KR20060044665A - Network security system co-operated with an authentication server and method thereof - Google Patents

Abstract

The present invention relates to a network security system and a method for performing authentication for a user who wants to access a network and performing a security policy for the network together. The network security system includes a personal security policy set for each user, a security server for storing and managing security information to be applied according to each personal security policy, and a user requesting authentication in connection with the security server. An authentication server for applying a security policy and allowing access to a network only to a terminal of a user who satisfies the personal security policy is provided.

According to the present invention, by performing authentication for users who want to access the internal network, and determining the user's terminal access to the network according to the installation state of the specific software according to the security information applied to each user by As a result, the best security policy for the network can be implemented.

Authentication Server, IEEE 802.1x, Security, Vaccine Program

Description

NETWORK SECURITY SYSTEM CO-OPERATED WITH AN AUTHENTICATION SERVER AND METHOD THEREOF}

1 is a configuration diagram schematically showing an authentication system according to the IEEE 802.1x standard.

FIG. 2 is a flow chart showing the operation contents between the entities of the authentication system of FIG.

3 and 4 are each a configuration diagram illustrating a centralized authentication method and a distributed authentication method.

5 is a block diagram showing the overall network security system according to a preferred embodiment of the present invention.

6 is a block diagram illustrating the operation of each user of the network security system according to an embodiment of the present invention.

7 is a flowchart sequentially showing the operation of an authentication server of a network security system according to a preferred embodiment of the present invention.

8 is a flowchart sequentially illustrating operations of a user terminal in a network security system according to a preferred embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: requestor

110: certifier

120: authentication server

500, 502, 504, 506, 508: user terminal

510: access point

520: switch

530: authentication server

540: security server

550: antivirus server

552: O / S Patch Server

554: PC Security Program Server

The present invention relates to a network security system and a method for executing an enhanced security policy for a network. More particularly, the present invention relates to a user configured to perform an authentication procedure for a user who wants to access a network, and to be configured for each user. A network security system that checks the installation status of specific software in the user terminal according to a personal security policy and determines whether to allow the user to access the network according to the result, thereby providing the best security state for the network. And to a method thereof.

1 is a diagram schematically illustrating an authentication system according to the IEEE 802.1x standard as a whole, and FIG. 2 is a diagram sequentially illustrating an authentication process. Referring to FIGS. 1 and 2, at present, the IEEE 802.1x standard standard defines three entities: a supplicant 100, an authenticator 110, and an authentication server 120.

Here, the requestor 100 is an entity for providing authentication information of the user to the authenticator 110 and requesting authentication, and examples thereof include wired and wireless terminals to be connected to a network. The authenticator's initial port status when the requestor requests authentication from the authenticator is set to uncontrolled port status, where the requestor and authenticator communicate only as an Extensible Authentication Protocol (EAP). This is possible.

Meanwhile, the authenticator 110 transmits the authentication information and the authentication request received from the requestor 100 to the authentication server 120. When the authentication is successful from the authentication server, the authenticator 110 transmits an authentication success message to the requestor and uses the port of the authenticator. Switch to Controlled port status. An example of such an authenticator may be one of an access point, a router, a switch, and the like.

In addition, the authentication server 120 is an entity that receives an authentication request for the requestor 100 from the authenticator 110 and determines whether to authenticate. The authentication server 120 stores and manages authentication information about the user in an internal database, or an external entity. It communicates with and receives authentication information about the user to determine whether to authenticate. At this time, the protocol used between the authentication server 120 and the authenticator 110 is not defined in IEEE 802.1x, but it is recommended to use the protocol used in the general AAA (Authentication, Authorization, Accounting) server. . Accordingly, the RADIUS (Remote Authentication Dial-In User Service) protocol is becoming an industry standard (De-Facto Standard).

In case of communication between authenticator and authentication server using RADIUS protocol, network access authority control for user is determined by authentication server's internal authentication algorithm and RADIUS attributes that can be transmitted in authentication success message. This can be implemented by using vendor and vendor specific RADIUS attributes (VSA).

Meanwhile, authentication methods in a network to which a plurality of devices are connected may be broadly classified into a central authentication method and a distributed authentication method. 3 is a diagram illustrating a network configuration according to a centralized authentication scheme, and FIG. 4 is a diagram illustrating a network configuration according to a distributed authentication scheme.

When the network is configured in accordance with the centralized authentication method as shown in FIG. 3, the authentication server is centrally installed to centralize user authentication management and thus have administrative advantages. However, if the authentication attempts are distributed to several places, there are restrictions on the speed of the network, and performance decreases due to an increase in server load.

