KR20050090848A - System and method for security management of next generation network - Google Patents

Abstract

The present invention relates to a next generation network security system and method thereof. The next-generation network security system and its method are similar to the mediation gateway when a normal traffic and an abnormal traffic whose source IP address is modified by a malicious attacker are introduced from a subscriber of the next-generation network using a SIP phone, a PC terminal, or the like. Abnormal traffic can be detected and blocked at the subscriber network access device, and the attacker's IP address can be traced back through packet analysis to detect the attacker's physical location. In this way, it is possible to block packets with the modified source IP address and to cooperatively determine the traffic flowing into the multiple paths to prevent false detection of abnormal packets. Satisfaction and reliability can be increased, and network traffic congestion or accidents caused by security accidents can be prevented in advance, thereby reducing network capacity and reducing security costs.

Description

Next-generation network security management system and its method {SYSTEM AND METHOD FOR SECURITY MANAGEMENT OF NEXT GENERATION NETWORK}

The present invention relates to a next generation network security system and method thereof, and more particularly, to a next generation network security system and method for enhancing security by selectively detecting, blocking, and backtracking normal traffic and abnormal traffic in a subscriber network access device. It is about.

Recently, as the spread of the Internet has increased the number of personal information request services such as e-commerce, network security has emerged as a major problem.

An intrusion detection and blocking system on a network according to an embodiment of the prior art detects an abnormality of traffic that is installed and input / output inside an access point of a subscriber network and a public network or inside a subscriber network so as to detect and block an electronic infringement activity To block.

However, most companies or subscribers do not operate a security task force to prevent illegal intrusion through the network due to cost or other reasons, so that it is difficult to respond to new hacking and the subscribers cannot directly operate the security.

Although intrusion detection and blocking on the network is operated by a professional security equipment company, the investment cost is high because each subscriber uses a different electronic intrusion detection and blocking device. There is a problem.

Therefore, there is a growing need for service providers to provide security functions for the detection and blocking of electronic infringement on the subscriber side, and the risk of traffic congestion in the network against Denial of Service (DoS) -type attacks in terms of service providers. This requires its own security features.

However, it is very expensive to introduce security equipment for separate intrusion detection and blocking inside the network of the service provider, and the use of routers, network attached storage (NAS), and packet filtering functions of the Ethernet system can be used for the equipment function. There is a problem that can worsen, or block all the same port the same can block the packets of normal users.

When traffic is transmitted through multiple paths, security devices have a number of false positives, but most operators operate dual paths for the stability and survival of communication. have.

A malicious attacker can send a packet by modifying the source address through a normal authentication process when authenticating a network connection, so the source address cannot be trusted, but general security equipment cannot find the attacker because most of the physical location of the source cannot be found. Attack blocking is difficult.

Therefore, the intrusion detection and blocking system on the network needs to have a security function for detecting IP address-modulated packets in the equipment of the subscriber access stage, and in particular, the access gateway or arbitration, which is the access equipment of the access stage of the next-generation network. (MEDIATION) There is an urgent need for the gateway to have the ability to block aggressive traffic from which the source IP address has been tampered with.

The technical problem to be achieved by the present invention is to selectively detect and block the packet modulated from the source IP address by extracting the packet head information from the access equipment of the access stage when the normal traffic and the aggressive traffic modulated with the IP address is mixed In addition, the present invention provides a next-generation network security system and method for tracing the origin of aggressive traffic.

In the next generation network security system according to the first aspect of the present invention, when normal / abnormal packets are mixed in and out / out of a user terminal, MAC authentication is performed by performing MAC (MAC) authentication to extract a MAC address, an IP address, and an ID sequence. server; A subscriber network access device connected to the user terminal and receiving the IP packet transmitted from the MAC authentication server to extract head information of the IP packet; And receiving the packet-related information from the MAC authentication server and the subscriber network access device, inspecting the ID sequence of the IP packet to detect a packet in which the IP address is modified, and performing block / backtracking of the modulated packet. Device.

The subscriber network access apparatus includes a packet head processing unit for extracting packet head information from incoming traffic when the user terminal and the user terminal are connected through a network, and blocking the packet according to a blocking command of a packet whose source IP address is modulated.

The security management device receives the MAC address, the source IP address, and the identification continuity (ID sequence) from the MAC authentication server and the subscriber network access device, and detects an abnormality of the ID sequence of the IP packet based on the information. An IP tamper detection unit for extracting a list of IP addresses of which the source IP address is modulated; And a back tracer and a blocker for blocking the packet through the IP address list extracted by the IP tampering detector or searching the attacker's physical location by backtracking the modulated packet.

