KR100443461B1 - system for harmful site connection interception service using tunneling protocol and service method thereof - Google Patents

Abstract

The present invention provides a harmful site access blocking service system and service method for efficiently blocking access to harmful sites including obscene or gambling sites at the request of subscribers when providing selective harmful site access blocking services in a high-speed Internet network. The present invention relates to an access server (NAS) that performs routing by classifying service subscriber IDs and non-subscriber IDs by checking user IDs for harmful site access blocking services, and authenticates high-speed Internet users and harmful site access blocking service subscriber IDs. It is characterized by consisting of an authentication server performing a function, a router (LNS) performing a routing function of Internet traffic, and a blocking system performing a harmful site access blocking function.

The present invention provides a subscriber with an ID including domain information (eg, user @ child), and then uses a tunneling protocol to classify harmful site access blocking service subscribers and non-subscribers by ID to route traffic to a blocking system for service subscribers. Provide Internet access to harmful sites.

Description

System for harmful site connection interception service using tunneling protocol and service method

The present invention relates to a harmful site access blocking service, and in particular, provides a harmful site access blocking service to users authenticated as service subscribers using a tunneling protocol, and provides a general Internet service to a user who is not. A site access blocking service system and a service method thereof.

1 is a configuration diagram of a conventional harmful site access blocking system, which will be described with reference to the following.

All traffic is routed through the L4 (Layer4) switch 30 in the blocking system, and the high-speed Internet traffic is input to the L4 switch 30 in the blocking system without distinguishing the harmful site access blocking subscriber 20 and the non-subscriber 10. After the subscriber 20 and the non-subscriber 10 are separated, the traffic of the non-subscriber 10 is directly connected to the Internet, and the traffic of the subscriber 20 is blocked according to a rule defined by the L4 switch 30. 40a) and 40b, then filtered and connected to the Internet.

As a result, a lot of load is applied to the L4 switch 30 without distinguishing between the subscriber 20 and the non-subscriber 10 for the blocking service, which may cause a failure.

As such, in the related art, all traffics are concentrated on the L4 switch without distinguishing between the subscriber and the non-subscriber for the blocking service.

The present invention was devised to improve the above-mentioned problems. As a result, the subscriber's traffic can be connected to the Internet and only the traffic of the subscriber can be separated by separating the subscriber's and the subscriber's traffic for the blocking service using the tunneling protocol. The purpose is to provide Internet harmful site access blocking service that is gathered in one place and passed through the blocking system.

1 is a block diagram of a conventional harmful site access blocking system.

Figure 2 is a network diagram of a harmful site access blocking service using the present invention L2TP.

Figure 3 is a flow chart of the harmful site access blocking method of the present invention.

<Description of Major Symbols in Drawing>

10, 100a, 100b: non-subscriber 20, 200a, 200b: subscriber

30, 610: L4 switch 40a, 40b, 610a, 610b: blocking server

300a, 300b: NAS (Network Access Server)

400a, 400b: Certificate Server

500a, 500b: Layer 2 tunneling protocol network server (LNS)

600: blocking system

As a technical configuration for achieving the above object,

The harmful site access blocking service system of the present invention,

It performs authentication function for the access server (NAS) which performs routing by classifying service subscriber ID and non-subscriber ID by checking user ID for harmful site access blocking service, and high speed internet user and harmful site access blocking service subscriber ID. It comprises a authentication server, a router (LNS) for performing the routing function of the Internet traffic, and a blocking system for performing harmful site access blocking function.

The tunneling protocol includes L2TP, and L2TP is driven in an access server (NAS) to operate as an L2TP Access Concentrator (LAC).

The harmful site access blocking service method of the present invention,

Attempting to connect by granting user ID after joining harmful site access blocking service and checking subscriber and non-subscriber ID of harmful site access blocking service if high speed internet user ID is authenticated and internet access is not allowed if not authenticated. For example, if the target ID is blocked, when a harmful site is accessed using an L2TP tunnel, a blocking message is sent to the user.If the target site is not connected, the user can surf the Internet and exit or return to the attempting to access the harmful site. In the case of surfing the Internet, characterized in that it comprises a step comprising terminating.

The blocking target ID is characterized by adding a domain that performs a function of blocking or connecting the connection according to whether or not the content of the site to be accessed by the user is harmful.

Referring to the operation and effect of the present invention made of such a configuration based on the accompanying Figure 2 as follows.

2 is a block diagram of a harmful site access blocking system using the tunneling protocol of the present invention. As shown in FIG. 2, a user ID for a harmful site access blocking service is checked to classify a service subscriber ID and a non-subscriber ID to perform routing. An access server (NAS) 300a and 300b, an authentication server 400a and 400b for performing authentication functions for high-speed Internet users and harmful site access blocking service subscriber IDs, and a router for routing Internet traffic. (LNS) 500a and 500b, and a blocking system 600 that performs a harmful site access blocking function, which will be described with reference to the following.

