WO2017034072A1

WO2017034072A1 - Network security system and security method

Info

Publication number: WO2017034072A1
Application number: PCT/KR2015/011066
Authority: WO
Inventors: 전석기; 소준영
Original assignee: 주식회사 아이티스테이션
Priority date: 2015-08-25
Filing date: 2015-10-20
Publication date: 2017-03-02
Also published as: KR20170024428A; KR101744631B1

Abstract

The present invention relates to a network security system and can provide a network security system comprising: a plurality of user terminals using an intra network; a system server for storing a plurality of pieces of main information or document information generated by at least one of the plurality of user terminals; a manager terminal for managing the plurality of user terminals; and a security server for protecting the user terminals, the manager terminal, and the system server.

Description

Network security system and security method

The present invention relates to a network security system security method, and more particularly, to a network security system and a security method capable of coping with an external unknown hacking risk.

Cyber attacks are organized and intelligent, and in particular, advanced persistent threats (APTs), in which hacking organizations are economically targeted, perform stealthy, continuous, and intelligent attacks against specific attack targets. It is rapidly increasing and is a big social problem. In particular, APT attacks involve hackers or hacking organizations infiltrating malicious code into the target organization to illegally steal the important information of the organization, and then continuously update the malware to infect the host of important information accessors with malware. This is an attack method that leaks important information.

In Korean Patent No. 10-0635130 ("Kernel backdoor detection system and method through Windows network monitoring"), a network packet passing through a TDI (Transport Driver Interface) layer and a Network Driver Interface Specification (NDIS) layer among the Windows network components. By comparing and analyzing the information on the network packets generated from normal network behaviors and network packets generated from malicious network behaviors such as kernel backdoors, the kernel backdoors are detected and the network packets generated from these kernel backdoors are filtered. A system and method for detecting a kernel backdoor that can prevent intrusion by a kernel backdoor are disclosed.

However, Korean Patent No. 10-0635130 is a technique limited to preventing intrusion into the kernel backdoor, and a technique for preventing document leakage or hacking through terminals connected to a system server or an internal network is not disclosed.

The problem to be solved by the present invention is to recover in case of suspicion of infringement of the system while performing operating system patch, application patch, software distribution and media control for effective defense of the client system which is the primary attack target of APT (Advanced Persistent Threat) It is to provide a network security system and security method that can apply technology to cope with unknown hacking threats.

In addition, another problem to be solved by the present invention is a network security system and security that can protect and monitor the user and administrator client access to the key information or document information to recognize the leakage of key information or document information and eliminate risks To provide a way.

In order to solve the above problems, the present invention provides a plurality of user terminals using an internal network, a system server for storing a plurality of main information or document information generated in at least one of the plurality of user terminals, and manages the plurality of user terminals. In the network security system comprising a security terminal to protect the user terminal, the user terminal, the administrator terminal and the system server, the security server is an important document to be attacked from the external hacking of the plurality of main information or document information A preventive control module for identifying and analyzing risk factors among the important documents to restrict access of the plurality of user terminals from external hacking servers known to control external access; Monitoring the network traffic to access the important document, and stores the log file of the user terminal that generated the network traffic to access the important document, if the abnormal behavior including hacking in the user terminal is monitored the work of the user terminal Detection control module to terminate the; And generating and storing a backup system image when the plurality of user terminals access the system server, and performing a restoration operation through the backup system image when the abnormal behavior is monitored among the plurality of user terminals. It can provide a network security system comprising a.

The preventive control module evaluates the importance of the main information or the document information by assigning a score to the confidentiality, integrity and availability of the plurality of main information or document information, and performs information management according to the evaluated importance. It may include an evaluation unit.

The preventive control module analyzes and detects a risk factor for a document having high importance among the main information or document information, and performs a safety check on all main information or document information when the risk factor is detected. The analysis unit may further include.

The preventive control module may further include a control policy management unit configured to transmit a security notice to the user terminal through the manager terminal, and to feed back whether the security bulletin is read from the user terminal.

