KR100614775B1 - System and method of protecting network - Google Patents

Abstract

The present invention relates to an apparatus and method for protecting a network, and particularly, detects and blocks attacks such as harmful traffic and viruses that are congested based on the MAC address of an internal network user, implements a quality of service policy for valid traffic, and improves network availability. A network security device and method that can be improved.

The present invention blocks L2 to L7 based harmful traffic and provides a fundamental blocking policy based on user MAC address, thereby preventing the spread of harmful traffic between sub-networks and responding to attacks through attack pattern recognition. do. Moreover, by placing the signature filter according to the present invention at the top, it is possible to effectively block the aggressive traffic coming from inside, and the normal traffic can be ideally passed. In addition, the present invention can identify and control the traffic state through a real-time QoS monitor to allocate dedicated bandwidth to specific users and applications, and prevent bandwidth monopoly of specific traffic.

Harmful Traffic, Firewall, IDS, Filtering, Virus.

Description

Network protection devices and methods {SYSTEM AND METHOD OF PROTECTING NETWORK}

1 is a view showing a problem of the external hacker intrusion prevention system according to the prior art.

2 is a diagram showing the configuration of a network security device according to the present invention;

Figure 3 illustrates a kernel constituting a network security device according to the present invention.

4 is a diagram illustrating a work flow of a pattern engine configuring a network security device according to the present invention.

5 is a flow chart showing the processing flow of the signature sensor constituting the network security device according to the present invention.

5A to 5F illustrate system screens provided by a network security device according to the present invention.

5G illustrates QoS policy establishment of a security device in accordance with the present invention.

<Explanation of symbols for the main parts of the drawings>

10: firewall

20: IDS / IPS system

30: removable media

40: backbone switch

50: segment

86: internal network

100: application area

110: user area

111: http process

112: Telnet process

113: subgate module

114: QoS module

115: traffic module

120: daemon area

121: signature sensor

122: QoS log sensor

123: IP Account Sensor

124: Net Cap

200: kernel area

212: pattern engine

213: QoS engine

250: hardware

The present invention relates to an apparatus and method for protecting a network, and in particular, detects and blocks attacks such as harmful traffic and viruses that are congested based on MAC addresses of internal network users, and provides a quality of service for valid traffic. And a network security apparatus and method for implementing network (QoS) policies to improve network availability.

Recently, as the network communication environment develops, harmful traffic such as hackers illegally invading the network and disseminating computer viruses frequently occurs, and the explosive increase of such harmful traffic is a router or a backbone switch constituting an internal network. It paralyzes the back and paralyzes the network.

However, as hacking techniques are sophisticated and virus spreads can occur at nodes in the internal network, it is not easy for network administrators to understand why, when, where, and why such a network is paralyzed.

Moreover, with the recent increase in computer performance and the speed of network transfers of more than a few tens of BPS, even if a firewall is installed to detect external intrusions, harmful traffic from the internal network can generate hundreds of mega BPS or more per second. Can result in paralyzing the network.

Moreover, as the generation of harmful traffic becomes more intelligent, even if a firewall is installed, the harmful traffic using the ports allowed by the firewall is increasing significantly, and more seriously, harmful traffic is generated from internal nodes as well as from outside. Is that there is.

In order to solve the problem, a technique for filtering a packet using an intrusion detection system (IDS) or a virus firewall is used, but since the firewall system is a means installed on a boundary line, pattern matching of a data area of a packet is performed. The conventional technique to filter by means that there is no way to block harmful traffic when a mobile user connects a laptop having a source of harmful traffic to an internal network node without knowing it.

Accordingly, the first object of the present invention is not only to protect the internal network from illegal intrusion, but also to protect the network by blocking harmful traffic under the assumption that harmful traffic sources exist in the internal network. To provide protection technology.

The second object of the present invention is, in addition to the first object, that when a large amount of traffic occurs in the network under the premise that the network is infected as mobile users, memory sticks or web hard disk users increase, its spread and surroundings The present invention provides a network protection method and apparatus that can prevent and protect an infection into a segment.

