KR101067686B1 - System and method for network security policy management based on web services security - Google Patents

Abstract

The present invention relates to a network security policy management system and method based on web services security that can safely and efficiently manage network operations such as service use and resource use of network nodes in a network environment.
In the network security policy management system based on the web service security according to the present invention, a security policy management system for managing a network security policy for service use of a network node made through a network, the service (2) of the network node (1) A security policy server 10 which registers and manages network security policy information according to use in a database 11 and applies network security policy information registered in the database 11 to perform network security; A security policy agent 20 installed in the network node 1 to receive network security policy information from the security policy server 10 and to manage and apply a security policy of the network node 1; In the event of a threat situation in the network, the differentiated security policies for each threat situation are applied to minimize the damage of the network according to the threat situation, and the security policy can be changed and applied in real time to enable flexible and active network security operations. To help.

Description

System and Method for Network Security Policy Management based on Web Services Security

The present invention relates to a network security policy management system and method based on web services security that can safely and efficiently manage network operations such as service use and resource use of network nodes in a network environment.

In particular, the present invention allows the network nodes to operate on the network such as service use and resource use based on the security policy, so that the operation of the network can be more efficiently operated and managed, and the threat situation in the network is increased. It is a network security policy management system and method for minimizing the damage of a network caused by a threat situation by separately operating a security policy for each threat situation. In addition, the present invention provides a secure and efficient network operation utilizing a security policy server for setting and managing a security policy of a network environment, a security policy agent for managing a security policy of a network node, and a web service security for secure communication between them. The present invention relates to a network security policy management system and a method for enabling the same.

1 illustrates a network configuration diagram of a network node and a service in a conventional general network environment.

As shown in FIG. 1, in a network environment, network nodes 1 generally use services 2 and serve to use resources of a network. The network environment includes a ubiquitous network, a home network, a sensor network, and a binary CDMA network, such as ubiquitous devices in a ubiquitous network, information appliances in a home network, various sensors in a sensor network, and binary CDMA in a binary CDMA network. Become network nodes.

In general, in the above network environment, once the network nodes 1 have been authenticated through the authentication procedure, the use of the service 2 and the use of resources are possible in a predefined privilege range. In addition, by acquiring the authentication information of the nodes through hacking such as network scanning, sniffing, and spoofing, it is possible to use services and use resources in a predefined range of privileges even through illegal access of the network. In other words, even if illegally authenticated, illegal access is recognized and not restricted to activities on the network as much as a predetermined authority until special restriction measures occur.

As a result, illegal actions in the network environment are not blocked until the restriction on the illegal access occurs, thus allowing illegal access to the entire network, even when normal use of the network is impossible.

In other words, in the network operation under the conventional network environment, it is difficult to take dynamic measures as needed for service use and resource use as predefined authority through the authentication process, and recognize illegal access even for illegal access and access the network. Until action is taken, it is difficult to block illegal behavior.

The present invention has been proposed to solve the above-mentioned problems in the conventional network environment, and an object of the present invention is to provide a security policy server even when network nodes acquire and use a service use and resource use right through a normal authentication process. The present invention provides a network security policy management system and method for enabling a more proactive and efficient network operation by receiving a security policy dynamically when necessary to change authority.

In addition, another object of the present invention is to receive a security policy for each threat situation in the network environment to receive a security policy for each threat situation to limit or block the use of services and resources to enable active response to the threat situation more secure To provide a network security policy management system and a method for efficient and efficient network operation and management.

In accordance with an aspect of the present invention, there is provided a network security policy management system based on a web service security in a network security policy management system for service use of a network node made through a network. A security policy server that registers and manages security policy information in a database and performs network security by applying security policy information registered in the database; And a security policy agent installed at the network node to receive network security policy information from the security policy server and to manage and apply the security policy of the network node.

The security policy server comprises: a security policy management GUI providing a GUI interface to register and change security policy information; A security policy management unit for registering and managing security policy information input through the security policy management GUI in the database; When the security policy information is changed or a network threat situation occurs or a security policy agent requests security policy information, the security policy information is queried from the database, and the changed security policy is received from the database and transmitted to the security policy agent. A security policy processing unit for generating information; An agent communication unit configured to communicate with a security policy agent connected through the network, and transmit changed security policy information generated through the security policy processing unit to a security policy agent; And a web service security processing unit that performs data security when communicating with a security policy agent through the agent communication unit.