The preventive control module includes a terminal authentication unit for authenticating using at least one authentication element of the user ID and the OTP, the official certificate, the ARS, and the QR code of the user terminal; The user terminal, which has been authenticated by the terminal authentication unit, monitors and manages access to an external network through a C & C C & C (Command & Control) server, or accesses the C & C server to the system server through the user terminal. Server management unit; The user terminal controls access to a P2P server or a harmful site, and when accessing the important information from the user terminal, access time and port are connected to the user terminal to confirm whether the user is authorized access or unauthorized access. A server access control unit which transmits a predetermined notification message, and transmits a warning message to the manager terminal by determining that an intrusion or hacking is received from an external server when there is no reply to the notification message after sending the notification message; And a network traffic analyzer configured to collect network traffic generated from the user terminal and set a path.

The calibration control module includes a TCP tagging and recognition unit for tagging a unique ID to network traffic or a network packet generated in the user terminal; A security agent manager for monitoring the installation of the security agent installed in the user terminal and transmitting the security agent to the user terminal in which the security agent is not installed; A user terminal controller which determines that the main information or document information is an external attack when the user terminal does not perform authentication and blocks access to the system server; And a system restoration unit which determines that the user terminal is infected with at least one of the virus, malicious code, and spyware, stores a backup image of the infected user terminal, and restores the backup image to a state before infection.

In addition, the present invention provides a plurality of user terminals using an internal network, a system server for storing a plurality of main information or document information generated in at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals and the A security method performed in a security server for protecting a user terminal, an administrator terminal, and a system server, the security method comprising: (a) defining a control policy for controlling access to an external network or an unconfigured server from the security server; (b) an authentication step of performing authentication in the user terminal to grant access to the system server for performing a task; (c) monitoring access of a main server, a C & C server, a P2P server, a malicious site, and checking whether the control policy is violated in the security server when the user terminal performs a task; (d) informing the administrator terminal of the control policy violation in the security server; (e) blocking the network of the user terminal in violation of the control policy at the security server; (f) storing a backup image of the user terminal in violation of the control policy in the security server; (g) recovering a user terminal through the backup image at the security server; And (h) performing digital forensics from the backup image at the security server.

Prior to the step (a), the importance of the critical information or document information is evaluated by assigning a score to the confidentiality, integrity and availability of the plurality of main information or document information stored in the system server, and according to the evaluated importance. Managing information; And analyzing and detecting a risk factor with respect to a document having high importance among the main information or document information, and performing a safety check on all main information or document information when the risk factor is detected. Can be.

The step (b) may be authenticated using at least one authentication element of the user ID and the OTP, public certificate, ARS, QR code of the user terminal.

After the step (h), it may further comprise the step of reflecting the digital forensic results in the control policy.

The network security system and security method according to an embodiment of the present invention performs an operating system patch, application patch, software distribution, and media control for effective defense of a client system that is a primary attack target of APT (Advanced Persistent Threat). In case of suspicion of intrusion, recovery techniques can be applied to counter unknown hacking threats.

In addition, when the user terminal is recognized, security may be strengthened through two-factor authentication, and information used for authentication may be protected by changing a service channel and a channel for authentication.

1 is a system diagram schematically showing a network security system according to an embodiment of the present invention.

2 is a block diagram showing the internal configuration of the security server shown in FIG.

3 is a block diagram showing the configuration of the preventive control module shown in FIG. 2;

4 is a block diagram illustrating the detection control module shown in FIG.

FIG. 5 is a block diagram illustrating the calibration control module shown in FIG. 2. FIG.

6 is a flowchart illustrating a network security method according to an embodiment of the present invention.

The present invention provides a plurality of user terminals using an internal network, a system server for storing a plurality of main information or document information generated in at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals, and the user terminal. And a security server for protecting an administrator terminal and a system server, wherein the security server identifies an important document to be attacked from an external hack among the plurality of main information or document information, and identifies the important document. A preventive control module configured to limit the access of the plurality of user terminals from external hacking servers known to control the external access by analyzing a risk factor among the; Monitoring the network traffic to access the important document, and stores the log file of the user terminal that generated the network traffic to access the important document, if the abnormal behavior including hacking in the user terminal is monitored the work of the user terminal Detection control module to terminate the; And generating and storing a backup system image when the plurality of user terminals access the system server, and performing a restoration operation through the backup system image when the abnormal behavior is monitored among the plurality of user terminals. It can provide a network security system comprising a.

Hereinafter, the description of the present invention with reference to the drawings is not limited to the specific embodiments, various changes may be made and various embodiments may be provided. In addition, the contents described below should be understood to include all transformations, equivalents, and substitutes included in the spirit and technical scope of the present invention.

