JP2004535096A - Method and system for regulating external access - Google Patents

Abstract

Disclosed herein is a method and apparatus for controlling external access via the Internet. The present invention uses a storage device for storing a list of allowed addresses in communication with a network interface card to extract addresses from packets sent / received through the network interface card, and to extract the extracted addresses and access addresses. An address on the allowed address list is compared, and access permission or access prohibition is determined based on the comparison result. The network interface card of the present invention communicates with a storage device that stores a secure access permission list on the Internet. The address determination unit of the network interface card extracts an address from a packet received from the outside and controls intentional access by permitting only access by a secure computer. In addition, the present invention uses a server that provides the latest service for an access permitted address or an access prohibited address according to a user's request.

Description

【Technical field】
[0001]
The present invention relates generally to a method and apparatus for controlling external access via the Internet, and more particularly to receiving packets transmitted / received through a network interface card and storing the packets in a transmit / receive buffer. And extracting an address from the stored packet, comparing the extracted address with a secure IP address stored in a storage list communicating with the network interface card, and accessing based on the result of the comparison. The present invention relates to a method for controlling external access via the Internet, which determines whether to permit or prohibit access, and an apparatus for implementing the method.
[Background Art]
[0002]
Since the Internet Protocol was standardized in 1983, the Internet has been used for various purposes such as e-mail, file transfer (FTF), gophers, and network news, mainly through computer networks of governments, large corporations, and many universities. Has become popular. Also, when the National Science Foundation (NSF) of the United States built NSFNET in 1985, NSF adopted TCP / IP, the ARPA Internet protocol, as a basic communication protocol. Thus, NSFNET has served as a backbone network for the Internet and has become very popular. Also, in 1988, the ARPA began removing ARPANET's original equipment. In 1990, the Internet finally reappeared as a private network, as ARPANET was no longer used in military applications. Among the many phenomena that emerge with the development of the information society, there is the integration of media and communication networks. This integration has made the Internet worthy of the media as the Internet evolved. As advanced information and communication technologies have evolved, the Internet has traditionally taken root in society. As such, it is creating enormous benefits. However, on the one hand, the Internet is also causing major social problems.
DISCLOSURE OF THE INVENTION
[Problems to be solved by the invention]
[0003]
FIG. 1 is a diagram showing a configuration of a general network used in a conventional company. Referring to FIG. 1, a conventional corporate network is generally configured as shown in FIG. The network includes a router 10 connected to the Internet and a firewall 20 connected to the router 10 for determining an optimal route and transmitting a packet to the determined route. Firewall 20 helps formulate an access control policy between the two networks. Also, various servers or hosts 60, 80, etc., which are protected according to the access control, are connected to the end of the firewall 20 by the switching hub 70. Further, the servers can be generally classified into a mail server 40, a web server 30, an FTP server 50, and the like. The function of each server is well known in this field, and a detailed description of the function will be omitted. The hosts 60 and 80, which are personal computers used by the user, are connected to the end of the firewall 20 via the switching hub 70. Important business data is stored in hosts 60 and 80 used in the enterprise. However, hacking techniques via the Internet are becoming more and more sophisticated, and attempts to hack directly to hosts 60 and 80 instead of hacking to servers are increasing. If an attempt is made to hack the hosts 60 and 80, there is a greater risk that important data will leak from the computer.
[0004]
On the other hand, a personal computer is basically not different from an ordinary computer. Security issues facing personal computer users include confidentiality, integrity, program, data, and hardware availability, as with mainframe computers. Therefore, standard control techniques such as access control lists, protected memories, user authentication techniques, and reliable operation systems must be equally applied in a personal computer environment. However, security controls on personal computers are generally less stringent than those on mainframe computers or similar types of computers. Further, even mainframe computers are not protected from data corruption by internal users. Personal computers have little hardware-level protection against intentional hacking by external Internet users. General hardware-level protection devices are mainly used in servers. However, such hardware-level protection devices are problematic because they are too expensive for use in small businesses. Also, even if a company purchases a device with hardware-level protection, it is usually not possible to optimize the management of the device because of the lack of manpower to control the device. Another problem is that the device is often useless.
