KR100471636B1 - system for processing a packet on a network of computer systems using a multi-bridge mode - Google Patents

Abstract

According to the present invention, the cable does not exceed the capacity caused by the sniffing mode by introducing a bridge method, and the possibility of harmful packet forwarding is made to 0%, the existing network can be used as it is, and multiple bridges can be constructed. In this case, a packet processing system in a network using a bridge method that can perform a load balancing function can be processed in parallel by processing a packet method that was processed serially in a sniffing mode.

The packet processing system is a packet on a network in which communication is performed between a plurality of user systems 17 including a communication device for data communication and a plurality of servers 12 connected to a hub 11 and forming an internal network. In a processing system, connected via a bridge of a receiving side NIC 21 and a transmitting side NIC 26 to receive and transmit network traffic from inside and outside in parallel before and after the hub 11 connecting the internal network. Among the packets flowing in from the NIC 21, the packet that has not already been created is examined according to the policy decision algorithm to check whether the packet is harmful and block if it is harmful, and if it is not harmful, the sending NIC 26 is blocked. It is characterized in that it comprises a CPU 23 and the memory means 22 to flow through the flow into the internal network.

Description

System for processing a packet on a network of computer systems using a multi-bridge mode}

The present invention relates to a packet processing system on a network using a multi-bridge method, and more particularly, the cable over-capacity phenomenon occurred in the sniffing mode by introducing a bridge method does not occur, and the possibility of harmful packet transmission is reduced to 0%. In addition, the existing network can be used as it is, and when multiple bridges are constructed, the bridges that can perform load balancing functions can be performed by processing the packet method that was processed serially in the sniffing mode in parallel. It relates to a packet processing system on a network using the scheme.

Regardless of the product performance of the IDS (Intrusion Detection System) commonly used today, in order to detect or prevent intrusion, it is possible to intercept or copy all the floating packets of the network to be managed. Have been called sniffing). Existing IDS uses a method such as port mirroring or a dummy hub of the switch for this function, and determines whether or not it is a harmful packet for a packet obtained by sniffing and makes a policy. .

The structure of a conventional sniffer type NIDS is shown in FIG. In FIG. 1, the internal network is not only established between the servers 12 via the hub 11, but also connected to the network 10 for communication with the outside via the hub 11, and the user system 17. Is connected to the network 10 for communication via a communication device such as a hub 16. In addition, the network intrusion detection system 13 is connected to the hub 11 to detect intrusion from the outside. In the case of network NIDS, intrusion is mainly detected through network packet. In the case of host-based IDS, intrusion is mainly detected through system log or audit log. Reading logs is a way of checking for events that have already occurred, which is far from the concept of real time, and when the amount of logs is large, it requires a lot of system resources and detection time for analysis.

In addition, this method has the following obvious limitations in a network with a large amount of packet usage. In the sniffing method used in the current IDS, as shown in FIG. 2, as shown in FIG. 2, all flowing packets are serially transmitted through one physical cable. For example, if there are n servers that process packets at a flow rate of m (bit / s), the flow rate of mn (bit / s) is transmitted serially on one cable. However, the allowance for CAT5, the most widely used network cable at present, is 100mbps, as it is known.If a packet exceeds this allowance, packet delay occurs or packet loss occurs when the delay becomes serious. It can be extended to a situation of loss, and more serious situation may require watching the harmful packet pass through to the serving server without any policy about harmful packet.

Therefore, there is a need for a change in the packet collection scheme in order to solve the problem of the IDS of the sniffing scheme. In other words, beyond the stereotype that IDS can only be implemented in Promiscuous mode, it introduces such a non-trivial way of bridge, so that the cable overcapacity occurred in sniffing mode does not occur. In this case, 0% chance of harmful packet forwarding is made, and existing network can be used as it is.If multiple bridges are established, the packet method that was processed serially in the sniffing mode can be processed in parallel. SUMMARY OF THE INVENTION An object of the present invention is to provide a packet processing system on a network using a bridge method that can also perform load balancing.

A packet processing system on a network using such a bridge method does not require logical setting work such as assigning an IP address because it only needs to be slipped on an upper line of systems to be managed in an already constructed network layout.

