KR100464487B1 - Apparatus and method for security through packet check in ADSL modem - Google Patents

Abstract

The present invention provides a security apparatus and method for inspecting a packet of an ADSL modem, comprising: a destination IP obtaining unit for obtaining a destination IP of a packet output from a PC in a subscriber's home; An input packet filtering unit for passing a packet only for an IP registered in the IP table control unit and a specific protocol; An IP table control unit which manages an IP database to be passed using the IP obtained from the destination IP acquisition unit and the source IP obtained by the input packet filtering unit, thereby separately installing a new protocol or program on the PC in the subscriber's home. If you do not load the ADSL modem, you can effectively secure the Internet.

Description

Apparatus and method for security through packet check in ADSL modem}

The present invention relates to an ADSL modem, and in particular, security through packet inspection of an ADSL modem, which is suitable for effectively performing Internet security without putting a load on the ADSL modem without installing a new protocol or program separately in the subscriber's home PC. An apparatus and a method thereof are provided.

In general, Asymmetric Digital Subscriber Line (ADSL) uses existing two-wire subscriber line to communicate (asymmetric) at 1.5 Mbps (or 6 Mbps) from the telephone company to the home and 16 Kbps (or 1 Mbps) from the home to the telephone company. Say technology that can realize.

The above-mentioned technology uses the same telephone line as the existing telephone line and uses two existing voice line telephone lines and one basic speed interface of ISDN (Integrated Services Digital Network), which enables high-speed data communication (2B +). D) can be accommodated.

ADSL is used for VDT (Video Dial Tone) service, which is a video transmission service of a local telephone company, which uses subscriber ADV technology and digital video compression technology MPEG 1 (1.5Mbps) to provide subscribers with CATV. It is to provide a video on demand (VOD) that can call and watch a desired movie from a video server such as a station.

This ADSL technology is proposed by the US Bell Core, which effectively uses a bandwidth of 400KHz in the higher frequency range than voice. For this reason, the transmission distance from the telephone station is limited, and it is known that the limit is about 5.5 km in 1.5 Mbps transmission and about 1.8 km in 6 Mbps transmission.

Thus, the conventional bridge type ADSL modem is connected to the Internet network and the subscriber's home PC without any Internet security method.

1 is a block diagram showing a network connection of a conventional ADSL modem.

Where reference numeral 10 is an Asynchronous Transfer Mode (ATM) network, 20 is an access node that is a switch, 30 is an ADSL Terminal Unit Central Office Receive Unit (ATU-R), and 40 is a subscriber premises Is the PC.

Conventional bridge-type ADSL modems reassemble ATM Adaptation Layer 5 (AAL5) ATM cells from DSL (Digital Subscriber Line) multiplexers into Ethernet packets and reconfigure them into Ethernet packets. And transmits the Ethernet packet from the subscriber's premises PC 40 to the AAL5 ATM Cell and transmits it to DSL_MUX.

2 is a diagram illustrating the operation of AAL5 segmentation and reassembly (SAR) of a conventional ADSL modem.

However, since the conventional bridge type ADSL modem has only been primarily connected to the Internet network to transmit data, there is no way to prevent external access from subscribers.

Accordingly, the present invention has been proposed to solve the above-mentioned conventional problems, and an object of the present invention is to effectively secure the Internet without putting a load on the ADSL modem without separately installing a new protocol or program in the subscriber's home PC. The present invention provides a security apparatus and method through packet inspection of an ADSL modem.

In order to achieve the above object, a security apparatus through packet inspection of an ADSL modem according to an embodiment of the present invention,

An ADSL modem, comprising: a destination IP acquisition unit for acquiring a destination IP of a packet output from a personal computer in a subscriber's home, and then registering the destination IP in an IP table of an IP table control unit; An input packet filtering unit for passing a packet only for the destination IP and a specific protocol registered in the IP table control unit; And an IP table control unit for managing an IP database to be passed using the IP obtained by the destination IP acquisition unit and the source IP acquired by the input packet filtering unit.

In order to achieve the above object, the security method through packet inspection of an ADSL modem according to an embodiment of the present invention, in the ADSL modem , acquires the destination IP of the packet output from the PC of the subscriber's home and registers it in the IP table. a first step of the; Performing a filtering on the destination IP and a specific protocol registered in the IP table to pass only a specific packet; And a third step of controlling the security check through packet inspection by managing an IP table storing the acquired destination IP and IP and protocol information of a specific packet passed.

