KR100446816B1 - Network for integrated security management service - Google Patents

Abstract

PURPOSE: An integrated security management service network is provided to promptly and effectively cope with traffic congestion type security threat by actively performing security policy and grasping a security situation of a whole network. CONSTITUTION: An integrated security system is formed of a VPN(Virtual Private Network), an F/W(Fire Wall), an NAT(Network Address Translator), a QoS(Quality of Service), an IDS(Intrusion Detection System), a VS(Virus Scanner), a CF(Contents Filter) and a VR(Virtual Router) to interrupt and manage security threat or traffic. A threat manager server(230) collects and manages system information from systems(290) of a plurality of clients, and collects and manages security threat or traffic information from the integrated security system. A situation managing console(240) grasps the abnormality of a network(210) while managing the threat manager server(230). A data generating server(250) analyzes the abnormality for generating analyzed data. A web server(260) provides an environment for reading the analyzed data. A message transmitting server(270) generates a message related to the abnormality for transmitting the message to the systems(290) of the plurality of clients. A router(280) relays the integrated security system with the systems(290) of the plurality of clients.

Description

Network-based integrated security management service network {NETWORK FOR INTEGRATED SECURITY MANAGEMENT SERVICE}

The present invention relates to an integrated security management service network, and in particular, in a wide area network (WAN), which is a management area of a telecommunications carrier, can integrate security measures for a system of a plurality of customers installed in a local area network (LAN) of an individual company. The present invention relates to a network-based integrated security management service network.

With the development of computers and information and communication technologies and the rapid spread of the Internet, information sharing and exchange through the network is taking place. However, as information progresses, there is a net function of sharing information resources or facilitating real-time transactions, while illegally invading a server or client terminal to destroy information resources by exploiting the possibility of online access through the network. The threat of network security breaches, such as alteration or hacking, is increasing.

Moreover, in recent years, the combination of hacking and virus technology, attacks on networks and services from attacks on individual systems (servers, PCs, etc.) of enterprises or organizations have changed the target of attack, increased intrusions on multimedia contents, and hacked wireless network services. As the hacking and viruses such as emergence tend to be automated, intelligent, popularized, decentralized, large-scaled, and concealed, the number and scale of the damages are increasing.

On the other hand, Figure 1 is a schematic diagram of an individual security management method using a conventional individual security system, each customer system 140 through an individual router 120 and the security system 130, the Internet network or IP-VPN network ( 110). As such, the customer 1 system 141 is installed in the customer 1 security system 131 for the sole responsibility for the security of the customer 1 system 141, the customer 2 system 142 to fully secure the security of the customer 2 system (14). Customer 2 security system 132 to be in charge is installed.

As shown in FIG. 1, the individual security system 130 separately includes a malicious system, a VPN, a firewall, a switch, an intrusion detection system, a QoS, a backbone switch, and a virus scanner to perform a customer-specific security function. .

However, in order to protect the customer's system in this form, companies or organizations that have their own local area network (LAN) need to install and operate various security systems for each function and periodically secure them to cope with the latest infringement technology. The systems must be replaced. In addition, there is a problem in that it is necessary to have a professional security personnel to monitor a 24-hour system while operating the security systems and the ability to establish an optimal security policy.

In addition, even if a company has its own security-related investments and human resources to protect systems from external intrusions in today's communication environment where e-commerce and information exchange is performed in real time through the Internet. If security measures are not taken simultaneously in a wide area network (WAN), which is a management area of the network, and in a network of another service provider that is not directly connected to a customer, there is a limit in dealing with such a security threat individually in an individual enterprise or an organization's local area network.

Accordingly, the present invention has been made to solve the above problems, the communication environment secured from the threat of security breaches by performing integrated security measures for the system of multiple customers installed in the individual local area network in the wide area network that is the management area of the carrier The purpose is to provide a network-based integrated security management service network that can guarantee the security.

In order to achieve the above object, the network-based integrated security management service network according to the present invention provides security for a system of a plurality of customers on a local area network (LAN) connected to a network such as an Internet network or an IP-VPN network. Integrated management in the edge connecting to the (WAN), VPN to build a virtual private network (internal network), F / W to prevent illegal attacks from the outside, and IP address of the internal network By comparing the NAT for blocking external access and strengthening security, the service characteristic for each protocol, and the QoS for efficient use of the line band, and the pattern or traffic change when hacking is attempted, IDS for identification, VS for blocking or blocking virus e-mails spread through attachments of mail, and harmful traffic propagating through the web CF to block the system and VR for accommodating a system of multiple customers but logically divided into individual customer units to provide an integrated security service independent of security application to other customer systems. An integrated security system that blocks and manages security threats or traffic such as hacking or Internet worms on a wide area network or a local area network; A threat manager server that collects and manages system information from a system of a plurality of customers, and collects and manages security threats or traffic information from the integrated security system; A situation management console for identifying anomalies in a network while managing the threat manager server; A data generation server analyzing the abnormality detected by the situation management console to generate analysis data; A web server providing an environment for viewing analysis data generated by the data generation server; A message transmission server which generates a message regarding an abnormality detected by the situation management console and transmits the message to a system of a plurality of customers; And a router relaying the integrated security system and a system of a plurality of customers.

