KR100694248B1 - Apparatus for testing security policies in network security system and its method - Google Patents

Abstract

A security policy test device of a network security system and a method thereof are provided to automatically progress overall processes up to an evaluation process of test results from a preparation process of a test, thereby minimizing user's intervention during the test processes while improving reliability on security policies of the system. A packet generator(100) comprises the followings. A rule interpreting module(110) receives filtering rules of a packet filtering program to decide whether the rules are accurate, and if so, the module(110) parses the corresponding rules to extract port information and protocol information as well as IP(Internet Protocol) addresses of transmitting/receiving sides. A test case generation module(120) generates test cases based on the extracted port information, protocol information, and IP addresses. A packet sender(140) automatically generates packets based on the test cases, and sends the packets. A test oracle generation module(130) automatically generates a test oracle for deciding on results by using log information of the sent packets and the generated test cases. A packet detection module(150) detects whether the sent packets are received, and records the detected results. A synchronizer(160) conducts synchronization and transmission of information necessary for test performance.

Description

Apparatus and method for testing security policy of network security system {APPARATUS FOR TESTING SECURITY POLICIES IN NETWORK SECURITY SYSTEM AND ITS METHOD}

1 is a block diagram of a test bed implemented by the security test apparatus of the present invention.

2 is a block diagram of a security test apparatus according to the present invention.

3 is a flowchart illustrating a process of extracting necessary information by analyzing a security rule (policy) of a network system to be tested in a rule analysis module constituting the security test apparatus of the present invention.

4 is a flowchart illustrating a process of automatically generating a test case in a test case generation module constituting the security test apparatus of the present invention.

5 is a flowchart illustrating a process of automatically generating a test oracle in a test oracle generation module constituting the security test apparatus of the present invention.

6 is a flowchart illustrating a process of generating and transmitting a packet to be transmitted based on a test case in a packet sender constituting the security test apparatus of the present invention.

7 is a flowchart illustrating a process of detecting and recording a packet transmitted from a packet detection module constituting the security test apparatus of the present invention.

8 is a flowchart illustrating a process of calculating a test result by analyzing a log of packets transmitted from a test Oracle in a result determination module constituting the security test apparatus of the present invention.

[Description of Drawing Reference]

100... Packet generator 110... Rule interpretation module

120... Test case generation module 130. Test Oracle Generation Module

140,210... Packet sender 150,220... Packet Detection Module

160,240... Synchronizer 200... Packet analyzer

230... Result determination module 300. Packet filter

The present invention relates to a security policy (security) test apparatus and method for a network security system that can effectively test the security of the system with minimal user intervention. Technically, the function of a packet filtering program and a network security system using the same Related to the field of testing.

Program testing is about finding errors in your code.

The testing work performed for this purpose can be largely divided into four detailed processes: planning stage of testing, preparation stage of testing, performance stage of testing, and evaluation stage of testing.

A) The planning phase of testing involves defining the scope of work for testing activities and identifying approaches, resources, and schedules. In this step, you collect the requirements of the test, plan the test, and review it.

B) The preparation phase for testing is the process of designing and preparing test cases for test execution and building a test environment.

C) The execution phase of testing is the process of executing the program to be tested based on the test case and recording the execution result.

D) The evaluation phase of testing is the process of determining whether an error exists in the program based on the execution result in the execution phase.

In general, a test case is composed of a test script representing a test procedure and a test oracle for determining whether there is an error in test data and execution results necessary for executing the test script. In other words, test Oracle means the expected result used to determine whether the test execution result is an error.

The packet filtering test is for testing the security policy or packet filtering rules of a firewall or router. This is to test whether the packet is filtered correctly according to the specified rule, that is, whether the system can be secured by the packet filter and the security policy using the same.

However, many studies have focused on more than session level studies such as Penetration Testing, Log Review, Virus Detectors, etc. rather than the study of packet filtering.

