KR101040543B1 - Detection system and detecting method for the cryptographic data in SSH - Google Patents

Abstract

The present invention relates to a detection system for detecting encrypted data in a communication environment based on SSH, and a detection method implemented using the detection system. In the communication environment for transmitting and receiving between the server and the server 20, the address translation module 31 for converting the IP and the port of the server 20 recognized by the client (11, 12) to the IP and port of the proxy module 33 ; The encrypted data received from the clients 11 and 12 is decrypted, the data to be transmitted to the clients 11 and 12 is encrypted, and the server 20 and the client 11 are used to confirm authentication of the connected clients 11 and 12. 12) a proxy module 33 for mediating direct communication between; In communication with the server 20, an agent that decrypts the encrypted data received from the server 20 and transmits the decrypted data to the proxy module 33, and encrypts the data received from the proxy module 33 to the server 20. Module 35; And verify the decrypted data communicating between the proxy module 33 and the agent module 35 and control the communication state between the proxy module 33 and the agent module 35 according to the criteria input to the security policy DB 36. The detection device 30 including the management module 34 to mediate the communication between the client (11, 12) and the server 20.

Description

Detection system and detecting method for the cryptographic data in SSH

The present invention relates to a detection system for detecting encrypted data in a communication environment based on SSH, and a detection method implemented using the detection system.

A security program called SSH or Secure Shell (hereinafter referred to as 'SSH') is a security with a network function that allows you to connect to another computer, execute commands through a remote system, copy files, etc. to another system. System.

SSH is designed to replace existing rsh, rlogin, telnet, etc., and ensures secure communication security in network environments that do not have strong authentication methods or have weak security. This is because the encryption method is applied to the data transmitted during the SSH communication process, and even though the data is exposed in the communication path, the exposed data is expressed as an encrypted character unknown to a third party, making it difficult to interpret the data.

SSH, meanwhile, utilizes a secure encrypted secure terminal session. Security threats such as Man In The Middle (MITM) attacks with high security algorithms (3DES, Blowfish, Twofish, Arcfour, Cast128-cbc) and strong authentication methods (public key-based authentication methods such as DSA and RSA) Corresponds to. The above-described cryptographic algorithm is internationally verified, and is designed not to intercept data by deceiving access identity in the middle of a network or by interfacing communication messages through a public key-based authentication scheme. In addition, communication traffic is dynamically selected and changed in multiple channels (256 channels), thereby maximizing security.

On the other hand, if the data is changed during the session transmission in the middle of the network, SSH immediately releases the connection without using the data to enhance the stability of data tampering, which is a kind of powerful hash algorithm to check whether the data has been tampered with. SHA-1 (a hash algorithm that changes all data even if only 1 bit of the algorithm with the effect of avalanche) is used.

However, the above-mentioned strong security of SSH is useful for data security between communication parties, but it is very disadvantageous in protecting the entire network and system and managing the communication environment through the contents verification. In other words, in the network communication environment where SSH is applied, the security system for network and system protection cannot check the structure and status of the communication data protected by SSH at all, thus blocking the problem data and the hacking program attached to the normal data. Or identification of various viruses is difficult.

Therefore, in a communication environment that transmits and receives encrypted data such as SSH, a separate program for security should be installed in clients and / or terminals of the network to complete the security system. However, since such a security system must partially change or modify the configuration of a complete SSH, a complete understanding of the structure of the SSH and a study for the SSH change or modification and security system must be performed together in order to manufacture the security system. As a result, a considerable amount of time and money must be consumed to complete the security system.

Of course, you can see SSH protocol-1 (previous versions that are vulnerable to encryption and key exchange) by packet sniffing using the hacking technique of some systems, the Men In The Middle (MITM) attack. In the network applied with the SSH protocol-2, which supplements the problem of the SSH protocol-1, the communication history between the server and the client cannot be checked at all, and even a sniffing method cannot block or tamper with the session through the SSH without breaking the session. The proposed security program is not a complete solution to the above problem.

After all, in the network environment by SSH applied server, even though it is impossible to monitor communication details through a separate security system, even if it can be monitored, it is inconvenient due to portability or compatibility problems and economic burden due to technology development. The application of a separate security system has not been achieved at all in the user environment of the network.

Accordingly, the present invention has been devised to solve the above problems, and to enable the server or client to perform the function of verifying, detecting, tampering, and blocking encrypted SSH data without installing a separate program for configuring a security system. The technical problem is to provide an encrypted data detection system and detection method in a communication environment.