In the following description, terms such as “first” and “second” are terms used to describe various components, and are not limited in themselves, and are used only to distinguish one component from other components.

Like reference numerals used throughout the present specification refer to like elements.

As used herein, the singular forms "a", "an" and "the" include plural forms unless the context clearly indicates otherwise. In addition, the terms "comprise", "comprise" or "have" described below are intended to designate that the features, numbers, steps, operations, components, parts, or combinations thereof described in the specification exist. It is to be understood that it does not exclude in advance the possibility of the presence or the addition of one or more other features or numbers, steps, actions, components, parts or combinations thereof.

Hereinafter, an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 6.

Referring to FIG. 1, a network security system according to an embodiment of the present invention may include a user terminal 10, an administrator terminal 20, a security server 40, and a system server 30.

In detail, the user terminal 10 may include a terminal such as a computer, a laptop, a smartphone, and the like used in an enterprise, a school, an institution, and the like.

The manager terminal 20 may include a terminal such as a computer, a laptop, a smartphone, or the like, such as the user terminal 10.

The system server 30 may be connected to the user terminal 10 through an internal communication network to store a plurality of pieces of main information or document information generated in the user terminal 10. The system server 30 may provide a usage environment of the user terminal 10 to access the system server 30.

The security server 40 evaluates the importance of a plurality of pieces of main information or document information and sets access rights according to the importance. For example, the security server 40 assigns scores for confidentiality, integrity, and availability of a plurality of pieces of key information or document information to evaluate the importance of the key information or document information, and the evaluated key information or document information to importance. Accordingly different access rights.

In addition, the security server 40 analyzes the risk factors to control the access of the main information or document information that has risk factors. The security server 40 controls access to main information or document information of the user terminal 10 according to authority for access control of main information or document information.

The security server 40 registers an external server used for hacking in order to protect key information or document information from external external hacking, and in advance, the user terminal 10 accesses an external server that is a main route of hacking. Block or control access to the user terminal 10 from an external server.

To this end, the security server 40 monitors the network traffic of the user terminal 10. In addition, the security server 40 stores a log file of the user terminal 10, and terminates the work of the user terminal when abnormal behavior including hacking through the user terminal 10 is monitored, or the user terminal 10 Log off).

In this case, the security server 40 may generate and store a backup image of the user terminal 10, restore the backup image, and provide the backup image to the user terminal 10.

The security server 40 may update the risk factors for risks such as a hacking server connected through the user terminal 10 before the backup image restoration and notify the user terminal 10.

The description of the security server 40 will be described in detail later with reference to FIGS. 2 to 5.

FIG. 2 is a block diagram showing an internal configuration of the security server shown in FIG. 1, FIG. 3 is a block diagram showing a configuration of the preventive control module shown in FIG. 2, and FIG. 4 is a detection control shown in FIG. A block diagram illustrating the module, and FIG. 5 is a block diagram illustrating the calibration control module shown in FIG. 2.

2 to 5, the security server 40 may include a preventive control module 100, a detection control module 200, and a calibration control module 300.

First, the preventive control module 100 may include an information asset evaluation unit 110, a risk analysis unit 120, and a control policy management unit 130.

Specifically, the information asset evaluation unit 110 evaluates the importance of the plurality of pieces of main information or document information. The information asset evaluation unit 110 evaluates the importance of the main information or the document information by assigning a score to the confidentiality, integrity, and availability of the plurality of pieces of the main information or the document information according to preset criteria. For example, the information asset evaluation unit 110 may store the main information or the document information stored in the system server 30 in the upper, middle, lower or A, B, C, ... or 1, 2, 3, Set the rating with ... For example, in the case of personal information, financial information, etc., confidentiality is set high, and documents, such as general work documents, are set relatively low.

In addition, the information asset evaluation unit 110 evaluates whether or not there is a defect with respect to the document of which confidentiality evaluation is completed. Whether or not the document is defective is set as a confidentiality evaluation through the virus or malicious code infection, whether the document is finished, whether it is encrypted or not. In addition, the information asset evaluation unit 110 sets a rating, such as a confidentiality evaluation, regarding the availability of the main information or the document information.