Next-generation network security method for systematically connected with the MAC authentication server and subscriber network access device according to the second aspect of the present invention to detect and block illegal intrusion, a) when the user terminal is connected to the network, the IP address through the MAC authentication server Authenticating the MAC address and securing an ID of the initial packet; b) if the user terminal is connected to a subscriber network access device, extracting packet head information of traffic flowing in / out from the user terminal from the subscriber network access device; c) checking an IP head based on the IP address and head information of the packet obtained through steps a) and b) to identify an ID sequence for each IP address; And d) retrieving a list of IP addresses whose source IP addresses have been modulated through step c) and optionally blocking the tampered packets or tracing back the physical location of an attacker.

In step c), if the ID for each IP address increases by 1, the next packet is inspected; if the ID for each IP address does not increase by 1, the source address modulation target depends on whether the fragmentation bit is determined. Selecting by IP address; c-2) generating an IP address list for source address modulation target IP addresses selected in step c-1), and searching the IP address list to determine whether ID sequences match; c-3) In step c-2), if there is no IP address that matches the ID sequence in the IP address list, a TEAR DROP packet is reported and an IP address whose ID sequence matches in the IP address list exists. Detecting a number of matches of the ID sequence; And c-4) reporting a source address modulation packet and checking another packet when the number of matching of the IP address and the ID sequence matches at least a predetermined number in step c-3).

The step d) may include: d-1) acquiring the attacker's IP address, searching for the beer address by searching the list of IP addresses in which the MAC authentication server and the predetermined source IP address have been modified; And d-2) finding and reporting the attacker's physical location using the location information of the brewery and the subscriber searched in step d-1).

In step d), when the administrator inputs a blocking packet list and transmits a packet blocking command to the IP address list in which the source IP address is modified, the subscriber network access device blocks the packet based on the source address. desirable.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

First, a next generation network security system according to an embodiment of the present invention will be described in detail with reference to FIG. 1.

1 illustrates a schematic network configuration of a next-generation network security system according to an embodiment of the present invention, and FIG. 2 illustrates the security management function blocks of FIG. 1 in detail.

As shown in FIG. 1, the next-generation network security system according to an embodiment of the present invention includes user terminals 111 and 112, an access gateway 122, an intermediate gateway 130, a soft switch 140, and a MAC. (MAC) authentication server 150, security management device 160, service server 150.

The user terminals 111 and 112 are next-generation network terminals such as the video terminal 111 or the PC phone 112. The video terminals 111 and 112 are connected to the dedicated subscriber network 121, and the PC phone 112 Is connected to the access gateway 122.

The intermediate gateway 130 is a subscriber network access device of the access stage.

The soft switch 140 manages the signaling network between the intermediate gateway 130 and the backbone delivery network to be connected to the service server 150, and the Mac authentication server 150 authenticates the connection of the user terminals 111 and 112. .

The security management apparatus 160 generates abnormal attack-type traffic whose source IP address is modified after normal authentication at initial access by the user terminals 111 and 112 and enters the network to mix with normal traffic. In order to detect the tampered traffic, the intermediary gateway 130 and the MAC authentication server 150 are connected to perform a security function.

Referring to Figure 2 looks at the security management function between the mediation gateway, Mac authentication server 150, security management device 160 in more detail.

The intermediate gateway 130 includes a subscriber access unit 131, a packet head processing unit 132, a multiplexing and switching unit 133, and a relay trunk 134.

The subscriber access unit 131 allows the user terminals 111 and 112 to be connected to the intermediate gateway 130 via the dedicated subscriber network 121 or the access gateway 122. The packet head processor 132 extracts packet head information from traffic flowing in and out through the subscriber access unit 131, and blocks the packet according to a packet blocking command.

The multiplexing and switching unit 133 multiplexes the traffic transmitted through the packet head processing unit 132 and performs a switching process to the relay trunk 134 relaying the connection with the backbone transport network.

The security management device 160 may include, but is not limited to, an IP tamper detection unit 161 and a traceback and blocking unit 162.

When the IP tamper detection unit 161 receives the MAC address, the source IP address, and the ID from the MAC authentication server 150 when the initial user terminals 111 and 112 are connected, the packet head processing unit of the intermediate gateway 130 ( In 132, the packet is a packet whose IP address is modulated by detecting the abnormality of the ID sequence of the received IP packet.

The traceback and blocking unit 162 blocks the IP packet by transmitting an intrusion prevention command to the intermediary gateway based on the modulated IP address list, or the user terminal 111 or 112 attacks. If received, it extracts the packet of the destination and performs a back trace to search for the physical MAC address using the IP address of the attack destination and the Mac address DB of the Mac authentication server 150.

