KR100495777B1 - An integrated client-management system using an agent program - Google Patents

Abstract

The present invention relates to a client integrated management system utilizing an agent, and more particularly, in a system using a network such as the Internet, blocking a connection of a computer generating excessive traffic or spreading a virus such as a worm. In constructing a system to prevent attacks, the agent installed on the client checks and updates security patches and antivirus software itself, and self-diagnoses viruses and excessive traffic, thereby causing harmful effects caused by malicious codes and hacking such as Internet worms. The present invention relates to a client integrated management system that can effectively block traffic while significantly reducing the overhead on the network.

The client to which the client integrated management system according to the present invention is applied automatically connects to the main server when connecting to the network, obtains basic information and latest patch file information of the client stored in the database of the server, compares them, and compares them to the client. In case of needing update of installed patch file, it automatically receives the latest update file from main server and performs update, and then transmits basic information of updated client to server, and communicates various kinds of client. An agent is installed that monitors the ports by itself and performs a function of blocking a network connection of the corresponding port when an abnormality is detected; The main server that integrates and manages this includes a client information database that stores client basic information received from the clients, and a patch file database that stores information about the latest patch files and the latest patch files to be provided to the clients. It is characterized by being.

Description

An Integrated Client-Management System Using an Agent Program

The present invention relates to a client integrated management system utilizing an agent, and more particularly, in a system using a network such as the Internet, blocking a connection of a computer generating excessive traffic or spreading a virus such as a worm. In constructing a system to prevent attacks, malicious code such as Internet worms can be configured by an agent installed on a client (that is, a user's computer) to check and update security patches and antivirus software itself, and to self-diagnose viruses and excessive traffic. And it relates to a client integrated management system that can effectively block harmful traffic caused by hacking, etc. while significantly reducing the overhead (overhead) on the network.

With the development of the Internet, various malicious programs such as virus programs are flooded, and companies producing and supplying operating systems (O / S) as well as companies producing and supplying applications are vulnerable to their programs. In order to reinforce the development of the patch program.

In general, PMS (Patch Management System) is to update engines such as games, antivirus, security patches or applications to compensate for O / S vulnerabilities such as Microsoft's Service Pack or Hot Fix. It is a system that manages patch files such as engine patches for the system, and updates the patch files that need to be updated in a timely manner to prevent the spread of contamination due to worm viruses on the network, which may be caused by insufficient update of the patch files. It is a system that can be prevented.

PMS is based on agent-based PMS and non-agent-based management depending on whether the client is connected to the main server, that is, the agent is installed on each user's computer, or whether the system is run on the main server without installing the agent. It can be divided into PMS.

Conventional PMSs are usually dominated by non-agent-based PMS, which centrally controls and manages all the control and management, such as checking the patch update status of clients connected to it from a central main server and performing an update if necessary. It is a system based on what you do. This non-agent based PMS has the advantage of being able to manage and control all connected clients collectively without installing a separate program. However, in order to obtain detailed information about the clients connected to the main server, Not only is there a lot of difficulty, it also requires a significant amount of load on the server and the network to check and update patches for all clients connected from the main server, and not all clients stay connected to the server at all times. Updating patches also presents a significant challenge.

In order to overcome the shortcomings of the non-agent-based PMS, an agent-based PMS that installs an agent program on a client to be managed and manages the client using the same has been used in recent years. Agent-based PMS has the trouble of installing an agent for each target client, but it has the advantage of easy client management on the main server as the installed agent delivers detailed information about the client to the main server.

However, in the case of agent-based PMS, the agent must be installed directly for each target client, and the patch is updated at the request of the agent program installed on the client. Therefore, the user using the client is required to install and use the agent. If you give up its use because you are not familiar with it, or do not use it because it is cumbersome, you cannot manage the client effectively.

In addition, for the safe management of the network, in addition to the PMS described above, the construction of an intrusion prevention system (IPS) is essential. IPS is a system that blocks the influx of malicious code or harmful traffic. Since it is mainly installed at the network level, it is preferred to use a system that supports Gigabyte or higher performance in preference to availability. There is an additional cost for network speed to build.