According to an aspect of the present invention,

In a communication environment for transmitting and receiving encrypted data between the client and the server, such as SSH, the address translation module for converting the IP and port of the server recognized by the client to the IP and port of the proxy module;

A proxy module for decrypting the encrypted data received from the client, encrypting the data to be transmitted to the client, and mediating direct communication between the server and the client for authentication of the connected client;

An agent module for communicating with the server, decrypting the encrypted data received from the server and transmitting the decrypted data to the proxy module, and encrypting the data received from the proxy module and transmitting the encrypted data to the server; And

A management module for checking decrypted data communicating between the proxy module and the agent module and controlling a communication state between the proxy module and the agent module according to a criterion input to the security policy DB;

The detection device comprising a is an encrypted data detection system of the CS communication environment to mediate communication between the client and the server.

The present invention to achieve the above technical problem

In the detection system including a detection device for mediating the communication between the client and the server, Traffic detection step of converting the IP and port of the server recognized by the client to the IP and port of the detection device;

An authentication confirmation step of directly connecting the client and the server to confirm the authentication of the client, and controlling a communication state with the client according to the authentication result;

A data decryption step of decrypting the encrypted data transmitted from the client when authentication of the client by the server is confirmed;

A data management step of checking the decrypted data and controlling a communication state with the client according to a security policy standard;

A data encryption step of encrypting the data when the decrypted data is confirmed; And

A transmission step of transmitting the data encrypted in the encryption step to the server;

The encrypted data detection method of the CS communication environment comprising a.

The present invention described above, by placing a detection device that applies the SSH communication environment as it is in the gateway section between the server and the client in the SSH-based communication environment, SSH traffic containing encrypted data without cumbersome changes or modifications of the server and client It can detect and analyze picks, which can enhance SSH network security.

In addition, it can be applied in parallel with the existing security system of all Inline gateway or Proxy gateway environment built in OS, and it can be applied to various network environments as it can change the information of decrypted data as well as complete decryption of encrypted data. It is effective to use enhanced security functions.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing an embodiment of a detection system according to the present invention, Figure 2 is a flowchart showing an embodiment of a detection method according to the present invention, it will be described with reference to this.

The detection system according to the present invention mediates communication between the clients 11 and 12 and the server 20 so as to detect and confirm communication data between the clients 11 and 12 and the server 20 for managing and supervising data. Including the detection device 30, the detection device 30 is operated by the administrator to modify and update the security policy of the communication between the client (11, 12) and the server 20 as well as control and management of the system operation The management terminal 30a is included.

The detection device 30 may be applied to an SSH-based network environment, or may be applied to a network communication environment in which various communication programs such as telnet and the like are combined with SSH. This will be described in more detail below.

The detection system according to the present invention includes a detection device 30 for mediating communication between the clients 11 and 12 and the server 20, and the detection device 30 includes a client 11 flowing to the server 20. An address translation module 31 for directing the transmission traffic of 12) to the detection device 30, and a proxy for configuring the clients 11 and 12 to recognize the detection device 30 as the server 20 and encrypting and decrypting the data. Module 33, a management module 34 for checking and processing the decrypted data, and an agent module 35 for decrypting and transmitting the data transmitted from the management module 34 or the server 20 to the server 20. And a security policy DB 36 which stores and updates security policy information on detection and management criteria through the management terminal 30a, and records the communication status between the clients 11 and 12 and the server 20. The audit log DB 37 may be further included.

An embodiment of a detection method will be described together for a more detailed description of the detection system according to the present invention.

S10; Traffic Driven Step

In the network communication between the clients 11 and 12 and the server 20 based on SSH, the address translation module 31 detects the data traffic of the clients 11 and 12 transmitted to the server 20. To guide. For this purpose, DNAT of iptables may be applied to the address translation module 31.

The data transmitted by the clients 11 and 12 to the target 20 is transmitted to the detection device 30 instead of the server 20 through the traffic induction of the address translation module 31. However, the clients 11 and 12 recognize the current connection as the server 20 instead of the detection device 30 by the operation of the address translation module 31. To this end, the address translation module 31 converts the IP address of the server 20 and the session to the SSH service port (TCP 22) into the IP address and service port that the proxy module 33 is waiting to receive.

The following is an example of an address translation script.