A packet processing system on a network using a bridge method for achieving the above object of the present invention is a communication between a plurality of user systems including a communication device for data communication and a plurality of servers constituting an internal network connected to a hub. In a packet processing system on a network comprising: a bridge connected to a receiving side NIC and a transmitting side NIC to receive and transmit network traffic from inside or outside before and after a hub connecting the internal network, the receiving side NIC or The packet that has not already been created from the packet from the sending NIC checks for harmful packets according to the decision-making algorithm. If the packet is harmful, the packet is blocked. If the packet is not harmful, the packet is sent through the sending NIC or the receiving NIC. CPUs and memory that leak out into the network It characterized in that it comprises a means.

In this case, in the present invention, the CPU, the memory means, the receiving NIC, and the transmitting NIC constitute a network intrusion prevention system, and the database of the network intrusion prevention system is based on a policy decision algorithm for determining whether a packet is harmful. An intrusion pattern database constructed to be queried by the network; and in the case of the multi-bridge in which the receiving NIC and the transmitting NIC are formed of a plurality of bridges, network traffic from the inside or the outside is transmitted and received in parallel, and parallel processing is performed. Load balancing is preferably achieved by distributing the load between the multi-bridges of the receiving NIC and transmitting NIC.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

3 is a block diagram showing the configuration of a packet processing system on a network using a multi-bridge method according to an embodiment of the present invention. An example of the configuration of the NIPS of FIG. 3 is shown.

In FIG. 3, the network 10 includes a hub 11 to which a plurality of user systems 17 are connected via a communication device such as a hub 16, and to which a plurality of servers 12 providing a service are connected. It is connected to the network 10 via the network intrusion prevention system 20.

Traffic packets from the network 10 are configured to be transmitted and received in parallel to the network intrusion prevention system 20 as shown in FIG. Therefore, the packet collection method is performed in parallel.

An example of a specific configuration of the network intrusion prevention system 20 is, as shown in FIG. 5, each having a receiving side NIC 21 and a transmitting side NIC 26 having a plurality of bridges, and receiving received packets. Memory means 22, such as RAM and / or ROM, comprising a buffer for temporarily storing, and an algorithm unit on which the policy decision algorithm is mounted, and a CPU 23 for performing the policy decision algorithm. It also includes a database 24 for referencing or storing data during the execution of the policy decision algorithm. In FIG. 5, the policy decision algorithm 25 is an algorithm for determining whether a packet is harmful to an incoming packet. The policy decision algorithm 25 may determine the harmfulness as an internal module, or may make a decision using an intrusion pattern database. A packet's harmfulness refers to a packet with an unauthorized destination or origin, or a packet randomly generated by an attacker who wants to use the network for malicious purposes.

 In 5, the database 24 includes a session database that stores whether a session has been created at this point in time, an intrusion pattern database containing definitions of hackers' general behavior, and malicious packets, and information about whether or not intrusions have been made. An example consists of an intrusion-related log database containing a.

The network intrusion prevention system 20 is configured to transmit and receive network traffic from the inside and the outside in parallel through a plurality of bridges of the receiving side NIC 21 and the transmitting side NIC 26, and the CPU 23 receives the receiving side NIC. Among the packets introduced in parallel to (21), the packet that has not already been created is checked for harmful packets according to the policy decision algorithm. At this time, if the packet is harmful, the corresponding bridge is blocked. If the packet is not harmful, the bridge is leaked through the transmitting NIC 26 and introduced into the internal network.

On the other hand, in the case where the receiving NIC 21 and the transmitting NIC 26 are multibridges formed of a plurality of bridges, it is preferable that load balancing is performed by distributing loads between the multibridges.

By using the bridge method as described above, it is only necessary to simply insert the prepared bridge type network intrusion prevention system 20 on the upper line of the systems to be managed in the network layout that is already established. Not only does the setup work need to be done, but the existing network is used as it is, so that the cable excess capacity that occurred in the sniffing mode does not occur, and the probability of harmful packet forwarding is reduced to 0%.

In addition, in the case of constructing a plurality of bridges, it is possible to process the packet method that was processed serially in the sniffing mode in parallel, thereby performing load balancing.

6 is a flowchart illustrating the processing of the packet of FIG. In Fig. 6, first, when a packet enters the receiving NIC 21 in step S1, each bridge is checked in step S2 to distribute the load, and the packet is loaded into the memory means 22 in step S3. In step S4, the control authority is transferred to the CPU 23 to perform a policy decision algorithm to determine whether or not the session has already been created in step S5 by querying each database 24 or the like. Transmits to the transmitting NIC 26, and if it is not a session already created, it is checked for harmfulness in step S6. If the packet is a harmful packet in step S6, the packet is stored in the intrusion-related log database of the database 24 in step S7, and the corresponding bridge is blocked. If the packet is not harmful, the packet is sent to the sending NIC 26 in step S8. send. Thereafter, in step S9, the load is balanced according to the load state of each bridge of the transmitting NIC 26 to achieve load balancing, and the packet is transmitted to the internal network to introduce the packet from the external network 10.