In addition, in the distributed authentication method as shown in FIG. 4, a main authentication server is installed at a central location, connected to a network to centrally manage resources and databases, and require authentication to reduce the load of the central authentication server. You will handle TLS sessions and key management locally. In this way, when the distributed authentication method is used, the efficiency of the network is increased about 5 times compared to the centralized authentication method, and stability is increased even when the local user is authenticated.

Meanwhile, in the 2000s, computer viruses, worms and other malicious codes have been diversifying their techniques, and even as hacking tools. As a result, its destructive power and damage scale are becoming more serious than ever before. Accordingly, a variety of anti-virus vaccine program (Anti-Virus Vaccine Program) has emerged. However, as the mobility of users increases, an update on an antivirus program is not performed properly, and a network connection is frequently performed in such a state.

In particular, access to the internal network from the external public network is controlled to some extent using a firewall, an expensive IDS / IPS, or an anti-virus system, thereby keeping the internal network secure. It becomes possible.

However, with the recent development of wireless communication technology, users are connected to a network by using mobile terminals such as laptops and personal digital assistants (PDAs). As a result, the current situation that the countermeasures against the internal infection path that can be propagated inside the network by such a mobile terminal can only rely on the user's vaccine update and voluntary scan (SCAN).

Therefore, there is a growing demand for a professional and compulsory comprehensive security solution that can proactively check the status of such an individual's PC and prevent potential incidents. In this regard, the present applicant intends to propose a method for providing such a comprehensive security solution.

An object of the present invention for solving the above problems is to provide a network security system that can provide a secure security for the network by optimizing the security state for each terminal to access the network.

In addition, another object of the present invention is to provide a network security server that can check the security status of the terminal of each user when performing authentication for the user in conjunction with the authentication server.

 A first aspect of the present invention for achieving the above-described technical problem, relates to a network security system for performing authentication for a user who wants to access the network and security for the network,

A security server for storing and managing personal security policies to be applied to registered users and security information for each personal security policy,

A terminal for transmitting basic authentication information input from a user to the outside and requesting authentication;

An authentication server configured to perform an authentication procedure for the user using basic authentication information received from the terminal, and receive a personal security policy and corresponding security information to be applied to the user from the security server;

After the authentication server succeeds in authenticating the user, the authentication server determines whether to allow network access to the terminal according to a personal security policy and security information provided from the security server.

In the network security system, the security information for the personal security policy is a list of the S / W to which the security policy is applied, the registration information for the S / W of the list, and the information on the management server managing the S / W It is preferable to include.

Also, the authentication server of the network security system determines whether the user is a registered user using basic authentication information transmitted from the terminal. If the connected user is not a registered user, the authentication server does not authenticate the user. No, it is desirable not to allow access to the network.

The authentication server of the network security system may determine whether the user is a registered user by using the basic authentication information transmitted from the terminal. If the connected user is a registered user, the authentication server may be provided from the security server. Transmit security information to the terminal,

Receiving the information from the terminal as a result of comparing the security information with the corresponding information of the terminal,

If it is confirmed that the two pieces of information match each other from the comparison result information, the network access to the terminal is allowed. If not, the VLAN ID of the management server managing the specific S / W is determined. It is preferable to set the same as the ID, and provide a URL for the management server to the terminal.

The network security system further includes at least one or more of an access point or a switch for allowing the terminal to access a network, and the access point or switch transmits or authenticates authentication request information from the terminal to the authentication server. It is preferable to transmit the information transmitted from the server to the terminal.

Network security server according to another aspect of the present invention,

A personal security policy to be set and applied for each user, a policy database for storing and managing security information constituting each personal security policy, and

The security information includes a S / W list to which a security policy is to be applied, registration information about the S / W of the list, and information about a management server managing the S / W.

It is linked with a management server managing the software to update the contents of the database at predetermined time intervals, and transmits a personal security policy and corresponding security information to be applied to a specific user according to a request from the authentication server to the authentication server.

Network security method according to another aspect of the present invention,

(a) receiving basic authentication information from a user's terminal and requesting authentication for the user;

(b) using the received basic authentication information, determining whether the connected user is a registered user;

(c) if the connected user is a registered user, receiving a personal security policy and corresponding security information set for the user from a security server, and transmitting the provided security information to the user's terminal;

(d) receiving comparison result information comparing the security information with corresponding registration information in the terminal from a user's terminal;

(e) allowing the user's terminal to access the network if it is confirmed that the information matches each other from the comparison result information;

(f) If it is confirmed that the information does not coincide with each other from the comparison result information, set the VLAN ID of the terminal of the user equal to the VLAN ID of the management server for the S / W, and to the management server Providing a URL to a user terminal.