Because of this, test studies on packet filtering, which are the basis of security systems such as routers and firewalls, have been overlooked, and there are only a few poorly-tested test tools, and most of the packet filtering tests are done manually. Test tools also require a lot of intervention and judgment from the user.

Conventional example

Ftester is a widely used tool for testing the security policy of a firewall. Ftest acts as a packet generator, Ftested acts as a packet searcher, 'ftest.conf' file to configure the basic environment, Ftest and It consists of Freport, which contains the scripts needed to compare the logs of Ftested. However, the Ftester described above requires artificial configuration and scripting for each new test case, and the analysis tool only provides a simple comparison of end-to-end logs.

The present invention has been made to improve the conventional problems related to packet filtering test, and by changing the packet filtering rule, new test cases and test oracles are automatically generated and compared with the execution results. It is an object of the present invention to provide a security test method and apparatus for a network security system that can automatically determine whether a packet filtering result is right or wrong.

In addition, an object of the present invention is to provide a method and apparatus for testing security of a network security system in which the test process can be automated as a whole while minimizing user intervention in the test process.

To this end, the present invention parses (parses) the packet filtering rules of the packet filtering program according to the security policy, extracts the necessary data, and then systematically automatically generates various combinations of test cases and test oracle using the same, and tests. We present a method to perform automatically and a method / device for automatically calculating test results. In other words, it aims to automate the creation of test cases and test oracles as described above to enable effective test execution while minimizing user intervention.

The present invention, in which such a technical problem can be achieved, may be composed of a packet generator and a packet analyzer of a special configuration connected to a packet filter for system security incorporating a packet filtering program as disclosed in, for example, claims 1 and 2.

Here, the packet generator receives the filtering rule of the packet filtering program to be tested from the user to determine whether the correct rule is correct. Rule analysis module for extracting information and protocol information ⓑ Test case generation module for generating test cases based on IP address and port information and protocol information of the sender / receiver side extracted from the rule analysis module ⓒ The test case generation A packet sender that automatically generates and transmits a packet based on the test case generated in the module, and the test for result determination using the log information of the test case generated in the test case generating module and the packet sent from the packet sender Oracle generates a test mode to automatically create the Oracle Ⓔ and forming the transfer and synchronization of the information required for packet detection module and ⓕ test carried out to detect and record whether or not the reception of the transmitted packet may be composed of a synchronizer.

On the other hand, the packet analyzer includes a packet sender that automatically generates and transmits a packet based on the test case generated by the test case generation module, a packet detection module that detects and records whether or not the received packet is received, and performs a test. using the detected packet and log generated by the test Oracle synchronizer, the packet detection module forming the transfer and synchronization of the information may be of a result of determination module for automatically calculating a test result.

In addition, the security test method of the network security system proposed by the present invention, as disclosed in claim 3, for example, a packet generator and a packet analyzer connected to a packet filter for system security incorporating a packet filtering program is connected to the security of the system In the method for testing sex, the rule analysis module of the packet generator parses the filtering rule of the packet filtering program, and the parsed filtering rule corresponds to any one of a basic policy, a flooding policy, a state-based policy, and a fragmentation policy. to determine (115) by a first process of extracting (116) information for the respective storage and whether that; A second step of generating a test case by the test case generating module of the packet generator based on the information extracted in the first step ; A third step of generating a packet using the test case generated in the second step and environment setting information of the packet filter, but leaving a log of the transmitted packet while sending the packet to a destination; A fourth step of generating a test oracle using a test case log in the second step and a log of packets transmitted in the third step; And by the logarithm of the test Oracle and the received packet to the packet analyzer produced in the fourth step the comparison result determining module of the packet analyzer it may be made of a fifth step of determining the result of executing the test.

Hereinafter, an apparatus and method for testing security of a network security system according to an embodiment of the present invention will be described with reference to the accompanying drawings. In the following embodiment, reference numeral I (input) is written for an input value and an output value is described. O (output) was written together.

In addition, the term "network security system" as used herein is defined as a computer system to which other computers are connected through a communication network such as an intranet or the Internet.