Next, the operation of the next generation network security system according to an embodiment of the present invention will be described in detail with reference to FIGS. 3 to 5.

3 is a flowchart illustrating a process of searching for a modulated IP packet in a next-generation network security method according to an embodiment of the present invention.

As shown in FIG. 3, in the next-generation network security method according to an exemplary embodiment of the present invention, when the user terminals 111 and 112 access the subscriber access unit 131 through a network, the MAC authentication server 150 uses the IP address and the IP address. Authenticates the MAC address and obtains the initial packet ID.

Then, the security management device 160 automatically performs a tamper detection process of the source IP address. That is, the IP tamper detection unit 161 receives the IP address from the packet head processing unit 132 of the intermediate gateway 130 and checks the ID sequence for each IP address for the packet flowing into or out of the subscriber access unit 131. S101)

The IP tamper detection unit 161 checks the next packet when the ID is increased by 1 for each IP address (including the cyclicity of 1 in the last order), and when the ID is not increased by 1 (the same, 2 or more). Fragmentation bit is determined in increments of steps (S102, S103).

Above, if the ID sequence for each IP address is incremented by 1 and the fragmentation bit is a fragmentation process, the next packet is examined by increasing the sequence number of the IP address. Select from the list of IP addresses (S104, S105).

The IP tamper detection unit 161 searches the above IP address list to determine whether the ID sequence matches (S106). If there is no ID sequence match in the modulation target IP address list, the IP tamper detection unit 161 reports the TEAR DROP packet. do.

Here, the TEAR DROP packet refers to a packet that can be down (down) by making the target host very unstable when combining with the UDP datagram when the abnormal IP fragment is sent.

The IP tampering detection unit 161 detects how many times (N> 0) ID sequences match if there is an IP address in which the ID sequence matches in the modulation target IP address list (S110).

At this time, if the ID sequence is matched more than the number of times determined by the system in the modulation target IP address list, the packet corresponding to the IP address is reported as the source address modulation IP packet, and then another packet is inspected. When the stop command is transmitted while the sequence matches within a predetermined number of times, the searching process of the source address is modified.

FIG. 4 illustrates a packet search process in which a source IP address is modulated by searching an ID sequence for each IP address.

Referring to FIG. 4, IP1 is a packet that is normally authenticated upon initial access, and after generating a packet by modulating IP2 in the same system, IP1 and IP2 flow into the intermediary gateway 130 at the same time.

The ID sequence of an IP packet does not increase by 1 for each IP address, but the packet of two IP addresses adds up by one. If this process occurs more than N times, it can be seen that the two packets are packets of which the source address is modulated because the probability of occurrence in the same system is almost one.

5 is a flowchart illustrating a backtracking and blocking process in a next-generation network security method according to an embodiment of the present invention.

As shown in FIG. 5, in the case where an attack is caused by a packet in which an IP address is modulated at a user terminal of the intermediary gateway 130, the backtracking and blocking unit 162 is configured to trace back an attacker's IP address. In step S201 and S202, the MAC address is retrieved by searching the IP address list of the source IP address modulated by the MAC authentication server 150 and the IP tamper detection unit 161 of the network.

The traceback and blocking unit 162 reports the physical location of the attacker for the location information of the brewery and the subscriber (S203), and targets the IP address list of which the source IP address reported by the IP tamper detection unit 161 is modulated. When the administrator inputs a block packet list and transmits a packet block command, the intermediary gateway 130 blocks the packet based on the source address. (S204, S205)

As described above, in the next-generation network security system and method according to an embodiment of the present invention, an identification (ID) field exists in the IP head, and this identification field has a positive random initial value and then increases by one. I use it.

Therefore, in the embodiment of the present invention, if the ID number of the starting address is recorded at the time of authentication of the initial user terminals 111 and 112 and counted continuously for the packet of the corresponding address, it is possible to determine whether there is an abnormality of the packet generated at the address. Can be. In particular, it is possible to detect the abnormality of the packet in the case of an abnormal packet after the successful authentication of the user terminal (111, 112), and only the route within the network for the packet arrived via a plurality of devices If it is unified, it is easy to detect.

Even when the path inside the network is dualized, it is possible to detect abnormality of packets while preventing false detection of abnormal packets through mutual coordination.

Although the preferred embodiment of the present invention has been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, the next-generation network security system and method according to the present invention detect a packet whose source IP address is modulated by head information extracted from a subscriber network access device such as an intermediate gateway, and access the subscriber network according to a blocking command for the packet. The device can block the packet.