Each NAS (Network Access Server) 300a (300b) sends traffic of a blocking target ID to a Layer 2 tunneling protocol network server (LNS) 500b through a Layer 2 Tunneling Protocol (L2TP) tunnel, and the LNS 500b. In the routing system 600 performs the routing. Traffic of the non-blocking target ID performs general Internet access via the LNS 500a.

When an Internet access subscriber requests blocking of a harmful site, the ISP (Internet Service Provider) will call the user @ adult (Adult ID) or User @ child (Minor ID or Youth ID) instead of the existing User @ ISP ID. When a subscriber using this ID, User @ child, tries to access the Internet, the access server (NAS) 300a and 300b receives the service subscriber authentication by the authentication server and blocks through the LNS 500b. Routing to the system 600, L2TP tunnel is generated between the NAS (300a) (300b) and the LNS (500b) in this process to route the traffic of the subscriber (200a) (200b).

When the subscribers 200a and 200b using the ID of User @ adult attempt to access the Internet, the access server (NAS) 300a and 300b authenticates the non-subscriber 100a and 100b by the authentication server. Using other L2TP tunnels and LNS (500a), the Internet or general services.

In other words, L2TP (Access Point Access Point (NAS) 300a, 300b located in a Point of Presence (POP) to receive and route subscriber traffic and to aggregate traffic input from the Internet in a Point-to-Point format to the subscriber Layer 2 Tunneling Protocol (LAC) is operated to operate as Layer 2 Tunneling Protocol Access Concentrator (LAC), and there is a router for LNS connected through a tunnel from a Network Access Server (NAS) 300a (300b) operating as the LAC. Become an end device. This termination device is LNS 500a and 500b.

Authentication server (RADIUS) 400a (400b) provides the authentication function for the user ID of the high-speed Internet service use and harmful site access blocking service, the harmful site access blocking system 600 is L4 switch 610 and blocking server 610a and 610b to perform a blocking function.

Apply LAC to NAS and run router as LNS to apply harmful blocking service system to LNS, and to block harmful site access ID after authentication, transfer data using L2TP tunnel between access server and LNS. Adopt.

In addition, the traffic of the harmful site access blocking service subscriber ID is routed to the blocking system using the L2TP tunnel.

3 is a flowchart of a harmful site access blocking service according to the present invention, which will be described below.

The harmful site access blocking service subscriber is given a user ID to which the domain is added (S100 to S110). Blocking access by the authentication server according to whether the subscriber performs PPP (Point to Point Protocol) authentication through the ID without domain information or additional domain information and PPP authentication through the ID with the blocked subscriber's domain information. The subscriber ID and the non-subscriber ID for the service are checked (S120 to S150).

If the user is authenticated as a harmful site access blocking service subscriber, the user is authenticated as a blocking service subscriber and then accesses the blocking system using an L2TP tunnel. Follow. The service subscriber who has passed through the blocking system transmits an access blocking message to the user when the site to be accessed is a harmful site (S160 to S200).

In addition, in the case of the non-blocking target ID (ie, an adult or a service subscriber), internet surfing (ie, internet exploration, that is, internet access) is performed (S210 and S220).

In other words, according to whether or not the content of the site to be accessed by the user of the ID to be blocked, the traffic for each authentication for the ID to which the domain is added to perform the function of blocking or connecting the connection is processed.

As such, the present invention separates the subscriber and the non-subscriber traffic for the blocking service by using the tunneling protocol to directly connect the non-subscriber traffic to the Internet, and collects only the subscriber's traffic into one place to pass through the blocking system.

As described above, the present invention can concentrate the traffic of only harmful site access blocking service subscribers using L2TP protocol, thereby providing harmful site access blocking service to service subscribers and providing general Internet services to users who do not. do.

Claims (5)

NAS (Network Access Server) that checks user ID for harmful site access blocking service and classifies service subscriber ID and non-subscriber ID to perform routing; Authentication server that performs authentication function for non-subscriber ID, Layer 2 tunneling protocol network server (LNS) for routing Internet traffic, In the harmful site access blocking service system using a tunneling protocol, characterized in that it comprises a blocking system for performing a harmful site access blocking function, The tunneling protocol is a harmful site access blocking service system using a tunneling protocol, characterized in that the Layer 2 Tunneling Protocol (L2TP). delete The harmful site access blocking service system according to claim 1, wherein the L2TP is operated on the NAS to operate as an L2TP access concentrator (LAC). Attempting to connect by granting a user ID after joining a harmful site access blocking service, If the high-speed Internet user ID is authenticated, check the harmful site access blocking service subscriber and non-subscriber ID, and if the authentication is not authenticated, internet access is not allowed. In case of the ID to be blocked, sending a blocking message to the user when the harmful site is accessed by using the L2TP tunnel, and if not connected, surfing the Internet and ending the process or returning to the harmful site access step; The harmful site access blocking service method using the tunneling protocol, characterized in that the non-blocking target ID comprises the step of terminating after surfing the Internet. [5] The harmful site access using the tunneling protocol according to claim 4, wherein the blocking target ID is added with a domain that performs a function of blocking or connecting the connection according to whether the content of the site to be accessed by the user is harmful. Block service method.