A third object of the present invention is to provide a network technology in addition to the first and second objects, which provides an availability analysis of a network and a policy-based QoS method.

In addition to the above object, a fourth object of the present invention is to provide a network security technology capable of securing a unit network, minimizing the spreading of harmful traffic and promoting policy-based traffic control.

In order to achieve the above object, the present invention provides a network security device that blocks the spread of harmful traffic by an attack or virus between network segments and protects important traffic through bandwidth guarantee. The process to implement is divided into application area and kernel area, and the application area includes http process and telnet process, and user area that provides statistics and data for the user or administrator to access, manage, maintain and monitor. ; It is located between the user area and the kernel area, and consists of a daemon area for collecting, analyzing, commanding, recording, and interfacing real-time packets. A decode engine; Dynamic filter to determine whether there is harmful traffic based on packet header information, IP spoofing filter to discard the packet if not registered based on source IP, database based WORM and virus pattern A pattern engine for inspecting and discarding packets defined as harmful traffic, including a static filter for blocking by pattern matching; A QoS engine for performing bandwidth adjustment according to a QoS policy defined by a user; ATTACK, DoS / DDoS, SCAN, MAC standard IP spoofing registered in the signature database to monitor packet header information, notify the pattern engine of harmful traffic, and determine the release time registered in the signature database. A signature sensor for notifying the pattern engine of a release command when there is no more attack; It provides a network security device including a log database for recording information on the blocking and release of the pattern engine, the internal IP of the traffic passing through, the destination IP, and the like, and the currently connected session information.

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of a network security technology according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing a problem of the external hacker intrusion prevention system according to the prior art. Referring to FIG. 1, even if the firewall 10 or the IDS / IPS system 20 is installed to protect the internal network, the above-described conventional technology is a security technology based on access control. There is no choice but to be exposed to the attack. This is due to the increase in mobile users and the increasing use of removable media 30 such as flash memory, memory sticks, portable computers, etc., with only one worm virus infection, including the backbone switch 40 and the entire internal network segment 50, etc. Can paralyze the network.

Accordingly, the present invention provides a means for minimizing the spread of damage, ensuring business continuity, and blocking problems at the same time, assuming that the internal network is already infected with a virus or harmful traffic.

The network security apparatus according to the present invention selectively blocks only packets that cause network failures and attacks, thereby ensuring continuity of work, and protects the upper backbone switches, routers, and servers. Moreover, the network security device according to the present invention blocks L2-L7 based harmful traffic and viruses and applies the original blocking policy based on the MAC address of the user.

For example, if port 80 is infected, the network security device according to the present invention disables the use of Internet Explorer, and blocks the packet entering port 80. On the other hand, e-mail and ERP tasks that do not use port 80 are continuously used to maintain business continuity.

2 is a diagram showing the configuration of a network security device according to the present invention. Referring to FIG. 2, a process implemented by the network security apparatus according to the present invention may be divided into an application area 100 and a kernel area 200, and the application area is again a user. It may be divided into a region 110 and a daemon region 120.

Kernel region 200 also controls and manages all network packets, including hardware 250. The network device according to the present invention may be a Linux system as a preferred embodiment of a running OS, and the user area 110 is an http process 111 and telnet that an administrator or user can access, manage, maintain and monitor. (telnet) process 112, and http process 111 may be divided into a subgate module 113, QoS module 114, traffic module 115.

The daemon area 120 of the process implemented by the network security device according to the present invention is located between the user 110 or the kernel 200, and collects, analyzes, commands, records, and interfaces real-time packets. To perform.

In addition, the kernel region 200 analyzes the physical packet signal received from the network LAN card, processes the packet to be easily analyzed in the daemon region 120, and buffers the packet to have a decision to discard the harmful traffic. In addition, the kernel 200 performs a function of applying a registered QoS policy to the packet passed to the end.

3 is a diagram showing the configuration of a kernel constituting the network security device according to the present invention. Referring to Fig. 3, a packet decode engine 211 according to the present invention accumulates and records header information of all packets coming from a network card in a buffer. On the other hand, all packets defined as harmful traffic are examined by the pattern engine 212 and immediately discarded when determined to be harmful traffic.

