KR100489216B1 - Network management system using Simple Network Management Protocol and method for exchanging information in the network management system - Google Patents

Abstract

The present invention provides a network management system using a simple network management protocol (SNMP) and an information exchange method in the network management system. The manager module sends the PDU converted and encrypted to XML along with the XML security policy to the agent module. The agent module decrypts PDUs encrypted in XML format, converts them back into SNMP messages using XML security policies, and performs security functions according to XML security policies. Therefore, it is possible to effectively solve the security weakness that occurs in the existing network management system and maintain compatibility.

Description

Network management system using Simple Network Management Protocol (SNMP) and method for exchanging information in the network management system {Network management system using Simple Network Management Protocol and method for exchanging information in the network management system}

The present invention relates to a network management system comprising a manager and network equipment, and more particularly, to a network management system using a simple network management protocol (SNMP) and an information exchange method in the network management system. will be.

Currently, most network equipment has a simple network management protocol (SNMP) service set up by default. Simple network management protocol (hereinafter referred to as SNMP), a network management standard protocol for exchanging management information bases (MIBs) between managers and network devices, is not only basic network management but also all forms of remote management structure. It is widely applied to the model, allowing network equipment to be managed from outside. However, since SNMP sets the community string used to read or change the system's settings as the default, more information may be exposed than necessary. Also, SNMP can be used to change the configuration of the device. There is a problem. In addition, when an abnormal message is received from a malicious user, a system may be down or rebooted. This is a problem that can be caused by the analysis of Protocol Data Units (PDUs) by attackers while the information in the Management Information Base (MIB) is shared. It does not provide a way to prevent the analysis.

SNMPv1, which was proposed by the Internet Engineering Task Force (IETF), is not a protocol written on the premise of security. Also, the assumptions made when writing the protocol are no longer applicable. SNMPv1 provided authentication service with only community and community name, but such simple structure could not solve the security problem of SNMP message. Therefore, IETF Working Group presented SNMPv2 and SNMPv3 with added security functions. In the handling of messages, USB (User-based Security Model, SNMPv3) was presented to solve the basic security problem, but there are still parts that are not considered. . This is caused by the unconsidered portion of USB that was added in SNMPv3 and is believed to be due to problems such as denial of service by the intruder or problems that the attacker can observe the traffic pattern between the manager and the agent.

Therefore, in the present invention, the manager module converts a protocol data unit (PDU) into a message format defined in an Extensible Markup Language (XML) policy, and transmits to the agent module together with the defined security policy. It is an object of the present invention to provide a network management system using a network management protocol (SNMP) and a method of exchanging information in the network management system.

In the network management system according to the present invention for achieving the above object, the manager module determines a security policy to be applied from among an XML policy store storing XML security related information and a security policy stored in the XML policy store and transmitting the An SNMP application for generating a message, an SNMP engine for receiving the message and a security policy from the SNMP application, converting the message into XML according to the security policy, encrypting the message, and transmitting the message to the agent; The module decodes a message transmitted from the manager and converts the message into an SNMP message using the security policy, and an SNMP application program that applies each device management and security policy according to the security policy received from the SNMP engine. It is characterized by including.

In addition, the information exchange method in the network management system according to the present invention for achieving the above object is to determine the security policy to be applied by the manager module to generate a message when a user request is input, according to the security policy Converting and encrypting the message into XML, applying a security model to the message and sending it to the agent module, authenticating the manager that received the message and sent the message to the agent module, Decrypting the message and converting the message into an SNMP message using the security policy; and applying each device management and security policy according to the security policy.

The present invention improves the security of the SNMP manager and the SNMP agent module in a network management system using a simple network management protocol (SNMP). To improve security, the SNMP manager converts protocol data units (PDUs) into message formats defined in Extensible Markup Language (XML) policies and sends them to the SNMP agent with the security policies defined in the policy store. Thus, an attacker can resolve security vulnerabilities such as denying service or observing traffic patterns between managers and agents by analyzing protocol data units (PDUs).

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The structure of a manager and an agent module in a network management system using a simple network management protocol (SNMP) according to the present invention is as follows.

1 is a configuration diagram of a manager module in a network management system according to the present invention, and includes an SNMP application program 100, an XML policy repository 110, and an SNMP engine 120.