In addition, the security (security policy) test apparatus and method of the following example are previously defined as including the following functions.

Iii) Ability to extract filtering information by analyzing filtering rules.

Ii) The ability to analyze the filtering rules and create various combinations of test cases.

Iii) Ability to analyze filtering rules and generate test Oracle accordingly.

Iii) a function of testing in a test bed of the present invention based on a test case.

Iii) A function that compares test result and test Oracle to determine whether filtering result is error. Here, the log of the packet before and after passing through the packet filtering program is compared with the test Oracle, and the test result is automatically calculated.

Example

1 is a configuration diagram of a test bed implemented by the security test apparatus of the present invention, Figure 2 is a configuration diagram of a security test apparatus according to the present invention, Figures 3 to 8 is a security test of the present invention This is a flowchart showing the information processing in each module constituting the device.

As mentioned above, the security test apparatus and method of the present invention should analyze the filtering rules of the system under test and automatically generate a test case conforming to the rules, and automatically generate the corresponding test oracle. In determining the test results, the results should be automatically calculated using the test Oracle and the test results, rather than the user checking / analyzing / deciding.

To this end, this embodiment proposes a test bed (whole system) consisting of a packet generator 100, a packet analyzer 200, and a packet filter 300 as shown in FIG.

The packet generator 100 parses packet filtering rules of a system under test and automatically generates test cases and test Oracles, and generates packets to be actually transmitted using the test cases and sends them to a destination.

The packet filter 300 is a system that includes a packet filtering program such as a router or a firewall, and is a test target.

The packet analyzer 200 compares the log of packets arriving at the test Oracle and the packet analyzer with each other to determine whether the packet filter is operating properly.

The test bed (system) of the present invention also has two connections for testing.

Among them, the ① connection (line) is a line for transmitting test packets, and the packet generator and the packet analyzer exchange packets with each other through the packet filter. On the other hand, connection ② is a line to keep the synchronization between the packet generator and the packet analyzer when performing the test, and to send and receive the information necessary for the test. Information transmitted through connection ② is log information between packet generator and packet analyzer, test Oracle information, and synchronization information for state-based filtering rule test.

Figure 2 shows the internal structure of the security test apparatus according to an embodiment of the present invention, as shown in the packet generator 100 of the present embodiment is the rule analysis module 110, test case generation module 120, test It is composed of an Oracle generation module 130, a packet sender 140, a packet detection module 150, a synchronizer 160. In contrast, the packet analyzer of the present embodiment includes a packet sender 210, a packet detection module 220, a result determination module 230, and a synchronizer 240.

Meanwhile, in the present embodiment, the filtering rules of the packet filter provided for the security of the network security system are classified into the following four types and applied to the testing.

■ Rules for Default Policy

■ Rules for Flooding Policies

■ Rules for Stateful Policy

■ Fragmentation Policy

Hereinafter, each module constituting the packet generator of the present embodiment will be described.

A) Rule interpretation module 110

The filtering rule to be tested is input from the user and the information necessary for the automatic generation of the test case and test oracle is extracted.

FIG. 3 illustrates how information necessary for automatic generation of test cases and test Oracles is extracted from filtering rules. When a user inputs a filtering rule (I-110) to be tested, the rule analysis module determines whether the rule is correct. (111) If the rule entered is the correct rule, the rule is parsed (113), and then the IP address and port information and protocol information of the sender / receiver side are extracted (114, O-114). Notify 112.

Thereafter, the parsed security policy (rule) determines whether it corresponds to a basic policy, a flooding policy, a state-based policy, and a fragmentation policy (115), and extracts and stores information for each of them (116). Here, if the extracted information relates to the basic policy 116-1, the permission / deny information (O-116-1) is extracted using a 5-tuple, that is, the IP address, port information, and protocol information of the transmitting / receiving side. In case of flooding policy 116-2, rate / burst information, which is a factor for determining flooding, and unit time information (O-116-2) expressed by a corresponding rule are extracted. In the case of 116-3), the permission / deny information (O-116-3) for each state is extracted, and in the case of the fragmentation policy 116-4 for the processing / performing of fragmented packets, Extract information about O-116-4.