[0005]
Also, few companies provide security services for the hosts 60 and 80, that is, business computers. In order to solve the above-mentioned problem, a user personally installs and uses a security program for a client. The personal firewalls mentioned above are hacked due to poor management, in that they are implemented in a software manner, and the user installing the firewall must directly control the program. The problem is that there is always the risk of
[0006]
Also, in general computers for home users, a communication environment using xDSL has become predominant with the development of the Internet environment. A hacking method targeting a home user's computer has been created as a simple program, and has been widely spread in a communication environment. Examples of these hacking programs are back orifice 2K, school bus, net bus, sub-seven y3k, and the like. A person skilled in the use of a computer can easily perform a hacker action on another person's personal computer only by studying the manual of the hacking program described above. However, the method of preventing hacking differs depending on the computer level of the user. The user-level security provides various protection methods such as a file encryption function, a screen locking function, an IP control function, a port control function, an access log control function, a process task management window function, and a sharing control function. However, there is a problem that few client users can properly maintain the installation and management of such a program.
[0007]
Accordingly, the present invention has noted the above problems encountered in the prior art. It is an object of the present invention to provide a method and apparatus for controlling intentional access from the outside via the Internet.
[0008]
It is another object of the present invention to provide a method and apparatus for controlling external access, which can prevent a user from deleting packets without permission.
[0009]
It is a further object of the present invention to provide a method and apparatus for controlling external access by the Internet performed by each user computer without a separate firewall.
[0010]
It is yet another object of the present invention to provide a method and apparatus for controlling external access via the Internet without requiring further management.
[Means for Solving the Problems]
[0011]
In order to achieve the above object, the present invention uses a storage device for storing a list of allowed addresses in communication with a network interface card to extract addresses from packets transmitted / received through the network interface card. Then, the extracted address is compared with an address on the access permitted address list, and access permission or access prohibition is determined based on the comparison result. Access from the user host (60) to the outside is freely performed. Further, it is possible to prohibit any arbitrary access request from outside to the user host (60). Further, the external terminal first requested to access by the user host (60) accepts the access request from the user host (60).
[0012]
The above and other objects, features, and advantages of the present invention will be more clearly understood from the following detailed description made with reference to the accompanying drawings.
BEST MODE FOR CARRYING OUT THE INVENTION
[0013]
FIG. 2 is a conceptual diagram showing an access request process using the SYN bit. When communicating over the Internet, the most common method of transmitting data to a partner computer is to transmit the data using a transmission control protocol (TCP). TCP provides a stream-type connection-oriented service that is reliable, ie, performs error control and flow control by retransmission. TCP connects between logical terminals of two communication computers. Before communication is performed between two computers, control information called handshake is transmitted. The handshake used in TCP is called a three-way handshake because three segments are exchanged. The user host 60 initiates access by sending one segment containing a “sync sequence number” (SYN) bit to the connector host 80. This segment informs the connector host 80 that the user host 60 wants to start access, and assigns a sequential number used by the user host 60 as the segment start number. Connector host 80 responds by sending one segment with the ACK and SYN bits set to user host 60. The segment from the connector host 80 informs the user host 60 that the connector host 80 has received the segment from the user host 60, and also informs the user host 60 of the starting serial number used by the connector host 80. Finally, the user host 60 sends a segment indicating that the user host 60 has received the segment from the connector host 80 to the connector host 80, and sends first valid data to the connector host 80. Thus, the user host 60 and the connector host 80 can reliably exchange data with each other. The above description is a three-way handshake method, which is the method most commonly used when a user wants to access a computer via TCP.
[0014]
Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
[0015]
FIG. 3 shows a method of controlling access from the outside via the Internet in detail. FIG. 3 is a diagram showing a configuration of a network for realizing an access control method via the Internet according to a preferred embodiment of the present invention.
[0016]
The network interface card 100 incorporated in the user host 60 is configured to communicate with the access-permitted address storage unit 200. The packet corresponding to the access request from the connector host 80 to the user host 60 is configured to pass through the network interface card 100 without fail. Therefore, the network interface card 100 extracts the source address from the passed packet, and compares the extracted source address with the address stored in the access-permitted address storage unit 200. As a result of the comparison, if the same address as the source address exists in the access-permitted address storage unit 200, the network interface card 100 passes the packet. Conversely, if the same address as the source address does not exist in the access-permitted address storage unit 200, the network interface card 100 deletes the packet. Further, in order to facilitate the interface between the hosts, when the user host 60 further requests access to the external connector host 80, the network interface card 100 stores the recently requested address in the additional buffer. Alternatively, the address may be retrieved later, and a standby may be made in preparation for a response signal received from the connector host 80 requested to be accessed by the user host 60. As described above, when the user host 60 requests access to the connector host 80, packet transmission is not restricted, and a packet corresponding to an access request from the connector host 80 to the user host 60 is transmitted. Deleted. However, when an access request from the connector host 80 based on a request from the user host 60 is input, the network interface card 100 temporarily stores the packet in a buffer and passes the packet. That is, when the address extracted from the transmitted packet exists in the buffer as the access permitted address, the connector host 80 can access the user host 60. As described above, since access to the external server 300 is frequently requested by the user host 60 in data search using the Internet or the like, a packet for accessing the external server 300 from the user host 60 is Are not restricted for the purpose of freely sending Also, even when an access request packet is transmitted from the external server 300, access to the external server 300 can be permitted by setting a flag for permitting access to the external server 300. . Therefore, there is no restriction even if the user pays by electronic money when purchasing a product through the Internet site.
