KR100445549B1 - Apparatus for active Test Access Port - Google Patents

Abstract

PURPOSE: An active TAP(Test Access Port) device is provided to mirror traffic of a network to transmit the mirrored traffic to a monitoring device and freely set up a communication path including the network and the monitoring device. CONSTITUTION: The first switching unit(46) selects one of a signal received from the second network(12) and a signal received from monitoring devices(31,32) to transmit the selected signal to the first network(11). The second switching unit(47) selects one of a signal received from the first network(11) and a signal received from the monitoring devices(31,32) to transmit the selected signal to the second network(12). A control unit(48) controls switching operation of the first switching unit(46) and the second switching unit(47) to connect the first network(11) or second network(12) with each other through the monitoring devices(31,32), or directly.

Description

Active TAP Device {Apparatus for active Test Access Port}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an active TAP device, and in particular, a TAP (Test) capable of actively controlling a network by setting a communication path according to each situation occurring in a network, such as whether power is normally supplied, a user setting state, a network or a traffic state. Access Port) device.

With the development of internet and network technology, it brings much convenience to real life. However, there are various side effects, such as hacking a specific device or an excessive traffic generation attack by an unspecified number. Accordingly, network security has emerged as a very important problem, and a firewall or an intrusion detection system (IDS) is used for network security.

Referring to FIG. 1, the monitoring device 30 such as IDS port-mirrors traffic on a communication path through a TAP device 20 located on a communication path between a first network 11 and a second network 12. Monitor traffic conditions. Here, the first network 11 and the second network 12 means any network (for example, an internet network and an intranet network) connected to each other. Port mirroring is a traffic forwarding technology mainly used in a switch, and is a method of exporting a specific port on a switch to a monitoring port.

Referring to FIG. 2, a conventional passive TAP device 20 used to mirror traffic on a communication path to a monitoring device includes a first network 11, a second network 12, and monitoring devices 31 and 32. Ports 21 to 24 are respectively provided for connecting. The monitoring device 30 monitors the equipment 31 for monitoring the traffic flowing from the first network 11 to the second network 12 and the traffic flowing from the second network 12 to the first network 11. It can be divided into the equipment 32 to be configured, but can be configured arbitrarily according to the convenience of use.

Traffic received from the first network 11 through the port 1 21 is transferred to the second network 12 through the port 2 22 through the amplifier 25 and simultaneously monitored through the port 3 23. Delivered to equipment A (31). In addition, the traffic received from the second network 12 through the port 2 (22) is transmitted to the first network 11 through the port 1 (21) via the amplifier 25 and at the same time the port 4 (24) Is transmitted to the monitoring equipment B (32). Here, the amplifier 25 is used to reinforce the signal attenuation generated when the same signal is divided into two.

This conventional passive TAP device 20 can only monitor traffic flowing on the communication path. Therefore, there is a problem in that active network control such as blocking a network or changing a communication path according to a traffic state or a network state is impossible.

Accordingly, the present invention has been proposed to solve the above problems, the active TAP device that can actively control the network according to each situation occurring in the network, such as whether the power supply is normal, user settings, network or traffic conditions The purpose is to provide.

In order to achieve the above object, the active TAP device according to the present invention, the first switching unit for selecting one of the signal received from the second network and the signal received from the monitoring equipment to transmit to the first network; ; A second switching unit which selects one of a signal received from the first network and a signal received from the monitoring device and transmits the selected signal to the second network; And a controller configured to control a switching operation of the first switching unit and the second switching unit so that the first network and the second network are connected or directly connected through the monitoring equipment.

The controller is configured to periodically receive an alive signal from the monitoring device, and to control the first switching unit and the second switching unit in a specific mode according to whether the alive signal is normally received. Actively cope with normal operation. The alive signal may be preferably configured by using a signal generated by a watchdog timer.

In addition, when the power is cut off, the controller may control the first switching unit and the second switching unit in a predetermined specific mode to actively cope with normal operation of the TAP device itself.