The SNMP application 100 may include a command generator 101, a notification originator 102, a notification receiver 103, and an XML policy decision block 104. ) The command generation block 101 generates an SNMP request message. The notification information generating block 102 monitors the system for a particular event or state and generates a message based on the event or state. The notification information receiving block 103 waits for the notification information message and generates a response message when the notification message is received. The XML policy decision block 104 determines the security policy to apply.

The XML policy repository 110 is a block that stores XML security related information that is set in advance for security. The XML policy repository 110 includes a policy database server.

The SNMP engine 120 includes a dispatcher 130, a message processing subsystem 140, and a security subsystem 150. The processing block 130 is a PDU. A processing area (PDU Dispatcher) 131, a message processing area (Message dispatcher) 132 and a transport mapping area (Transport mapping) (133), the message processing subsystem block 140 is a plurality of different versions of SNMP (141) To 144, and the security subsystem block 150 is composed of an XML translation area (Parser) 151, an XML encryption area (152), a USB model (153), and other security models (154).

The manager module of the present invention shown in FIG. 1 is configured based on the existing SNMPv3. The XML application decision block 104 is included in the SNMP application 100 and the security subsystem block 150 of the SNMP engine 120 is included in the manager module. The XML conversion area 151 and the XML encryption area 152 are further included to maintain the compatibility with the existing SNMP and to enhance the security of the PDU.

2 is a configuration diagram of an agent module in a network management system according to the present invention, and is composed of an SNMP application program 200 and an SNMP engine 210.

The SNMP application 200 includes a proxy forwarder 201, a command responder 202, a notification originator 203, an XML policy enforcer 204. And a MIB information interpretation block 205 and a policy information base block (PIB). The command response block 202 generates a response message to the SNMP request message, and the proxy delivery block 201 transmits an SNMP message.

The SNMP engine 210 may include a dispatcher 220, a message processing subsystem 230, a security subsystem 240, and an access control subsystem; 250, wherein the processing block 220 includes a transport mapping area 221, a message dispatcher 222, and a PDU dispatcher 223, and a message processing subsystem. Block 230 is composed of a number of different SNMP versions (231 to 234), security subsystem block 240 is an XML Interpreter (241), XML Decryption (242), USB Model (Model) 243) and other security models 244, the process control subsystem block 250 comprises a view-based access control model 251 and an authentication area 252.

The agent module of the present invention shown in FIG. 2 is configured based on the existing SNMPv3, and the XML application execution block 204 is included in the SNMP application 100, and the security subsystem block 240 of the SNMP engine 210 is included in the agent module. The XML conversion area 241 and the XML decryption area 242 are further included to maintain the compatibility with the existing SNMP and to enhance the security of the PDU.

Next, a process of exchanging information between the manager and the agent module configured as described above will be described with reference to FIGS. 3 and 4.

3 is a flowchart illustrating an operation of a manager module in a network management system according to the present invention.

Step MS1 : When a user request is input, the XML policy decision block 104 of the SNMP application 100 determines a security policy to be applied among the security policies stored in the XML policy store 110, and the command generation block 101 transmits. Create a PDU for The determined security policy is sent to the processing block 130 of the SNMP engine 120 with the generated PDU.

Step MS2 : The processing block 130 sends a message to the message processing subsystem block 140. At this time, the PDU processing area 131 of the processing block 130 classifies the PDU type, and the message processing area 132 classifies the type of message.

Step MS3 : The message processing subsystem block 140 allocates the message according to the SNMP versions 141 to 144 and forwards the message to the secure subsystem block 150.

Step MS4 : The XML conversion area 151 of the security subsystem block 150 converts the PDU into XML according to the security policy defined in the XML policy store 110 to enhance security. At this time, the PDU determined by the XML policy decision block 104 does not need to be converted into XML, and PDUs generated by other applications are converted into XML.

Step MS5 : The XML encryption region 152 of the security subsystem block 150 encrypts the PDU converted to XML.

Step MS6 : Security subsystem block 150 applies UBS model 154 or other security model 154 to the entire message to be sent.

Step MS7 : The transport mapping region 133 of the processing block 130 selects a transport protocol 160 that can be transmitted and transmits a message to the agent module through the network 170.

4 is a flowchart illustrating an operation of an agent module in a network management system according to the present invention.