[0017]
Next, a network interface card according to a preferred embodiment of the present invention will be described in detail with reference to FIG. FIG. 4 is a block diagram showing the internal configuration of a network interface card having an access control function via the Internet according to the present invention.
[0018]
The network interface card 100 uses a PCI bus for communicating with a computer. The network interface card 100 includes a MAC processing unit 150 for processing a medium access control (MAC) in a packet transmitted through a PCI bus, a PHY processing unit 160 for processing a physical layer, a buffer 120 required for packet processing, and a boot ROM. , A connector and the like.
[0019]
Further, the network interface card 100 of the present invention further includes an address determination unit 110, an access-permitted address storage unit 200, a transmission packet queue 130, and a reception packet queue 140. Further, the network interface card 100 may be implemented to further include a buffer 120 for storing information related to an access request from the user computer to the connector host 80 or the external server 300.
[0020]
As shown in FIG. 4, the address determination unit 110 is connected at a stage before the MAC processing unit 150, but may be arranged between the MAC processing unit 150 and the PHY processing unit 160, or , PHY processing unit 160 may be connected to the next stage. In FIG. 4, the transmission packet queue 130 and the reception packet queue 140 are provided separately, but may be integrated with the signal packet queue.
[0021]
The address determination unit 110 extracts a source / destination address from a packet transmitted through the Ethernet / PCI bus. The destination address is extracted from the packet transmitted through the PCI bus. On the other hand, the source address is extracted from the packet transmitted through the Ethernet bus. The address determination unit 110 extracts an address from the input packet, compares this address with an address on an address list stored in the buffer 120 or the access-permitted address storage unit 200, and compares the address with the address. It is determined whether or not the packet should be passed on the basis of the packet. In addition, the address determination unit 110 may check all the packets passing therethrough. However, it is preferable to determine whether or not the input packet is to be processed and pass the packet which is not to be processed, and to determine whether or not only the packet to be processed should be passed therethrough. . It is preferable that packets to be processed are restricted to packets using TCP and UDP. As described later, the packet input to the address determination unit 110 is temporarily stored in the transmission packet queue 130 or the reception packet queue 140 via the address determination unit 110. In addition, the address determination unit 110 performs a function of storing the address extracted from the packet in the buffer 120.
[0022]
The access-permitted address storage unit 200 is configured to store an address of a computer to which an access request from an external computer of the user host 60 is always permitted, and to communicate with the network interface card 100. That is, the access-permitted address storage unit 200 may be stored in a hard disk incorporated in the computer, or the network interface card 100 may have a separate storage device. A nonvolatile memory such as a flash memory or an EEPROM is used as a separate storage device. The content stored in the access-permitted address storage unit 200 is a number corresponding to the IP address of the computer to which access is permitted, or a character value corresponding to the URL address. The number and the character value are not stored in the access-permitted address storage unit 200 as they are, but are preferably stored in the access-permitted address storage unit 200 as a form subjected to hash processing by a hash function. Since the hash function has no inverse function, the stored content is a value that cannot be read by anyone trying to read it. Also, the contents stored as hash values are beneficial in that they are formed and stored as indices so that they can be searched more quickly than normal text searches. Further, the access-permitted address storage unit 200 may further include an access prohibition list, which is a list of addresses that are always prohibited from being accessed, so that the address determination unit 110 can determine the access prohibition. .
[0023]
If the user host 60 has recently requested access via the Internet, the buffer 120 temporarily stores the content related to the access request sent by the user host 60, thereby allowing another buffer to be provided from the external server 300. The packet for the access request is passed. In addition, the buffer 120 is configured so that the number of recently requested access packets stored in the buffer 120 can be arbitrarily set. That is, the number of packets increases according to the capacity of the buffer 120, so that information on all access request packets from the beginning to the end of the Internet access by a normal computer user can be stored in the buffer 120. When the capacity of the buffer 120 is small, the most recently received access request packet is stored in the buffer 120, and the first received access request packet is deleted first.
[0024]
The buffer 120 can be realized as a nonvolatile memory such as a flash memory or a volatile memory such as a RAM. However, due to its high access speed, it is preferable to use volatile memory.