The agent communication unit includes a transceiver for communicating with a security policy agent, an event generator for generating event information indicating a change state of security policy information when the security policy information is changed, and transmitting the event information to the security policy agent through the transceiver; A threat situation receiver is provided to generate threat situation occurrence information and transmit it to an event generator when a threat situation of a network occurs. The event generator generates event information according to a threat situation when threat occurrence occurrence information is received from a threat situation receiver. It is sent to the security policy agent.

In addition, the security policy agent includes a server communication unit for communicating with the security policy server; A security policy management unit for requesting and receiving security policy information from the security policy server through the server communication unit, storing and managing the received security policy information, and maintaining the latest security policy information; A security policy manager for querying the security policy manager for the security policy applied to the network node and applying the security policy to the security policy of the network node; And a web service security processing unit that performs data security when communicating with a security policy server through the server communication unit.

The server communication unit is provided with an event listener for detecting event information generated according to a security policy change and a network threat situation in the security policy server.

On the other hand, the network security policy management method based on the web service security according to the present invention for achieving the above object, in the network security policy management method for using the service of the network node made through a network, the security policy for managing the security policy When the security policy information is changed in the server, generating event information indicating a security change status and transmitting the event information to the security policy agent installed in the network node; When the security policy agent receives the security policy change event information transmitted from the security policy server, requesting the changed security policy information from the security policy server; Receiving, by the security policy server, a security policy request from a security policy agent, querying the security policy information in a database in which the security policy information is registered, and receiving the result to generate modified security policy information to be transmitted to the security policy agent; And transmitting, by the security policy server, the generated security policy information to a security policy agent.

In addition, the network security policy method based on the web service security according to the present invention for achieving the above object is a security policy server for managing a security policy in a network security policy management method for using a service of a network node made through a network; Recognizing the threat situation when the network threat situation occurs, generating event information indicating the occurrence of the network threat situation, and transmitting the event information to the security policy agent installed in the network node; When the security policy agent receives threat situation event information transmitted from a security policy server, requesting security policy information for each threat situation from the security policy server; The security policy server receives the security policy information request for each threat situation of the security policy agent, queries the security policy information for each threat situation in the database where the security policy information is registered, and receives the result to transmit the threat policy information to the security policy agent. Generating security policy information for each star; And transmitting, by the security policy server, the generated security policy information for each threat situation to a security policy agent.

The network security policy management system and method thereof according to the present invention operate network operations such as service use and resource use of network nodes in a network environment based on a security policy, so that network operation and management can be efficiently performed. In the event of a threat situation in the network, differentiated network security operations according to the threat situation can be applied by applying differentiated security policies for each threat situation, and the network security can be changed and applied in real time. It has the effect of making the operation flexible and active.

In addition, the network security policy management system and method thereof according to the present invention have excellent portability because they are expressed by applying an XML base as a security policy and a transport protocol. By using the technology to secure message transmission, heterogeneous compatibility and scalability can be guaranteed, it can be applied to various network environments, and interworking and expansion between networks are easy.

1 is a network configuration diagram of a network node and a service in a conventional general network environment;
2 is a network configuration diagram of network nodes and services in a network environment to which a security policy server and a security policy agent are applied according to the present invention;
3 is a block diagram of a security policy server according to the present invention;
4 is a block diagram of a security policy agent according to the present invention;
5 is a flowchart illustrating a process of registering security policy information for setting a security policy according to the present invention;
6 is a flowchart illustrating a security policy transmission process in a normal network situation according to the present invention;
7 is a flowchart illustrating a process of transmitting a security policy for each threat situation when a network threat situation occurs according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a network configuration of network nodes and services in a network environment to which a security policy server and a security policy agent are applied according to an embodiment of the present invention.

As shown in FIG. 2, a network security policy management system based on a web service security system according to the present invention includes a security policy server 10 for managing a security policy of a network, and a network node 1 from the security policy server 10. It includes a security policy agent 20 that receives, manages and applies a security policy for the use of the service (2) and network resource usage of the).

The security policy server 10 registers and manages information related to a security policy required for network operation in the database 11, and the database 11 stores data such as security policy element information and security policy information.