The information asset evaluation unit 110 sets a rating by combining confidentiality, integrity, and availability. The information asset evaluation unit 110 distinguishes key information or document information having a high comprehensive grade from key information or document information having a low comprehensive grade.

The information asset evaluation unit 110 may change the access authority when the user terminal 10 or the manager terminal 20 accesses according to the grade when the grade of the main information or the document information is determined. For example, when the level of the main information or the document information is high, the user terminal 10 may not be accessible, and only the manager terminal 20 may be accessible. In addition, when the grade of the main information or document information is lowered, the user terminal 10 may be accessible.

The risk analysis unit 120 analyzes a vulnerability of a network or a vulnerability of main information or document information. The risk analysis unit 120 analyzes a potential risk factor of key information or document information using a vulnerability analysis tool, and if a new vulnerability is found, the risk analysis unit 120 performs a security check on a new vulnerability to detect a new vulnerability. Provide information.

In addition, the risk analysis unit 120 stores a history related to vulnerability inspection and vulnerability discovery information of potential risk factors, and may provide such a history to the manager terminal 20.

The risk analysis unit 120 may provide a graph, a figure, a numerical value, or the like to visually recognize the vulnerability information or the history provided to the manager terminal 20.

The control policy manager 130 controls the user terminal 10 or the administrator terminal 20 to access an unauthorized web server in order to control access to main information or document information. To this end, the control policy management unit 130 presets URL information of an accessible web server or a blocked web server. The control policy manager 130 may notify the user terminal 10 or the administrator terminal 20 to block access when the URL of the web server is blocked.

In addition, the control policy management unit 130 may force the security notification to the user terminal (10). For example, when the control policy management unit 130 transmits the security notification in the form of a web page from the manager terminal 20 to the user terminal 10, the control policy manager 130 blocks the connected web page of the user terminal 10, and the security notification web. Can direct access to a page.

The control policy manager 130 controls the security notice sent to the user terminal 10 to determine whether the security notice sent from the manager terminal 20 is confirmed by the user terminal 10. Feedback to 130 may be made.

The preventive control module 100 may include a terminal authenticator 210, a server manager 220, a server access controller 230, and a network traffic analyzer 240.

In detail, the terminal authenticator 210 may perform access authentication of the system server 30 for the task of the user terminal 10 or the manager terminal 20. In this case, the terminal authentication unit 210 may use a two factor authentication method that can authenticate using two or more authentication elements. For example, the terminal authentication unit 210 performs the first authentication when the ID (ID) and the password (Password) input in the user terminal 10 or the administrator terminal 20, and after the first authentication is completed, OTP, Secondary authentication is performed using a method such as an accredited certificate, ARS or QR code. Through this, the access security of the terminal can be strengthened.

In this case, the terminal authenticator 210 performs authentication through a separate channel, and the authentication channel does not use another service. In this way, the user terminal 10 or the manager terminal 20 can fundamentally block the risk of the attacker's account takeover during authentication.

When the authentication is completed in the terminal authenticator 210, the system server 30 may be notified to access the system server 30 from the user terminal 10 or the manager terminal 20.

The server manager 220 manages an IP list of a Command & Control (C & C) server that serves as a host of an advanced persistent threat (APT), and collects and analyzes related information. The server manager 220 periodically updates the list of new C & C servers provided as RSS services to access the user terminal 10 or the manager terminal 20 through the C & C server, or the user terminal 10 or the C & C server. The manager terminal 20 can manage access to the system server 30.

The server access control unit 230 may control the user terminal 10 or the administrator terminal 20 to access the P2P server or harmful site. The server access control unit 230 may control the access of the harmful site by using a preset P2P server or URL information of the harmful site. At this time, the server access control unit 230 controls the access of P2P server or harmful sites other than C & C server access.

When the server access control unit 230 accesses the main information or document information in the terminals, the server access control unit 230 transmits a notification message to determine the access time and port to the terminals in order to check whether the authorized access or unauthorized access.

At this time, the server access control unit 230 transmits a warning message using a phone number, a messenger, an e-mail, etc. set in the administrator terminal 20 by determining that an intrusion of an external server is not received after a notification is sent. .

In addition, the server access control unit 230 detects this when the user terminal 10 accesses the main information or document information and notifies the manager terminal 20.

