user requested the resource, and the fourth item is about the reason why the connection was blocked.

In addition, when providing HTTP service, the administrator can restrict access by registering access restriction related URL in access control rule during busy hours such as business hours, and monitor illegal use for internal users because real-time monitoring is also possible. can do.

As such, the present invention provides a resource requested by a user using a cache function 21, and manages internal users and URLs in group units for all requests in order to increase convenience in case of a network group and a URL category. In addition, network traffic can be prevented by blocking access from a specific host to a specific site by using the time, date, and day of the week information set in the rule from the network group to the URL category.

As described above, according to the present invention, an HTTP proxy is used to block access to a specific site from a specific host at a specific time, date, and day of the week using an HTTP proxy for a heavily used HTTP service in a firewalled environment, and a web cache function. This can prevent unnecessary network traffic, so that limited network resources can be used efficiently.

Claims (7)

An HTTP client requesting resources for output to a web browser, An HTTP proxy for performing access control when requesting the resource of the HTTP client to block access to the violation of rules and at the same time transmitting the blocking information; A file system that receives the resource request information confirmation message from the HTTP proxy and checks whether the information exists; A monitor that receives the blocking information from the HTTP proxy and outputs it to the screen; And a web server for transmitting the information to the HTTP proxy when the information is not present in the file system. The method of claim 1, wherein the HTTP proxy, A web cache unit for temporarily storing data transmitted from the web server; An access control unit that restricts the use of the service by using an IP address, time, day of the week, and date; User access control device, characterized in that consisting of an alarm unit for notifying the administrator of the blocking information in real time in case of violation. After the user makes a resource request with an HTTP proxy, the HTTP proxy collects information to determine which network group the user belongs to or where to try to connect. Performing access control using the collected information to transmit blocking information to the administrator in violation of the rule; A process of comparing cache information about whether the requested resource exists in the file system of the HTTP proxy when the access control passes, and transmitting the information to the HTTP client if the information exists; If the cache information is not found when comparing the cache information, the HTTP proxy attempts to access the web server, requests the resource, and stores the resource in its file system. And storing the resource and transmitting the resource to the HTTP client. 4. The method of claim 3, wherein the access control rule is set according to a grouping of users and categorization of URLs, and access control is performed according to a specific date, time, and day of the week. The method of claim 3 or 4, wherein, when the access control violation occurs, the HTTP proxy transmits blocking information in real time using a packet of UDP type to the monitor. 4. The method of claim 3, wherein the web cache function cannot be used without access control. The method of claim 3, wherein the access control, Checks the network group of the HTTP client with the user IP address and allows access control when the network group does not exist; Obtaining a network group in the above process and checking the category to which the URL information requested by the HTTP client belongs to allow access control when the category does not exist, Allowing access control when the rule does not exist by checking whether the corresponding rule exists based on the network group and URL category information; If the rule exists, access control is denied if it falls within the range compared to the date, time, day of the week information applied to the rule and the current date, time, and day of the day when the service is requested. Implementation method of the HTTP proxy, characterized in that comprises a process.