KR101081992B1 - Method and System for Securing Network by Using Packet Marking, and Recording Medium for Recording Programs for Realizing the Same - Google Patents

Abstract

The present invention relates to a network security method and system using packet marking, and a recording medium on which a program for implementing the same is recorded, the user terminal periodically checking its security state and system setting state; Recording the result checked by the user terminal in every packet transmitted; Analyzing, by the network apparatus, information recorded in the packet received from the user terminal to determine whether the security state of the user terminal is good; And if the security state of the user terminal is good in the network device, determining whether the user terminal can access the internal network or the external network according to the information recorded in the packet received from the user terminal.

Packet marking, network security, internal network, external network, network access control

Description

Method and system for network security using packet marking, and recording medium recording program for implementing the same {Method and System for Securing Network by Using Packet Marking, and Recording Medium for Recording Programs for Realizing the Same}

The present invention relates to a network security technology, and more particularly, to a network security method and system using packet marking, and a recording medium having a program for implementing the same.

In the conventional network security, by installing a firewall that blocks access other than the authorized user, such as a router or an application gateway to block aggressive harmful traffic from the external network, outside users access the private network inside the organization and host the internal network. The main focus was on preventing the random use or disturbance of computer resources or the illegal leakage of important information.

However, according to the conventional harmful traffic blocking system as described above, only the incoming traffic from the external network can be detected and blocked. Therefore, the harmful traffic generated from the internal network is responsible for the harmful traffic. As it was determined by the inspection, it was impossible to detect the recent attacks on the internal network (harmful traffic of internal worm infected people, attempts to leak personal information by insiders).

Therefore, in the conventional harmful traffic blocking system, an overload occurs in the internal network to cause a Denial of Service (DoS) phenomenon, and even if harmful traffic (attack program) is infected from the host to which the harmful traffic originates, it can be blocked. There was no way that the entire host eventually became unresponsive.

The present invention has been made to solve the above problems, and provides a network security method and system using packet marking to block harmful traffic generated in the internal network, and a recording medium having a program for implementing the same. Its purpose is to.

Another object of the present invention is to provide a network security method and system using packet marking for protecting a network infrastructure from worms, botnets, and the like, and a recording medium having recorded thereon a program for implementing the same.

The present invention for achieving the above object, the user terminal for periodically checking its security state and system setting state, and writes the result of the check in all packets to be transmitted; And a network device analyzing information recorded in a packet received from the user terminal, and determining whether the user terminal can access an internal network or an external network according to a security state and a system setting state of the user terminal. Provides a network security system using packet marking.

The present invention includes the steps of the user terminal periodically checks its security state and system configuration state; Recording the result checked by the user terminal in every packet transmitted; Analyzing, by the network apparatus, information recorded in the packet received from the user terminal to determine whether the security state of the user terminal is good; And determining whether the user terminal can access the internal network or the external network according to the information recorded in the packet received from the user terminal when the security state of the user terminal in the network device is good. It provides a network security method using.

The present invention includes the steps of the user terminal periodically checks its security state and system configuration state; And recording a result of the check by the user terminal in every packet to be transmitted, wherein the program for implementing the network security method using packet marking is recorded.

The present invention includes the steps of analyzing the security state information of the user terminal recorded in the packet received from the user terminal in the network device to determine whether the security state of the user terminal is good; And determining, by the network apparatus, whether the user terminal can access an internal network or an external network according to system setting state information recorded in a packet received from the user terminal when the security state of the user terminal is good. A recording medium having a program recorded thereon for implementing a network security method using packet marking is provided.

As described above, according to the present invention, a network security method and system using a packet marking for checking a security state and a system setting state of each terminal transmitting a packet from the inside to the packet, and a program for implementing the same By providing this recorded recording medium, it is possible to protect the network infrastructure from worms, botnets, and the like, and to enhance network security.

In addition, by changing the connection path of the network itself according to the state of each terminal, there is an effect that can actively respond to network infrastructure security threats.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 is a block diagram showing a schematic configuration of a network security system using packet marking according to an embodiment of the present invention.