The network traffic analyzer 240 collects all network traffic generated by the user terminal 10 and stores a path. In this case, the network traffic analyzer 240 monitors the port, service active state, and main window log for accurate analysis of the corresponding user terminal 10 when the access of the main information or document information which is not authorized in the user terminal 10 is monitored. Etc. can be collected.

Meanwhile, the network traffic analyzer 240 may not perform packet monitoring on a site or server that is registered in advance using a pre-matching URL and IP.

Meanwhile, the network traffic analyzer 240 may monitor the secret packet transmitted through the encrypted communication in order to detect the IP-based C & C server.

The calibration control module 300 may include a TCP packet tagging and recognition unit 310, a security agent manager 320, a central document manager 330, a user terminal controller 340, and a system restorer 350.

Specifically, the TCP packet tagging and recognition unit 310 may tag a unique ID to all TCP packets generated in the user terminal 10 in order to distinguish the network packet generated in the user terminal 10 using the router of the internal network. have. Through this, the TCP packet tagging and recognizing unit 310 may distinguish the TCP packet so that the network traffic collected by the network traffic analyzer 240 may be easily analyzed.

The security agent manager 320 monitors the installation of a security agent (for example, a security program or an antivirus program) installed in the user terminal 10, and installs the security agent in the user terminal 10 on which the security agent is not installed. The security agent may be transmitted to the user terminal 10 to install.

In addition, the security agent manager 320 proceeds to update the latest version to the security agent installed in the user terminal 10.

The central document manager 330 uses a file system driver to store a document worked on the user terminal 10 in the system server 30. Here, the file system driver may be a document preparation standard file system of the user terminal 10.

When the user terminal 10 accesses the main information or the document information from the unauthorized user terminal 10, the user terminal control unit 340 determines that the external attack, and the network of the user terminal 10 as a communication and a main medium (system server, etc.). You can block access. The user terminal controller 340 approaches the user terminal 10 and forcibly terminates execution of a process or a program classified as a threat, such as malware, spyware, a virus, a spy bot, or executes the processor. Can be prevented. In addition, the user terminal controller 340 generates and transmits a one-time password to allow access to the system server 30 to the user terminal 10 where the risk factor is not found, and transmits the password to the system server 30 when the password is input. Grant access

If it is determined that the user terminal 10 is infected with a virus, malware, spyware, spy bot, etc., the system restorer 350 stores a backup image of the corresponding user terminal.

The system restorer 350 restores the user terminal 10 to a virus, malware, spyware, spy bot, etc. state before infection. In this case, the system restoration unit 350 may perform the digital forensics, and notify the control policy management unit 130 of the forensic results.

Referring to FIG. 6, in the network security method according to an embodiment of the present invention, a control policy is defined in a preventive control module of a security server (S150), an authentication of a user terminal (S220), and a task of a user terminal. Monitoring the access of the main server, C & C server, P2P server, harmful site at the user terminal when performing, and checking whether the control policy violation (S297), and notifying the administrator terminal in the calibration control module when the control policy violation (S310) ), Blocking the network of the user terminal (S320), image storage step for forensics (S330), image recovery step (S340), forensic step (S335) and the control policy reflection step (S357) for forensic results can do.

Specifically, defining the control policy (S150) is a step performed in the preventive control module 100. Prior to the step of defining the control policy (S150), the information asset business impact evaluation step (S110), identifying a critical asset (S120), risk analysis step (S130) and vulnerability analysis step (S140) is preceded.

The information asset business impact evaluation step (S110) and the step of identifying the important asset (S120) evaluate the importance of the important information or document information stored in the system server 30 according to the set criteria, and identify the important asset according to the importance . As described above, the importance of the main information or document information evaluates the confidentiality, integrity, and availability of the main information or document information in the information asset evaluation unit 110. At this time, the high-level main information or document information is classified as an important asset.

Next, the risk analysis step (S130) and vulnerability analysis step (S140) analyzes the vulnerability of the internal network or the vulnerability of the main information or document information in the preventive control module (100). At this point, a vulnerability analysis tool or program is used to analyze potential risks of key information or document information. If a risk factor of main information or document information is found in the risk analysis step (S130), a safety check is performed, and the manager terminal 20 is notified of this.

Defining a control policy (S150) defines a URL of an accessible server and a URL of an access prohibited server in order to control access of main information or document information. Through this, when accessing the URL of the server forbidden access from the user terminal or the administrator terminal, it can be blocked, and the work performed in the user terminal 10 or the administrator terminal 20 can be terminated.