1 is an overview of the installation of the monitoring equipment,

2 is a configuration of a conventional TAP device;

3 is a preferred embodiment of an active TAP device according to the present invention;

4 is a specific application example of an active TAP device according to the present invention;

5 is a flowchart for setting a communication path for each mode;

6 is a communication path in a power off state,

7 is a communication path in the TAP mode,

8 illustrates a communication path in the In-Line mode.

* Explanation of symbols for main parts of the drawings

11,12: network 20: TAP device

21-24: Port 25: Amplifier

30,31,32: monitoring equipment 41 ~ 44: port

45: amplifier 46,47: switching unit

48: control unit 51: adapter

52: USB port 53: Communication port

54: mode setting switch

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 3, the active TAP device according to the present invention includes a first switching unit 46 and a second switching unit 47. The controller 48 controls each of the switching units 46 and 47 to establish a communication path connected to each of the networks 11 and 12. Here, the monitoring equipment A 31 is a device for monitoring the traffic flowing from the first network 11 to the second network 12, the monitoring equipment B 32 is the first network 11 from the second network 12 Assume that it is a device that monitors the traffic flowing through).

The first switching unit 46 selects one of a signal received from the second network 12 through the port 2 42 and a signal received from the monitoring equipment A 31 and the first through the port 1 41. Transfer to the network (11).

The second switching unit 47 selects one of a signal received from the first network 11 through the port 1 41 and a signal received from the monitoring device B 32 and the second through the port 2 42. Forward to the network 12.

The role of each amplifier 45 is used to reinforce the signal attenuation generated when dividing the same signal into two as described in FIG.

In addition, the controller 48 controls the switching operation of the first switching unit 46 and the second switching unit 47 so that the first network 11 and the second network 12 are connected to the monitoring equipment 31, 32. To be connected via direct or direct).

For example, the control unit 48 controls the first switching unit 46 to pass a signal received from the second network 12 through the port 2 42 to the port 1 41 and also to the second. If the switching unit 47 is controlled to pass a signal received from the first network 11 through the port 1 41 to the port 2 42, the first network 11 and the second network 12 are transmitted. Is directly connected.

Meanwhile, the controller 48 controls the first switching unit 46 to pass the signal received from the monitoring equipment A 31 through the port 3 43 to the port 1 41 and the second switching unit. (47) controls the first network 11 and the second network 12 to pass the signal received from the monitoring equipment B (32) through port 4 (44) to port 2 (42). The connection is made via the monitoring equipment 31, 32. That is, a communication path via the monitoring equipment 31, 32 is formed.

Looking at the communication path at this time, the traffic received through the first network 11 is port 1 (41), amplification unit 45, port 3 (43), monitoring equipment A (31), monitoring equipment B (32) ), The port 4 (44), the second switching unit 47, and the port 2 (42) are transmitted to the second network 12. In addition, the traffic received through the second network 12 is port 2 (42), amplifier (45), port 4 (44), monitoring equipment B (32), monitoring equipment A (31), port 3 (43). ), It is transmitted to the first network 11 via the first switching unit 46 and the port 1 41.

Each of the switching units 46 and 47 described above may be preferably implemented using a relay element. At this time, the control unit 48 applies a constant relay control signal to each relay element to establish a connection relationship between the input terminal and the output terminal.

A detailed embodiment of configuring an active TAP device according to the present invention will now be described with reference to FIG. 4.

The power required for the operation of the active TAP device according to the present invention is supplied from a power adapter 51 for rectifying and supplying external AC power or via a USB (Universal Serial Bus) port 52 between the monitoring device 30. Can be supplied. Of course, it can also be powered by any device that employs a standard USB port. In this case, it is preferable that the user selects which method is to be supplied with power.

The active TAP device according to the present invention may be configured to include a mode setting switch 54 for allowing a user to directly set certain items such as a power supply method or an operation mode.

In addition, the communication device receives the various control signals while communicating with the monitoring equipment 30 through the constant communication port 53 which can communicate with each other according to a certain communication protocol such as RS-232C, and sets an operation mode according to the control signal. It can also be configured to.