In addition, in recent years, when the importance of intellectual property rights has been emphasized, the indiscriminate installation and use of illegal software by institutions and organizations will not only affect the social status of the institutions and organizations, but also be severely affected economically. Therefore, the construction of a system that blocks such illegal software is also urgently required. To this end, in the conventional technology, since the institution has collectively installed the software required for the client to belong to it, the system has mainly used a method of blocking the installation of illegal software by setting a security lock device in hardware. Under the law, although illegal software can be strongly blocked, additional security patches or engine patches, etc., on the client are very difficult to install.

The present invention is to solve the above-mentioned problems of the prior art, and an object of the present invention is to minimize the load on the main server using the agent-based PMS as a basic skeleton, while introducing the automatic update function by the agent to belong to the client It provides a PMS that can efficiently update various patch files in a timely manner irrespective of the characteristics of users, and implements its own IPS through an agent installed in each client, thereby remarkably reducing the overhead on the network generated by the conventional PMS or IPS. To provide a client integrated management system that can be reduced.

In addition, another object of the present invention is to perform the functions of PMS and IPS, at the same time, illegal software blocking function and IP address conflict or unassigned to prevent users from installing and using illegal software on their client PC arbitrarily It is to provide a client integrated management system that can also perform asset management functions to prevent random use of IP addresses.

As a technical idea for achieving the above object of the invention,

In the integrated client management system for managing the networking and patch file updates between the main server and the client (user computer) connected to it,

The client,

When connected to the network, it automatically connects to the main server, and obtains the basic information and the latest patch file information of the client stored in the database of the main server, compares them, and automatically updates the patch files installed on the client if necessary. After receiving the latest version update file from the main server and performing the update, it transmits the basic information of the updated client to the server and monitors various communication ports of the client by itself and if an abnormality is found An agent is installed that performs a function of blocking a network connection of a port;

In the main server,

A client information database that stores client basic information received from the clients belonging to the client, and a patch file database that stores information about the latest patch files and the latest patch file to provide to the client is utilized Provides a client integrated management system.

Hereinafter, with reference to the accompanying drawings, the configuration and operation of the embodiment of the present invention will be described in detail.

1 is a schematic diagram showing a network connection relationship of a client integrated management system according to the present invention.

Referring to FIG. 1, a client integrated management system according to the present invention basically establishes a network connection with clients 101, 102, 103, 201, 202, 203 connected to a network such as a local area network (LAN), that is, user computers. It is composed of a main server 400 for managing them. The management servers 301 and 302 shown in FIG. 1 are configured to manage the networking of clients belonging to each group by classifying the clients into a certain group 100 and 200 in order to make their networking more efficient when the number of clients is large. can do.

Client integrated management system according to the present invention is based on the active use of the agent, under the client integrated management system of the present invention, such as worm virus or other malicious code that causes network traffic in institutions using the Internet and other networks It is possible to significantly reduce the management burden of the network added by the agent installed in the client in the client rather than on the network.

In order to effectively perform the above functions, it is essential to install an agent on all clients. In the present invention, the agent program is automatically applied to all connected clients through the Internet use monitoring using port 80 on the main server. The system is configured to force-install by transferring to the Active X installation method.

In more detail, the main server can monitor the Internet usage of the clients under its management, and among the clients, the client without the agent is connected to the network and connected to the outside through port 80. When attempting to communicate with the agent, it detects this and captures the information of the TCP / IP header part of the communication, and uses this information to secure the communication over the Internet on the monitor screen of the client. After opening a message window indicating that installation is required, the agent is installed on the client by sending a packet for agent installation with the user's consent. At this time, if the user does not agree with the agent installation and proceeds with communication using port 80 as it is, the main server repeatedly displays a warning message on the monitor screen of the client to call attention or until the agent is installed. You can force the agent to install by taking measures such as blocking the client's Internet connection.

As soon as the agent is installed in the client, the agent grasps the basic information of the client and transmits it to the main server, and the main server stores the received basic information of the client in its client information database for each client. This basic information includes information about network resources such as the client's IP address, MAC address, user name and group name, version information of the client's O / S, security patch file or antivirus engine patch file. In some cases, various application programs used by the client and its version information may be included.

After that, the agent installed on each client is automatically run as the client is booted, and attempts to connect to the main server. When connected to the main server, the agent's basic information and the latest patches stored in the database of the main server Obtain the file information, compare them, and update the patch file installed on the client, automatically receive the latest version of the update file from the main server, perform the update, and send the updated client's basic information to the server. At the same time, by monitoring the number of sessions and patterns of various communication ports of the client by itself, and when an abnormality is found, it blocks the network connection of the corresponding port.

