KR100796814B1 - Pci-type security interface card and security management system - Google Patents

Abstract

A PCI(Peripheral Component Interconnect)-typed security interface card and a security management system using the same are provided to prevent hacking infection or spread of a worm virus or hacking which detours security equipment of a gateway end fundamentally by attaching the PCI-typed security card to a main board of a server. A security card body(20) determines access of a user requesting the access through the internal/external network and packet transfer depending on a predetermined security level. A power supply interface(13) is installed under the security card body and supplies operation power by being mounted on a PCI slot of the main board of the server. A control interface(14) is installed under the body and transfers a command received from the server by being mounted on the PCI slot of the main board. An external connection port(11) is installed to one side of the security card body and transceives the packet connecting the external environment to a network cable. An internal connection port(12) is installed to one side of the security card body, refines/transmits the packet received from the outside to the server or receives the packet received from the server, and is connected to an NIC(Network Interface Card) end of the server through a cable.

Description

PC-type security interface card and security management system

1 is a block diagram showing a PCI type security interface card according to the present invention.

FIG. 2 is a diagram illustrating a security management system of servers equipped with the PCI type security interface card of FIG. 1. FIG.

3 is a view showing the configuration of a central management server constituting the security management system of FIG.

<Description of the symbols for the main parts of the drawings>

10: PCI type security interface card 11: external connection port

12: internal connection port 13: power supply interface

14: control interface 20: security card body

21: central processing unit 22: boot memory

23: packet buffer 24: pattern storage memory

30: individual server 40: central management server

41: individual server connection 42: security policy setting unit

43: log file collection unit 44: security report generation unit

45: danger level notification unit 50: RDBMS

60: management console

The present invention relates to a PCI type security interface card to prevent hacking and virus penetration of individual servers, and in particular, separate security of packets transmitted from the server and packets received separately from the main board of the server and separately A PCI type security interface card, which makes up for the above-mentioned disadvantages of conventional borderline security products; A central management server capable of integrated management of individual servers equipped with the PCI type security card and security interface cards mounted on the individual servers, and connected to the central management server to establish a security policy and monitor each individual server. It provides a security management system consisting of a management console that can be used and an RDBMS that stores and manages log files of individual servers collected from a central server, thereby protecting individual servers from hacking threats from external and internal users.

Current security products for protecting information by preventing servers from being hacked are being developed and provided based on a software method and a hardware method.

The security method of the software method is mainly provided in the form of a program, it is installed on the server to block harmful information from the outside, but because of operating in a single application state inside the operating system, the problem of performance degradation or existing system or other There was a problem with conflicts with programs.

In addition, hardware-based security products have been developed as a single solution used in network systems and integrated security products that integrate Firewall, IDS, VPN, and so on. It was installed in the network to block harmful information from outside and prevent hackers from invading through the gateway to prevent malicious viruses from entering the server or leaking information from the server.

However, as described above, a security product installed at a gateway stage, that is, a boundary line can prevent intrusion from the outside through a network, but there is a problem in that it is difficult to fundamentally respond to malicious hacking of an internal user.

In addition, the conventional security products are installed in the Internet contact area that can be used VPN and wireless LAN, there is a problem that can be invaded inside by bypassing the contact area is always exposed to the bypass infiltration.

In addition, there was a problem that it was difficult for the internal critical server to cope with the distribution and spread of malicious worm virus by internal users, and it was difficult to control the access to the internal network when the subcontractor resides, which made it difficult to cope with the protection of the main server. There was a problem.

In addition, since the hardware-based security products use a separate power source, there was a problem that a serious obstacle to security occurs when the power is cut off, and since the product is large and expensive, it takes a lot of cost to build a security system. There was also a problem that it is too expensive to buy separately for mounting on a server or PC.

  In addition, all of the software or hardware-based security products operate on the server's operating system, which makes them vulnerable to DoS or DDoS attacks and worm viruses. Server resources such as CPU and memory of the server There was also the problem of slowing down overall server performance because of sharing.

Accordingly, the present invention provides a PCI-type security interface card that can be individually mounted on the main board of the server in order to solve the problems of the above-described software and hardware-based security products, hacking is made by bypassing the security equipment of the gateway It aims to be able to fundamentally prevent worm virus infection or spread.

In addition, by installing the PCI-type security interface card according to the present invention for each server separately to prevent malicious hacking by the internal user or illegal access to the important server to protect the company's important information resources safely For another purpose.

In addition, it can be installed on the server individually to prevent conflicts with existing operating systems or other programs, and to block DDoS attacks and worm viruses and protect the server safely without degrading server performance due to the addition of security functions. To do it for another purpose.

In addition, since it is mounted on the server and driven by receiving power from the server, another object of the present invention is to prevent a problem of power failure in advance without using a separate power source.

In addition, because it is manufactured in a small size to be mounted on the main board it is possible to reduce the manufacturing cost to facilitate the security of individual servers and PCs without burdening the consumer purchase.