As a preferred embodiment of the present invention, the pattern engine 212 according to the present invention may include a dynamic filter, an IP spoofing filter, a static filter, and the like, and each function may be provided. As follows. That is, the dynamic filter performs a function of blocking harmful traffic continuously flowing based on packet header information, and at this time, the blocking criteria blocks based on the command determined by the signature sensor 121.

On the other hand, the IP spoofing filter monitors the incoming passage C1 passing packets from the internal network 86. As a preferred embodiment of the present invention, if the internal network band is not registered based on the source IP, the packet is discarded. At this time, 0.0.0.0 IP can be passed when DHCP protocol is in operation.

In addition, the static filter is a filter that matches and blocks packets passing through the dynamic filter spoofing filter based on a database-based worm and virus pattern. For example, it can be blocked by hacking hidden in traffic data and pattern matching of worm viruses.

Referring back to FIG. 3, the QoS engine 213 adjusts bandwidth according to the QoS class policy defined by the user. In addition, the netcap 124 module illustrated in FIG. 3 receives and buffers header information of the packet analyzed by the packet decode engine 211 from the kernel, and buffers the buffered packet by the signature sensor 121 and the QoS log sensor 122. And deliver to the IP account sensor 123.

In a preferred embodiment of the present invention, the signature sensor 121 monitors header information of a continuously flowing packet in real time to determine harmful traffic, and transmits a block command and a release command to the pattern engine 212, and the corresponding packet information. Is recorded in the log database 129.

In a preferred embodiment of the present invention, Attacks, DoS / DDoS, SCAN, MAC reference IP spoofing registered in the signature database can be monitored and a block command can be issued to the pattern engine 212. In another preferred embodiment of the present invention, the release command is sent to the pattern engine 212 when there are no more attacks based on the release time registered in the signature database.

On the other hand, all information about blocking and release is recorded in the log database. As a preferred embodiment of the present invention, it is possible to record in the log database on the basis of the internal IP and the destination IP for all traffic passing through. As still another embodiment of the present invention, all currently connected session information may be recorded in a log database.

3, packet flow in the network protection device according to the present invention will be described. First, the internal packet flow C1 is as follows. When the packet is generated in the user area, the packet decode engine 211 is decomposed and accumulated in the kernel butter so that the packet can be easily and quickly analyzed through the C1 path through the internal NIC 86 and then exported to the path C2. Then, the next step, the pattern engine 212 determines the fate of the packet, and is blocked or passed by each filter such as the signature filter, the IP spoofing filter, the static filter, and the like.

According to a preferred embodiment of the present invention, the blocked packet is immediately discarded without further filters, and the passed packet is passed through passage C3 to the QoS engine 213 for queuing, and finally through passage C4. It is delivered to the external NIC 262.

On the other hand, a preferred embodiment of the packet flow of the external network is as follows. That is, when a packet is generated in the external NIC 87, the packet decode engine 211 decomposes the incoming packet to be easily and quickly analyzed through the passage C5, accumulates it in the kernel buffer, and sends the packet to the passage C6.

The next step, the pattern engine 212, determines the packet fate, which is blocked or passed by each filter, such as the signature filter, the IP spoofing filter, the static filter, and the like. The blocked packet is then discarded immediately without further filtering, and the passed packet is passed through the passage C7 to the QoS engine 213 for queuing, and finally through the passage C8 to the internal NIC 261. do.

4 is a diagram illustrating a work flow of a pattern engine constituting the network security apparatus according to the present invention. Referring to FIG. 4, when a packet is introduced, information about a source port, a destination port, and a packet length in the case of a protocol, a source MAC, a destination MAC, a source IP, a destination IP, a TCP, or a UDP socket may be stored in a memory. It loads (step S410).

Subsequently, the pattern engine according to the present invention refers to the pattern data registered in the policy and verifies the defect of the packet. As a preferred embodiment of the present invention, the flawless error verification step (step S411) may include CRC error check, LAND ATTACK, broadcast check, source IP range error check, and the like.