In addition, defining the control policy (S150) may include forcing the security notification to the user terminal 10. In this case, the preventive control module 100 induces the security notification to be transmitted to the user terminal 10 through the manager terminal 20, and the user terminal 10 receiving the security notification blocks the connected webpage, It can be connected to the announcement web page.

In performing the authentication of the user terminal (S220), when the user terminal 10 approaches the system server 30, two-factor (2factor) authentication is performed in advance. At this time, the two-factor authentication performs the first authentication through the user ID and password as described above, and performs the second authentication using additional authentication means (for example, OTP, public certificate, ARS, QR code, etc.). do.

In this case, when the two-factor authentication is not performed, the user terminal 10 may not access the system server 30 or may terminate the user terminal 10 (S225).

After the authentication is completed, the user terminal 10 may store main information or document information generated after the work in the system server (S230 and S235). In addition, the user terminal 10 may receive a major security bulletin notification received from the manager terminal 20 (S240). The manager terminal 20 or the system server 30 may store a confirmation log corresponding thereto. The user terminal 10 receives a security agent from the user terminal controller 340 and performs a security check inside the user terminal 10 (S250). At this time, the security agent is periodically updated. Thereafter, the result log of the security check may be stored in the system server 30 or the security server 40 (S255). After the security check, the user terminal 10 may continue to perform the task (S260).

On the other hand, the detection control module 200 monitors the abnormal behavior from the user terminal 10 during the performance of the user terminal 10 (S270). In this case, when abnormal behavior is not detected in the user terminal 10, the work is normally performed, and the work ends after the work is performed. Here, after the end of the work, the calibration control module 300 checks whether the security patch transmitted to the user terminal 10 (S350). If there is no need for a security patch as a result of the security patch check, the window of the user terminal 10 may be finally terminated. If a security patch is required, the image of the user terminal 10 is stored. Subsequently, the security patch is installed on the user terminal 10 (S370), and a log file of installation information is stored. Subsequently, after storing the system image of the user terminal 10 (S375), the system image is restored (S360).

When abnormal behavior is monitored in the detection control module 200, the main server access is checked (S275). In this case, the information on the main server may be URLs or IP addresses of preset servers.

The detection control module 200 transmits a user confirmation notification message to the corresponding user terminal when the main server access is confirmed as a result of the main server access check (S280). In addition, the user terminal 10 requests the authentication (S300). The two-factor authentication described above may be performed for authentication with the user terminal 10. In this case, the user terminal 10 and the security server 40 may perform authentication through a dedicated channel for authentication. When the authentication is completed, to continue the work performance (S260).

However, if the authentication is not confirmed, and notifies the manager terminal 20, and stores a log file for the system image recovery of the user terminal (S310).

On the other hand, in the detection control module 200 as a result of the main server access check, if the main server access is not checked whether the C & C server access (S290). In addition, after checking the access to the C & C server, if not the access to the C & C server, and checks the P2P server access (S295). If it is determined that the P2P server is not accessed, the access to the harmful site is checked (S299). If it is determined that the access to the C & C server or P2P server or harmful site is determined above, it is determined whether the policy is violated (S297). In this case, if the detection control module 200 determines that the policy violation of the user terminal 10 is notified to the manager terminal 20 and stores a log file (S310).

Subsequently, the network of the user terminal is blocked (S320).

Thereafter, the system image of the user terminal 100 is stored for forensics (S330). At this time, the final system full image of the user terminal is stored for the digital forensics of the user terminal 10.

Next, the system image of the user terminal 10 is restored using the stored image (S340).

Thereafter, the digital forensics of the user terminal 10 is performed (S335), and the control policy for the digital forensic result is reflected (S357).

The security server described above may be combined with a system server and may be an OS or a program operating in the system server.

In addition, the terminal authentication unit has been described, for example, included in the detection control module, but is not limited thereto, and may be included in a calibration control module or a system server.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art may implement the present invention in other specific forms without changing the technical spirit or essential features of the present invention. You will understand that. Accordingly, the embodiments described above are exemplary in all respects and not restrictive.