In order to achieve the above object, the present invention includes a security card body for determining whether or not the connection of the user requesting access through the internal and external network and whether or not the packet transmission according to a predetermined security level; A power supply interface installed at the bottom of the security card main body and supplied with a PCI slot of a main board of the server to supply power for driving; A control interface installed at the bottom of the security card main body and mounted in a PCI slot of the main board of the server to transmit a command from the server; An external connection port installed at one side of the security card main body and transmitting and receiving a packet connecting a network cable with an external environment; PCI type security interface is installed on one side of the main body of the security card, characterized in that it consists of an internal connection port connected to the server's NIC end by receiving a packet transmitted from the server to refine the packet transmitted from the outside to the server Provide the card.

In addition, the main board is equipped with a PCI type security card, and the individual server is installed a security card control agent for controlling the security card; A central management server connected to the individual servers to set a security policy and control a security card through the control agent accordingly, and monitor the server and the network; An RDBMS connected to the central management server to store and manage log files collected for each server to generate statistical values of log files for generating reports; Access the central management server through an encrypted web browser to establish a security policy of the protected server connected to the central management server, and a PCI-type security interface card comprising a management console configured to allow the security administrator to monitor Provides a security management system.

Hereinafter, with reference to the accompanying drawings will be described in more detail the present invention.

1 illustrates a PCI type security interface card 10 according to the present invention, and includes a security card body 20 for determining whether a user requests access through an internal and external network and whether a packet is transmitted according to a preset security level. ; A power supply interface 13 installed at the bottom of the security card body 20 and mounted in a PCI slot of a main board of the server to supply driving power; A control interface 14 installed at the bottom of the security card main body 20 and mounted in a PCI slot of the main board of the server to transmit a command from the server; An external connection port 11 installed at one side of the security card main body 20 for transmitting and receiving a packet connecting a network cable with an external environment; Installed on one side of the security card main body 20 is purified by the packet transmitted from the outside and transmitted to the server or receives the packet transmitted from the server and consists of an internal connection port 12 connected to the NIC end of the server.

In addition, the security card main body 20 is applied to the inbound packet received by the external connection port 11 from the external network or the outbound packet received from the server and sent to the external network by applying a preset security level. A central processing unit (21) for determining whether or not to transmit a packet to a connected authorized person, and for identifying, purifying, and processing the virus in the packet; A boot memory 22 which receives power from the power supply interface 13 and is executed for smooth operation of the security card; A packet buffer 23 which is a buffer space memory of a predetermined space for processing a large amount of packets; It consists of a pattern storage memory 24 for setting and storing a security policy and storing a pattern, and an LED 25 for indicating an operation state of the security card.

In addition, the control agent, which is a program stored in the boot memory of the security interface card or separately provided, is installed in the server where the PCI type security interface card is installed. The control agent manages a physical connection state between the security interface card and the server, executes a command for establishing a security policy, retrieves the version of the security card in real time, and checks or applies an update in real time.

In the security method of the PCI-type security interface card as described above, a server operator or a PC owner directly sets a security policy so that only an authorized user can access the server. Next, check the IP and service level to access the server in accordance with the set security policy so that only authorized users can access the server. In addition, by performing detailed packet inspection on the user and service level allowed access, if it is determined to be a bad packet according to the set security policy, it blocks it, and passes only the safe packet to the server through the internal connection port. In addition, for DOS, DDOS, traffic anomaly, and protocol anomaly attacks, traffic control and management functions are provided when setting the security policy to control the harmful traffic flowing into the server to improve server safety. can do.

As described above, the PCI type security interface card accesses the user connected to the server according to the authorized user and the service level, and even the accessed user checks the safety of the packet and transmits only the safe packet to the server to the user through the external network. And secure the server from internal users.

The PCI-type security interface card as described above has been described as being mounted on the server, but can be easily applied to the security of the PC by mounting it on the motherboard of the PC.

Next, FIG. 2 schematically shows a security system for centrally managing individual servers installed with a PCI type security interface card according to the present invention, in which a PCI type security interface card is mounted on a main board and controls the security card. Individual servers 30 to which a security card control agent is installed; A central management server 40 connected to the individual servers 30 to set a security policy and to control the security card through the control agent and to monitor the server and the network accordingly; A relational database management system (RDBMS) 50 connected to the central management server 40 for storing and managing log files collected for each server to generate statistical values of log files for generating reports; Access to the central management server through an encrypted web browser to establish a security policy of the server to be protected connected to the central management server, and consists of a management console 60 to monitor the security administrator.

In addition, Figure 3 shows the configuration of the central management server 40 of the security system of Figure 2 in accordance with the present invention, the central management server 40 is integrated management intensively distributed security for each individual server 30 In order to manage the control agent installed in the individual server 30 to update the security policy for each individual server in real time, the individual server connection unit 41 for requesting the execution of the command; A server-specific security policy setting unit 42 for setting and controlling an individual security policy by varying a security level according to data stored for each server 30; A log file collecting unit 43 for collecting log files of users accessing individual servers according to the established security policy, calculating statistical values, and storing the calculated log values in the RDBMS; A security report generator 44 for generating a security report for each server according to the statistical value calculated by the log file collector 43; The individual server 41 is configured to include a risk level notification unit 45 to check whether the intrusion of hackers or infiltration of the virus in real time to tell the level of danger.

