JP5692662B2 - Protection system and method for LAN - Google Patents

Description

      The present invention relates generally to network security methods, and more particularly to protection systems and methods for LANs.

      With the development of the Internet, network packets can be transmitted between a client and a server via a LAN (Local Area Network). When one of the LANs is disconnected, network packets are nevertheless transmitted through other channels by channel routing techniques to maintain continuity of network transmission. In addition, the network transmission rate of network packets can also be increased by using multiple channels.

      In the development of information technology, companies and individuals have relied heavily on IT equipment, and information security has simultaneously become the most important issue for the development and use of computer hardware and software. Lack of information security, which can lead to serious consequences whenever data leakage, data addition, deletion or tampering, computer related service outages due to computer viruses, or disabling the daily work of businesses and individuals , All leading to significant losses and inconveniences for businesses and individuals.

      Like the problem described above, information leakage causes the most serious adverse effects. For example, once a company's R & D results, trade secrets, financial status or customer data and other information is leaked, the company loses strategic competitive advantage in technology development or even puts the company in a financial crisis And that leads to product development or customer loss without entering the market. Therefore, companies that require extensive use of information technology and vendors receiving R & D information security technology see it as the first challenge to establish information security that prevents information leakage.

      Depending on these circumstances, various methods for information control are provided. Most of them are based on account password mechanisms to ensure user access to information with sufficient permissions. Through the verification procedure, the user can be limited to transferring data via the Internet or other interface or storing the data in an external storage device, thereby preventing various methods of information leakage. However, the above methods have imperfections or disadvantages that these protection mechanisms need to utilize specific software for startup.

      In addition, the use of network resources is not complete and the network processing system and architecture are more complex. Therefore, the present invention provides a simple processing system and method for network packet security to solve the information leakage problem.

      Based on the above, one embodiment of the present invention is a protection method for a local area network, wherein a request command is transmitted by a transmitting terminal and a mark or whitelist is marked in a network packet; and reception Receiving a request command by the terminal and checking if the mark or whitelist is in the network packet. The protection method further includes the step of passing the network packet if the mark or white list is found in the network packet and disabling the network if the mark or white list is not found in the network packet.

      Another object of the present invention is a protection system for a local area network, wherein a network packet protocol unit capable of marking a mark or white list in a network packet and the mark or white list in a network packet And a network packet inspection unit capable of checking whether or not. If this protection system is found in a network packet whose mark or white list is checked by the network packet inspection unit, the network packet will pass and the mark or white list will be found in the network packet checked by the network packet inspection unit. If not, further includes disabling the network.

      The network packet includes an SMB packet, a NetBIOS packet, a MAC packet, a TCP packet, an IP packet, or an Ethernet packet. The mark is added in the SMB packet.

      The components, characteristics and advantages of the present invention can be understood by the detailed description of the preferred embodiments outlined in the specification and the accompanying drawings:

FIG. 2 illustrates a schematic diagram of one embodiment of a LAN protection system according to the present invention. FIG. 3 illustrates a schematic diagram of one embodiment of a network packet according to the present invention. 2 illustrates a flow diagram of a protection method for a LAN according to the present invention. 2 illustrates a flow diagram for establishing a protocol in accordance with the present invention.

      Some preferred embodiments of the invention are described in more detail below. However, it should be appreciated that the preferred embodiments of the present invention are provided for purposes of illustration rather than limiting the present invention. In addition, the invention may be practiced in a wide variety of other embodiments besides those explicitly described, and the scope of the invention, except as specified in the appended claims, is It is not explicitly limited.

      In order to avoid improper access of data and ensure the security of information transmitted between users in the vicinity of the network, the present invention provides a LAN protection system. Network packets within the network neighborhood are marked by an appropriate mark (such as a parameter or symbol label), on the basis of which the file or data can be SMB (Server Message Block), SMB2 or CIFS (Common Internet File System) ) Can be transferred into the network.

      As shown in FIG. 1, it shows a schematic diagram of one embodiment of a LAN protection system according to the present invention. In this embodiment, the LAN protection system 10 can be used as a LAN system from server to client or between clients. The LAN protection system 10 includes a network packet protocol unit 11 and a network packet inspection unit 12. The network packet protocol unit 11 can mark the mark in the network packet 13, and the network packet inspection unit 12 can check the marked mark in the network packet 13. In other words, using the system of the present invention, when a file or data is transferred between two clients, the data transmission terminal (eg, the first computer) is transferred by the network packet protocol unit 11 into the network packet 13. And a data receiving terminal (eg, a second computer) can check the mark in the network packet 13 by the network packet inspection unit 12. If the source IP or MAC is found during the mark in the network packet 13 checked by the network packet inspection unit 12, or during the whitelist, the file or data is exchanged or transferred between the two terminals. Can. Otherwise, if the mark is not found in the network packet 13 checked by the network packet inspection unit 12, or if the source IP or MAC is not in the white list, the network between the data transmission terminal and the data reception terminal Connection is disabled.

      In another embodiment, no matter what mark is present in the network packet 13, it only verifies that the source IP of the network packet or MAC is in the whitelist, and if so, the network packet 13 passes, If not, the network connection between the data transmission terminal and the data reception terminal is disabled.