As described above, under the client integrated management system utilizing the agent according to the present invention, the agent is installed in all connected clients and the installed agent is automatically executed every time the client is booted to update the patch file. PMS solves problems such as virus spread due to inadequate user management or inadequate update due to negligence, and compares and updates patch files when each client connects to the network. Difficulties in obtaining individual client information that occurred in the conventional non-agent-based PMS, problems such as heavy load on the main server imposed during the updating process and inefficient management due to differences in connection points of the clients It can also be solved.

2 is a flowchart illustrating a process of updating a patch file and monitoring a port by an agent program installed in a client in a client integrated management system according to the present invention.

When the client accesses the network, the agent program installed in the client is automatically executed (S100), and attempts to access the main server (S200). At this time, when the connection with the main server is not established, a reconnection is attempted every time a predetermined time elapses until the connection is made (S201).

When the connection with the main server is made, the agent obtains basic information of the client and the latest patch file information held by the main server from the database of the main server (S300).

Comparing the obtained information (S400), if it is determined that the update is necessary, the agent obtains the latest patch file required for the update from the main server (S401) and updates the corresponding patch file (S402), based on the client basic information Update and transmit the updated client basic information to the main server (S403).

In parallel with this, the agent monitors various communication ports of the client by itself from the moment the client connects to the network (S500), and when an abnormality is detected such that an excessive network load (harmful traffic) is generated by opening a session above the threshold. (S501), the network connection of the corresponding port is blocked (S600), and a log file thereof is transmitted to the main server (S700).

The agent is terminated with the shutdown of the client (S800).

3 is a process of the agent obtaining necessary information from the main server, updating the patch file, and transmitting the updated client basic information to the main server during the execution process of the agent shown in FIG. 2 (S300 to S403). This is a flow chart that illustrates one more example.

When the basic information of the client stored from the main server is obtained (S300), the agent first checks whether the stored IP address matches the IP address of the current client (S410). In this case, when the two IP addresses are different, the user arbitrarily changes the IP address of the client, thereby prohibiting the use of the network of the client in asset management (S411).

After checking the IP address, the agent checks whether the stored MAC address and the current client MAC address match (S420). At this time, if the MAC address stored in the server and the current client's MAC address do not match due to a change in the client's LAN card, etc., the updated MAC address is sent to the main server to update the MAC address stored in the database. (S421).

After checking the MAC address, the agent checks whether the stored O / S information and the current client O / S match (S430). At this time, if the O / S information of the client is changed because the O / S of the client is changed and the current O / S of the client does not match, the information of the changed OS is sent to the main server to send the O / S stored in the database. The S information is updated (S431).

After checking the O / S, the agent compares the client information stored in the server with the latest patch file information obtained from the main server to check whether the security patch of the current client O / S is the latest version (S440). If it is determined that the update of the security patch is necessary, the agent receives the latest version of the security patch file from the main server and updates the O / S security patch of the client (S441).

After the update of the security patch, the agent checks whether the antivirus is installed on the client (S450). If the antivirus is not installed, the agent receives the antivirus from the main server and installs it on the client (S451).

If it is confirmed that the antivirus is installed, the agent checks whether the currently installed antivirus is the latest version (S460). If it is determined that the update of the vaccine is necessary, the agent receives the latest version of the vaccine from the main server and updates the client's antivirus (S461).

When the update of the patch files is completed (S470), the agent updates the client basic information based on this and transmits the updated client basic information to the main server (S403).

In the above description, only the security patch and the update process of the antivirus are described, but the function of the integrated management system of the present invention is not limited thereto, and the update of various applications is also the same for each application patch. It is obvious that this can be done by carrying out the process.

In addition, under the client integrated management system according to the present invention, the main server database provides basic information on network resources (client IP address, MAC address, user name, group name, etc.) of each client through an agent installed in the clients. And the client is automatically run when the client is connected to the network, the client accesses the main server, obtains this information, and compares it with the basic information of the current client. It is possible to perform asset management functions such as preventing an IP address conflict or a user from randomly using an unassigned IP address without having to build a system.