Step AS1 : When the message transmitted through the network 170 is received in the transport mapping area 221 of the processing block 220 through the transport protocol 260 which can be received, the authentication of the processing control subsystem block 250 is performed. The zone 252 authenticates the access authority for the manager that sent the message, and the process control model 251 sends the message received from the manager to the security subsystem block 240.

Step AS2 : The security subsystem block 240 performs a decryption operation on the other security model 244 and the UBS model 243 for the portion where the encryption operation such as the USB model of the SNMP protocol is performed in the message transmitted from the manager. do.

Step AS3 : The XML decryption area 242 of the security subsystem block 240 decrypts the PDU encrypted with XML.

Step AS4 : The XML conversion area 241 of the security subsystem block 240 converts the decrypted PDU into an SNMP message using the XML security policy defined in the XML policy store 110 and the message processing subsystem block 230 Send to). In other words, the message received from the manager converted to XML format is converted back into an SNMP message.

Step AS5 : The message processing subsystem block 230 extracts the data from the PDU for the SNMP versions 231 through 234 and passes it to the processing block 220 in order to make the messages with different versions valid.

Step AS6 : The processing block 220 processes the message and sends it to the XML policy execution block 204 of the SNMP application 200. At this time, the PDU processing area 223 of the processing block 220 classifies the type of PDU, and the message processing area 222 classifies the type of message.

Step AS7 : The XML policy execution block 204 selects an appropriate XML security policy and applies each device management and security policy according to the security policy of the predefined policy information base block 206. An example of applying the security policy is to grant each user the right to manage different devices according to the security policy selected by the manager, and to provide Denial of Service (an attacker between the manager and the agent), a vulnerability in the existing SNMP protocol. The policy is applied by the XML policy execution block 204 by pre-setting the security policy to the policy information base block 206, such as blocking the IP where the attack occurred during an attack (interrupting an incoming message). When a service requires a service, an error message is generated and the user ID and IP address are monitored.

Here, the basic background of the present invention for converting the SNMP management information base (MIB) to XML is as follows.

J.P Martin-Flatin provided a model for converting SNMP management information bases (MIBs) to XML as a method for data integration in a Web-based unified architecture. This is defined as model-level mapping. Model-level mapping is a method in which a document type definition (DTD) is specifically created in the SNMP management information base (MIB). In other words, element and attribute are created in XML DTD using SNMP variable name. In addition, metamodel-level mapping is a method of defining a generalized DTD and applying it to all management information bases (MIBs). This model uses generic keywords instead of naming elements using variables defined in the management information base (MIB).

In the present invention, since a single DTD can be defined and applied to all SNMP management information bases (MIBs), the SNMP management information bases (MIBs) are converted to XML using meta-model-level mapping, which has an advantage of easy conversion program. By mapping the converted data to a policy, the network system can be controlled.

As described above, SNMP performs a function of monitoring message transmission / reception between the manager and the agent, an event or a status. In the manager module of the present invention, the XML policy decision block 104 is applied among the security policies stored in the XML policy store 110. Determine the security policy you want to do. The XML conversion area 151 converts the PDU into XML, and the XML encryption area 152 encrypts the converted PDU. The encrypted PDU is transmitted to the agent module through the network with the determined security policy.

In the agent module, the XML decryption area 242 decrypts the PDU encrypted in the XML format, and the XML conversion area 241 converts the decrypted PDU back into the SNMP message using an XML security policy. The XML policy execution block 204 applies each device management and security policy according to the XML security policy.

In the present invention, each component included in the SNMP engine of the manager module and the agent module may be operated interchangeably when transmitting and receiving a message. For example, the XML encryption area 152 of the security subsystem block 150 encrypts a PDU converted to XML when a message is transmitted, but decrypts a PDU encrypted with XML when a message is received. can do.

As described above, the present invention provides a network management system using a simple network management protocol (SNMP) with enhanced security. The manager module sends the converted and encrypted PDUs to the agent module along with the XML security policy. The agent module decrypts PDUs encrypted in XML format, converts them back into SNMP messages using XML security policies, and performs security functions according to XML security policies. Therefore, it is possible to effectively solve the security weakness that occurs in the existing network management system.

In addition, the network management system of the present invention can maintain compatibility because it is configured in the form of adding a component for solving the above security weaknesses in the existing SNMP manager module and agent module, and the XML-based security policy Use can provide flexibility.