In a preferred embodiment under the control of the monitoring device 30, a predetermined Alive signal is periodically input from the monitoring device 30, and the first switching unit 46 depends on whether the alive signal is normally received. ) And the second switching unit 47 to be controlled in a specific mode. Such an alive signal can be preferably implemented by being configured to be generated by a watchdog timer.

As an example, when an abnormality occurs in the monitoring equipment 30, since the alive signal will not be transmitted to the active TAP device according to the present invention, the controller 48 controls the respective switching units 46 and 47 to control the first signal. The network 11 and the second network 12 may be processed to be directly connected regardless of the monitoring device 30.

In addition, in addition to the live signal periodically transmitted from the monitoring equipment 30, the controller 48 may turn off the power or when the user sets the mode setting switch 54 to operate in a specific mode, the first switching unit ( 46 and the second switching unit 47 may be configured to control the predetermined mode.

5, an example of an operation of an active TAP device according to the present invention will be described.

In a state where the active TAP device is powered off (S61), the controller 48 first and second networks 11 and 2 through the port 1 41 and the port 2 42 as shown in FIG. Only the connection of 12 is allowed to operate normally (S62).

However, when the power supply is normally performed, the user manually sets the mode setting switch 54 to the TAP mode, or when the TAP mode setting instruction is issued from the monitoring device 30, or depending on a program installed in the TAP device. If set (S63), the first network 11 and the second network 12 are normally connected via the port 1 (41) and the port 2 (42), as shown in the example shown in FIG. Traffic flowing through the 41 and the port 2 42 is transmitted to the monitoring device 30 through the port 3 (43) and the port 4 (44) (S64).

On the other hand, when the power supply is normally performed, the user manually sets the mode setting switch 54 to the in-line mode, or when the in-line mode setting instruction is given from the monitoring device 30 or the program installed in the TAP device. In the case of being set to the in-line mode (S65), the first network 11 and the second network 12 are connected to each other via the monitoring equipment 30 as shown in FIG. 8.

The above-described embodiments are intended to help the understanding of the present invention, and the present invention is not limited to the above-described embodiments and can be variously modified and implemented by those skilled in the art without departing from the technical spirit of the present invention. to be.

According to the present invention, not only the traffic flowing on the network can be mirrored and transmitted to the monitoring device, but also the communication path including the network and the monitoring device can be freely set. As a result, it can proactively cope with the network or traffic conditions, and can be effectively used for various security and measurement equipment such as intrusion detection system (IDS), network analyzer (Analyzer), RMON, and DDoS solution.

Claims (7)

In the TAP (Test Access Port) device that delivers traffic flowing through the communication path between the first network and the second network to a certain monitoring device, the monitoring device to monitor the traffic on the communication path, A first switching unit which selects one of a signal received from the second network and a signal received from the monitoring device and transmits the selected signal to the first network; A second switching unit which selects one of a signal received from the first network and a signal received from the monitoring device and transmits the selected signal to the second network; And And a controller configured to control a switching operation of the first switching unit and the second switching unit so that the first network and the second network are connected or directly connected through the monitoring equipment. The method of claim 1, The first switching unit and the second switching unit active TAP device, characterized in that it comprises a relay. The method of claim 1, The control unit periodically receives an alive signal from the monitoring equipment and controls the first switching unit and the second switching unit in a specific mode according to whether the alive signal is normally received. Device. The method of claim 3, wherein The alive signal is an active TAP device, characterized in that the signal generated by a watchdog timer (WatchDog Timer). The method of claim 1, The controller controls the first switching unit and the second switching unit in a predetermined mode when the power is cut off. The method of claim 5, wherein The power supply is an active TAP device, characterized in that configured to be supplied from a power adapter for rectifying and supplying external AC power and a universal serial bus (USB) port of the monitoring equipment. The method of claim 1, It includes a mode setting switch for setting the operation mode directly by the user, The controller controls the first switching unit and the second switching unit in the corresponding mode according to the state of the mode setting switch.