In addition, if necessary, the main server's database is updated with the list of legal software licensed for the system at that time, and when the agent is running, the agent downloads this list and installs and operates it on its own client. Compared with various softwares, it checks whether or not illegal software is installed, and if illegal software is found, a message requesting uninstall (uninstall) is displayed on the monitor screen to induce deletion or forced to stop using it. Accordingly, it may be provided with additional functions for monitoring and blocking illegal software such as forcibly deleting the illegal software.

Although the configuration and some embodiments of the present invention have been described above, this is merely to show a preferred embodiment of the present invention and the present invention is not limited thereto, and the protection scope of the present invention is a matter described in the claims to be described below. Is limited. In addition, those skilled in the art to which the present invention belongs, it is natural that various modifications can be made without changing the gist of the invention claimed in the claims, such modifications and improvements are within the scope of the present invention. As long as it is obvious to those skilled in the art, it will fall within the protection scope of the present invention.

As described above, the client integrated management system utilizing the agent according to the present invention configures the agent installed in the client to check and update the security patch and antivirus software by itself, and to self-diagnose the virus and excessive traffic. While effectively blocking harmful traffic caused by malware and hacking, the network overhead can be significantly reduced.

In addition, by using the agent comparison and inspection function, it is possible to monitor the use of asset management functions and illegal software, such as preventing the user from arbitrarily using IP address conflicts or unassigned IP addresses without building a separate system, You can also perform a function to block.

1 is a schematic diagram showing a network connection relationship of a client integrated management system according to the present invention.

2 is a flowchart illustrating a process of updating a patch file and monitoring a port by an agent program installed in a client in a client integrated management system according to the present invention.

FIG. 3 is a flow chart illustrating in detail the process of comparing information and updating a patch file in the execution process of the agent shown in FIG. 2.

<Description of the symbols for the main parts of the drawings>

101, 102, 103, 201, 202, 203: Client (user computer)

100, 200: client group

301, 302: management server 400: main server

Claims (7)

In the integrated client management system for managing the networking and patch file updates between the main server and the client (user computer) connected to it, In each of the clients, When connected to the network, it automatically connects to the main server, obtains the basic information and the latest patch file information of the client stored in the database of the main server, compares them, and needs to update the patch file installed on the client. In this case, after automatically receiving the update file of the latest version from the main server, performing an update, and transmitting the basic information of the updated client to the main server, various communication ports of the client itself An agent is installed which monitors and blocks the network connection of the corresponding port when an abnormality is detected; In the main server, A client information database for storing client basic information received from the clients and a patch file database for storing information on the latest patch files and the latest patch file to be provided to the clients are utilized. One client integrated management system. The method of claim 1, The agent, the client integrated management system utilizing the agent, characterized in that the main server automatically installed through the Internet monitoring to all the clients under its own management. The method of claim 2, Forced installation of the agent by the main server, When the main server monitors the Internet use of the clients under its own management, among the clients, if the client without the agent is connected to the network and tries to communicate with the outside through port 80, After capturing the information of the TCP / IP header part of the communication, and using this information, a message window is displayed on the monitor screen of the client to indicate that the agent installation is required to secure the communication over the Internet. Client integrated management system utilizing the agent, characterized in that to install the agent on the client by sending a packet for the agent installation with the user's consent. The method of claim 2 or 3, The agent grasps basic information of the client and sends it to the main server as soon as it is installed in the client; The main server is a client integrated management system using an agent, characterized in that for storing the basic information of the received client in each client information database for each client. The method of claim 1, The agent monitors the communication ports of the client by itself and, if an abnormality is found, blocks the network connection of the corresponding port and transmits a log file for the main server to the main server. Client Integrated Management System. The method of claim 1, The basic information of the client that the agent obtains from the main server includes network resource information of the client including the client's IP address and MAC address, and the agent uses the obtained IP address and the current client. A client integrated management system utilizing an agent, characterized by further performing an asset management function to prevent a user from using an IP address conflict or an unassigned IP address by comparing and checking an IP address. The method of claim 1, The main server further includes a software list database for updating and storing a list of legal software licensed for use in the system. When the agent accesses the main server and obtains necessary information, the agent acquires the software list together, checks whether or not illegal software is installed in comparison with various software currently installed and operated on the client, and illegally. If the software is found, the uninstall request message is displayed on the monitor screen of the client to induce the deletion or additionally perform the illegal software monitoring and blocking function for forcibly deleting the illegal software. Integrated client management system using agents.