1 is a configuration diagram of a manager module in a network management system according to the present invention.

2 is a block diagram of an agent module in a network management system according to the present invention;

3 is a flowchart for explaining an operation of a manager module in a network management system according to the present invention;

4 is a flowchart illustrating the operation of an agent module in a network management system according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: SNMP application 101: command generation block

102: notification information generation block 103: notification information receiving block

104: XML policy decision block 110: XML policy store

120: SNMP engine 130: processing block

131: PDU processing area 132: message processing area

133: transport mapping area 140: message processing subsystem block

141 to 144: SNMP version 150: security subsystem block

151: XML conversion area 152: XML encryption area

153: USB Model 154: Other Security Models

160: transport protocol 170: network

200: SNMP application 201: Proxy forwarding block

202: Command response block 203: Notification information generation block

204: XML policy execution block 205: MIB information interpretation block

206: Policy Information Baseblock 210: SNMP Engine

220: processing block 221: transport mapping area

222: message processing area 223: PDU processing area

230: Message processing subsystem blocks 231 to 234: SNMP version

240: security subsystem block 241: XML conversion area

242: XML decryption area 243: USB model

244: Other security model 250: Process control subsystem block

251: processing control model 252: authentication realm

260: transport protocol

Claims (8)

In a network management system using a simple network management protocol (SNMP) and consists of a manager module and an agent module, The manager module includes an XML policy repository for storing XML security related information. An SNMP application for determining a security policy to be applied among the security policies stored in the XML policy store and generating a message for transmission; Receiving the message and the security policy from the SNMP application, and converts the message into XML according to the security policy, and encrypts and sends to the agent, SNMP engine, The agent module includes an SNMP engine for decoding a message transmitted from the manager and converting the message into an SNMP message using the security policy. Network management system using a simple network management protocol (SNMP) comprising an SNMP application for applying each device management and security policy in accordance with the security policy received by the SNMP engine. The method of claim 1, wherein the SNMP application program of the manager module comprises a command generation block for generating the message, A notification information generation block that monitors the system for an event or state and generates a message based on the event or state; Notification information receiving block for generating a response message to the notification message, A network management system using a simple network management protocol (SNMP), characterized in that the XML policy decision block for determining the security policy. The method of claim 1, wherein the SNMP engine of the manager module is a processing block for processing and transmitting the message; A message processing subsystem block for allocating a version to a message received from the processing block; And a security subsystem block for converting and encrypting the message received from the message processing subsystem block into XML according to the security policy. 4. The system of claim 3, wherein the security subsystem block comprises: an XML conversion area for converting the message into XML according to the security policy; An XML encryption area for encrypting the converted message; A network management system using a simple network management protocol (SNMP), characterized in that consisting of a USB model and other security models to apply to the message. The method of claim 1, wherein the SNMP engine of the agent module is a processing block for processing and transmitting a message received from the manager module; A process control subsystem block for checking access rights to the manager that sent the message; A message processing subsystem block for extracting data according to a version from a message received from the processing block; And a security subsystem block for decrypting the message and converting the message into an SNMP message using the XML security policy. 6. The system of claim 5, wherein the security subsystem block comprises: an XML decryption area for decrypting the message; An XML conversion area for converting the message into XML according to the security policy; A network management system using a simple network management protocol (SNMP), characterized in that consisting of a USB model and other security models applied to the message transmitted. The method of claim 1, wherein the SNMP application of the agent module is a proxy forwarding block for delivering the message, A command response block for generating a response message to the message; A notification information generation block that monitors the system for an event or state and generates a message based on the event or state; An XML policy execution block that applies each device management and security policy according to the security policy; MIB information interpretation block, A network management system using a simple network management protocol (SNMP), characterized in that the policy information base block for pre-setting the required security policy. In a method of exchanging information in a network management system using a simple network management protocol (SNMP) and consisting of a manager module and an agent module, Determining a security policy to be applied by the manager module and generating a message when a user request is input; Converting and encrypting the message to XML according to the security policy, Applying a security model to the message and sending it to the agent module, Receiving the message at the agent module and authenticating the manager that sent the message, Decrypting the message and converting the message into an SNMP message using the security policy; And applying each device management and security policy according to the security policy. 10. A method of information exchange in a network management system using a simple network management protocol (SNMP).