-A PREROUTING -d 192.168.1.123 -p tcp -m tcp --dport 22 -j DNAT --to-destination 127.0.0.1:4001

S20; Authentication / Channel Verification Step

The data transmitted from the clients 11 and 12 is transferred to the proxy module 33 of the detection device 30 through the traffic derivation of the address translation module 31, and the proxy module 33 is the client 11 or 12. Mediates communication with the server 20 for authentication.

In more detail, the server 20 for communicating based on SSH communicates only with the authenticated clients 11 and 12 for maintaining a stable communication environment and security. Therefore, when any client 11, 12 transmits data for communication with the server 20, the server 20 checks whether the client 11, 12, which is the subject of the data transmission, is an authenticated client. However, in the detection system according to the present invention, the data transmission of the clients 11 and 12 passes through the detection device 30, and the detection device 30 manages the communication between the clients 11 and 12 and the server 20. Since it is for supervision, the authentication of the client (11, 12) must be made in the detection device (30).

By the way, the detection system according to the present invention, while minimizing the modification of the existing system consisting of the client 11, 12 and server 20 to communicate on the SSH basis in order to minimize the initial burden for the reinforcement of the detection device 30 Since only the detection device 30 is added to allow normal system operation, the authentication of the clients 11 and 12 is performed in the server 20 as before, and the detection device 30 according to the present invention is a client ( In the authentication procedure of 11 and 12, the proxy module 33 mediates the clients 11 and 12 and the server 20.

Meanwhile, SSH includes a plurality of traffic channels (256 channels) between the clients 11 and 12 and the server 20, and changes the effective channel between the clients 11 and 12 and the server 20 from time to time for security. Therefore, the server 20 checks the channel synchronization between the clients 11 and 12 and the server 20 together with the authentication procedure, thereby limiting data communication between the clients 11 and 12 and the server 20.

In the SSH-based network as described above, the client (11, 12) to communicate with the server 20 via the detection device 30, the server 20, the current communication target is not the detection device 30 And the server 20 recognizes the current communication target as the clients 11 and 12 instead of the detection device 30, and thus the client 11 and 12, the detection device 30, and the detection device 30. Each traffic channel of the server 20 will be independently checked for synchronization. That is, the traffic channels of the clients 11 and 12 and the detector 30 and the traffic channels of the detector 30 and the server 20 may be different.

Therefore, the server 20 may check the synchronization of the channel together with the authentication of the clients 11 and 12, which is the intermediary of the proxy module 33, and at this time, the server 20 recognizes the clients 11 and 12. Check whether the channel is synchronized with the detection device (30). On the other hand, the proxy module 33 waits for the final confirmation of the server 20 for authentication and channel synchronization.

S40; Data decryption step

The management module 34 transmits an authentication failure message to the client 11 or 12 or terminates the session itself when the server 20 rejects the connection for the reason of no authentication or channel asynchronous at the final confirmation of the server 20.

On the other hand, when the server 20 confirms the connection on the basis of the authentication value and / or the channel synchronization at the final confirmation of the server 20, a virtual TTY (TeleTYpewriter) is generated and the data transmitted from the clients 11 and 12 are transmitted. It is transmitted to the agent module 35 through the management module 34.

By applying the virtual TTY to the proxy module 33 and the agent module 35, the module 33. 35 can pass SSH sessions to each other without being limited to standard input (stdin) and standard output (stdout). Forms the basis.

Subsequently, the encrypted data transmitted from the clients 11 and 12 is decrypted by the proxy module 33. As described above, the clients 11 and 12 communicate directly with the server 20 and the server 20 recognizes as communicating directly with the clients 11 and 12, but in practice the clients 11 and 12 and the server 20 ) Communicate with each other through the intermediary of the detection device 30, so that the management of the public and private keys between the clients 11 and 12, the detection device 30, the detection device 30 and the server 20 is performed separately.

The proxy module 33 decrypts the encrypted data transmitted from the clients 11 and 12 according to the promised rule and transmits the encrypted data to the management module 34.

S50; Data management stage

The management module 34 receives the decrypted data transmitted from the proxy module 33, detects and confirms it, and collects, detects, blocks, and modifies data according to the security policy.

The security policy DB 36 stores a criterion for determining whether to allow the communication according to the contents of the decrypted data while communicating with the management module 34. The IP addresses and connection IDs of the clients 11 and 12 are stored. , The program information, the access time, and the like, as well as the text of the deciphered data through decoding, determine whether to transmit the server 20 according to whether or not the prohibited word is written.