Referring to FIG. 1, a network security system according to the present invention includes a user terminal 110, a network device 120, a quarantine network 130, and the like.

The user terminal 110 periodically checks its various security states and system setting states, and records the check results in all packets transmitted from the user terminal 110 using the installed network kernel driver. . The user terminal 110 may be a desktop computer, a notebook computer, a smart phone, a personal digital assistant (PDA), a mobile phone, or the like.

That is, the user terminal 110 has various security states including its antivirus update state, security patch update state, operating system update state, and firewall setting state, its software installation state, accessibility to internal network, and external network. Check system configuration, including accessibility. In this case, various items necessary for the inspection of the user terminal 110 and the inspection period of the user terminal 110 may be changed by the administrator.

The user terminal 110 sets a value within the range of 0 to 65535, and records the result in a packet used to perform a network connection. At this time, the user terminal 110 does not change the network speed or the packet data amount by recording the set value in a data area not used in the IP header of the packet.

The information recorded in the packet by the user terminal 110 may include information indicating the software installation state of the user terminal 110 (eg, illegal software, game software and harmful software that should not be used within a company), vaccines, and security. Information indicating whether a patch is updated, information indicating whether a firewall is installed, information indicating whether an internal network can be accessed, information indicating whether an external network is accessible, and the like may be included, and information recorded in a packet may be changed by an administrator. have.

The network device 120 analyzes the information recorded in the packet received from the user terminal 110 to determine whether the user terminal 110 can access the internal network or the external network according to the state of each user terminal using the network. Determine. Here, the network device 120 may be a router, a switch, or a separate server.

In addition, the network device 120 analyzes the information recorded in the packet received from the user terminal 110 so that the user terminal 110 is connected to the quarantine network 130 when the security state of the user terminal 110 is insufficient. do.

The quarantine network 130 transmits a message requesting the security status check to the user terminal 110 as the user terminal 110 is connected, and thus the user terminal 110 requests the security status check on its screen. By outputting the message, the user checks the security state of the user terminal 110.

2 is a flowchart illustrating a network security method using packet marking according to an embodiment of the present invention.

Referring to FIG. 2, the user terminal 110 periodically checks its various security states and system setting states (S210). For example, the user terminal 110 periodically accesses various security states including its antivirus update state, security patch update state, operating system update state, firewall setting state, its software installation state, and internal network. And a system setting state including whether the external network can be accessed.

The user terminal 110 sets a value within the range of 0 to 65535, and records the checked result in all packets used to perform a network connection (S220). At this time, the user terminal 110 does not change the network speed or the packet data amount by recording the set value in a data area not used in the IP header of the packet.

The information recorded in the packet by the user terminal 110 may include information indicating the software installation state of the user terminal 110 (eg, illegal software, game software and harmful software that should not be used within a company), vaccines, and security. It may include information indicating whether a patch is updated, information indicating whether a firewall is installed, information indicating whether an internal network can be accessed, information indicating whether an external network is accessible, and the like.

Subsequently, the network device 120 analyzes the information recorded in the packet received from the user terminal 110 and determines whether the security state of the user terminal 110 is good (S230). That is, the network device 120 determines whether the security state of the user terminal 110 is good by checking whether the vaccine of the user terminal 110, the security patch is updated, and whether the firewall is installed.

When the security state of the user terminal 110 is insufficient, the network device 120 allows the user terminal 110 to access the quarantine network 130 (S240). For example, the network device 120 requests the user terminal 110 to access web sites such as Naver, Daum, and Nate that exist in an external network. However, if the user terminal 110 has insufficient security status, the user terminal ( 110 connects to quarantine network 130 (prepared internal web page).

The quarantine network 130 transmits a message requesting the security status check to the user terminal 110 as the user terminal 110 is connected (S250). Accordingly, the user terminal 110 checks the security status on its screen. By outputting a message requesting (S260), the user to check the security status.

In addition, when the security state of the user terminal 110 is good, the network device 120 connects to the external network or the internal network of the user terminal 110 according to the information recorded in the packet received from the user terminal 110. It is determined whether or not (S232).