[0025]
The transmission packet queue 130 serves to temporarily store packets input to the address determination unit 110 from the PCI bus. Further, while the transmission packet queue 130 temporarily stores the packet, the address determination unit 110 extracts an address from the packet. Thereafter, when the SYN bit corresponding to the access request is set in the packet transmitted from the user host 60 to the external server 300 or the connector host 80, the transmission packet queue 130 temporarily stores the packet, while the SYN bit is stored. The destination address is stored in buffer 120 to wait for a signal having the ACK bit and the ACK bit. Further, while the transmission packet queue 130 temporarily stores the packet, the access permitted address list is stored in the buffer 120 which is separate from the access permitted address storage unit 200. Therefore, when the access request packet in which the SYN bit is set is received from the access permission address stored in the buffer 120, the access to the user host 60 can be permitted. Further, the transmission packet queue 130 can be realized as a volatile memory such as a RAM or a nonvolatile memory such as a flash memory. However, considering the access speed, it is preferable to use a volatile memory.
[0026]
The reception packet queue 140 serves to temporarily store packets input to the address determination unit 110 from the Ethernet. Further, while the reception packet queue 140 temporarily stores the packet, the address determination unit 110 extracts an address from the packet. When the address determination unit 110 determines that the address is an address whose access is prohibited, the corresponding packet is deleted. However, if the input packet is a packet corresponding to the address requested to be accessed by the user host 60, the received packet is stored in the buffer 120 as an access-permitted address, and the received packet queue 140 Through. That is, by transmitting the SYN bit to the external computer requested to be accessed by the user host 60, access to the SYN bit and the ACK bit received from the external computer can be permitted. Further, the reception packet queue 140 may be realized as a volatile memory or a nonvolatile memory, like the transmission packet queue 130. However, the receive packet queue 140 is preferably implemented as a volatile memory.
[0027]
Hereinafter, access permission / prohibition of the received packet will be described with reference to FIG. FIG. 5 is a flowchart of a process of allowing / prohibiting an access request by checking a received packet by an address determination unit according to a preferred embodiment of the present invention.
[0028]
In step S100, the network interface card 100 installed in the user host 60 connected to the Internet receives a packet from the external server 300 or the connector host 80. In step S110, the network interface card 100 stores the received packet in the reception packet queue 140 by copying the received packet. In step S120, the address determination unit 110 extracts a source address from the received packet. In step S130, the address determination unit 110 compares the extracted source address with the address stored in the buffer 120.
[0029]
If the same address as the extracted address exists in step S130-1 with respect to the address classified in the buffer 120, it is determined in step S131 whether the extracted address is classified as an access-permitted address. You. If the address is classified as an access-permitted address in step S132, the address determination unit 110 passes the packet in step S134. On the other hand, if the address is classified as an access prohibition address in step S133, the address determination unit 110 deletes the corresponding packet in step S135.
[0030]
If the same address as the extracted address does not exist in the buffer 120 in step S130-2, in step S140, the address determination unit 110 stores the extracted address in the access-permitted address storage unit 200. Address in the address list.
[0031]
In step S150, the address determination unit 110 determines whether any address on the address list stored in the access-permitted address storage unit 200 is the same as the extracted address. If it is determined in S150-1 that any address on the address list is not the same as the extracted address, in step S151, the address corresponds to the reception prohibition. Therefore, the extracted address is recorded in the buffer as an access prohibition address in step S152. In step S153, the corresponding packet is deleted.
[0032]
If it is determined in step S150-2 that an arbitrary address on the address list stored in the access-permitted address storage unit 200 is the same as the extracted address, the extracted address is set in step S150-2. In S160, it is recorded in the buffer as an access-permitted address. In step S170, the corresponding packet is passed.
[0033]
Hereinafter, access permission / prohibition of a transmission packet will be described with reference to FIG. FIG. 6 is a flowchart of a process of permitting / prohibiting an access request by checking a transmission packet by an address determination unit according to a preferred embodiment of the present invention.
[0034]
In step S200, when the user host 60 requests access to an external server 300 such as the connector host 80 or any web server 30 using a web browser or another application program, the network incorporated in the user host 60 The interface card 100 receives a transmission packet. Therefore, the network interface card 100 stores the packet in the transmission packet queue 130 in step S210. The address determination unit 110 extracts the destination address from the received packet in step S220, and compares the extracted destination address with the address stored in the buffer 120 in step S230.
[0035]
If the same address as the extracted destination address exists in the buffer 120 in step S230-1, the address determination unit 110 passes the corresponding packet in step S231. On the other hand, if the same address as the extracted destination address does not exist in the buffer 120 in step S230-2, the address determination unit 110 determines in step S240 whether the SYN bit is set in the packet. .