      As shown in FIG. 2, it shows a schematic diagram of one embodiment of a network packet according to the present invention. In general, in open system interconnection, a reference model based on the achievement of the tasks of the entire network, it can be divided into different functional blocks, so-called levels (layers). In one example, based on TCP / IP (Transmission Control Protocol / Internet Protocol), it comprises an application layer, a forwarding layer, a network interconnection layer, and a network interface layer to constitute an Internet-based network protocol. The application layer can communicate the network with other programs such as file transfer protocol (FTP), hypertext transfer protocol (HTTP), SMB, NetBIOS, and the like. The forwarding layer is used to determine to which application the predetermined information should be sent, for example including TCP. The network interconnection layer can select a path on the network (Internet) for data packet transmission including, for example, IP (Internet Protocol). The network interface layer can transfer data packets from the network layer of one device to that of another device, for example by utilizing a network card software driver, including Ethernet or firmware or It can be controlled by using a dedicated chip. Therefore, the network packet 13 of the present invention includes the application layer packet 100 (including the SMB packet / CIFS packet 101a and the network basic input / output system (NetBIOS) packet 101b), the transport layer TCP packet 102, the network interconnection layer It includes all levels of packets, including IP packets (IPv4 or IPv6 packets) 103 and network interface layer Ethernet packets 104. A server message block (SMB) or CIFS (Common Internet File System) protocol can be used as a protocol for sharing files in the network.

      As shown in FIG. 3, it shows a flow chart of the protection method for LAN of the present invention. For example, LAN protection is information exchange protection for the network neighborhood, ie, FIG. 3 is a flow diagram for the network neighborhood with network protection capability. As described above, in data exchange, marks are marked in packets near the network. First, in step 110, it is checked whether a protocol is established and a mark or white list is in the network packet. The process for negotiating the request / response in step 110 is shown in FIG. First, the medium access control address (MAC address), Internet protocol address (IP address) and host name for network protocols (such as SMB packet, NetBIOS packet, MAC packet, TCP packet, IP packet, Ethernet packet) Addressed as a send packet. In step 120, the sending terminal 14 sends a send request command to mark a mark or whitelist in the network packet. For example, the transmission terminal 14 transmits a transmission request command and is transmitted by a network driver interface specification driver (NDIS driver). NDIS is an API that can be used for a network interface card (NIC).

      In one example of a network neighborhood, before data is exchanged between the data sending terminal 14 and the data receiving terminal 15, a mark is marked in a packet near the network. For example, a mark is marked in the SMB header, and the SMB must have enough space fields to mark in the packet. A mark such as a unique identifier (unique ID) can be located in the space field or fixed field of the SMB protocol. That is, with some commands, a mark is marked on the space field or fixed field of the SMB protocol as the basis for packet inspection to determine network validation or prohibition. In another embodiment, the mark may be located in other space fields based on other different commands, and the mark annotation field depends on the actual application. In addition, different operating systems (such as Vista / Win7 / XP) support different protocols (such as SMB / SMB2) and thus the marks can be adjusted or changed.

      Thereafter, in step 121, the receiving terminal 15 receives a receiving request to check and confirm whether the mark or white list is in the network packet. Then, at step 122, the receiving terminal 15 sends a response command in response to the receiving terminal 15 that it has confirmed whether the mark or whitelist is in the network packet. Finally, at step 123, the sending terminal 14 receives the response command, thereby establishing a network protocol. Similarly, on the other hand, the role can be reversed between the sending terminal and the receiving terminal. The completed network protocol suggests that the network packets between the sending terminal 14 and the receiving terminal 15 have the same mark identifier (MID) or whitelist. For example, the same mark identifier suggests that the network packets at the sending terminal 14 and the receiving terminal 15 have a space string with the same length string, parameter or symbol tag.

      After establishing the protocol, at step 111 it performs the step of establishing a network connection between the sending terminal 14 and the receiving terminal 15. After the network connection is established, at step 112, the sending terminal 14 and the receiving terminal 15 can open a file directory near the network. Then, according to those requests, in step 113, the transmission terminal 14 or the reception terminal 15 can open the subdirectory file (subfolder) under the file directory near the network. Next, at step 114, it can open the file under the subdirectory. After opening the file, at step 115 it can read or write the file. Finally, at step 116, it can close the file. Of course, in the process of exchanging information, it also includes accessing files in the vicinity of the network.

      The foregoing description is a preferred embodiment of the present invention. As is well understood by those skilled in the art, the above-described preferred embodiments of the invention are illustrative of the invention rather than limiting the invention. The present invention is intended to encompass various modifications and similar arrangements included within the spirit and scope of the appended claims, the scope of which includes all such modifications and similar structures. The broadest interpretation should be given to

DESCRIPTION OF SYMBOLS 10 LAN protection system 11 Network packet protocol unit 12 Network packet inspection unit 13 Network packet 14 Data transmission terminal 15 Data reception terminal 100 Application layer packet 101a SMB packet / CIFS packet 101b NetBIOS packet 102 TCP packet 103 IP packet 104 Ethernet packet

Claims (1)

A protection method for a local area network,
Sending a request command in the form of a network packet by the sending terminal and marking in the network packet by the sending terminal;
Receiving the request command by the receiving terminal and checking by the receiving terminal whether a mark is in the network packet and checking whether the IP or MAC of the sending terminal is in the white list of the receiving terminal Including
If the mark is found in the network packet, or if the IP or MAC of the sending terminal is found in the white list, the network connection through which the network packet passes is established, and the mark is the network packet Disabling the network connection if not found in and the IP or MAC of the sending terminal is not found in the whitelist.