The security policy DB 36 may be updated through the operation of the management terminal 40, and the criteria of the security policy to be updated may be various in addition to the above-described example.

When the transmission of the server 20 is determined, the data is transmitted to the agent module 35. If the transmission is rejected, the data may be transmitted to the client 11 or 12, or the session may be terminated. In addition, a command not allowed by the security policy may be blocked by the management module 34, and the corresponding session may be terminated or an appropriate blocking message may be transmitted to the clients 11 and 12.

Meanwhile, the management module 34 records and stores information on the newly created session in the audit log DB 37. This is to record and store the history information in the audit log DB 37 even after the command is blocked or the session is terminated, so that the administrator can check it.

In general, the integrated console connection (Telnet, SSH) of the network is performed through '/ dev / pts0X', which is a logical device of the connection target server. In this case, the standard input / output of the console is a structure that is input / output on the screen of the client access program through the communication interval, and the detection system according to the present invention substitutes the virtual '/ dev / tty0X' for '/ dev / pts0X'. Use 'to ignore standard input / output or transfer only empty data with a data length of' 0 '. Therefore, the server 20 which has performed the authentication and channel synchronization check procedure can continue stable operation without a system error despite the blocking by the management module 34.

S60; Data encryption step

The data transmitted through the transmission permission of the management module 34 is transmitted to the agent module 35 and then encrypted again and transmitted to the server 20.

The agent module 35 is recognized as the clients 11 and 12 from the viewpoint of the server 20, and the data received from the proxy module 33 is transmitted to the server 20 as if the user of the clients 11 and 12 keystrokes. Is sent.

Meanwhile, in the embodiment of the present invention, a Unix Domain Socket (UDS) may be applied as a communication environment between the proxy module 33 and the agent module 35, which is a path through which the management module 34 checks the decrypted data. As a result, the data communication between the proxy module 33 and the agent module 35 is made of UDS instead of the standard input / output communication structure of pts or tty, and the agent module 35 receiving the data encrypts the data of the pts or tty. Transfer to server 20 through a communication structure. Description of this will be described in detail below.

S70; Transmission step

The agent module 35 encrypts the data and transmits the data to the server 20, and the server 20 receives the data and performs a communication procedure between the general clients 11 and 12 and the server 20.

As described above, in the SSH-based network environment, the encrypted data transmitted from the clients 11 and 12 is transmitted to the server 20 through the detection device 30, specifically, transmitted from the clients 11 and 12. Data is transmitted to the server 20 through the proxy module 33, the management module 34 and the agent module 35. At this time, the proxy module 33 decrypts the encrypted data of the client, and the agent module 35 encrypts the decrypted data and transmits the encrypted data to the server 20.

On the other hand, the encrypted data transmitted from the server 20 is transmitted to the agent module 35, the agent module 35 decrypts the encrypted data, the proxy module 33 encrypts the decrypted data to the client 11 , 12).

The latter process is the same as the flow of data described above, so the description thereof is omitted here.

3 is a block diagram illustrating another embodiment of a detection system according to the present invention, and FIG. 4 is a flowchart illustrating another embodiment of the detection method according to the present invention.

The detection system according to the present invention further includes a communication type confirmation module 32, and can be applied in parallel with an existing security system of all Inline gateway or Proxy gateway environments based on SSH.

The data communication of the clients 11 and 12 induced by the address translation module 31 confirms which communication type is applied through the communication type checking module 32, and the communication type checking module 32 confirms the confirmed communication. This is handled according to the format.

Therefore, in the detection method according to the present invention, after the traffic derivation step (S10), the communication type confirmation step (S20) is performed.

S20; Communication type check step

In order to allow the detection system according to the present invention to simultaneously handle Telnet and SSH, it operates as an existing security system in an Inline gateway or Proxy gateway environment or processes an SSH session according to the characteristics of the session through a PTS (Pseudo TTY Slave) inspection routine. Configure branching to work in any way you can.

Pseudo code for identifying whether the service of the server 20 to be connected is Telnet or SSH is as follows.