[0036]
If the SYN bit is set in the packet in step S240-1, the destination address is recorded in the buffer 120 as an access-permitted address in step S250, and the ACK bit transmitted from the destination address in step S260. The waiting state for the reception of the packet having is stored. Further, in step S270, the address determination unit 110 allows the packet to pass and allows the packet to be transmitted to the outside through the Ethernet.
[0037]
On the other hand, if the SYN bit is not set in the packet in step S240-2, the destination address is stored in the buffer in step S241. Also, in step S242, the address determination unit 110 allows the packet to pass and allows the packet to be transmitted to the outside through the Ethernet.
[0038]
While disclosed to illustrate examples of preferred embodiments of the present invention, those skilled in the art will appreciate that various modifications can be made without departing from the scope and spirit of the invention as set forth in the appended claims. , Addition and replacement are possible.
[Industrial applicability]
[0039]
As described above, the method and apparatus for controlling external access via the Internet according to the present invention are advantageous in that intentional external access via the Internet can be controlled.
[0040]
Further, the present invention is advantageous in that it is possible to prevent a user from arbitrarily deleting or deleting a packet.
[0041]
Further, the present invention is advantageous in that it is possible to control external access from the Internet using individual computers without an additional firewall.
[0042]
Further, the present invention is advantageous in that external access through the Internet can be controlled without requiring additional management for access control.
[Brief description of the drawings]
[0043]
FIG. 1 is a diagram showing a configuration of a general network used in a conventional company.
FIG. 2 is a conceptual diagram illustrating an access request process using a SYN bit.
FIG. 3 is a diagram showing a configuration of a network for realizing a method for controlling external access via the Internet according to a preferred embodiment of the present invention.
FIG. 4 is a block diagram showing an internal configuration of a network interface card having an access control function via the Internet according to a preferred embodiment of the present invention.
FIG. 5 is a flowchart of a process of permitting / prohibiting an access request by checking a received packet by an address determination unit.
FIG. 6 is a flowchart of a process of permitting / prohibiting an access request by checking a transmission packet by an address determination unit.

Claims (7)

A method for controlling external access via the Internet and handled by a network interface card,
Receiving one or more packets transmitted / received through the network interface card and storing the packets in a transmit / receive buffer;
Extracting an address from the stored packet;
Comparing the extracted address with a secure IP address stored in a storage list in communication with the network interface card;
Determining access permission or access prohibition based on the comparison result;
The method that has. A method for controlling external access via the Internet and handled by a network interface card,
Storing one or more packets received by the network interface card in a predetermined area and extracting an address from the packets;
Checking whether the same address as the extracted address is stored in the access permission list for communicating with the network interface card;
Determining access permission / access prohibition by checking whether the same address as the extracted address is stored in the access permission list;
The method that has. Storing, in a buffer, a packet having the SYN bit set among packets transmitted through the network interface card, and extracting an address from the packet;
Transmitting a packet with the SYN bit set through a network interface card;
Receiving a packet having an ACK bit received from the same address as the extracted address, and setting an access permission flag in a buffer;
The access control method according to claim 1 or 2, further comprising: Storing, in a buffer, a packet having the SYN bit set among packets transmitted through the network interface card, and extracting and storing an address from the packet;
Comparing the extracted address with each address stored in the buffer and determining whether the addresses are the same and whether an access permission flag is set;
Passing the received packet when the compared addresses are the same and the access permission flag is set;
The access control method according to claim 1 or 2, further comprising: Storing, in a buffer, a packet having the SYN bit set among packets received through the network interface card, and extracting and storing an address from the packet;
Comparing the extracted address with each address stored in the buffer and determining whether the addresses are the same and whether an access permission flag is set;
Deleting the received packet when the compared addresses are not the same and the access permission flag is not set;
The access control method according to claim 1 or 2, further comprising: A device for controlling external access via the Internet,
An access-permitted address storage unit for storing a secure address of a computer to which access is permitted based on the request;
A transmission packet queue for temporarily storing transmission packets transmitted to the outside,
A reception packet queue for temporarily storing received packets received from outside;
An address is extracted from the received packet to determine whether or not the extracted address is access-permitted by referring to the access-permitted address storage unit, and the same address as the extracted address exists in the access-permitted address storage unit. If not, the received packet is deleted, and if the same address as the extracted address exists in the access-permitted address storage unit, an address determination unit that accepts the received packet;
An apparatus comprising: 7. The access control device according to claim 6, wherein the access-permitted address storage unit stores the address information in an encrypted form using a hash function.

Images