1 is a block diagram showing a network connection of a conventional ADSL modem,

2 is a view showing the operation of the AAL5 SAR of the conventional ADSL modem,

3 is a block diagram of a security device through packet inspection of an ADSL modem according to the present invention;

4 is a flowchart illustrating a security method through packet inspection of an ADSL modem according to the present invention;

FIG. 5 is a detailed flowchart of the first step in FIG. 4;

6 is a detailed flowchart of the second step in FIG.

7 is a detailed flowchart of the third step in FIG.

Explanation of symbols on the main parts of the drawings

10: ATM network 20: access node

30: ATU-R 31: destination IP acquisition unit

32: input packet filtering unit 33: IP table control unit

40: PC

Hereinafter, an embodiment according to the present invention as described above, according to the technical spirit of the security device and method through the packet inspection of the ADSL modem will be described with reference to the drawings.

3 is a block diagram of a security device through packet inspection of an ADSL modem according to the present invention.

As shown here, an ADSL modem, comprising: a destination IP acquisition unit 31 for acquiring a destination IP (Internet Protocol) of a packet output from a PC (40) in a subscriber's home; An input packet filtering unit 32 for passing a packet only for an IP registered in the IP table control unit 33 and a specific protocol; And an IP table control unit 33 which manages an IP database to be passed using the IP obtained by the destination IP acquisition unit 31 and the destination IP acquired by the input packet filtering unit 32.

In the above, the destination IP acquisition unit 31 acquires the destination IP of the Ethernet packet from the subscriber premises side, and registers the acquired destination IP in the IP table of the IP table control unit 33.

In the above, the input packet filtering unit 32 obtains the source IP and the protocol type from the input packet on the ADSL line side, and compares the condition with the IP and protocol obtained with the IP and protocol of the IP table control unit 33. If not satisfied, discard the packet.

In the above, the IP table control unit 33 removes, from the registration of the IP table, the IP which is not acquired from the destination IP acquisition unit 31 again for a predetermined time among the IPs registered in the IP table, and the user's arbitrary setting or ADSL. Register or remove an IP according to a command from an ATM cell on the line side.

4 is a flowchart illustrating a security method through packet inspection of an ADSL modem according to the present invention.

As shown here, an ADSL modem comprising: a first step (ST10) of acquiring a destination IP of a packet output from a PC (40) in a subscriber's premises; A second step (ST20) of performing filtering on a specific protocol and an IP registered in the IP table to pass only a specific packet; And a third step (ST30) of controlling the security check through packet inspection by managing an IP table storing the acquired IP and IP and protocol information of a specific packet passed.

FIG. 5 is a detailed flowchart of the first step in FIG. 4.

As shown therein, obtaining the destination IP of the Ethernet packet from the subscriber premises side (ST11); And registering the acquired destination IP in the IP table of the IP table control unit 33 (ST12).

6 is a detailed flowchart of the second step in FIG.

As shown therein, a step (ST21) of obtaining a source IP and a protocol type from an input packet on the ADSL line side; Comparing the obtained IP and protocol information with the IP and protocol of the IP table control unit 33 to determine whether the corresponding condition is satisfied (ST22) (ST23); Executing the condition so that the Internet connection through the ADSL modem is maintained if the corresponding condition is satisfied (ST23); If the corresponding condition is not satisfied, the method includes discarding the packet (ST25).

7 is a detailed flowchart of the third step in FIG.

As shown therein, steps (ST31) (ST32) of registering the acquired destination IP in the IP table and determining whether any of the registered IPs have not been acquired again for a predetermined time; If any of the registered IPs have not been acquired again for a predetermined time, removing the corresponding IPs from the registration of the IP table and determining whether there is a registration / removal command of the IPs (ST33) (ST34); If there is a registration / removal command of the IP, a step of registering or removing the IP (ST35) is performed.

Operation of the security device and the method through the packet inspection of the ADSL modem according to the present invention configured as described above will be described in detail with reference to the accompanying drawings.

First, the present invention is to perform the Internet security through packet inspection in the ADSL modem.

Therefore, the basic operation is the same as the conventional bridge type ADSL modem, but the IP address of the modem is searched for and disconnected from the IP not connected to the subscriber.