Hereinafter, with reference to the accompanying drawings will be described in detail the overall configuration and operation of the network security system according to an embodiment of the present invention.

5 is a block diagram showing the overall network security system according to an embodiment of the present invention. Referring to FIG. 5, the network security system according to the present invention includes a user terminal 500, 502, 504, 506, and 508, an access point 510, a switch 520, and an authentication server 530 that want to access a network. Security server 540, management servers 550, 552, 554 for specific software. Hereinafter, the configuration and operation of each component will be described in detail.

A user who wants to access the network accesses the access point 510 or / and switch 520 using his terminal and inputs basic authentication information. Here, the basic authentication information may be a user ID and a password. The user terminal transmits basic authentication information input from the user to the access point 510 and / or the switch 520 and requests authentication of the user. The access point or / and switch, which has been authenticated by the wired / wireless terminal, transmits the information to the authentication server 530, and requests the authentication server to authenticate the user. In this case, at least one access point and at least one switch may be provided according to the size of the network. In this case, the core switch 522 may be used to collectively manage the at least one switch.

The authentication server 530 receives basic authentication information for a user through an authenticator such as a switch and performs an authentication procedure for the user. Here, the basic authentication information includes identification information (ID), password, etc. for the user, and the contents of the basic authentication information may be changed according to a network or a communication protocol. If authentication of the user is successful, the authentication server checks the personal security policy applied to the user in association with the security server, and checks the S / W installation state of the user's terminal according to the security information of the confirmed personal security policy. Check it. If the S / W installation state of the user's terminal is consistent with the security information of the personal security policy, the authentication server allows the user's terminal to access the network. A detailed operation of the authentication server will be described later.

Next, the security server 540 sets a personal security policy for each user, and has security information to be applied to each personal security policy, the security information being a list of software to be used in the security policy, The registration information for each software and the information about the management server managing each software are stored and managed in an internal database. In addition, the security server is linked with the management server (550, 552, 554) for managing each software registered in the list, and stores the latest registration information for the software in the database, and at the request of the authentication server Send the information to the authentication server.

Here, the software registered in the security server is, for example, an antivirus program, an O / S patch program or other security related programs, and the management server managing and operating each of them is an antivirus server 550 and an O / S. Patch server 552, other PC security server 554, and the like. However, it is natural that the type of software registered in the security server can be variously set according to the requirements of the system administrator or the system.

6 and 7, a process of performing authentication for a user and applying a personal security policy to a user by interworking with the security server will be described in detail with reference to FIG. 6 and FIG. 7. FIG. 6 is a block diagram illustrating the operation of the network security system according to the present embodiment. FIG. 7 is a flowchart sequentially illustrating the entire operation of the authentication server. As shown in FIG. 6, a user is an unregistered user 508, a registered user 506 whose registered program is not updated, a registered user 502 whose VLAN ID = 20, or a registered user whose VLAN ID = 30 ( 500) can be assumed. 6 and 7, the operation of the authentication server will be described sequentially for each user assumed in FIG.

First, as shown in FIG. 7, the authentication server receives basic authentication information from one of user terminals 500, 502, 506, and 508 (700). Next, it is determined whether the user is a registered user using the basic authentication information received from the user terminal (step 710). If the user is not a registered user (corresponding to the unregistered user 508 of FIG. 6), the user is authenticated. Do not allow access to the internal network (step 725) and terminate the authentication procedure.

If it is determined in step 720 that the user is registered (corresponding to the registered users 502, 504, 506 of FIG. 6), the user ID of the basic authentication information is transmitted to a security server, and the user ID is transmitted from the security server. A personal security policy corresponding to the security information and security information according to the personal security policy are provided (step 730). Here, the personal security policy is a security policy set and applied for each user, and the corresponding security information includes a specific S / W list set for each user and registration information for each S / W.

Next, the authentication server receives the personal security policy and security information provided from the security server from the security server, and transmits the security information to the user terminal (step 740). Meanwhile, the user terminal receiving the security information from the authentication server reads the S / W information registered in the security information, checks whether the read S / W is installed in the user terminal, and if so, the user terminal of the user terminal. Get registration information about S / W. The user terminal compares the security information provided from the authentication server with registration information for the S / W of the user terminal and transmits the comparison result information to the authentication server.