On the other hand, when testing a plurality of rules (117) continues to extract information about the next rule.

B) Test Case Generation Module 120

Test cases are generated based on the information extracted from the rule analysis module (O-114, O-116-1 to O-116-4). When creating test cases, test cases are generated according to the basic policy, flooding policy, state-based policy, and fragmentation policy. This is the normal state (what should pass through the packet filter) and abnormal state (packet) when testing the security policy of the system. Reflect on testing by considering all of the filters to be filtered).

For reference, the table below shows the test policy taken for each test target in this embodiment.

4 illustrates a process of generating a test case reflecting the test method, and receives information (O-114, O-116-1 to O-116-4) extracted from the rule analysis module 110 as an input ( 121. It is determined 122 which policy the policy is related to, and the permission / deny range of each rule is extracted.

In detail, in the case of the basic policy, the basic policy information is read (123-1) to derive the permission range expressed by the corresponding rule (124-1), and the equivalence area analysis and the boundary value analysis are performed on the entire domain. Test case is generated through (125-1) (O-125-1). For example, if you grant access to a packet whose IP address is between 192.168.0.1 and 192.168.0.255, a packet with a range of the IP address and a range other than that range (upper or lower than that range) will be tested. Becomes At this time, the packet created by using the test case extracted from the range should pass through the packet filter, and the packet created by using the test case extracted from the range other than the range should not pass.

In the case of the flooding policy, after reading the rate / burst information and the unit time information (O-116-2) extracted from the rule interpretation module (123-2), a criterion for determining the flooding state is found ( 124-2). Using this, a normal case (Non-Flooding) and an abnormal state (Flooding) are determined to generate a test case (125-2).

In the case of state-based policy, normal state transition and abnormal state transition information are extracted (124-3) by reading permission state / deny information (O-116-3) extracted from the rule interpretation module (123-3). This information is used to generate a test case (125-3).

In the case of the fragmentation policy, the fragmentation information O-116-4 extracted from the rule interpretation module is read (123-4), and then permission / rejection information of the fragmentation packet is extracted (124-4). The information is then used to generate test cases for the normal and abnormal states (125-4).

C) Test Oracle Generation Module 130

The test Oracle generation module includes test case information (O-125-1 to O-125-4) generated by the test case generation module 120 and transport packet logs (O-148) generated by the packet senders 140 and 210. Create a test Oracle using. According to this, for each test case, a packet to be transmitted may be extracted, a test may be performed, and then the result may be automatically determined.

FIG. 5 shows a detailed process related to this, and test oracle is also generated according to each test target.

As shown in the drawing, the test Oracle generation module reads test cases (132-1 to 132-4) for each test object and reads the corresponding transport packet log (O-148) (133-1 to 133-4). It is.

If the information read is about the basic policy, test packets are generated (134-1, O-134-1) and flooded by analyzing transport packets corresponding to the permission range of the test case and extracting packets to be transmitted. In case of policy, the test case is generated by analyzing the total number of packets that can be arrived by using test cases corresponding to flooding criteria (134-2, O-134-2) .In case of state-based policy, it induces normal state transition. Test Oracle is generated by analyzing the packet to be analyzed (134-3, O-134-3), and if it is about the fragmentation policy, the test Oracle is generated by analyzing the fragmented packets that can be arrived using test cases (134-4 and O-134). -4)

D) Packet Sender 140

Generates a packet using test cases (O-125-1 to O-125-4) and network configuration information (I-143) generated from the test case generation module 130, sends the packet to the destination, and sends the packet. Leave a log (148, O-148) for.

The process involved in this is illustrated in FIG. 6.

In the figure, the packet sender reads necessary information (142-1 to 142-4) after determining (141) which policy the generated test case is a rule for.