In addition, the present invention includes a destination IP acquisition unit 31, an input packet filtering unit 32, and an IP table control unit 33 in the ATU-R.

The destination IP acquisition unit 31 acquires the destination IP of the packet output from the PC 40 in the subscriber's premises.

The input packet filtering unit 32 passes the packet only for the IP registered in the IP table control unit 33 and a specific protocol.

The IP table control unit 33 manages the IP database to be passed using the IP acquired by the destination IP acquisition unit 31 and the destination IP acquired by the input packet filtering unit 32.

Referring to the operation of the present invention in more detail as follows.

First, the destination IP acquisition unit 31 acquires the destination IP of the Ethernet packet from the subscriber premises side. The acquired destination IP is also registered in the IP table of the IP table control unit 33.

The input packet filtering unit 32 obtains the source IP and the protocol type from the input packet on the ADSL line side. In addition, the packet is discarded when the corresponding condition is not satisfied, compared with the IP and protocol obtained by the IP table control unit 33 and the IP and protocol.

The IP table control unit 33 removes, from the registration of the IP table, the IP which is not acquired from the destination IP acquisition unit 31 again for a predetermined time among the IPs registered in the IP table. It also registers or removes IP according to user's arbitrary setting or command from ATM cell on ADSL line side.

As described above, the present invention effectively performs Internet security without installing a new protocol or program on the subscriber's home PC without putting a load on the ADSL modem.

Although the preferred embodiment of the present invention has been described above, the present invention may use various changes, modifications, and equivalents. It is clear that the present invention can be applied in the same manner by appropriately modifying the above embodiments. Accordingly, the above description does not limit the scope of the invention as defined by the limitations of the following claims.

As described above, the security device and the method through the packet inspection of the ADSL modem according to the present invention effectively performs Internet security without putting a load on the ADSL modem without installing a new protocol or program separately in the subscriber's home PC It will work.

Claims (8)

In the ADSL modem, A destination IP acquisition unit for acquiring the destination IP of the packet output from the PC in the subscriber's home and registering it in the IP table of the IP table control unit; An input packet filtering unit for passing a packet only for the destination IP and a specific protocol registered in the IP table control unit; And an IP table control unit configured to manage an IP database to be passed using the IP obtained by the destination IP acquisition unit and the source IP obtained by the input packet filtering unit. delete The method of claim 1, wherein the input packet filtering unit, Characterized in that the source IP and the protocol type are acquired from the input packet on the ADSL line side, and the packet is discarded if the corresponding condition is not satisfied compared with the obtained IP and protocol of the destination IP and protocol of the IP table controller. Security device through packet inspection of modem. The method of claim 1, wherein the IP table control unit, Among the IPs registered in the IP table, the IP which is not acquired from the destination IP acquisition unit again for a predetermined time is removed from the registration of the IP table, and the IP is registered according to a user's arbitrary setting or an instruction from an ATM cell on the ADSL line side. Or removing the security device through packet inspection of an ADSL modem. In the ADSL modem, A first step of acquiring a destination IP of a packet output from a PC in the subscriber's home and registering it in an IP table ; Performing a filtering on the destination IP and a specific protocol registered in the IP table to pass only a specific packet; And a third step of controlling the security check through packet inspection by managing an IP table storing the acquired destination IP , IP and protocol information of a specific packet passed. Security method through inspection. delete The method of claim 5, wherein the second step, Obtaining a source IP and a protocol type from an input packet on the ADSL line side; Comparing the obtained source IP and protocol information with a destination IP and a protocol of the IP table controller to determine whether a corresponding condition is satisfied; If the corresponding condition is satisfied, executing the condition so that the Internet connection through the ADSL modem is continued; If the corresponding condition is not satisfied, discarding the packet, including the step of performing a security check through the packet inspection of the ADSL modem. The method of claim 5, wherein the third step, Registering the acquired destination IP in an IP table, and determining whether any of the registered IPs has not been acquired again for a predetermined time; If there is an IP which has not been acquired again for a predetermined time among the registered IPs, removing the corresponding IP from the registration of the IP table and determining whether there is a registration / removal command of the IP; If there is a registration / removal command of the IP, the security method through the packet inspection of the ADSL modem, comprising the step of registering or removing the IP.