Accordingly, the authentication server receives the comparison result information from the user terminal (step 750), and reads the comparison result information (step 760). If it is confirmed from the comparison result information that the security information and the S / W registration information of the user terminal coincide with each other, it is assigned to the user terminal (corresponding to the registered users (502, 504) of Figure 6) After allowing the connection to the network (step 780), the procedure ends.

If it is confirmed from the comparison result information that the security information and the S / W registration information of the user terminal does not match each other (corresponding to the registered user 506 of Figure 6), the VLAN ID of the user terminal Set the same as the VLAN ID for the S / W management server, and transmits the URL for the S / W management server to the user terminal (step 770). That is, the authentication server sets the VLAN ID of the user terminal to be the same as the VLAN ID including the management server of a specific S / W and allocates the corresponding IP, thereby restricting access to another network, Only connections to the management server will be allowed.

Meanwhile, the user terminal provided with the URL for the S / W management server accesses the S / W management server, downloads the corresponding S / W, installs it in the terminal, or updates to the latest version (up-date). next. The user terminal compares the security information provided from the authentication server with the S / W registration information of the user terminal again, and transmits the comparison result information to the authentication server.

Next, the authentication server reads the comparison result information received from the user terminal. If it is confirmed from the comparison result information that the security information and the S / W registration information of the user terminal is the same, after allowing the user access to the network assigned to the user, the procedure is terminated.

Hereinafter, an operation of a terminal program installed in a user terminal in a network security system according to an exemplary embodiment of the present invention will be described in detail.

First, the basic authentication information input from the user who wants to access the network is transmitted to the authentication server (step 800). Next, an authentication success message and specific security information are also received from the authentication server, where the specific security information includes a list of specific software and information on registration information or version for each software (step 810). ). Next, the user terminal reads registration information for a specific S / W from the security information, and reads the S / W registration information of the user terminal (step 820). Next, the security information is compared with the S / W registration information of the user terminal, and the comparison result information is transmitted to the authentication server (step 830).

If network access is allowed from the authentication server, the procedure ends (step 840).

If network access is not allowed from the authentication server and URL information about a specific S / W management server is provided (step 850), the S / W management server is accessed and downloaded and installed (step 860). ). Next, the corresponding S / W registration information of the user terminal is read again, the security information is compared with the read registration information, and then the comparison result information is transmitted back to the authentication server (step 830), from the authentication server. Network access is allowed.

The network security system according to the preferred embodiment of the present invention performs authentication of a user who wants to access a network, and checks the installation and version of specific software, an O / S patch program, an antivirus program, and the like stored in the user's terminal. After that, the network connection to the user terminal is allowed. In addition, the authentication server according to the present invention, in connection with the security server, if the specific software of the user terminal is not installed or is not the latest version, after restricting access to the network for the user terminal, Allow access to the network later to update it.

In this case, the specific software used may be variously used, such as an antivirus program, an O / S patch program, and other PC security related programs. In particular, when the registration information on the antivirus program is used for security of the user terminal, the antivirus program of the user terminal can always be updated to the latest version at the same time as authentication is performed, It is possible to secure the security of the network.

On the other hand, the network security system according to another embodiment of the present invention, by mounting a module that performs the function of the security server in the authentication server, it is possible to integrally form the security server and the authentication server.

In addition, the network security system according to another embodiment of the present invention, the user terminal to be connected to the network, as well as the comparison result information between the security information and the S / W registration information of the terminal, the execution result information for the S / W The server is transmitted together to the authentication server, and the authentication server analyzes the information transmitted from the terminal to determine whether to allow the terminal to access the network.

In this case, S / W is set as an antivirus program, and if the execution result information on the terminal indicates "the terminal is infected with a virus", the authentication server blocks the access to the network of the terminal and at the same time a safe network path. You can connect to the vaccine management server to heal the virus.

Although the present invention has been described above with reference to preferred embodiments thereof, this is merely an example and is not intended to limit the present invention, and those skilled in the art do not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications which are not illustrated above in the scope are possible. For example, in the embodiment of the present invention, the type of S / W used for the security of the user terminal, the authentication server, and the items of the database stored and managed in the security server may be used to improve network performance or the size of network equipment. In consideration of the various modifications can be carried out. And differences related to such modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

By the network security system according to the present invention, it is possible to set a personal security policy for each user, apply the set personal security policy for each user, and determine whether to allow the user's access to the network according to the personal security policy, This will make your network more secure.