[Pseudo code]

/ **
* @brief
* Function to determine whether the service is Telnet or SSH based on the input pts_ip and pts_port
* @param pts_ip: IP address of the PTS server
* @param pts_ip: PTS service port
* @return PTS_TYPE_TELNET (telnet), SSH_DEFAULT_PORT (SSH)
* @remark
* Perform ssh_server.lst check, real connection and input port check in combination.
* /
integer check_pts_type (String * pts_ip, Integer pts_port)
{
integer type;

/ * Step 1: If the service is in the list of already recorded SSH server, it is regarded as SSH service * /
type = check_server_list (pts_ip, pts_port);
if (PTS_TYPE_UNKNOWN! = type)
return type;

/ * Step 2: TCP connection based on IP address and port is used to determine SSH based on the information returned * /
type = check_pts_socket (pts_ip, pts_port);
if (PTS_TYPE_UNKNOWN! = type)
return type;

/ * Step 3: Determine SSH based on port if never logged and no response from server * /
if (SSH_DEFAULT_PORT == pts_port)
return PTS_TYPE_SSH;

/ * Step 4: If all of the above checks can't determine whether SSH or Telnet, lead to legacy code * /
return PTS_TYPE_TELNET;
}

When the server 20 to be connected through the check routine is confirmed as the SSH server, the plain text communication section between the proxy module 33 and the agent module 35 is configured as a Unix Domain Socket. In the detection system according to the present invention, in order to configure a communication channel between a plurality of clients 11 and 12 and a plurality of servers 20 without duplication, a path of a Unix Domain Socket is automatically generated in the following manner.

[Path to Unix Domain Socket]

-Departure IP Address: 192.168.1.69, Departure Port Number: 1234, Destination IP Address: 192.168.1.70, Destination Port Number: 22
-Where is the Unix Domain Socket path?
ssh_192.168.1.69_1234_192.168.1.70_22. generated by sock

As a result, when the detection system according to the present invention is applied to the path of the existing security system that communicates through the Inline gateway or Proxy gateway environment, the same socket function is used for the Unix Domain that transmits / receives the TCP / IP socket of the existing security system. Apply Socket to replace IP address and port information.

Therefore, the communication type checking module 32 checks the communication path between the clients 11 and 12 and the server 20, and if it is confirmed with SSH, the proxy module 33 receives the data received through the address translation module 31. In addition, when the transmission is performed through the management module 34 and the agent module 35, and the other environment is confirmed, the data received through the address conversion module 31 is directly checked by the management module 34 and then the server ( 20) (S80; data management step).

1 is a block diagram showing an embodiment of a detection system according to the present invention;

2 is a flowchart showing an embodiment of a detection method according to the present invention;

3 is a block diagram showing another embodiment of a detection system according to the present invention;

4 is a flowchart illustrating another embodiment of a detection method according to the present invention.

Claims (8)

delete delete delete delete In the system of mediating communication between the clients 11 and 12 and the server 20 through the detection device 30 based on SSH, the IP and port of the server 20 recognized by the clients 11 and 12 are determined. A traffic derivation step of the address conversion module 31 converting the IP and the port of the detection device 30; The proxy module 33 directly connects the clients 11 and 12 and the server 20 so that the server 20 can check whether the clients 11 and 12 are authenticated, and the clients 11 and 12 and the detection device. Of the plurality of traffic channels connecting 30, the traffic channels set in the clients 11 and 12 and the traffic channels set in the detection device 30 are checked to match each other, and thus the clients 11 and 12 and the detection device 30 are identified. Authentication confirmation step of controlling the communication between; A data decryption step of the proxy module 33 decrypting the encrypted data transmitted from the clients 11 and 12 while the communication between the clients 11 and 12 and the detection apparatus 30 is maintained; The management module 34 checks the decrypted data and controls the communication with the clients 11 and 12 according to the criteria input to the security policy DB 36; A data encryption step of encrypting the decrypted data by the agent module 35; And The agent module 35 transmitting the encrypted data to the server 20 through the traffic channel of the detection device 30 and the server 20; Encrypted data detection method of the CS communication environment comprising a. delete The method of claim 5, The communication section of the data decrypted by the detection device 30 is Unix Domain Socket characterized in that the encrypted data detection method of the HS communication environment. The method of claim 5, By checking the data of the client (11, 12) transmitted to the detection device 30 through the traffic derivation step, the communication path between the client (11, 12) and the server 20 is any of SSH, Inline gateway or Proxy gateway The method of claim 1, further comprising a communication type checking step of selecting and determining a processing path for data confirmation.

Images