Here, the corresponding packet is discarded in the error checking step (step S411). On the other hand, by checking the signature filter match by inserting each packet on the basis of various types of packet information received from the signature sensor (step S412), if the match, the packet is discarded.

Subsequently, the direction of movement of the packet is examined, and the LAN interface tag of the packet is examined, and the packet coming from the internal (user) network goes through the inspection of the IP band and flows in from the outside. In the case of a packet, the process moves to step S415.

When it is determined that the packet is received from the inside in step S413 described above, based on the source IP, the packet is examined by referring to the data registered in the internal IP band database, and when the source IP is the registered IP, the next test is performed. If it is not an internal IP, it is immediately discarded (step S414). Then, the L7 based static harmful traffic is checked (step S415), and the packet is discarded immediately.

The static filter pattern may be examined by a combination of a source port, a destination port, and a string of data areas containing a packet. As a preferred embodiment of the present invention, an algorithm using a data structure form called a one pass scan using a fast inspection technique may be applied.

About the packet which passed all the inspection items of step S410-step S415 mentioned above, the information of a normal packet is recorded in the temporary memory database buffer (step S416), and this packet is handed over to a next module.

In a preferred embodiment of the present invention, a packet discarded to drop writes blocked packet information to a temporary memory database butter and then the packet can be discarded.

5 is a flowchart illustrating a work flow of the signature sensor constituting the network security device according to the present invention. Referring to Fig. 5, packets that can be analyzed per unit time (1 second) are buffered while being blocked from the net cap 124 (step S521). Subsequently, the procedure is repeated as follows while all the registered signature patterns are substituted.

First, check whether there is packet information that matches the registered pattern (step S522), and check whether there is a corresponding signature packet for each protocol (TCP, UDP, ICAM) type based on the source IP, and if there is a corresponding packet, step S523 If the packet does not exist, the next signature is checked.

In a preferred embodiment of the present invention, if there is already the same signature that is already being detected and blocked with the same signature pattern, the flow proceeds to step S522, and if not, the flow goes to step S524.

Then, all packets detected by the signature are recorded in the database (step S524). In the blocking mode other than the packet detection among the environment setting parameters, step S526 (blocking instruction) is executed, and in the detection mode, the flow moves to step S522. On the other hand, in step S526, the best command to be blocked as the preferred embodiment of the present invention is transmitted to the pattern engine 212 (step S526). Substituting all blocked pattern information, the bottom point of all signatures that are currently blocked or detected is determined, and the currently blocked pattern information is read (step S527).

On the other hand, it is determined based on the current blocked packet count and release time to determine whether to release the blocked packet rule set (step S528). If the packet rule set to be released is moved to step S529, the next pattern information is prompted.

As a preferred embodiment of the present invention, the total blocked or detected packet count and blocked time information can be recorded at the release time (step S529). Subsequently, the release engine of the blocked root set is instructed to the pattern engine 212, and it is determined whether or not to continue the analysis operation. If necessary during the signature padding analysis operation, the process returns to step S521 to continue the signature analysis.

5A to 5F are diagrams illustrating a system screen provided by a network security device according to the present invention. Referring to FIG. 5A, it is a diagram showing the usage status of the network security apparatus according to the present invention, and provides the service module state harmful traffic blocking information, system usage, and the like.

Fig. 5B shows a harmful traffic policy list as a preferred embodiment of the present invention. The present invention provides a harmful traffic blocking pattern and can completely block attacks and viruses based on Layer 2-7. Figure 5c is a diagram showing the harmful traffic real-time blocking history as a preferred embodiment of the present invention. The present invention repeatedly performs automatic detection, blocking, and releasing through real-time major packet analysis, and can apply detailed blocking for each service port and protocol based on MAC and IP addresses. Referring to FIG. 5D, the network security apparatus according to the present invention may provide a harmful traffic blocking log for daily, weekly, monthly, and specific time zones, and sets a security policy for a corresponding service port in consideration of risk.