The security policy agent 20 is installed in the network node 1, respectively, and requests and receives security policy information from the security policy server 10 to execute the security policy of the network node 1, the security policy Data transmission and reception of data between the server 10 and the security policy agent 20 is achieved through web service security.

3 shows a block diagram of a security policy server according to an embodiment of the present invention.

As shown in FIG. 3, the security policy server 10 according to the present invention provides a security policy management that provides a user interface so that an administrator can easily register information necessary for network security operation such as security policy element information and security policy information. A graphical user interface (GUI) 110, a security policy manager 120 for registering and managing security policy information, a database manager 170 for managing a database 11, and a network node 1 A security policy processing unit 130 for querying the database 11 for a security policy to be applied and generating a security policy, an agent communication unit 140 for communicating with the security policy agent 20, and the security policy agent 20 Web service security processing unit 150 for performing data security processing when communicating with the; and XML processing unit 160 for parsing and processing the data expressed in XML It is broken.

The security policy manager 120 is a program module that registers and manages security policy related information input from the security policy management GUI 110. The security policy management unit 120 includes a security policy element registration unit 121 for registering element information necessary for setting a security policy, and a security policy registration unit 122 for registering and managing a security policy to be applied to security operation in a normal network situation. And a security situation registration unit 123 for each threat situation that registers and manages a security policy for each threat situation to be applied in a threat situation of the network.

The security policy processing unit 130 generates security policy information to be transmitted to the security policy agent 20 included in the network node 1 by receiving and providing security policy information to the database 11 to be applied to the network node 1. Is a program module. The security policy processing unit 130 includes a security policy querying unit 131 which performs a query relating to a security policy to the database 11 according to a request of a security policy to be applied in a normal network situation, and a query for a query from the database 11. Security policy generation unit 132 receiving the result data and generating security policy information, and threat situation by the database to query the security policy for each threat situation according to the security policy request to be applied in the threat situation of the network The security policy querying unit 133 and the threat situation-specific security policy generating unit 134 for receiving the result data of the query from the database 11 and generating a security policy for each threat situation are provided.

The agent communication unit 140 is a program module that performs communication between the security policy server 10 and the security policy agent 20. The agent communication unit 140 includes a server communication unit provided in the security policy agent 20, a transceiver unit 141 for transmitting security policy information, event information, and the like, and a network node 1 when security policy information is added or changed. Event generator 142 for generating event information informing the change of the security policy to be transmitted to the security policy agent 20 provided in the threat situation, and threat situation for generating threat situation information when the network threat situation occurs and transmits it to the event generator 142 Receiver 143 is provided. When the event generator 142 receives threat situation occurrence information from the threat situation receiver 143, the event generator 142 generates event information according to the threat situation occurrence and transmits the event information to the security policy agent 20.

The web service security processing unit 150 is a program module that processes data security during communication between the security policy server 10 and the security policy agent 20. The web service security processing unit 150 is provided with a web service security library 151 for interpreting and expressing a web service security specification, and a cryptographic library 152 for processing data encryption and decryption.

The XML processor 160 is a program module for generating or interpreting a security policy based on XML, and interpreting and processing data expressed based on XML such as a web service security specification expressed in XML.

4 is a block diagram of a security policy agent according to an embodiment of the present invention.

As shown in FIG. 4, the security policy agent 20 according to the present invention includes a security policy manager 220 for storing and managing security policy information received from the security policy server 10 and maintaining the latest information. A security policy operating unit 240 for querying and providing security policy information to be applied to the operation of the node 1 and applying it to the network node 1, and a server communication unit 210 for communicating with the security policy server 10; In addition, a web service security processing unit 230 for performing data security processing when communicating with the security policy server 10, and an XML processing unit 250 for parsing and processing data expressed in XML is provided.

The security policy management unit 220 stores a security policy information to be applied in a normal network situation received from the security policy server 10 and maintains / manages the latest security policy storage unit 221 and a network threat situation to be applied. A threat situation security policy storage unit 222 is provided for storing and maintaining / managing a threat situation security policy.

The security policy management unit 240 may be applied to a security policy query unit 241 for querying security policy information to be applied to the network node 1 in a normal network situation stored in the security policy management unit 220, and to be applied in a network threat situation. A threat situation security policy query unit 242 for querying the security policy and a security policy node application unit 243 for applying the result obtained through the query to the network node 1 are provided.