The network intrusion prevention system 20 in the bridge mode thus configured can also perform some of the functions of the firewall and can be easily modified.

As can be seen from FIG. 3 and FIG. 4, the bridge has the following advantages.

Physical installation is concise. In other words, the existing NIDS method had physical limitations such as supporting spanning ports in the network equipment to be installed. However, Bridge type packet collection is installed on the existing line as it is, there is no physical limitation.

Further, a packet processing system on a network using the bridge system of the present invention has a basic stealth function. In other words, the bridge does not have an IP address on the network. Therefore, it can prevent the target of attack from any attacker.

Further, the packet processing system on the network using the bridge system according to the present invention can manage more users. In other words, as described above, in the sniffing method, due to the limitation of traffic processing, the amount of packets that can be collected by the NIDS is very small, and the number of users that can be managed is limited. However, the bridge method is an existing network. With the structure intact, it can withstand heavy traffic.

In addition, the packet processing system on the network using the bridge system of the present invention constitutes an internal firewall. In other words, most firewalls are bridged. Thus, this type of intrusion, detection, and prevention system can build the ability to perform its functions without the introduction of additional firewalls.

While the present invention has been described with reference to specific embodiments, the above disclosure of the invention is not limited to the specific embodiments as merely preferred embodiments of the present invention. In addition, it will be readily understood by those skilled in the art that various modifications and changes can be made without departing from the spirit or scope of the invention as set forth in the claims below.

Therefore, according to the configuration and operation of the packet processing system on the network using the bridge method according to an embodiment of the present invention, there is a need for a change in the packet collection method. In other words, beyond the stereotype that IDS can only be implemented in Promiscuous mode, it introduces such a non-trivial way of bridge, so that the cable overcapacity occurred in sniffing mode does not occur. In this case, 0% chance of harmful packet forwarding is made, and existing network can be used as it is.If multiple bridges are established, the packet method that was processed serially in the sniffing mode can be processed in parallel. Load balancing can also be performed.

1 is a block diagram showing the configuration of a packet processing system on a network for conventional intrusion detection and prevention;

FIG. 2 is a packet flow diagram illustrating a packet collection method in the sniffing method of FIG. 1;

3 is a block diagram showing the configuration of a packet processing system on a network using a multi-bridge method according to an embodiment of the present invention;

4 is a packet flow diagram illustrating a packet collection method in the multi-bridge method of FIG.

5 is a block diagram showing an example of the configuration of the NIPS of FIG. 3;

6 is a flowchart of the packet processing of FIG. 5;

<Description of the symbols for the main parts of the drawings>

10: Network (LAN) 11: Hub

12: Server 13: Network Intrusion Detection System (NIDS)

16: Hub 17: User System

20: Network Intrusion Prevention System (NIPS) 21, 26: NIC

22: memory means 23: CPU

24: Database 25: Policy Decision Algorithm

Claims (2)

In a packet processing system on a network in which communication is performed between a plurality of user systems 17 including a communication device for data communication and a plurality of servers 12 constituting an internal network connected to a hub 11, Bridged to and connected to the receiving side NIC 21 and the transmitting side NIC 26 to receive and transmit network traffic from inside or outside before and after the hub 11 connecting the internal network. Alternatively, the packet sent from the sending NIC 26 is checked for harmful packets according to the policy decision algorithm, and blocked if the packet is harmful, and blocked if it is not harmful. Or a CPU (23) and a memory means (22) for flowing out through the receiving side NIC (21) to the network to flow into the network. 2. The network intrusion prevention system (20) according to claim 1, wherein the CPU (23), the memory means (22), the receiving side NIC (21), and the transmitting side NIC (26) constitute a network intrusion prevention system (20). Database 24 includes an intrusion pattern database constructed to be inquired by a policy decision algorithm that determines whether a packet is harmful or not. In the case of a multibridge constructed as a bridge, network traffic from the inside or the outside is received and transmitted in parallel, and the load is distributed between the multibridges of the receiving NIC 21 and the transmitting NIC 26 through parallel processing. By using one or more bridges, characterized in that load balancing is achieved.