In the security method of the security system using the PCI type security interface card configured as described above, first install the PCI type security interface card on the motherboard for each server, and install the security card control agent for each server. Next, the central management server classifies the security level of the data stored in each server, establishes a security policy for each server, and transmits the established security policy to each server to reflect a separate security policy for each server. At this time, the security policy provides the information of the access authorization for each server so that an unauthorized person can block the access beforehand. Next, establish a security policy by collecting log files connected to individual servers according to the established policy, storing them in the RDBMS, calculating the general value at regular intervals, and generating security reports of individual servers based on the statistics. It is used as data to say.

As described above, by installing a hardware-type PCI type security interface card and a security card control agent according to the present invention, by establishing and applying a security policy according to the security level of the server through the central management server to access not only external users but also internal users Authority can be supervised.

As described above, the present invention has been described with reference to the embodiments shown in the drawings, but it is only for illustrating the invention, and those skilled in the art to which the present invention pertains various modifications or equivalents from the detailed description of the invention. It will be appreciated that one embodiment is possible. Therefore, the true scope of the present invention should be determined by the technical spirit of the claims.

As described above, the PCI type security interface card according to the present invention provides a PCI type security interface card that can be individually mounted on a main board of a server, thereby preventing hacking or worm virus infection or spreading by bypassing a security device at a gateway end. Can be prevented fundamentally.

In addition, by installing the PCI-type security interface card according to the present invention for each server, it is possible to fundamentally block malicious hacking by the internal user or illegal access to the important server to securely protect important information resources of the enterprise.

In addition, by separately installing on the server, it is possible to prevent conflicts with existing operating systems or other programs, and to block DDoS attacks and worm viruses and to secure the server without degrading the server performance due to the addition of security functions. .

In addition, since it is mounted on the server and driven by receiving power from the server, there is no need to use a separate power source, thereby preventing the problem of power failure in advance.

In addition, since it is manufactured in a small size to be mounted on the main board of the server, manufacturing cost can be reduced, so that individual servers and PCs can be easily secured without burdening consumers.

Claims (6)

A security card body for determining whether a user who requests access through an internal or external network and whether or not a packet is transmitted according to a preset security level; A power supply interface installed at the bottom of the security card body and mounted in a PCI slot of a main board of the server to supply driving power; A control interface installed at the bottom of the security card main body and mounted in a PCI slot of the main board of the server to transmit a command from the server; An external connection port installed at one side of the security card main body and transmitting and receiving a packet connecting a network cable with an external environment; PCI type security, characterized in that it is installed on one side of the main body of the security card and purified by the packet transmitted from the outside to transmit to the server or receive the packet transmitted from the server and an internal connection port connected to the NIC of the server by a cable Interface card. The method of claim 1, The security card body, Determining whether a connection is made and whether to send a packet to an authorized user by applying a preset security level to an inbound packet received from an external network by an external connection port or an outbound packet received from a server and sent to an external network, A central processing unit for identifying and purifying the packet including the virus; A boot memory which receives power from the power supply interface and is executed for smooth operation of the security card; A packet buffer which is a buffer space memory of a predetermined space for processing a large amount of packets; A pattern storage memory for setting and storing security policies and storing patterns; PCI type security interface card comprising an LED indicating the operating state of the security card. The method of claim 1, The PCI type security interface card, It further comprises a control agent that manages the physical connection between the security interface card and the server, performs a command for establishing a security policy, and checks or applies an update by searching for the version of the security card in real time. PCI-type security interface card. The method of claim 3, wherein The security policy of the control agent, PCI type security interface card, characterized in that for setting the access authorization, and determine the level of accessible services, such as the authorization, to determine the safety of the packets received from the external port, and to adjust and manage the traffic level. A main server equipped with a PCI type security interface card of claim 1 and installed with a security card control agent for controlling the security card; A central management server connected to the individual servers to set a security policy and control a security card through the control agent accordingly, and monitor the server and the network; An RDBMS connected to the central management server to store and manage log files collected for each server to generate statistical values of log files for generating reports; Access the central management server through an encrypted web browser to establish a security policy of the protected server connected to the central management server, and a PCI-type security interface card comprising a management console for the security administrator to monitor Security management system using. The method of claim 5, wherein The central management server, An individual server connection unit for managing a control agent installed in each server to centrally manage the security distributed by each server, updating the security policy for each server in real time, and requesting execution of a command; A server-specific security policy setting unit for setting and controlling an individual security policy by varying a security level according to data stored for each server; A log file collecting unit collecting log files of users accessing individual servers according to the established security policy, calculating a statistical value, and storing the calculated log values in the RDBMS; A security report generator for generating a security report for each server according to the statistical value calculated through the log file collector; Security management system using a PCI-type security interface card, characterized in that it comprises a risk level notification unit that informs the risk level in real time by checking whether the hacker intrusion or virus infiltration to the individual server.

Images