The packet sender reads the information indicated in the security policy and network configuration information of the actual test environment (143-1 to 143-4) and generates and transmits the actual packet (148) if necessary.

The number of packets to be transmitted 146 is determined by the user's input as indicating the number of tests. The transmitted packets support various tests based on normal and abnormal states of the test case.

E) Packet Detection Module 150

Detecting packets 151 coming into the packet generator 100 and leaving a log (154).

The packet detection module determines whether the packet is related to the test for all packets coming through the network (152), and leaves a log (O-154) for the related packet, and detects the packet indicating the end of the test (153). Is terminated. A related flow is shown in FIG.

F) Synchronizer (Synchronizer) (160)

It sends log and test Oracle about packet sent and received through connection ② to packet analyzer and sends synchronization information with packet analyzer.

Hereinafter, each module constituting the packet analyzer of the present embodiment will be described.

■ Packet Sender (210)

The packet analyzer sends a packet to be sent to the packet generator.

The test case for the packet to send is generated by the packet generator and received through connection ②. The information on the sent packet leaves a log, and the packet sender on the packet analyzer side operates in the same manner as the packet sender on the packet generator side described above.

■ Packet Detection Module (220)

The packet analyzer detects incoming packets and leaves a log, which also operates in the same way as the packet detector module on the packet generator side.

G) result determination module 230

The test Oracle (O-134) and the detection packet log (O-154) are analyzed to determine whether the filtering result is correct.

A related flow is shown in FIG. 8.

As shown in the figure, test Oracle (O-134) is sent from the packet generator through the ② connection after performing the test. When performing the test, the detection packet log (O-154) of the packet detection module 220 is used, and the test execution result is determined 234 by comparing the detected test packets with the loaded test packets 231 and 232 (233). .

For example, if it is related to the basic policy, the test Oracle and the packet analyzer compare the log of the packet received to automatically determine whether only the passable packet has passed. If the flood policy is related, the log of the packet received to the test Oracle and the packet analyzer is passed. Automatically compares the number of packets allowed by the number of packets and automatically determines whether an acceptable state transition has been made by comparing the log of packets received by the test Oracle and the packet analyzer, As far as the fragmentation policy is concerned, the test Oracle and the packet analyzer are compared to log the packets received to automatically determine if only acceptable fragmentation packets have been passed. At this time, an error log (O-236) and a result log (O-235) are generated (236 and 235) according to the test result.

■ Synchronizer (Synchronizer) (240)

It receives log information and test Oracle from the packet generator, and receives information about packets to be sent from the packet analyzer. It also sends out synchronization information with the packet generator if necessary.

The security test apparatus and method of the present embodiment configured as described above operate as follows.

First, the packet generator 100 obtains necessary information by analyzing the security policy (rules) of the packet filter 300 in the rule analysis module 110, and uses the information to test the test case in the test case generation module 120. The packet is generated according to the test case and then transmitted to the target through the packet sender 140 to the packet analyzer 200. In addition, the packet transmitted continuously is logged.

Subsequently, the test oracle generation module 130 generates a test oracle (O-134) using the test case and the log of the transmitted packet (O-148) as inputs, and synchronizes the generated test oracle with the synchronizer and FIG. It sends to the packet analyzer 200 through the ② connection of the.

Accordingly, the packet detection module 220 of the packet analyzer leaves a log for the received packet, and the test oracle transmitted through the ② connection is sent to the result determination module 230 to determine the test result.

According to the security test apparatus and method of the network security system according to an embodiment of the present invention as described above, the entire process from the preparation of the test to the evaluation of the test results automatically proceeds to minimize user intervention in the test process. It can improve the reliability of the security policy of the system, and can shorten the execution time for the security test.