The server communication unit 210 is a program module that communicates with the security policy server 10. The server communication unit 210 includes a transceiver 211 for requesting security policy information from the agent communication unit 140 of the security policy server 10 and receiving a response, and security policy change event information from the security policy server 10. Is detected, it is provided with an event listener (212) for real-time processing.

The web service security processing unit 230 and the XML processing unit 250 perform the same functions as the web service security processing unit 150 and the XML processing unit 160 provided in the security policy server 10. The processor 230 and the XML processor 250 are lightweight program modules suitable for the security policy agent 20.

Hereinafter, a process of registering and operating a security policy through a web service security based network security policy management system having the above configuration will be described.

5 is a flowchart illustrating a process of registering security policy information for setting a security policy according to an embodiment of the present invention.

Steps S100, S110 and S120: First, in order to register the security policy information, the user (administrator) accesses the security policy server 20 (step S100), and performs a user authentication through a login process (step S110). Step S120).

Steps S130 and S131: The security policy server 10 checks whether the login information is valid (step S130), and blocks access if not a valid user (step S131).

Steps S140 and S150: If the user is a valid user, the user is provided with an information registration page in a GUI environment in which the user can register security policy related information, thereby performing operations such as registration, modification, and deletion of security policy information to be applied in a normal network situation. (Step S140), and to perform the registration of the security policy information for each threat situation to be applied in the network threat situation (step S150). The security policy information changed by the user is registered and managed in the database 11 by the security policy manager 120 of the security policy server 10.

Steps S160 and S170: When the information is changed, generate event information informing the security policy information change through the event generator 142 of the agent communication unit 140 (step S160), and generate the security policy information change event information as the security policy. It transmits to the agent 20 so that the security policy is reflected to the network node 1 in real time (step S170).

Step S180: The security policy information registration process is repeated until the user logs off.

6 is a flowchart illustrating a security policy transmission process in a normal network situation according to an embodiment of the present invention.

Steps S200, S210, and S220: First, when a change such as registration, modification, and deletion of the security policy occurs in the security policy server 10 in a normal network situation (step S200), the security policy change event through the event generator 142. Generate the information (step S210), and transmit the security policy change event information to the security policy agent 20 installed in the network node 1 (step S220).

Step S230: When the security policy agent 20 receives the event information through the event listener 212, requests the changed security policy information to the security policy server 10, the security policy server 10 to receive the request. do.

Steps S240 and S250: The security policy server 10 receiving the change security policy information request from the security policy agent 20 queries the database 11 for the changed security policy information through the security policy processing unit 130 (step S240). ) Receives the changed security policy information from the database 11 and generates the changed security policy information to be transmitted to the security policy agent 20 (step S250).

Step S260, S270: The generated security policy information is transmitted to the security policy agent 20 through the agent communication unit 140 (step S360), this security policy transmission process of the network node (1) connected to the network The process is repeated until all are transmitted to the security policy agent 20 (step S270).

7 is a flowchart illustrating a process of transmitting a security policy for each threat situation when a network threat situation occurs according to an embodiment of the present invention.

Steps S300, S310, and S320: First, when a threat situation of a network occurs, threat situation occurrence information is generated through a threat situation receiver 143 provided in the agent communication unit 140 of the security policy server 10, and an event generator ( 142) (step S300), the event generator 142 generates threat situation event information (step S310), and the threat situation event information generated by the event generator 142 is sent to the security policy agent 20. Is transmitted (step S320).

Step S330: When the security policy agent 20 receives the event information through the event listener 212, the event listener 212 requests the security policy server 10 for each threat situation to the security policy server 10, and the security policy server 10 receives the request (step S330).

Steps S340 and S350: The security policy server 10 that receives the security policy information request for each threat situation queries the database 11 for the security policy information for each threat situation through the security policy processing unit 130 (step S340). On the basis of the information provided through the (11) to generate the security measures information for each emergency situation to be sent to the security policy agent 20 (step S350).

Steps S360 and S370: The generated security policy information for each threat situation is transmitted to the security policy agent 20 through the agent communication unit 140 to be performed by the security policy agent 20 (step S360). The security policy information transmission process is repeated until all are transmitted to the security policy agent 20 of the security policy node 1 connected to the network (step S370).