The embodiments of the present invention described above are not implemented only through the apparatus and the method, and programs that realize functions corresponding to the configurations of the embodiments of the present invention, or hard disks, CD-ROMs, DVDs, and removable disks on which the programs are recorded. It can also be implemented through a recording medium of the above, such an implementation can be easily implemented by those skilled in the art from the description of the embodiments described above.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

1 is a block diagram showing a schematic configuration of a network security system using packet marking according to an embodiment of the present invention;

2 is a flowchart illustrating a network security method using packet marking according to an embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

110: user terminal 120: network device

130: quarantine network

Claims (16)

A user terminal which periodically checks its security state and system setting state and records the check result in every packet transmitted; And A network device that analyzes the information recorded in the packet received from the user terminal and determines whether the user terminal can access an internal network or an external network according to a security state and a system setting state of the user terminal; Network security system using a packet marking comprising a. The method of claim 1, A quarantine network that transmits a message requesting a security state check of the user terminal to the user terminal; Network security system using a packet marking, characterized in that it further comprises. The method of claim 2, The network device, if the security state of the user terminal is insufficient, the network security system using a packet marking, characterized in that for connecting the user terminal to the quarantine network. The method of claim 1, And said network device comprises at least one of a router, a switch and a server. The method of claim 1, The user terminal sets a value within the range of 0 to 65535 to the result of the check, and records the set value in all the packets to be transmitted, the network security system using a packet marking. The method of claim 5, And the user terminal records the set value in a data area not used in an IP header of the transmitted packet. The method of claim 1, The user terminal is a network security system using a packet marking, characterized in that it comprises at least one of a desktop computer, a notebook computer, a smart phone, a PDA and a mobile phone. The method of claim 1, The information recorded in all transmitted packets includes information indicating software installation status of the user terminal, information indicating whether a vaccine and security patch are updated, information indicating whether a firewall is installed, information indicating whether internal network can be accessed, and external network access. Network security system using a packet marking, characterized in that it comprises at least one of information indicating whether or not. Periodically checking, by a user terminal, its own security state and system configuration state; Recording the result checked by the user terminal in every packet transmitted; Analyzing, by the network apparatus, information recorded in the packet received from the user terminal to determine whether the security state of the user terminal is good; And When the security state of the user terminal is good in the network device, determining whether the user terminal can access an internal network or an external network according to information recorded in a packet received from the user terminal; Network security method using a packet marking comprising a. 10. The method of claim 9, Allowing the user terminal to access a quarantine network when the security status of the user terminal is insufficient in the network device; And Transmitting, by the quarantine network, a message requesting a security status check to the user terminal; Network security method using a packet marking, characterized in that it further comprises. The method of claim 9, wherein the recording of the result of the check in every packet to be transmitted includes: Setting a value of the check result by the user terminal within a range of 0 to 65535; And Recording, by the user terminal, the set value in all transmitted packets Network security method using a packet marking, characterized in that it comprises a. 12. The method of claim 11, wherein the recording of the set value in all the transmitted packets comprises: And the user terminal records the set value in a data area not used in the IP header of all transmitted packets. 10. The method of claim 9, The information recorded in all transmitted packets includes information indicating software installation status of the user terminal, information indicating whether a vaccine and security patch are updated, information indicating whether a firewall is installed, information indicating whether internal network can be accessed, and external network access. Network security method using packet marking, characterized in that it comprises at least one of information indicating whether or not. Periodically checking, by a user terminal, its own security state and system configuration state; And Recording the result checked by the user terminal in every packet transmitted; The recording medium having a program recorded thereon for implementing a network security method using a packet marking comprising a. Analyzing, by the network apparatus, the security state information of the user terminal recorded in the packet received from the user terminal to determine whether the security state of the user terminal is good; And When the security state of the user terminal is good in the network device, determining whether the user terminal can access an internal network or an external network according to system setting state information recorded in a packet received from the user terminal; The recording medium having a program recorded thereon for implementing a network security method using a packet marking comprising a. The method according to claim 14 or 15, And the recording medium includes at least one of a hard disk, a CD-ROM, a DVD, and a removable disk.

Images