1 is a schematic diagram of an individual security management method using a conventional individual security system,

2 is a schematic diagram of an integrated security management service network using an integrated security system according to the present invention;

3 is a block diagram of an integrated security system according to the present invention;

4 is a block diagram illustrating integrated security management according to the present invention;

5 is a conceptual diagram of a threat management service for blocking cyber attacks according to the present invention;

6 is an embodiment of a web-based portal service according to the present invention.

* Explanation of symbols for main parts of the drawings

210: Internet network / IP VPN network 220: integrated security system

221: VPN 222: F / W

223: NAT 224: QoS

225: IDS 226: VS

227: CE 228: VR

230: Threat Manager Server 240: Situation Management Console

250: data generation server 260: web server

270: message transfer server 280: router

290: Customer System

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

2 is a schematic diagram of an integrated security management service network using an integrated security system according to the present invention, the integrated security system 220, threat manager server 230, situation management console 240, Data generation server 250, web server 260, and message transfer server 270 are connected to system 290 of multiple customers via router 280. Through such a service network, it is possible to integrate and manage security for the system 290 of a plurality of customers located in an internal network using a network service, that is, a local area network (LAN). In this case, the customer 1 system 291, the customer 2 system 292, the customer n system 293, and the like refer to a system of a plurality of customers on a separately constructed local area network (LAN).

The integrated security system 220 is an integrated type that integrates conventional individual security systems, and blocks and manages security threats or traffic such as hacking or Internet worms on a wide area network or a local area network (LAN) on a per-customer basis. Integrate and manage security. As such, one integrated security system 220 may be integrated and managed by providing a logically separate integrated security system to each of the customers as if the customer has a separate security system for the network 290 of multiple customers connected to the network .

The threat manager server 230 collects and manages information about the system, such as logs generated from the system 290 of multiple customers, and collects and manages security threats or traffic information from the integrated security system 220.

In addition, the situation management console 240 manages the threat manager server 230 to identify anomalies in the network using security threats or traffic information, and the data generation server 250 may manage the situation management console 240. Analyze the anomalies identified in the and generate analysis data to provide to the customer.

The web server 260 provides an environment for viewing the analysis data generated by the data generation server 250 through the account provided by the customer, the message transmission server 270 in the situation management console 240 A message, such as an e-mail or SMS, is generated and transmitted to the system 290 of a plurality of customers. The router 280 relays between the integrated security system 220 and the system 290 of multiple customers to provide an optimal path.

3 is a block diagram of an integrated security system in accordance with the present invention, VPN 221, F / W 222, NAT 223, QoS 224, IDS 225, VS 226, CE 227 ), And VR 228 and the like. The integrated security system 220 can effectively grasp the overall security situation by integrating and operating individual systems having various security functions into one.

Referring to FIG. 3, the VPN 221 is a module for establishing a virtual private network and may build a private network using a public network. At this time, the VPN 221 can be applied to companies that only want to access the Internet. The F / W 222 may block an illegal attack from the outside based on a security policy as an intrusion prevention system such as a firewall.

NAT 223 is an address translator (Network Address Translator) to convert the IP address of the internal network to block the connection from the outside to enhance the security while reducing the waste of the internal address. In addition, the QoS 224 relates to a quality of service and defines a service characteristic for each protocol to efficiently use a line band.

IDS 225 is an intrusion detection system (Intrusion Detection System) when the hacking attempts from the external network or the internal network can compare the pattern or the change of traffic, etc. to identify abnormal signs. In addition, the VS 226 may block a virus mail propagated through an attachment file of a mail or a spam mail as a virus scanner.

The CF 227 may block harmful traffic such as Codered, Nimda, or the like that propagates through the web as a content filter. In addition, VR 228 is a virtual router (Virtual Router) to accommodate the system of the multiple customers 290 to provide an integrated security function, through the logical division of individual customer units independent of the application of security to other customer systems May be provided to the system 290 of a particular customer.

4 is a block diagram illustrating integrated security management according to the present invention, in which each element interoperates to provide an integrated security service.

As shown in FIG. 4, the threat manager server 230 collects system information from the customer system 290 while operating a separate slave server 231 in preparation for a failure, and is generated from the integrated security system 220. The security event is collected and stored in the interworking database 232. That is, it checks whether the customer system 290 is Windows or Unix based on TCP / IP information, and collects event information about the customer system 290 using communication protocols such as UDP / IP, SNMP, SYSLOG, and the like. Check security threats and traffic information.