As described above, the above-described present invention provides a network in which network nodes 1 access a network, use services 2, and use network resources in various network environments such as ubiquitous networks, home networks, sensor networks, and binary CDMA networks. In operation, it provides safe and efficient network security operation based on security policy.

The present invention is not limited to the above-described embodiments, and various modifications within the equivalent scope of the technical idea of the present invention and the claims to be described below by those skilled in the art to which the present invention pertains. Of course, modifications can be made.

1: network node 2: service
10: Security Policy Server 11: Database
110: security policy management GUI 120: security policy management unit
130: security policy processing unit 140: agent communication unit
150: Web service security processing unit 160: XML processing unit
170: database management unit 20: security policy agent
210: server communication unit 220: security policy management unit
230: Web service security processing unit 240: Security policy management unit
250: XML processing unit

Claims (8)

delete delete delete A security policy server 10 which registers and manages network security policy information for use of the service 2 of the network node 1 in the database 11 and performs network security according to the security policy; and the security policy server 10 In the network security policy management system provided with a security policy agent 20 for receiving and receiving network security policy information from the network node (1) to manage and apply the security policy,
The security policy server 10
A security policy management GUI (110) providing a GUI interface to register and change the security policy information;
A security policy management unit (120) for registering and managing security policy information input through the security policy management GUI (110) in the database (11);
When the security policy information is changed or a network threat situation occurs or a security policy agent 1 requests security policy information, the security policy information is queried from the database 11 and security policy information is received from the database 11. A security policy processing unit 130 generating security policy information to be transmitted to the security policy agent 20;
Generated through a transceiver 141 for communicating with the security policy agent 20, a threat condition receiver 143 for generating threat situation occurrence information when a threat situation of a network occurs, and the security policy processor 130. The event generator 142 generating event information according to the security policy information or the threat situation occurrence information generated through the threat situation receiver 143 and transmitting the event information to the security policy agent 20 through the transceiver 141 is provided. An agent communication unit 140 provided;
And a web service security processing unit (150) for performing data security when communicating with the security policy agent (20) through the agent communication unit (140). delete The method of claim 4,
The security policy agent 20 is
A server communication unit (210) which communicates with the security policy server (10) and has an event listener (212) for detecting event information transmitted from the agent communication unit (140) of the security policy server (10);
A security policy manager 220 which requests and receives security policy information from the security policy server 10 through the server communication unit 210, stores and manages the received security policy information, and maintains the latest security policy information;
A security policy manager 240 for querying the security policy manager 220 for the security policy applied to the network node 1 and applying the security policy to the security policy of the network node 1;
And a web service security processing unit (230) for performing data security when communicating with the security policy server (10) through the server communication unit (210). In the network security policy management method for using a service of a network node made through a network,
(a) When the security policy information is changed in the security policy server 10 that manages the security policy, event information indicating the security policy change state is generated and transmitted to the security policy agent 20 installed in the network node 1. Steps;
(b) when the security policy agent 20 receives the security policy change event information transmitted from the security policy server 10, requesting the changed security policy information from the security policy server 10;
(c) the security policy server 10 receives the security policy information request from the security policy agent 20, queries the security policy information to the database 11 where the security policy information is registered, and receives the result to receive the security policy information. Generating modified security policy information to be sent to the policy agent 20;
(d) transmitting the generated security policy information to the security policy agent (20) by the security policy server (10). In the network security policy management method for using a service of a network node made through a network,
(a) The security policy server 10 that manages the security policy recognizes the threat situation when the network threat situation occurs, generates event information indicating the occurrence of the network threat situation, and transmits it to the security policy agent 20 installed in the network node 1. Making a step;
(b) when the security policy agent 20 receives the threat situation event information transmitted from the security policy server 10, requesting security policy information for each threat situation to the security policy server 10;
(c) the security policy server 10 receives the security policy information for each threat situation from the security policy agent 20, queries the security policy information for each threat situation in the database 11 where the security policy information is registered, and Receiving security results and generating security policy information for each threat situation to be transmitted to the security policy agent 20;
(d) transmitting, by the security policy server (10), the generated security policy information for each threat situation to a security policy agent (20).

Images