Claims

A plurality of user terminals using an internal network, a system server for storing a plurality of main information or document information generated in at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals and the user terminal, manager In the network security system having a security server for protecting the terminal and the system server,

The security server

The plurality of users from the external hacking server known to control the external access by identifying the important document to be attacked from the external hacking of the plurality of main information or document information, and analyzing the risk factor of the important document A preventive control module configured to restrict access of the terminal;

Monitoring the network traffic to access the important document, and stores the log file of the user terminal that generated the network traffic to access the important document, if the abnormal behavior including hacking in the user terminal is monitored the work of the user terminal Detection control module to terminate the; And

A calibration control module for generating and storing a backup system image when the plurality of user terminals access the system server, and performing restoration work through the backup system image when the abnormal behavior is monitored among the plurality of user terminals; Including network security system.
The method of claim 1,

The preventive control module

A network comprising an information asset evaluation unit for assigning a score for confidentiality, integrity and availability of the plurality of pieces of main information or document information to evaluate the importance of the main information or document information, and performing information management according to the evaluated importance. Security system.
The method of claim 2,

The preventive control module

Further comprising a vulnerability analysis unit for analyzing and detecting a risk factor for a document of high importance among the main information or document information, and performs a safety check on all the main information or document information when the risk factor is detected. Network security system.
The method of claim 3, wherein

The preventive control module

And a control policy management unit configured to transmit a security notice to the user terminal through the manager terminal, and to feed back whether the security bulletin is read from the user terminal.
The method of claim 1,

The preventive control module

A terminal authentication unit for authenticating using at least one authentication element of a user ID and an OTP, an official certificate, an ARS, and a QR code of the user terminal;

A server that monitors and manages a user terminal authenticated by the terminal authentication unit accessing an external network through a command & control (C & C) server, or accessing the C & C server to the system server through the user terminal while performing a task. Management;

The user terminal controls access to a P2P server or a harmful site, and when accessing the important information from the user terminal, access time and port are connected to the user terminal to confirm whether the user is authorized access or unauthorized access. A server access control unit which transmits a predetermined notification message, and transmits a warning message to the manager terminal by determining that an intrusion or hacking is received from an external server when there is no reply to the notification message after sending the notification message; And

The network security system further comprises a network traffic analysis unit for collecting the network traffic generated from the user terminal and set the path.
The method of claim 1,

The calibration control module

A TCP tagging and recognizing unit for tagging a unique ID to network traffic or a network packet generated at the user terminal;

A security agent manager for monitoring the installation of the security agent installed in the user terminal and transmitting the security agent to the user terminal in which the security agent is not installed;

A user terminal controller which determines that the main information or document information is an external attack when the user terminal does not perform authentication and blocks access to the system server; And

It is determined that the user terminal is infected with at least one of the virus, malicious code, spyware, and further includes a system restorer for storing a backup image of the infected user terminal, and restores to a previous state of infection.
A plurality of user terminals using an internal network, a system server for storing a plurality of main information or document information generated in at least one of the plurality of user terminals, an administrator terminal for managing the plurality of user terminals and the user terminal, manager terminal And a method for protecting information performed on a security server protecting a system server,

(a) defining a control policy for controlling access from the security server to access to an external network or to an unconfigured server;

(b) an authentication step of performing authentication in the user terminal to grant access to the system server for performing a task;

(c) monitoring access of a main server, a C & C server, a P2P server, a malicious site, and checking whether the control policy is violated in the security server when the user terminal performs a task;

(d) informing the administrator terminal of the control policy violation in the security server;

(e) blocking the network of the user terminal in violation of the control policy at the security server;

(f) storing a backup image of the user terminal in violation of the control policy in the security server;

(g) recovering a user terminal through the backup image at the security server; And

(h) performing digital forensics from the backup image at the security server.
The method of claim 7, wherein

Before step (a) above,

Evaluating the importance of the main information or document information by assigning scores for confidentiality, integrity, and availability of a plurality of main information or document information stored in the system server, and managing information according to the evaluated importance level; And

A network further comprising analyzing and detecting a risk factor with respect to a document having high importance among the main information or document information, and performing a safety check on all the main information or document information when the risk factor is detected. Security method.
The method of claim 7, wherein

Step (b) is

And a user ID and an OTP, an official certificate, an ARS, and a QR code of at least one authentication element of the user terminal.
The method of claim 7, wherein

After step (h),

And reflecting the digital forensic result in the control policy.