Claims (6)

A security test apparatus comprising a packet generator and a packet analyzer connected to a packet filter for system security incorporating a packet filtering program. The packet generator The filtering rule of the packet filtering program to be tested is input from the user to determine whether it is the correct rule. If the input filtering rule is the correct rule, the rule is parsed to extract the IP address, port information, and protocol information of the sending / receiving side. A rule interpretation module ; A test case generation module for generating a test case based on the IP address, port information, and protocol information of the transmitting / receiving side extracted from the rule analysis module; A packet sender for automatically generating and transmitting a packet based on a test case generated by the test case generation module; A test oracle generation module for automatically generating a test oracle for result determination using the test case generated by the test case generation module and log information of the packet transmitted from the packet sender; A packet detection module for detecting and recording a received packet ; And Synchronizers to achieve transfer and synchronization of information required to perform the test; Security test apparatus for a network system comprising a. The method of claim 1, The packet analyzer is A packet sender for automatically generating and transmitting a packet based on a test case generated by the test case generation module; A packet detection module for detecting and recording a received packet ; Synchronizers to achieve transfer and synchronization of information required to perform the test A result determination module for automatically calculating a security test result using the detection packet log generated by the packet detection module and the test Oracle; Security test apparatus for a network system comprising a. In the method of testing the security of the system by connecting a packet generator and a packet analyzer to a packet filter for system security incorporating a packet filtering program, The rule analysis module of the packet generator parses the filtering rule of the packet filtering program, and determines (115) whether the parsed filtering rule corresponds to a basic policy, a flooding policy, a state-based policy, or a fragmentation policy. A first process of extracting and storing information suitable for each; A second step of generating a test case by the test case generating module of the packet generator based on the information extracted in the first step ; A third step of generating a packet using the test case generated in the second step and environment setting information of the packet filter, but leaving a log of the transmitted packet while sending the packet to a destination; A fourth step of generating a test oracle using a test case log in the second step and a log of packets transmitted in the third step; And A fifth step of determining, by the result determination module of the packet analyzer, a result of the test by comparing the test Oracle generated in the fourth process with a log of the packet received by the packet analyzer; Security test method for a network system, characterized in that comprises a. The method of claim 3, The second process, The information extracted in the first process When it comes to the basic policy, the basic policy information is read to derive the permission range expressed by the filtering rule, and the test case is automatically generated through the analysis of equivalence domain and boundary value for the entire domain. When it comes to flooding policy, it reads Rate / Burst information and unit time information extracted from the rule analysis module of the packet generator, finds the criteria for judging the flooding status, and checks the normal status (Non-Flooding) Automatically generate test cases for Flooding, If it is related to the state-based policy, the test case is automatically generated by reading the normal state and abnormal state transition information by reading the permission / rejection information for each state extracted from the rule interpretation module of the packet generator. In the fragmentation policy, the fragmentation information extracted from the rule analysis module of the packet generator is read, and the permission / rejection information of the fragmentation packet is extracted (124-4) to automatically generate test cases of normal and abnormal states. Security test method for a network system, characterized in that. The method according to claim 3 or 4, The fourth process is that the read information In case of the basic policy, test Oracle is generated automatically by extracting the packet to be transmitted by analyzing the transport packet corresponding to the test scope of the test case. When it comes to flooding policies, test cases are generated automatically by analyzing the total number of packets that can arrive using test cases that meet the flooding criteria. When it comes to state-based policy, it automatically generates test Oracle by analyzing packets that induce normal state transitions. If the fragmentation policy is for the security test method of the network system, characterized in that the process of automatic generation of the test Oracle by analyzing the arrival of the fragmented packet using a test case. The method according to claim 3 or 4, The fifth process If it is about the basic policy, the test Oracle and the packet analyzer are compared with the log of the packets received to automatically determine whether only the packets that can pass are passed. If it is about flooding policy, the test Oracle and the packet analyzer are compared to log the packets received to automatically determine whether only the number of packets allowed is passed. When it comes to state-based policy, the test Oracle and the packet analyzer are compared to log the packets received to automatically determine whether an acceptable state transition has been made. If it is related to the fragmentation policy, it is a process of comparing the log of the packet received by the test Oracle and the packet analyzer to automatically determine whether only the allowable fragmented packet passed.

Images