5E is a preferred embodiment of the present invention, which provides network resource status through QoS real-time traffic monitoring. Referring to FIG. 5F, the present invention improves network capability through QoS traffic analysis. 5G is a diagram illustrating QoS policy establishment of a security device according to the present invention, which defines a class-specific content service and provides time-based scheduling.

The foregoing has outlined rather broadly the features and technical advantages of the present invention to better understand the claims of the invention which will be described later. Additional features and advantages that make up the claims of the present invention will be described below. It should be appreciated by those skilled in the art that the conception and specific embodiments of the invention disclosed can be readily used as a basis for designing or modifying other structures for carrying out similar purposes to the invention.

In addition, the inventive concepts and embodiments disclosed herein may be used by those skilled in the art as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. In addition, such modifications or altered equivalent structures by those skilled in the art may be variously changed, substituted, and changed without departing from the spirit or scope of the invention described in the claims.

 As described above, by blocking the L2-L7-based harmful traffic based on the present invention, and by providing a fundamental blocking policy based on the user MAC address, it prevents the spread of harmful traffic between sub-networks, and responds to attacks by attack pattern recognition It becomes possible. Moreover, by placing the signature filter according to the present invention at the top, it is possible to effectively block the aggressive traffic coming from inside, and the normal traffic can be ideally passed.

In addition, the present invention can identify and control the traffic state through a real-time QoS monitor to allocate dedicated bandwidth to specific users and applications, and prevent bandwidth monopoly of specific traffic.

Claims (9)

In a network security device that blocks the spread of harmful traffic by an attack or a virus between network segments and protects critical traffic by guaranteeing bandwidth, the process implemented by the network security device is applied to an application area and a kernel area. And the application area is a user area including an http process and a telnet process and providing statistics and data for the user or administrator to access, manage, maintain and monitor; Daemon domain located between the user domain and kernel domain to collect, analyze, command, record, and interface real-time packets The kernel region is composed of A packet decode engine that analyzes all network packets and accumulates the header information of the packets in a buffer; Dynamic filter to determine whether there is harmful traffic based on packet header information, IP spoofing filter to discard the packet if not registered based on source IP, database based WORM and virus pattern A pattern engine for inspecting and discarding packets defined as harmful traffic, including a static filter for blocking by pattern matching; A QoS engine for performing bandwidth adjustment according to a QoS policy defined by a user; ATTACK, DoS / DDoS, SCAN, MAC standard IP spoofing registered in the signature database to monitor packet header information, notify the pattern engine of harmful traffic, and determine the release time registered in the signature database. A signature sensor for notifying the pattern engine of a release command when there is no more attack; Log database that records information about blocking and releasing of the pattern engine, records internal IP, destination IP, etc. of traffic passing through, and records currently connected session information Network security device comprising a. delete delete delete delete delete In the method for determining whether the packet flowing into the network node is harmful traffic, (a) loading source PORT and destination and packet length information into a memory in the case of a protocol, source MAC, destination IP, TCP or UDP socket of an incoming packet; (b) performing CRC error checking, LAND ATTACK, Broadcast attack, source IP range error checking; (c) checking whether the pattern matches by substituting each packet based on the packet information received from the signature sensor; (d) checking a packet moving direction by examining a LAN interface tag of the packet; (e) determining whether the source IP is a registered IP based on the data registered in the internal IP band database in the case of the packet coming up from the inside (d); (f) checking the combination of the source port, the destination port, and the character string of the data area containing the packet to check the L7 based packet; And (g) storing the information of the passed normal packet and the blocked packet in a temporary memory database buffer Harmful traffic blocking method comprising a pattern analysis method of a packet comprising a. delete In the method for determining whether the packet flowing into the network node is harmful traffic, (a) buffering while analyzing packets that can be analyzed per unit time; (b) checking whether there is packet information corresponding to a pattern in which the signature packet is registered for each protocol type; (c) determining whether a signature is registered in the pattern engine; (d) recording all packets detected in the signature into a database; (e) transmitting to the pattern engine in the packet blocking mode; And (f) reading the packet data registered and blocked by the pattern engine and determining whether to release the packet data; Harmful traffic blocking method comprising a.

Images