The context management console 240 may identify an abnormality through security event information such as security threats or traffic collected in the threat manager server 230. At this time, the situation management console 240 monitors the security threats or traffic information collected through the VPN, F / W, IDS, VS, and CF in real time, and then monitors the risk of the customer system 290 You can alert your customers by classifying them. In addition, after analyzing the various monitored information, the risk may be comprehensively calculated according to the asset value of the customer system 290 to identify an abnormality of the network according to the risk status of the customer system 290.

In other words, anomalies are identified by determining whether the collected threats are in fact meaningful to the customer's system. For example, if the customer system 290 is a Windows-based system, the risk is calculated after determining whether the collected security event is fatal to the Windows system. Therefore, even if threat information is collected, if the threat is meaningless to the customer's system, the risk is calculated to be low, so that it can respond appropriately.

The message transmission server 270 may transmit an alert mail or a text message informing the operator or the customer that an abnormality has occurred. The data generation server 250 may collect and process data necessary for reporting from the database 232, and the web server 260 may view the processed report through the data generation server 250 in a format desired by the customer. Provide an environment.

5 is a conceptual diagram of a threat management service for cyber attack blocking according to the present invention, and shows correlations between elements.

Event analysis and management item collects traffic and event information from network and integrated security system to analyze and manage anomalies or statistical information of events. Vulnerability information management items collect the latest security information trends such as hacking and viruses, and collect and manage patch information related to vulnerabilities.

On the other hand, the incident management item responds to similar incidents while receiving infringement incidents from customers or managing the incident information through a black list. Security history management item collects and manages security information such as OS, process, etc. of customer system, and generates vulnerability report for each customer system using vulnerability information and provides it to corresponding customer. For example, the alarm management item provides various alarm information generated from threat management to customers in the form of e-mail or short message.

6 is a web-based portal service embodiment according to the present invention, which shows a service that can be provided to a customer through a web-based portal.

When a request for a setting regarding a security policy or a preliminary warning policy is received from a customer, the operator reviews and reflects it. When the customer requests system information or network scan to check whether there is a vulnerability, the operator checks whether the system is vulnerable and generates a report on the result and response method and provides it to the customer.

It analyzes the events and vulnerabilities collected from the integrated security system and monitors the threat of the customer system in real time. If a threat occurs, provide a mail or short message to the customer or operator immediately to prepare for the threat. The customer can be provided with a report based on the collected event or traffic information, and can also access the latest security information.

As described above, the network-based integrated security management service network does not end with implementing various security functions in a single integrated system form, but has a separate system for securing the security measures for the systems of several customers in one system. Logically separate and perform independently, and comprehensively analyze correlations between individual security breaches to understand the overall security status of the network and proactively detect and manage harmful traffic flowing through the service provider's network. Security measures can be performed. As a result, it can respond quickly and effectively to traffic congestion threats that paralyze network infrastructure or services.

Claims (3)

Security of multiple customers' systems on a local area network (LAN) connected to a network such as an Internet network or an IP-VPN network is integratedly managed in an edge connected to a wide area network (WAN). VPN to build a virtual private network (internal network), F / W to prevent illegal attacks from outside, NAT to block external access and strengthen security by translating IP address of internal network, protocol QoS to use line band efficiently by defining service characteristics by each service, IDS to identify abnormality by comparing pattern or traffic change when hacking is attempted, and virus mail spread through email attachment VS for blocking or blocking spam mail, CF for blocking harmful traffic spreading through the web, and a system of multiple customers, but logically divided into individual customer units, VR is integrated to provide integrated security service independently, and hacking on wide area network or local area network by individual customer And integrated security systems that perform the isolation and management of security threats and Internet traffic such as worms; A threat manager server that collects and manages system information from a system of a plurality of customers, and collects and manages security threats or traffic information from the integrated security system; A situation management console for identifying anomalies in a network while managing the threat manager server; A data generation server analyzing the abnormality detected by the situation management console to generate analysis data; A web server providing an environment for viewing analysis data generated by the data generation server; A message transmission server which generates a message regarding an abnormality detected by the situation management console and transmits the message to a system of a plurality of customers; And Network-based integrated security management service network comprising a router for relaying the integrated security system and the system of a plurality of customers. delete The situation management console of claim 1, Real-time monitoring of security threats or traffic information collected through the VPN, F / W, IDS, VS, and CF, and alerting the customer by classifying the risks of the customer's system, and mutually analyzing various monitored information Then, the network-based integrated security management service network, characterized in that to determine the risk of the network according to the risk status of the customer system by comprehensively calculating the risk according to the asset value of the customer system.