 Next-generation network security system and method according to the present invention obtains the ID value of the source IP address packet at the time of authentication of the initial user terminal and checks the continuity of identification of the packet of the source IP address (that is, the ID sequence) to check the corresponding address packet. By verifying that there is an abnormality, there is an effect that can detect the aggressive packet modulated from the source IP address.

 The next-generation network security system and method according to the present invention detects the physical location of the attacker by trace backing based on the MAC address database of the Mac authentication server when the attacker obtains the IP address by analyzing the IP packet of the malicious network attacker. It can work.

 The next-generation network security system and method according to the present invention block the packet of which the source IP address has been tampered with, and cooperatively determine the traffic flowing into a plurality of paths, thereby preventing false detection of abnormal packets. There is.

Therefore, the next-generation network security system and method according to the present invention can maintain service continuity, thereby increasing service satisfaction and reliability, and prevent network congestion or accidents caused by security incidents in advance, thereby freeing up the network. This can reduce capacity and reduce the cost of security.

1 illustrates a schematic network configuration of a next-generation network security system according to an embodiment of the present invention.

FIG. 2 illustrates the security management functional blocks of FIG. 1 in detail.

3 is a flowchart illustrating a process of searching for a modulated IP packet in a next-generation network security method according to an embodiment of the present invention.

FIG. 4 illustrates a packet search process in which a source IP address is modulated by searching an ID sequence for each IP address.

5 is a flowchart illustrating a backtracking and blocking process in a next-generation network security method according to an embodiment of the present invention.

Claims (8)

A MAC authentication server extracting a MAC address, an IP address, and an ID sequence by performing MAC authentication when normal / abnormal packets are mixed in and out of the user terminal; A subscriber network access device connected to the user terminal and receiving the IP packet transmitted from the MAC authentication server to extract head information of the IP packet; And The MAC management server and the subscriber network access device receives the packet-related information, examines the ID sequence of the IP packet, detects a packet whose IP address is modified, and performs a block / backtracking of the modulated packet. Next generation network security system comprising a. The method of claim 1, The subscriber network access apparatus includes a packet head processing unit which extracts packet head information from incoming traffic when connected to a user terminal through a network, and blocks the packet according to a blocking command of a packet whose source IP address is modulated. Network security system. The method of claim 1, The security management device, The MAC authentication server and the subscriber network access device receive information on MAC address, source IP address, and identification continuity (ID sequence), and detect the abnormality of the ID sequence of the IP packet based on the information, and then modulate the source IP address. An IP tamper detection unit for extracting an IP address list; And A back tracer and a blocker that blocks the packet through the IP address list extracted by the IP tampering detector or searches the attacker's physical location by backtracking the modulated packet. Next generation network security system comprising a. In the next generation network security method that systematically connects with a Mac authentication server and subscriber network access device to detect and block illegal intrusions, a) when the user terminal accesses a network, authenticating an IP address and a MAC address through a Mac authentication server and securing an ID of an initial packet; b) if the user terminal is connected to a subscriber network access device, extracting packet head information of traffic flowing in / out from the user terminal from the subscriber network access device; c) checking an IP head based on the IP address and head information of the packet obtained through steps a) and b) to identify an ID sequence for each IP address; And d) retrieving a list of IP addresses modulated by the source IP address through step c) and optionally blocking the tampered packet or tracing the physical location of the attacker. Next generation network security method comprising a. The method of claim 1, C), c-1) checking the next packet when the ID for each IP address is increased by 1, and selecting the source address modulation target IP address according to whether a fragmentation bit is determined if the ID for each IP address is not increased by 1; ; c-2) generating an IP address list for source address modulation target IP addresses selected in step c-1), and searching the IP address list to determine whether ID sequences match; c-3) In step c-2), if there is no IP address that matches the ID sequence in the IP address list, a TEAR DROP packet is reported and an IP address whose ID sequence matches in the IP address list exists. Detecting a number of matches of the ID sequence; And c-4) reporting the source address modulation packet and checking another packet when the number of matching of the IP address and ID sequence matches more than a predetermined number in step c-3). Next generation network security method comprising a. The method of claim 4, wherein In the step c-4), when the number of matching of the IP address and the ID sequence is equal to or less than a predetermined number of times, the next packet is examined until the search stop command is transmitted. The method of claim 4, wherein Step d), d-1) acquiring the attacker's IP address and searching the beer address by searching the list of IP addresses in which the MAC authentication server and the predetermined source IP address have been modified; And d-2) finding and reporting the physical location of the attacker using the location information of the brewer and the subscriber searched in step d-1) Next generation network security method comprising a. The method of claim 4, wherein In step d), when the administrator inputs a blocking packet list and transmits a packet blocking command to the IP address list of which the source IP address is modified, the subscriber network access device blocks the packet based on the source address. Network security method.