According to the present invention, a terminal of a user registered in an authentication server based on IEEE 802.1x can install a security related program or an antivirus program and always update to the latest version.

In addition, when a user terminal is infected with a virus, the virus is automatically isolated from the network to heal the virus, and if necessary, remote defense work can be performed by interworking with an antivirus management server through a protected path.

In addition, the network security system according to the present invention does not allow access to the network for terminals that do not have the latest security-related programs or antivirus programs, thereby inherently providing network access for terminals that are concerned about virus infection or security. It can be blocked.

Claims (12)

In the network security system that performs the authentication and security of the network for the user who wants to access the network, A security server for storing and managing personal security policies to be applied to registered users and security information to be applied to each personal security policy; A terminal for transmitting basic authentication information input from a user to the outside and requesting authentication; And An authentication server for performing an authentication procedure for the user using basic authentication information transmitted from the terminal and receiving a personal security policy and corresponding security information to be applied to the user from the security server; And the authentication server determines whether to allow network access to the terminal according to a personal security policy and security information provided from the security server after successful authentication of the user. The method of claim 1, wherein the security information of the personal security policy includes a list of specific S / Ws to be installed in a corresponding terminal for each user and registration information for each S / W. Each security information of the security server includes a list of specific software to which a security policy is to be applied, registration information for each software, and information about a management server managing the software. Security system. The network security system of claim 2, wherein the specific S / W is one of an antivirus program, an O / S patch program, and a PC security program. The method according to any one of claims 1 to 3, wherein the authentication server It is determined whether the user is a registered user using the basic authentication information transmitted from the terminal. If the connected user is not a registered user, the user is not authenticated and not allowed to access the network. Network security system. The method according to any one of claims 2 to 3, wherein the authentication server It is determined whether the user is a registered user using the basic authentication information transmitted from the terminal. If the connected user is a registered user, the security information provided from the security server is transmitted to the terminal. Receiving comparison result information comparing the security information with corresponding registration information in the terminal from the terminal, If it is confirmed that the two pieces of information match each other from the comparison result information, the network security system, characterized in that to allow the network access to the terminal. The method according to any one of claims 2 to 3, wherein the authentication server It is determined whether the user is a registered user using the basic authentication information transmitted from the terminal. If the connected user is a registered user, the security information provided from the security server is transmitted to the terminal. Receiving the comparison result information from the terminal comparing the security information with the corresponding information of the terminal, If it is confirmed that the two pieces of information do not coincide with each other from the comparison result information, the VLAN ID of the terminal is set equal to the VLAN ID of the management server managing the specific S / W, and the terminal is connected to the management server. Network security system, characterized in that providing a URL for. The network security system according to any one of claims 1 to 3, wherein the network security system further comprises at least one or more of an access point or a switch for allowing the terminal to connect to the network. The network security system, characterized in that for transmitting the authentication request information of the authentication server or information transmitted from the authentication server to the terminal. According to any one of claims 1 to 3, The terminal reads the list of S / W from the security information provided from the authentication server, the registration information for the S / W installed in the terminal, And comparing the security information with the read registration information and transmitting the comparison result information to the authentication server. According to any one of claims 1 to 3, If the terminal is provided with a URL for the management server of a specific S / W from the authentication server, connected to the management server to the terminal to the corresponding S / W Network security system, characterized in that to download or update to the latest version. A personal security policy to be set and applied for each user and a database for storing and managing security information for each personal security policy; The security information is composed of the S / W list to which the security policy is applied, the registration information for the S / W of the list, and the information about the management server for managing the S / W, It is linked with the management server for managing the software to update the contents of the database at predetermined time intervals, and transmits the personal security policy and security information to be applied to a specific user to the authentication server in response to a request from the authentication server. Network security server. In the network security method for performing a security for the user terminal and the network to access the network, (a) receiving basic authentication information from a user's terminal and requesting authentication for the user; (b) determining whether the connected user is a registered user by using the received basic authentication information; (c) if the connected user is a registered user, receiving a personal security policy and security information to be applied to the user from a security server and transmitting the received security information to a user's terminal; (d) receiving comparison result information comparing the security information with corresponding information in the terminal from a user terminal; (e) allowing the user's terminal to access the network if it is confirmed that the information matches each other from the comparison result information; Network security method comprising the. 12. The method of claim 11, wherein the network security method further comprises: (f) if it is determined from the comparison result information that the information does not match each other, the VLAN ID of the terminal of the user is determined by the management server for the S / W. And setting the same as the VLAN ID and providing a URL for the management server to the user's terminal.

Images